kritya 0.8.2-beta

package/dist/mcp/tokens.js

@@ -0,0 +1,97 @@
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+import { debugLog } from "../config/debug.js";
+import { hardenWindowsDir } from "../config/winAcl.js";
+/**
+ * Persistent OAuth state for remote MCP servers, in `~/.kritya/mcp-auth.json`.
+ *
+ * This file holds live bearer tokens for third-party accounts (Linear, Notion,
+ * Sentry, …), so it is the single most sensitive file kritya writes — more so
+ * than config.json, whose provider keys the user can at least rotate from one
+ * place. It gets the same 0600 + Windows-ACL treatment as the rest of
+ * CONFIG_DIR, and never travels with the workspace.
+ *
+ * Records are keyed by the server's canonical URL rather than its configured
+ * name: the same endpoint is often called different things in a user's global
+ * config and a repo's .mcp.json, and renaming a server in config shouldn't
+ * silently orphan a token and force a fresh browser round-trip.
+ */
+/**
+ * Where the store lives. Read per call rather than captured at import time so
+ * KRITYA_MCP_AUTH_FILE can be set after this module loads — the test suite must
+ * never touch a developer's real tokens, and ESM import hoisting makes
+ * "set the env first" unreliable otherwise.
+ */
+export function authFilePath() {
+    return process.env.KRITYA_MCP_AUTH_FILE || path.join(CONFIG_DIR, "mcp-auth.json");
+}
+/** Normalize a server URL so trivial spelling differences map to one record. */
+export function authKey(url) {
+    try {
+        const u = new URL(url);
+        u.hash = "";
+        u.search = "";
+        // A trailing slash on the path is not a different resource.
+        if (u.pathname.length > 1 && u.pathname.endsWith("/"))
+            u.pathname = u.pathname.slice(0, -1);
+        return u.toString();
+    }
+    catch {
+        return url;
+    }
+}
+function loadStore(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch (err) {
+        debugLog(`mcp tokens loadStore(${file})`, err);
+        return {};
+    }
+}
+function saveStore(file, store) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    hardenWindowsDir(path.dirname(file));
+    fs.writeFileSync(file, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+    // `mode` only applies when writeFileSync creates the file; enforce it even if
+    // mcp-auth.json already existed with looser permissions (e.g. restored from a
+    // backup, or written by an older build).
+    try {
+        fs.chmodSync(file, 0o600);
+    }
+    catch (err) {
+        debugLog(`mcp tokens chmod(${file})`, err);
+    }
+}
+export function loadAuth(url, file = authFilePath()) {
+    return loadStore(file)[authKey(url)];
+}
+export function saveAuth(url, auth, file = authFilePath()) {
+    const store = loadStore(file);
+    store[authKey(url)] = auth;
+    saveStore(file, store);
+}
+/** Forget a server's grant locally. Returns what was removed, for revocation. */
+export function deleteAuth(url, file = authFilePath()) {
+    const store = loadStore(file);
+    const key = authKey(url);
+    const existing = store[key];
+    if (!existing)
+        return undefined;
+    delete store[key];
+    saveStore(file, store);
+    return existing;
+}
+/** Every stored grant, for `/mcp` status display. */
+export function listAuth(file = authFilePath()) {
+    return Object.entries(loadStore(file)).map(([url, auth]) => ({ url, auth }));
+}
+/**
+ * Whether an access token is close enough to expiry to refresh proactively.
+ * The 60s skew keeps a token from dying mid-request after passing this check.
+ */
+export function isExpired(auth, now = Date.now()) {
+    return auth.expiresAt !== undefined && auth.expiresAt - 60_000 <= now;
+}

package/dist/mcp/transport.js

@@ -0,0 +1,295 @@
+import { spawn } from "node:child_process";
+import { McpAuthRequiredError, OAuthSession, parseWwwAuthenticate } from "./oauth.js";
+import { planSpawn } from "./spawnWin.js";
+/** Same-origin redirects we'll follow before calling it a loop. */
+const MAX_REDIRECTS = 5;
+function isRedirect(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+/** How much of a server's stderr to keep for diagnostics, and how much to report. */
+const STDERR_KEEP_BYTES = 8_192;
+const STDERR_REPORT_LINES = 5;
+/** Env vars an MCP server's own OS/runtime needs to start up at all, without inheriting API keys. */
+const PASSTHROUGH_ENV_VARS = [
+    "PATH",
+    "HOME",
+    "USERPROFILE",
+    "SystemRoot",
+    "windir",
+    "TEMP",
+    "TMP",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "NODE_PATH",
+];
+function minimalEnv() {
+    const env = {};
+    for (const key of PASSTHROUGH_ENV_VARS) {
+        const value = process.env[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    return env;
+}
+/**
+ * A signal that fires on either the per-request timeout or the user's cancel.
+ * `AbortSignal.any` only landed in Node 20 and we support 18, hence the manual
+ * bridge.
+ */
+function withTimeout(timeoutMs, signal) {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    if (!signal)
+        return timeout;
+    const any = AbortSignal.any;
+    if (any)
+        return any.call(AbortSignal, [signal, timeout]);
+    const ctrl = new AbortController();
+    const abort = () => ctrl.abort();
+    if (signal.aborted || timeout.aborted)
+        ctrl.abort();
+    else {
+        signal.addEventListener("abort", abort, { once: true });
+        timeout.addEventListener("abort", abort, { once: true });
+    }
+    return ctrl.signal;
+}
+export class StdioTransport {
+    onMessage = () => { };
+    onError = () => { };
+    proc;
+    buffer = "";
+    /** Tail of the server's stderr, kept for the exit message (see below). */
+    stderrTail = "";
+    constructor(command, args, env, cwd) {
+        const plan = planSpawn(command, args);
+        this.proc = spawn(plan.command, plan.args, {
+            // Minimal env, not the full process env: every provider API key lives
+            // in process.env, and an MCP server is third-party code the user opted
+            // into but shouldn't automatically receive credentials it never asked
+            // for. Servers that need extra vars declare them in their own `env`.
+            env: { ...minimalEnv(), ...env },
+            // Always explicit. Inheriting kritya's cwd makes a server's scope depend
+            // on which directory the user launched from — see McpServerConfig.cwd.
+            cwd,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsVerbatimArguments: plan.windowsVerbatimArguments,
+        });
+        this.proc.stdout?.setEncoding("utf8");
+        this.proc.stdout?.on("data", (chunk) => this.onData(chunk));
+        // Draining stderr is not optional: we asked for a pipe, and a server that
+        // logs more than the ~64KB pipe buffer blocks in write() forever if nobody
+        // reads it. Keeping the tail also means a server that dies on a bad token
+        // can say why, instead of just "exited".
+        this.proc.stderr?.setEncoding("utf8");
+        this.proc.stderr?.on("data", (chunk) => {
+            this.stderrTail = (this.stderrTail + chunk).slice(-STDERR_KEEP_BYTES);
+        });
+        // Report on "close" (all stdio flushed), not "exit", so the stderr that
+        // explains the exit has actually arrived. "close" can be held open by a
+        // grandchild inheriting the pipes, so "exit" still arms a short fallback —
+        // a slightly thinner message beats never reporting at all.
+        let reported = false;
+        const report = (code, signal) => {
+            if (reported)
+                return;
+            reported = true;
+            const how = signal ? `killed by ${signal}` : `exited with code ${code ?? 0}`;
+            this.onError(new Error(`server process ${how}${this.stderrDetail()}`));
+        };
+        this.proc.on("close", report);
+        this.proc.on("exit", (code, signal) => {
+            setTimeout(() => report(code, signal), 200).unref();
+        });
+        this.proc.on("error", (err) => this.onError(new Error(`${err.message}${this.stderrDetail()}`)));
+    }
+    /** The last few non-blank stderr lines, formatted for an error message. */
+    stderrDetail() {
+        const lines = this.stderrTail
+            .split(/\r?\n/)
+            .map((l) => l.trim())
+            .filter(Boolean)
+            .slice(-STDERR_REPORT_LINES);
+        return lines.length ? ` — stderr: ${lines.join(" | ")}` : "";
+    }
+    onData(chunk) {
+        this.buffer += chunk;
+        let idx;
+        while ((idx = this.buffer.indexOf("\n")) >= 0) {
+            const line = this.buffer.slice(0, idx).trim();
+            this.buffer = this.buffer.slice(idx + 1);
+            if (!line)
+                continue;
+            try {
+                this.onMessage(JSON.parse(line));
+            }
+            catch {
+                // ignore non-JSON (some servers log to stdout)
+            }
+        }
+    }
+    send(msg) {
+        this.proc.stdin?.write(JSON.stringify(msg) + "\n");
+        return Promise.resolve();
+    }
+    close() {
+        this.proc.kill();
+    }
+}
+export class HttpTransport {
+    url;
+    headers;
+    onMessage = () => { };
+    onError = () => { };
+    /** Assigned by the server on initialize (Mcp-Session-Id header), echoed thereafter. */
+    sessionId;
+    /** Negotiated on initialize; sent as MCP-Protocol-Version on later requests. */
+    protocolVersion;
+    /** OAuth state for this endpoint, when the user has logged in (see oauth.ts). */
+    oauth;
+    constructor(url, headers) {
+        this.url = url;
+        this.headers = headers;
+        this.oauth = new OAuthSession(url);
+    }
+    async buildHeaders() {
+        const headers = {
+            "content-type": "application/json",
+            accept: "application/json, text/event-stream",
+            ...this.headers,
+        };
+        if (this.sessionId)
+            headers["mcp-session-id"] = this.sessionId;
+        if (this.protocolVersion)
+            headers["mcp-protocol-version"] = this.protocolVersion;
+        // A configured Authorization header wins: someone who pasted a PAT into
+        // config meant to use it, and shouldn't be overridden by a stale grant.
+        const hasExplicitAuth = Object.keys(headers).some((k) => k.toLowerCase() === "authorization");
+        if (!hasExplicitAuth) {
+            const token = await this.oauth.accessToken();
+            if (token)
+                headers.authorization = `Bearer ${token}`;
+        }
+        return headers;
+    }
+    async send(msg, timeoutMs, signal) {
+        let res = await this.post(msg, timeoutMs, signal);
+        // 401 has two meanings: an access token that just aged out (refresh and
+        // retry once — silent, and the common case an hour into a session), or no
+        // usable grant at all, which only a browser login can fix.
+        if (res.status === 401) {
+            const refreshed = await this.oauth.handleUnauthorized();
+            if (refreshed) {
+                await res.body?.cancel().catch(() => { });
+                res = await this.post(msg, timeoutMs, signal);
+            }
+            if (res.status === 401) {
+                const challenge = parseWwwAuthenticate(res.headers.get("www-authenticate"));
+                await res.body?.cancel().catch(() => { });
+                throw new McpAuthRequiredError(this.url, challenge);
+            }
+        }
+        const sid = res.headers.get("mcp-session-id");
+        if (sid)
+            this.sessionId = sid;
+        if (!res.ok) {
+            // Drain to avoid leaking the connection, then surface the status.
+            const body = await res.text().catch(() => "");
+            throw new Error(`HTTP ${res.status}${body ? `: ${body.slice(0, 200)}` : ""}`);
+        }
+        const contentType = res.headers.get("content-type") ?? "";
+        if (contentType.includes("text/event-stream")) {
+            await this.readSse(res);
+        }
+        else if (contentType.includes("application/json")) {
+            const parsed = (await res.json());
+            for (const m of Array.isArray(parsed) ? parsed : [parsed])
+                this.onMessage(m);
+        }
+        // Anything else (e.g. a 202 Accepted for a notification) carries no messages.
+    }
+    async post(msg, timeoutMs, signal) {
+        const body = JSON.stringify(msg);
+        let url = this.url;
+        // Bounded, because a redirect chain is otherwise a free loop.
+        for (let hop = 0;; hop++) {
+            const res = await fetch(url, {
+                method: "POST",
+                headers: await this.buildHeaders(),
+                body,
+                // Following redirects automatically re-sends every header — including
+                // Authorization — to whatever Location names. A compromised server, or
+                // anyone able to rewrite a plaintext hop, could point that at their own
+                // origin and collect the token. Handle them here so we can look first.
+                redirect: "manual",
+                // Cancelling has to tear the socket down too, or the request stays in
+                // flight for the full timeout after the user has walked away.
+                signal: withTimeout(timeoutMs, signal),
+            });
+            if (!isRedirect(res.status))
+                return res;
+            const location = res.headers.get("location");
+            await res.body?.cancel().catch(() => { });
+            if (!location)
+                throw new Error(`HTTP ${res.status} redirect with no Location header`);
+            if (hop >= MAX_REDIRECTS)
+                throw new Error(`too many redirects from ${this.url}`);
+            const target = new URL(location, url);
+            // Same-origin only. A cross-origin redirect may be entirely legitimate
+            // (a vendor moving endpoints), but we cannot tell that from an attack,
+            // and the cost of guessing wrong is the user's bearer token. Refuse, and
+            // name the destination so a real migration is a one-line config edit.
+            if (target.origin !== new URL(url).origin) {
+                throw new Error(`refusing redirect to a different origin (${target.origin}) — ` +
+                    `it would send this server's credentials there. ` +
+                    `If that endpoint is genuine, point the server's "url" at it directly.`);
+            }
+            url = target.toString();
+        }
+    }
+    /** Parse an SSE body, feeding each `data:` event's JSON to onMessage. */
+    async readSse(res) {
+        if (!res.body)
+            return;
+        const decoder = new TextDecoder();
+        let buffer = "";
+        const dispatch = (rawEvent) => {
+            const data = rawEvent
+                .split(/\r?\n/)
+                .filter((l) => l.startsWith("data:"))
+                .map((l) => l.slice(5).trimStart())
+                .join("\n");
+            if (!data)
+                return;
+            try {
+                this.onMessage(JSON.parse(data));
+            }
+            catch {
+                // ignore non-JSON events (keep-alives, comments)
+            }
+        };
+        for await (const chunk of res.body) {
+            buffer += decoder.decode(chunk, { stream: true });
+            let idx;
+            while ((idx = buffer.search(/\r?\n\r?\n/)) >= 0) {
+                const rawEvent = buffer.slice(0, idx);
+                buffer = buffer.slice(idx).replace(/^\r?\n\r?\n/, "");
+                dispatch(rawEvent);
+            }
+        }
+        if (buffer.trim())
+            dispatch(buffer);
+    }
+    close() {
+        // Best-effort explicit session termination, per the Streamable HTTP spec.
+        if (!this.sessionId)
+            return;
+        this.buildHeaders()
+            .then((headers) => fetch(this.url, {
+            method: "DELETE",
+            headers,
+            redirect: "manual",
+            signal: AbortSignal.timeout(3_000),
+        }))
+            .catch(() => { });
+    }
+}

package/dist/net/urlSafety.js

@@ -0,0 +1,158 @@
+/**
+ * Shared "is this host on a private/internal network" check, used by both
+ * fetch_url (src/tools/fetchUrl.ts) and the MCP HTTP transport guard
+ * (src/mcp/client.ts) so the two SSRF chokepoints can't silently drift apart.
+ */
+function isPrivateIPv4Parts(a, b) {
+    return (a === 10 ||
+        a === 127 ||
+        (a === 192 && b === 168) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 169 && b === 254) ||
+        a === 0 ||
+        // 100.64.0.0/10 — carrier-grade NAT / Tailscale range.
+        (a === 100 && b >= 64 && b <= 127) ||
+        // 198.18.0.0/15 — benchmarking range, sometimes used internally.
+        (a === 198 && (b === 18 || b === 19)) ||
+        // 192.0.0.0/24 — IETF protocol assignments (includes some cloud
+        // metadata-adjacent uses).
+        (a === 192 && b === 0));
+}
+function parseIPv4(host) {
+    const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (!m)
+        return null;
+    const parts = m.slice(1).map(Number);
+    if (parts.some((p) => p > 255))
+        return null;
+    return parts;
+}
+/**
+ * Whether `host` is a "plain" numeric IPv4 written as a single decimal, octal,
+ * or hexadecimal integer, or a dotted form with octal/hex octets (e.g.
+ * `2130706433`, `0x7f000001`, `017700000001`, `0177.0.0.1`) — forms that
+ * browsers and curl still resolve as IP addresses but that {@link parseIPv4}'s
+ * plain dotted-decimal-quad regex doesn't recognize, so they'd otherwise sail
+ * straight past the private/loopback check (e.g. `http://2130706433/` is
+ * `http://127.0.0.1/`). Rather than compute the exact address these forms
+ * resolve to, treat any host shaped like one as suspicious and block it
+ * outright — no ordinary public hostname is written this way, so this has no
+ * legitimate-use cost.
+ */
+function isNonStandardNumericIPv4(host) {
+    if (parseIPv4(host))
+        return false; // ordinary dotted-decimal quad, handled separately
+    return /^(0x[0-9a-f]+|0[0-7]*|[1-9]\d*)(\.(0x[0-9a-f]+|0[0-7]+|[1-9]\d*|0))*$/i.test(host);
+}
+/**
+ * Expands an IPv6 literal (no brackets/zone id) into its 8 16-bit groups, or
+ * null if it isn't a valid IPv6 literal. Handles "::" compression and a
+ * trailing embedded IPv4 tail (e.g. "::ffff:169.254.169.254").
+ */
+function parseIPv6Groups(host) {
+    if (!host.includes(":"))
+        return null;
+    // Normalize a trailing embedded IPv4 (e.g. "::ffff:169.254.169.254") into
+    // two plain hextets first, so the rest of the parser only ever deals with
+    // a pure hextet address — no separate bookkeeping for the IPv4 tail.
+    let normalized = host;
+    const ipv4Tail = host.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (ipv4Tail) {
+        const parts = parseIPv4(ipv4Tail[1]);
+        if (!parts)
+            return null;
+        const g1 = (((parts[0] << 8) | parts[1]) >>> 0).toString(16);
+        const g2 = (((parts[2] << 8) | parts[3]) >>> 0).toString(16);
+        normalized = host.slice(0, host.length - ipv4Tail[1].length) + g1 + ":" + g2;
+    }
+    const sides = normalized.split("::");
+    if (sides.length > 2)
+        return null;
+    const parseHextets = (s) => {
+        if (s === "")
+            return [];
+        const hextets = s.split(":");
+        const nums = [];
+        for (const h of hextets) {
+            if (!/^[0-9a-f]{1,4}$/.test(h))
+                return null;
+            nums.push(parseInt(h, 16));
+        }
+        return nums;
+    };
+    if (sides.length === 1) {
+        const groups = parseHextets(sides[0]);
+        return groups && groups.length === 8 ? groups : null;
+    }
+    const left = parseHextets(sides[0]);
+    const right = parseHextets(sides[1]);
+    if (!left || !right)
+        return null;
+    const missing = 8 - left.length - right.length;
+    if (missing < 0)
+        return null;
+    return [...left, ...Array(missing).fill(0), ...right];
+}
+function isPrivateOrLoopbackIPv6Groups(groups) {
+    const allZero = (from, to) => groups.slice(from, to).every((g) => g === 0);
+    // ::1 loopback and :: unspecified.
+    if (allZero(0, 7) && (groups[7] === 0 || groups[7] === 1))
+        return true;
+    // fc00::/7 unique-local.
+    if ((groups[0] & 0xfe00) === 0xfc00)
+        return true;
+    // fe80::/10 link-local.
+    if ((groups[0] & 0xffc0) === 0xfe80)
+        return true;
+    // IPv4-mapped (::ffff:a.b.c.d) and deprecated IPv4-compatible (::a.b.c.d) —
+    // both embed a real IPv4 address in the low 32 bits and must be judged by
+    // that address's range, not treated as "just IPv6" and allowed through.
+    if (allZero(0, 5) && (groups[5] === 0 || groups[5] === 0xffff)) {
+        const a = (groups[6] >> 8) & 0xff;
+        const b = groups[6] & 0xff;
+        return isPrivateIPv4Parts(a, b);
+    }
+    return false;
+}
+function isLoopbackIPv6Groups(groups) {
+    const allZero = (from, to) => groups.slice(from, to).every((g) => g === 0);
+    if (allZero(0, 7) && groups[7] === 1)
+        return true;
+    // IPv4-mapped/compatible loopback, e.g. ::ffff:127.0.0.1.
+    if (allZero(0, 5) && (groups[5] === 0 || groups[5] === 0xffff)) {
+        return groups[6] >> 8 === 127;
+    }
+    return false;
+}
+export function isPrivateOrLoopbackHost(rawHost) {
+    const host = rawHost.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    const v4 = parseIPv4(host);
+    if (v4)
+        return isPrivateIPv4Parts(v4[0], v4[1]);
+    if (isNonStandardNumericIPv4(host))
+        return true;
+    const v6 = parseIPv6Groups(host);
+    if (v6)
+        return isPrivateOrLoopbackIPv6Groups(v6);
+    return false;
+}
+/** Loopback only — used where private-but-routable (e.g. LAN) hosts are still acceptable. */
+export function isLoopbackHost(rawHost) {
+    const host = rawHost.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    const v4 = parseIPv4(host);
+    if (v4)
+        return v4[0] === 127;
+    // A non-standard numeric form could resolve to anything, including a
+    // loopback address — refuse it here too rather than let it pass as "not
+    // loopback" and be treated as an acceptable LAN target.
+    if (isNonStandardNumericIPv4(host))
+        return true;
+    const v6 = parseIPv6Groups(host);
+    if (v6)
+        return isLoopbackIPv6Groups(v6);
+    return false;
+}

package/dist/permissions/danger.js

@@ -0,0 +1,96 @@
+/**
+ * Flags shell commands that are destructive or irreversible. When a command
+ * matches, kritya forces a permission prompt with a warning even if the
+ * command would otherwise be covered by an allowlist rule or an "always allow"
+ * choice — so a blanket `shell(*)` allow can't silently run `rm -rf /`.
+ */
+const PATTERNS = [
+    {
+        re: /\brm\s+.*(-[a-z]*[rf][a-z]*\b|--recursive\b|--force\b|--no-preserve-root\b)/i,
+        label: "recursive/forced file deletion (rm -rf)",
+    },
+    { re: /(?<!git\s)\brm\b\s+\S/i, label: "file deletion (rm)" },
+    { re: /\brmdir\s+\/s/i, label: "recursive directory deletion" },
+    {
+        re: /\bgit\s+push\b.*(--force(-with-lease)?|-f)\b/i,
+        label: "force push (rewrites remote history)",
+    },
+    { re: /\bgit\s+reset\s+--hard/i, label: "hard reset (discards local changes)" },
+    {
+        re: /\bgit\s+clean\s+.*(-[a-z]*f[a-z]*\b|--force\b)/i,
+        label: "git clean (deletes untracked files)",
+    },
+    {
+        // git restore discards working-tree changes — except the pure --staged
+        // form, which only unstages (safe) unless --worktree is also given.
+        re: /\bgit\s+checkout\s+--\s|\bgit\s+restore\b(?!\s+--staged\b(?!.*--worktree))/i,
+        label: "discards uncommitted changes",
+    },
+    { re: /\bgit\s+branch\s+(?:\S+\s+)*-D\b/, label: "force-deleting a branch" },
+    { re: /\bfind\b.*\s-delete\b/i, label: "bulk file deletion (find -delete)" },
+    { re: /\bshred\b/i, label: "irrecoverable file destruction (shred)" },
+    { re: /\btruncate\b.*\s-s\s*0\b/i, label: "truncating a file to zero size" },
+    { re: /\bxargs\b.*\brm\b/i, label: "bulk file deletion (xargs rm)" },
+    { re: /\bdel\b\s+\S*\/(s|q|f)\b/i, label: "bulk file deletion (del)" },
+    { re: /\brd\s+\/s/i, label: "recursive directory deletion (rd /s)" },
+    { re: /\bformat\s+[a-z]:/i, label: "disk format" },
+    {
+        re: /\bremove-item\b.*(-recurse\b|-force\b)/i,
+        label: "recursive/forced deletion (Remove-Item)",
+    },
+    { re: /\bmkfs\b/i, label: "filesystem format" },
+    { re: /\bdd\b.*\bof=\/dev\//i, label: "raw disk write (dd)" },
+    { re: />\s*\/dev\/(sd|nvme|hd|disk)/i, label: "writing to a raw disk device" },
+    {
+        re: /\bchmod\s+.*(-R\b|--recursive\b).*\b777\b|\bchmod\s+.*\b777\b.*(-R\b|--recursive\b)/i,
+        label: "world-writable recursive chmod",
+    },
+    { re: /\bchown\s+(-R\b|--recursive\b)/i, label: "recursive ownership change" },
+    { re: /:\(\)\s*\{.*\}\s*;/, label: "fork bomb" },
+    {
+        re: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i,
+        label: "piping a remote script into a shell",
+    },
+    { re: /\bsudo\b/i, label: "elevated privileges (sudo)" },
+    { re: /\bshutdown\b|\breboot\b|\bhalt\b|\bpoweroff\b/i, label: "system power state change" },
+    { re: /\bnpm\s+publish\b|\byarn\s+publish\b/i, label: "publishing a package" },
+    { re: /\bkillall\b|\bkill\s+-9\s+-1\b/i, label: "mass process kill" },
+    // Exfiltration: every prior pattern above is about local destruction —
+    // none of them catch a command whose actual purpose is sending local files
+    // (credentials, source, secrets) to a remote host. classifyDanger forces a
+    // warning prompt even under an allowlist, so these need the same coverage.
+    {
+        re: /\bcurl\b[^|]*(-d|--data(-raw|-binary|-urlencode)?|-F|--form|-T|--upload-file)\b/i,
+        label: "uploading data to a remote server (curl)",
+    },
+    {
+        re: /\bwget\b[^|]*(--post-data|--post-file)\b/i,
+        label: "uploading data to a remote server (wget)",
+    },
+    { re: /\bscp\b\s+\S+\s+\S+@/i, label: "copying files to a remote host (scp)" },
+    { re: /\brsync\b.*\S+@\S+:/i, label: "syncing files to a remote host (rsync)" },
+    { re: /\bnc\b|\bncat\b|\bnetcat\b/i, label: "raw network connection (nc/ncat)" },
+    {
+        re: /\bcurl\b[^|]*\|\s*\S|\bwget\b\s+-[^|]*-O\s*-[^|]*\|\s*\S/i,
+        label: "piping downloaded content into another command",
+    },
+    // Interpreter/eval evasion: a way to run arbitrary code that doesn't spell
+    // out a recognizable destructive command, so the patterns above can't see
+    // it — e.g. `eval "$(echo cm0gLXJmIC8=|base64 -d)"` or `python -c "..."`.
+    { re: /\beval\b/i, label: "dynamic code evaluation (eval)" },
+    { re: /\bbase64\b.*(-d|--decode)\b/i, label: "decoding base64 (often obfuscated payload)" },
+    {
+        re: /\b(python3?|node|ruby|perl)\b\s+(-c|-e)\b/i,
+        label: "running an inline script (bypasses command-text inspection)",
+    },
+    { re: /\bexec\s+\d*[<>]/i, label: "redirecting a shell's own file descriptors (exec)" },
+];
+/** Returns a human-readable danger label if the command is destructive, else null. */
+export function classifyDanger(command) {
+    const cmd = command.trim();
+    for (const { re, label } of PATTERNS) {
+        if (re.test(cmd))
+            return label;
+    }
+    return null;
+}