muonroi-cli 1.7.2 → 1.8.1

package/dist/src/utils/install-manager.js

@@ -1,4 +1,4 @@
-import { spawn } from "child_process";
+import { exec, spawn } from "child_process";
 import { createHash } from "crypto";
 import fs from "fs";
 import os from "os";
@@ -83,6 +83,34 @@ export function getScriptInstallContext(homeDir = os.homedir()) {
     }
     return null;
 }
+export function fetchLatestGitTag(gitDir) {
+    return new Promise((resolve) => {
+        exec(`git -C "${gitDir}" ls-remote --tags origin`, (error, stdout) => {
+            if (error) {
+                resolve(null);
+                return;
+            }
+            const lines = stdout.split(/\r?\n/);
+            let maxVersion = null;
+            for (const line of lines) {
+                const match = line.match(/refs\/tags\/(v?[0-9]+\.[0-9]+\.[0-9]+[^\s]*)$/);
+                if (!match)
+                    continue;
+                let tag = match[1];
+                if (tag.endsWith("^{}")) {
+                    tag = tag.slice(0, -3);
+                }
+                const version = normalizeReleaseVersion(tag);
+                if (!version)
+                    continue;
+                if (!maxVersion || semverGt(version, maxVersion)) {
+                    maxVersion = version;
+                }
+            }
+            resolve(maxVersion);
+        });
+    });
+}
 export async function fetchLatestReleaseVersion() {
     const release = await fetchReleaseJson(`${RELEASES_API}/latest`);
     return release ? normalizeReleaseVersion(release.tag_name) : null;
@@ -179,31 +207,66 @@ export async function runManagedUpdate(currentVersion) {
     const method = detectInstallMethod();
     if (method === "script")
         return runScriptManagedUpdate(currentVersion);
+    const root = findGitRoot(path.dirname(runningModulePath()));
+    let latestVersion = null;
+    if (method === "dev-link" && root) {
+        latestVersion = await fetchLatestGitTag(root);
+    }
+    else {
+        latestVersion = await fetchLatestReleaseVersion();
+    }
+    const normalizedCurrent = semverValid(currentVersion);
+    let statusHeader = "";
+    let hasUpdate = false;
+    if (latestVersion && normalizedCurrent) {
+        hasUpdate = semverGt(latestVersion, normalizedCurrent);
+        if (hasUpdate) {
+            statusHeader = `A new version of muonroi-cli is available!\n  Current version: v${normalizedCurrent}\n  Latest version: v${latestVersion}\n\n`;
+        }
+        else {
+            statusHeader = `You are already up to date!\n  Current version: v${normalizedCurrent}\n  Latest version: v${latestVersion}\n\n`;
+        }
+    }
+    else if (normalizedCurrent) {
+        statusHeader = `Current version: v${normalizedCurrent}\nUnable to check the latest version from GitHub.\n\n`;
+    }
     const cmd = getUpdateCommandForMethod(method);
     if (cmd) {
         const pm = method === "bun-global" ? "bun" : "npm";
+        const instruction = hasUpdate
+            ? `To update, run this in a fresh terminal:\n\n  ${cmd}\n\nThen restart muonroi-cli.`
+            : `If you want to reinstall, run this in a fresh terminal:\n\n  ${cmd}`;
         return {
             success: true,
-            output: `Installed via ${pm} (global package). To update, run this in a fresh terminal:\n\n  ${cmd}\n\nThen restart muonroi-cli.`,
+            output: `${statusHeader}${instruction}`,
         };
     }
     if (method === "compiled") {
         const target = getReleaseTargetForPlatform();
         const asset = target?.assetName ?? "the release asset for your platform";
+        const instruction = hasUpdate
+            ? `Download the latest ${asset} from https://github.com/${GITHUB_REPO}/releases/latest and replace the current binary, or rebuild from source.`
+            : `If you want to reinstall, download the latest ${asset} from https://github.com/${GITHUB_REPO}/releases/latest and replace the current binary.`;
         return {
             success: true,
-            output: `Standalone binary install. Download the latest ${asset} from https://github.com/${GITHUB_REPO}/releases/latest and replace the current binary, or rebuild from source.`,
+            output: `${statusHeader}${instruction}`,
         };
     }
     if (method === "dev-link") {
-        const root = findGitRoot(path.dirname(runningModulePath()));
         const target = root ?? "the muonroi-cli checkout";
+        const instruction = hasUpdate
+            ? `To update, pull the latest changes and rebuild:\n\n  git -C "${target}" pull && bun install && bun run build\n\nThen restart muonroi-cli. (If you also use the compiled muonroi-cli-dev binary, rebuild that separately.)`
+            : `To rebuild your local installation:\n\n  git -C "${target}" pull && bun install && bun run build\n\nThen restart muonroi-cli.`;
         return {
             success: true,
-            output: `Running a linked/source build from ${target}. To update, rebuild it:\n\n  git -C "${target}" pull && bun install && bun run build\n\nThen restart muonroi-cli. (If you also use the compiled muonroi-cli-dev binary, rebuild that separately.)`,
+            output: `${statusHeader}${instruction}`,
         };
     }
-    return notScriptManaged("update");
+    const fallback = notScriptManaged("update");
+    return {
+        success: fallback.success,
+        output: `${statusHeader}${fallback.output}`,
+    };
 }
 export async function runScriptManagedUpdate(currentVersion) {
     const context = getScriptInstallContext();
@@ -348,7 +411,13 @@ async function fetchReleaseJson(url) {
     try {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-        const res = await fetch(url, { signal: controller.signal, headers: { Accept: "application/vnd.github+json" } });
+        const res = await fetch(url, {
+            signal: controller.signal,
+            headers: {
+                Accept: "application/vnd.github+json",
+                "User-Agent": "muonroi-cli",
+            },
+        });
         clearTimeout(timer);
         return res.ok ? (await res.json()) : null;
     }

package/dist/src/utils/install-manager.test.js

@@ -1,7 +1,15 @@
+import { exec } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+vi.mock("child_process", async () => {
+    const actual = await vi.importActual("child_process");
+    return {
+        ...actual,
+        exec: vi.fn(),
+    };
+});
 import { buildScriptUninstallPlan, getInstallMetadataPath, getReleaseTargetForPlatform, getScriptInstallContext, getScriptInstallDir, loadScriptInstallMetadata, parseChecksumsFile, saveScriptInstallMetadata, } from "./install-manager.js";
 let tempDirs = [];
 afterEach(() => {
@@ -124,4 +132,38 @@ describe("buildScriptUninstallPlan", () => {
         expect(plan?.removePaths).toContain(path.join(installDir, currentTarget.binaryName));
     });
 });
+describe("runManagedUpdate", () => {
+    beforeEach(() => {
+        vi.stubGlobal("fetch", vi.fn());
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it("handles dev-link update when newer version is available", async () => {
+        vi.mocked(exec).mockImplementation(((cmd, callback) => {
+            callback(null, "hash\trefs/tags/v2.0.0\n", "");
+            return {};
+        }));
+        const { runManagedUpdate } = await import("./install-manager.js");
+        const result = await runManagedUpdate("1.0.0");
+        expect(result.success).toBe(true);
+        expect(result.output).toContain("A new version of muonroi-cli is available!");
+        expect(result.output).toContain("Current version: v1.0.0");
+        expect(result.output).toContain("Latest version: v2.0.0");
+        expect(result.output).toContain("git -C");
+        expect(result.output).toContain("pull && bun install && bun run build");
+    });
+    it("handles dev-link when already up to date", async () => {
+        vi.mocked(exec).mockImplementation(((cmd, callback) => {
+            callback(null, "hash\trefs/tags/v1.0.0\n", "");
+            return {};
+        }));
+        const { runManagedUpdate } = await import("./install-manager.js");
+        const result = await runManagedUpdate("1.0.0");
+        expect(result.success).toBe(true);
+        expect(result.output).toContain("You are already up to date!");
+        expect(result.output).toContain("Current version: v1.0.0");
+        expect(result.output).toContain("Latest version: v1.0.0");
+    });
+});
 //# sourceMappingURL=install-manager.test.js.map

package/dist/src/utils/llm-deadline.d.ts

@@ -41,4 +41,12 @@ export declare function withTimeoutSignal(parent: AbortSignal | undefined, timeo
  * still be aborted via `withTimeoutSignal` for cleanup; this layer just ensures
  * the caller is never blocked past the deadline.
  */
-export declare function withDeadlineRace<T>(fn: () => Promise<T>, deadlineMs: number, label: string): Promise<T>;
+export declare function withDeadlineRace<T>(fn: () => Promise<T>, deadlineMs: number, label: string, 
+/**
+ * User-abort signal. When it fires, the race rejects within `abortGraceMs`
+ * even if `fn()` hasn't settled — so a provider that ignores its abortSignal
+ * mid-call (observed with DeepSeek/grok socket stalls) can't keep the caller
+ * (and, for council, the locked composer) blocked until the full `deadlineMs`.
+ * The short grace lets the normal fetch-level abort win first when it's quick.
+ */
+abortSignal?: AbortSignal, abortGraceMs?: number): Promise<T>;

package/dist/src/utils/llm-deadline.js

@@ -62,19 +62,48 @@ export function withTimeoutSignal(parent, timeoutMs) {
  * still be aborted via `withTimeoutSignal` for cleanup; this layer just ensures
  * the caller is never blocked past the deadline.
  */
-export async function withDeadlineRace(fn, deadlineMs, label) {
+export async function withDeadlineRace(fn, deadlineMs, label, 
+/**
+ * User-abort signal. When it fires, the race rejects within `abortGraceMs`
+ * even if `fn()` hasn't settled — so a provider that ignores its abortSignal
+ * mid-call (observed with DeepSeek/grok socket stalls) can't keep the caller
+ * (and, for council, the locked composer) blocked until the full `deadlineMs`.
+ * The short grace lets the normal fetch-level abort win first when it's quick.
+ */
+abortSignal, abortGraceMs = 1500) {
     let timer = null;
+    let abortTimer = null;
+    let abortListener = null;
     const deadline = new Promise((_, reject) => {
         timer = setTimeout(() => {
             reject(new Error(`${label} exceeded ${deadlineMs}ms deadline (timeout)`));
         }, deadlineMs);
     });
+    const racers = [fn(), deadline];
+    if (abortSignal) {
+        const abortRace = new Promise((_, reject) => {
+            const arm = () => {
+                abortTimer = setTimeout(() => reject(new Error(`${label} aborted by user`)), abortGraceMs);
+            };
+            if (abortSignal.aborted)
+                arm();
+            else {
+                abortListener = arm;
+                abortSignal.addEventListener("abort", arm, { once: true });
+            }
+        });
+        racers.push(abortRace);
+    }
     try {
-        return await Promise.race([fn(), deadline]);
+        return await Promise.race(racers);
     }
     finally {
         if (timer)
             clearTimeout(timer);
+        if (abortTimer)
+            clearTimeout(abortTimer);
+        if (abortListener && abortSignal)
+            abortSignal.removeEventListener("abort", abortListener);
     }
 }
 //# sourceMappingURL=llm-deadline.js.map

package/dist/src/utils/logger.d.ts

@@ -0,0 +1,28 @@
+export type LogLevel = "debug" | "info" | "warn" | "error";
+export type LogNamespace = "cli" | "ui" | "orchestrator" | "storage" | "ee" | "mcp" | "pil" | "router";
+export interface LogContext {
+    elapsedMs?: number;
+    error?: Error | unknown;
+    [key: string]: unknown;
+}
+/**
+ * Checks if the given log level is enabled based on the current process level weight.
+ */
+export declare function isLogLevelEnabled(level: LogLevel): boolean;
+/**
+ * Redacts common patterns of API keys and credential strings from log messages.
+ */
+export declare function redactSecrets(str: string): string;
+/**
+ * Recursively redacts sensitive fields from context objects.
+ */
+export declare function redactObject(obj: unknown): unknown;
+/**
+ * Structured unified logging system.
+ */
+export declare const logger: {
+    debug(ns: LogNamespace, msg: string, ctx?: LogContext): void;
+    info(ns: LogNamespace, msg: string, ctx?: LogContext): void;
+    warn(ns: LogNamespace, msg: string, ctx?: LogContext): void;
+    error(ns: LogNamespace, msg: string, ctx?: LogContext): void;
+};

package/dist/src/utils/logger.js

@@ -0,0 +1,171 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+const LEVEL_WEIGHTS = {
+    debug: 0,
+    info: 1,
+    warn: 2,
+    error: 3,
+};
+// Default log level is 'info' unless explicitly configured.
+const CURRENT_WEIGHT = (() => {
+    const envLevel = process.env.MUONROI_LOG_LEVEL?.toLowerCase();
+    if (envLevel === "debug")
+        return LEVEL_WEIGHTS.debug;
+    if (envLevel === "info")
+        return LEVEL_WEIGHTS.info;
+    if (envLevel === "warn")
+        return LEVEL_WEIGHTS.warn;
+    if (envLevel === "error")
+        return LEVEL_WEIGHTS.error;
+    return LEVEL_WEIGHTS.info;
+})();
+/**
+ * Checks if the given log level is enabled based on the current process level weight.
+ */
+export function isLogLevelEnabled(level) {
+    return LEVEL_WEIGHTS[level] >= CURRENT_WEIGHT;
+}
+/**
+ * Redacts common patterns of API keys and credential strings from log messages.
+ */
+export function redactSecrets(str) {
+    return str
+        .replace(/\bsk-[A-Za-z0-9-_]{20,}\b/g, "[REDACTED_API_KEY]")
+        .replace(/\bxai-[A-Za-z0-9-_]{20,}\b/g, "[REDACTED_API_KEY]")
+        .replace(/\bAIzaSy[A-Za-z0-9-_]{30,}\b/g, "[REDACTED_API_KEY]");
+}
+/**
+ * Recursively redacts sensitive fields from context objects.
+ */
+export function redactObject(obj) {
+    if (obj === null || obj === undefined)
+        return obj;
+    if (typeof obj === "string") {
+        return redactSecrets(obj);
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(redactObject);
+    }
+    if (typeof obj === "object") {
+        const res = {};
+        for (const [k, v] of Object.entries(obj)) {
+            const lowerK = k.toLowerCase();
+            if (lowerK.includes("key") ||
+                lowerK.includes("secret") ||
+                lowerK.includes("token") ||
+                lowerK.includes("password") ||
+                lowerK.includes("auth")) {
+                res[k] = "[REDACTED]";
+            }
+            else {
+                res[k] = redactObject(v);
+            }
+        }
+        return res;
+    }
+    return obj;
+}
+/**
+ * Returns true if the interactive TUI is active, preventing console writes.
+ */
+function isTuiActive() {
+    try {
+        return globalThis.__muonroiTuiActive === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Writes logs safely to ~/.muonroi-cli/debug.log.
+ */
+function appendToFile(level, ns, msg, ctx) {
+    try {
+        const dir = path.join(os.homedir(), ".muonroi-cli");
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        const logPath = path.join(dir, "debug.log");
+        const ts = new Date().toISOString();
+        const redactedCtx = ctx ? redactObject(ctx) : null;
+        const ctxStr = redactedCtx ? ` ${JSON.stringify(redactedCtx)}` : "";
+        const logLine = `[${ts}] [${level.toUpperCase()}] [${ns.toUpperCase()}] ${redactSecrets(msg)}${ctxStr}\n`;
+        fs.appendFileSync(logPath, logLine, "utf8");
+    }
+    catch {
+        /* fail-open */
+    }
+}
+/**
+ * Formats console log lines with colors.
+ */
+function formatConsole(level, ns, msg, ctx) {
+    const ts = new Date().toISOString().split("T")[1].slice(0, -1); // HH:MM:SS.mmm
+    const levelStr = level.toUpperCase();
+    const nsStr = ns.toUpperCase();
+    const cleanMsg = redactSecrets(msg);
+    const redactedCtx = ctx ? redactObject(ctx) : null;
+    const ctxStr = redactedCtx ? ` ${JSON.stringify(redactedCtx)}` : "";
+    // Apply colors for developer convenience in terminal logs (non-TUI)
+    let color = "\x1b[0m"; // Reset
+    if (level === "debug")
+        color = "\x1b[90m"; // Gray
+    if (level === "info")
+        color = "\x1b[32m"; // Green
+    if (level === "warn")
+        color = "\x1b[33m"; // Yellow
+    if (level === "error")
+        color = "\x1b[31m"; // Red
+    return `${color}[${ts}] [${levelStr}] [${nsStr}] ${cleanMsg}${ctxStr}\x1b[0m`;
+}
+/**
+ * Structured unified logging system.
+ */
+export const logger = {
+    debug(ns, msg, ctx) {
+        if (!isLogLevelEnabled("debug"))
+            return;
+        if (isTuiActive()) {
+            appendToFile("debug", ns, msg, ctx);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.log(formatConsole("debug", ns, msg, ctx));
+        }
+    },
+    info(ns, msg, ctx) {
+        if (!isLogLevelEnabled("info"))
+            return;
+        if (isTuiActive()) {
+            appendToFile("info", ns, msg, ctx);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.log(formatConsole("info", ns, msg, ctx));
+        }
+    },
+    warn(ns, msg, ctx) {
+        if (!isLogLevelEnabled("warn"))
+            return;
+        if (isTuiActive()) {
+            appendToFile("warn", ns, msg, ctx);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.warn(formatConsole("warn", ns, msg, ctx));
+        }
+    },
+    error(ns, msg, ctx) {
+        if (!isLogLevelEnabled("error"))
+            return;
+        if (isTuiActive()) {
+            appendToFile("error", ns, msg, ctx);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.error(formatConsole("error", ns, msg, ctx));
+        }
+    },
+};
+//# sourceMappingURL=logger.js.map

package/dist/src/utils/permission-mode.d.ts

@@ -5,6 +5,39 @@ export type PermissionMode = "safe" | "auto-edit" | "yolo";
  * without manual confirmation when the user has opted into auto-edit mode.
  */
 export declare const AUTO_EDIT_ALLOWED: ReadonlySet<string>;
+/**
+ * Structured block result returned by safety checks.
+ * `null` means the command is safe to proceed.
+ */
+export interface SafetyBlockResult {
+    /** Machine-readable kind for routing to the right askcard layout. */
+    kind: "catastrophic" | "dangerous" | "git-safety" | "empty-bash";
+    /** Human-readable reason explaining why it was blocked. */
+    reason: string;
+    /** The original command text that was blocked. */
+    command: string;
+}
+/**
+ * Returns a SafetyBlockResult if `command` matches a catastrophic
+ * pattern, or `null` if the command is safe to proceed.
+ *
+ * This is checked at the tool layer (BashTool.prepareCommand) and is
+ * independent of the UI-layer permission approval system — it applies even
+ * in yolo mode.
+ */
+export declare function checkCatastrophicCommand(command: string): SafetyBlockResult | null;
+/**
+ * Check a command against the "dangerous" patterns used by `toolNeedsApproval`.
+ * These are less severe than catastrophic but should still prompt for approval
+ * in safe / auto-edit modes.
+ *
+ * Returns a SafetyBlockResult or null if safe.
+ */
+export declare function checkDangerousCommand(command: string): SafetyBlockResult | null;
+/**
+ * Check if a command is a safety-blocked git operation (push-on-red, broad staging).
+ */
+export declare function checkGitSafetyCommand(command: string, gitSafetyKey: string): SafetyBlockResult | null;
 /**
  * Returns true if the given tool call requires manual user approval
  * under the specified permission mode.

package/dist/src/utils/permission-mode.js

@@ -19,6 +19,159 @@ export const AUTO_EDIT_ALLOWED = new Set([
     "grep",
     "list_directory",
 ]);
+/**
+ * Catastrophic commands: unrecoverable operations that are ALWAYS hard-blocked
+ * at the tool layer regardless of permission mode (safe/auto-edit/yolo).
+ *
+ * These are patterns where the potential for irreversible damage to the host
+ * system is high enough that no user approval dialog is sufficient — they must
+ * never execute. This list intentionally errs on the side of caution.
+ *
+ * Override: set MUONROI_ALLOW_CATASTROPHIC=1 to bypass (not recommended;
+ * intended only for explicit test harness scenarios).
+ */
+const CATASTROPHIC_PATTERNS = [
+    // Disk / filesystem destruction
+    {
+        pattern: /\bdd\b[^|&;\n]*\bof=\/dev\//i,
+        reason: "dd writing to a raw device can destroy disk contents irreversibly.",
+    },
+    {
+        pattern: /\bmkfs\b/i,
+        reason: "mkfs formats a filesystem, destroying all data on the target device.",
+    },
+    // Fork bomb — classic bash pattern: :(){ :|:& };:
+    // Match the defining signature: a function named `:` that calls itself recursively.
+    // This is tight enough to avoid false positives on URLs containing `:/`.
+    {
+        pattern: /:\s*\(\s*\)\s*\{[^}]*:\s*\|\s*:/,
+        reason: "Fork bomb pattern detected — would exhaust host process table.",
+    },
+    // Remote code execution via piped shell
+    {
+        pattern: /\bcurl\b[^|&;\n]*\|\s*(?:ba)?sh\b/i,
+        reason: "curl piped to a shell executes arbitrary remote code without inspection.",
+    },
+    {
+        pattern: /\bwget\b[^|&;\n]*\|\s*(?:ba)?sh\b/i,
+        reason: "wget piped to a shell executes arbitrary remote code without inspection.",
+    },
+    // Privilege escalation
+    {
+        pattern: /\bsudo\s+/i,
+        reason: "sudo privilege escalation is not permitted from the agent shell.",
+    },
+    {
+        pattern: /\bsu\s+-\s*/i,
+        reason: "su to root is not permitted from the agent shell.",
+    },
+    // Persistence mechanisms — block crontab edits/writes; allow only -l (list, read-only)
+    // crontab <file>, crontab -, crontab -e all create/modify the crontab.
+    {
+        pattern: /\bcrontab\b(?!\s+-l\b)/i,
+        reason: "crontab write/edit commands create persistent execution outside the session.",
+    },
+    {
+        pattern: /\/etc\/(?:rc\.d|init\.d|systemd|cron)/i,
+        reason: "Writing to system init or cron directories would create persistence.",
+    },
+    // Reverse shells
+    {
+        pattern: /\bnc\b[^|&;\n]*(?:-e|-c)\s+/i,
+        reason: "nc with -e/-c flag can open a reverse shell.",
+    },
+    {
+        pattern: /\bsocat\b[^|&;\n]*(?:EXEC|SYSTEM):/i,
+        reason: "socat with EXEC/SYSTEM can open a reverse shell.",
+    },
+    {
+        pattern: /\/dev\/tcp\//i,
+        reason: "Bash /dev/tcp redirect can open a covert reverse shell connection.",
+    },
+    // Exfiltration of credentials / secrets directories
+    {
+        pattern: /(?:tar|zip|gzip|rsync|scp|sftp|ftp)\b[^|&;\n]*\.(?:muonroi-cli|ssh|gnupg|aws|kube)/i,
+        reason: "Archiving or uploading credential directories is not permitted.",
+    },
+];
+/**
+ * Returns a SafetyBlockResult if `command` matches a catastrophic
+ * pattern, or `null` if the command is safe to proceed.
+ *
+ * This is checked at the tool layer (BashTool.prepareCommand) and is
+ * independent of the UI-layer permission approval system — it applies even
+ * in yolo mode.
+ */
+export function checkCatastrophicCommand(command) {
+    if (process.env.MUONROI_ALLOW_CATASTROPHIC === "1")
+        return null;
+    for (const { pattern, reason } of CATASTROPHIC_PATTERNS) {
+        if (pattern.test(command)) {
+            return { kind: "catastrophic", reason, command };
+        }
+    }
+    return null;
+}
+/**
+ * Check a command against the "dangerous" patterns used by `toolNeedsApproval`.
+ * These are less severe than catastrophic but should still prompt for approval
+ * in safe / auto-edit modes.
+ *
+ * Returns a SafetyBlockResult or null if safe.
+ */
+export function checkDangerousCommand(command) {
+    const dangerousPatterns = [
+        // Filesystem destruction
+        /rm\s+-rf?\s+\/(?!tmp|var\/tmp)/i,
+        // Unrestricted chmod
+        /chmod\s+(?:777|a\+[rwx])/i,
+        // Code injection
+        /eval\s*\(/i,
+        /exec\s*\(/i,
+        // External network fetches (non-local)
+        /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+        /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+        // Process substitution with external commands
+        /\$\([^)]*(?:curl|wget|nc|socat)[^)]*\)/i,
+        // Writing to /etc (besides allowed subdirs)
+        /\bchown\s+root/i,
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(command)) {
+            return {
+                kind: "dangerous",
+                reason: `Command matched dangerous pattern: ${pattern.source}`,
+                command,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Check if a command is a safety-blocked git operation (push-on-red, broad staging).
+ */
+export function checkGitSafetyCommand(command, gitSafetyKey) {
+    // Lazy import to avoid circular deps at module level
+    const { analyzeGitCommand, checkPushGate, checkSensitiveStaging } = require_inline_safety_deps();
+    const gt = analyzeGitCommand(command);
+    if (gt.isPush) {
+        const gate = checkPushGate(gitSafetyKey);
+        if (gate.blocked) {
+            return {
+                kind: "git-safety",
+                reason: `git push blocked: ${gate.failed.join(", ")}`,
+                command,
+            };
+        }
+    }
+    return null;
+}
+// Inline require to avoid circular dependency at module load.
+function require_inline_safety_deps() {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const mod = require("../tools/git-safety.js");
+    return mod;
+}
 /**
  * Returns true if the given tool call requires manual user approval
  * under the specified permission mode.
@@ -34,12 +187,20 @@ export function toolNeedsApproval(toolName, mode, context) {
         if (!cmd)
             return false;
         const patterns = [
+            // Filesystem destruction
             /rm\s+-rf?\s+\/(?!tmp|var\/tmp)/i,
-            /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
-            /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
-            /chmod\s+777/i,
+            // Unrestricted chmod
+            /chmod\s+(?:777|a\+[rwx])/i,
+            // Code injection
             /eval\s*\(/i,
             /exec\s*\(/i,
+            // External network fetches (non-local)
+            /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+            /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+            // Process substitution with external commands
+            /\$\([^)]*(?:curl|wget|nc|socat)[^)]*\)/i,
+            // Writing to /etc (besides allowed subdirs)
+            /\bchown\s+root/i,
         ];
         return patterns.some((p) => p.test(cmd));
     };