nine-hundred 0.0.1

package/dist/agent/mcp/index.js

@@ -0,0 +1,90 @@
+import chalk from 'chalk';
+import { McpServerClient } from './client.js';
+import { isHttpConfig, isStdioConfig, readMcpConfig } from './config.js';
+import { jsonSchemaToZod } from './schema.js';
+const clients = new Map();
+let wrappers = [];
+let initialized = false;
+function formatConnectionLabel(serverName, params) {
+    if (isStdioConfig(params)) {
+        return `${params.command}${params.args ? ' ' + params.args.join(' ') : ''}`;
+    }
+    if (isHttpConfig(params)) {
+        return params.url;
+    }
+    return serverName;
+}
+export async function initializeMcpClients() {
+    if (initialized)
+        return;
+    const config = await readMcpConfig();
+    const entries = Object.entries(config.mcpServers ?? {});
+    if (entries.length === 0) {
+        initialized = true;
+        return;
+    }
+    const serverCount = entries.length;
+    console.log(chalk.blue(`[MCP] 正在连接 ${serverCount} 个 MCP 服务器...`));
+    const newWrappers = [];
+    const seenNames = new Set();
+    let successCount = 0;
+    let failCount = 0;
+    for (const [serverName, params] of entries) {
+        const label = formatConnectionLabel(serverName, params);
+        const mode = isHttpConfig(params) ? 'HTTP' : 'stdio';
+        console.log(chalk.dim(`[MCP] [${mode}] 连接 "${serverName}" (${label})...`));
+        const client = new McpServerClient(serverName, params);
+        try {
+            await client.connect();
+            clients.set(serverName, client);
+            successCount++;
+            const tools = client.getTools();
+            console.log(chalk.green(`[MCP] "${serverName}" 连接成功`) + chalk.cyan(`，发现 ${tools.length} 个工具`));
+            for (const def of client.getTools()) {
+                if (seenNames.has(def.name)) {
+                    console.warn(`[MCP] Duplicate tool name "${def.name}" from server "${serverName}", skipping.`);
+                    continue;
+                }
+                seenNames.add(def.name);
+                newWrappers.push({
+                    name: def.name,
+                    description: def.description,
+                    schema: jsonSchemaToZod(def.inputSchema),
+                    invoke: (args) => client.callTool(def.name, args),
+                });
+            }
+        }
+        catch (err) {
+            failCount++;
+            console.warn(chalk.red(`[MCP] "${serverName}" 连接失败: ${err.message}`));
+            try {
+                await client.disconnect();
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    wrappers = newWrappers;
+    initialized = true;
+    if (failCount === 0) {
+        console.log(chalk.green.bold(`[MCP] 全部 ${serverCount} 个服务器连接成功，共注册 ${newWrappers.length} 个工具`));
+    }
+    else if (successCount === 0) {
+        console.warn(chalk.red.bold(`[MCP] 所有 ${serverCount} 个服务器均连接失败`));
+    }
+    else {
+        console.log(chalk.yellow.bold(`[MCP] ${successCount}/${serverCount} 个服务器连接成功，共注册 ${newWrappers.length} 个工具`));
+    }
+}
+export function getMcpToolWrappers() {
+    return wrappers;
+}
+export async function shutdownMcpClients() {
+    for (const client of clients.values()) {
+        await client.disconnect().catch(() => { });
+    }
+    clients.clear();
+    wrappers = [];
+    initialized = false;
+}

package/dist/agent/mcp/schema.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+export function jsonSchemaToZod(schema) {
+    if (typeof schema !== 'object' || schema === null) {
+        return z.any();
+    }
+    const s = schema;
+    if (Array.isArray(s.enum) && s.enum.every((v) => typeof v === 'string')) {
+        return z.enum(s.enum);
+    }
+    switch (s.type) {
+        case 'string': {
+            let base = z.string();
+            if (typeof s.minLength === 'number')
+                base = base.min(s.minLength);
+            if (typeof s.maxLength === 'number')
+                base = base.max(s.maxLength);
+            return base;
+        }
+        case 'number':
+            return z.number();
+        case 'integer':
+            return z.number().int();
+        case 'boolean':
+            return z.boolean();
+        case 'array': {
+            const items = (s.items ?? {});
+            return z.array(jsonSchemaToZod(items));
+        }
+        case 'object': {
+            const properties = (s.properties ?? {});
+            const required = new Set(Array.isArray(s.required) ? s.required : []);
+            const shape = {};
+            for (const [key, propSchema] of Object.entries(properties)) {
+                let prop = jsonSchemaToZod(propSchema);
+                if (!required.has(key)) {
+                    prop = prop.optional();
+                }
+                shape[key] = prop;
+            }
+            return z.object(shape).passthrough();
+        }
+        case 'null':
+            return z.null();
+        default: {
+            if (Array.isArray(s.anyOf)) {
+                const unions = s.anyOf.map(jsonSchemaToZod);
+                if (unions.length >= 2) {
+                    return z.union(unions);
+                }
+                if (unions.length === 1)
+                    return unions[0];
+            }
+            return z.any();
+        }
+    }
+}

package/dist/agent/permission/exec.js

@@ -0,0 +1,71 @@
+import { commandChangesDirectory, detectDangerousOperation, detectLanguageInterpreter, detectSafeCommand, } from './util/index.js';
+/**
+ * Decide whether an exec tool call should be auto-allowed, blocked, or
+ * sent to the human-in-the-loop interrupt.
+ *
+ *   - explicit `cwd` arg (anything other than ".") → `block`
+ *     (the tool would execute inside a subdirectory of the project root,
+ *      leaving the current working directory)
+ *   - `command` contains a `cd` / `pushd` to anywhere → `block`
+ *   - `command` invokes a non-shell language interpreter → `block`,
+ *     with a redirect to `run_py_tool` / `run_js_tool` when applicable
+ *   - `command` is a known dangerous operation (sudo, rm, mv, chmod, kill,
+ *     useradd, ssh, …) or a read-style command targeting a sensitive path
+ *     → `block`
+ *   - `command` consists entirely of read-only safe commands
+ *     (ls, pwd, cat, head, tail, grep, find, git status/diff/log, …) → `allow`
+ *   - otherwise → `ask` (fall through to interrupt)
+ *
+ * The shell-command scan only runs when args carries a non-empty `command`
+ * string. `run_js_tool` / `run_py_tool` carry source under `code`, not
+ * `command`, so they are unaffected.
+ */
+export async function checkExecPermission(args) {
+    const cwd = args.cwd;
+    if (typeof cwd === 'string' && cwd.length > 0 && cwd !== '.') {
+        return {
+            action: 'block',
+            message: `⚠️ \`cwd="${cwd}"\` 会把命令切到子目录执行,不允许。` +
+                `exec 工具只能在当前工作目录执行。` +
+                `请去掉 cwd 参数,或直接在当前目录完成工作。`,
+        };
+    }
+    const command = args.command;
+    if (typeof command === 'string' && command.length > 0) {
+        const dirResult = commandChangesDirectory(command);
+        if (dirResult.changes) {
+            return {
+                action: 'block',
+                message: `⚠️ 命令 \`${dirResult.segment}\` 包含 \`cd\` / \`pushd\`,会切换到其他目录,不允许。` +
+                    `exec 工具只能在当前工作目录执行。` +
+                    `请去掉 cd / pushd,或在当前目录下完成工作。`,
+            };
+        }
+        const langResult = detectLanguageInterpreter(command);
+        if (langResult.found) {
+            return {
+                action: 'block',
+                message: langResult.tool
+                    ? `⚠️ 命令 \`${langResult.segment}\` 调用了 ${langResult.lang} 解释器,不允许。` +
+                        `请改用 \`${langResult.tool}\` 工具执行 ${langResult.lang} 代码。`
+                    : `⚠️ 命令 \`${langResult.segment}\` 调用了 ${langResult.lang} 解释器,不允许。` +
+                        `exec 工具只支持 shell / bash / sh 命令,不支持 ${langResult.lang}。`,
+            };
+        }
+        const dangerResult = detectDangerousOperation(command);
+        if (dangerResult.found) {
+            return {
+                action: 'block',
+                message: dangerResult.category === 'sensitive' && dangerResult.path
+                    ? `⚠️ 命令 \`${dangerResult.segment}\` 访问了敏感路径 \`${dangerResult.path}\`,不允许。` +
+                        `请改用其他安全方式。`
+                    : `⚠️ 命令 \`${dangerResult.segment}\` 是危险操作 (${dangerResult.description}),不允许。` +
+                        `请改用其他安全方式。`,
+            };
+        }
+        if (detectSafeCommand(command).safe) {
+            return { action: 'allow' };
+        }
+    }
+    return { action: 'ask' };
+}

package/dist/agent/permission/network.js

@@ -0,0 +1,37 @@
+import { isSafeDomain, } from './util/index.js';
+/**
+ * Decide whether a network tool call should be auto-allowed or sent to
+ * the human-in-the-loop interrupt.
+ *
+ *   - no `url` in args → `allow`
+ *     (e.g. `web_search_tool` only takes a `query`, not a URL)
+ *   - `url` parses, has a hostname, and that hostname is in the safe-
+ *     domain list → `allow`
+ *   - `url` parses but the hostname is not safe → `ask`
+ *   - `url` fails to parse, or parses with an empty hostname (e.g.
+ *     `file:///etc/passwd`) → `ask`
+ *
+ * There is intentionally no `block` outcome — unknown hosts get a
+ * confirmation prompt rather than a hard rejection, so the user can
+ * still approve a one-off fetch.
+ */
+export async function checkNetworkPermission(args, _options = {}) {
+    const url = args.url;
+    if (typeof url !== 'string' || url.length === 0) {
+        return { action: 'allow' };
+    }
+    let hostname;
+    try {
+        hostname = new URL(url).hostname;
+    }
+    catch {
+        return { action: 'ask' };
+    }
+    if (!hostname) {
+        return { action: 'ask' };
+    }
+    if (isSafeDomain(hostname)) {
+        return { action: 'allow' };
+    }
+    return { action: 'ask' };
+}

package/dist/agent/permission/read.js

@@ -0,0 +1,27 @@
+import { isDangerousPath, } from './util/index.js';
+/**
+ * Decide whether a read tool call should be auto-allowed, blocked, or sent to
+ * the human-in-the-loop interrupt.
+ *
+ * Read tools auto-execute as long as the path is not dangerous:
+ *   - no `filePath` in args → `allow`  (e.g. profile_update_tool)
+ *   - `filePath` matches a dangerous-path entry → `block` with a message
+ *     that is returned to the LLM
+ *   - otherwise → `allow`  (paths outside cwd are read-only and safe to open)
+ */
+export async function checkReadPermission(args, _options = {}) {
+    const filePath = args.filePath;
+    if (typeof filePath !== 'string' || filePath.length === 0) {
+        return { action: 'allow' };
+    }
+    if (isDangerousPath(filePath)) {
+        return {
+            action: 'block',
+            message: `⚠️ 路径 \`${filePath}\` 是危险路径,不允许访问。` +
+                `危险路径包含 ~/.ssh、~/.aws、~/.gnupg、/etc、/var 等敏感目录,` +
+                `以及 Windows 上的 %APPDATA%、C:\\Windows\\System32 等。` +
+                `请改用工作目录内的其他文件。`,
+        };
+    }
+    return { action: 'allow' };
+}

package/dist/agent/permission/util/command-changes-directory.js

@@ -0,0 +1,29 @@
+/**
+ * Check whether a shell command string would change the working directory
+ * during execution (via `cd` or `pushd`).
+ *
+ * The parser is deliberately conservative: it splits on common shell chain
+ * operators (`&&`, `||`, `;`, `|`, `&`) and inspects each segment for a
+ * leading `cd` / `pushd`. Quoting, subshells, and variable expansion are
+ * NOT understood, so a literal `cd /tmp` inside an `echo` will be flagged
+ * as a change. Erring on the safe side is the point.
+ */
+export function commandChangesDirectory(command) {
+    const segments = command.split(/&&|\|\||;|\||&/);
+    for (const raw of segments) {
+        const segment = raw.trim();
+        if (!segment)
+            continue;
+        // The argument group is optional so bare `cd` (defaults to HOME in
+        // the shell) and bare `pushd` (swaps to the previous directory) are
+        // both detected as directory changes.
+        const match = segment.match(/^(?:cd|pushd)(?:\s+(.+?))?\s*$/);
+        if (!match)
+            continue;
+        const arg = match[1]?.trim().replace(/^["']|["']$/g, '');
+        if (arg === '.' || arg === './')
+            continue;
+        return { changes: true, segment };
+    }
+    return { changes: false };
+}

package/dist/agent/permission/util/dangerous-path.json

@@ -0,0 +1,116 @@
+{
+    "macos": [
+        "~/.ssh",
+        "~/.gnupg",
+        "~/.aws",
+        "~/.azure",
+        "~/.config/gcloud",
+        "~/.kube",
+        "~/.docker",
+        "~/.netrc",
+        "~/Library/Keychains",
+        "~/Downloads",
+        "~/Library/Application Support/Google/Chrome",
+        "~/Library/Application Support/Chromium",
+        "~/Library/Application Support/Firefox",
+        "~/Library/Application Support/Slack",
+        "~/Library/Application Support/Discord",
+        "~/Library/Application Support/Telegram",
+        "~/Library/Application Support/Signal",
+        "~/.zshrc",
+        "~/.bashrc",
+        "~/.bash_profile",
+        "~/.profile",
+        "~/.env",
+        "~/.env.*",
+        "~/.gitconfig",
+        "~/.git-credentials",
+        "~/.npmrc",
+        "~/.pnpmrc",
+        "~/.yarnrc",
+        "~/.pypirc",
+        "~/.m2",
+        "~/.gradle",
+        "~/.terraform",
+        "~/.config/gh",
+        "~/.config/gitlab",
+        "~/.circleci",
+        "~/.vercel",
+        "~/.netlify",
+        "~/Library/Containers",
+        "/private",
+        "/etc",
+        "/var"
+    ],
+    "linux": [
+        "~/.ssh",
+        "~/.gnupg",
+        "~/.pki",
+        "~/.aws",
+        "~/.azure",
+        "~/.config/gcloud",
+        "~/.kube",
+        "~/.docker",
+        "~/.netrc",
+        "~/.local/share/keyrings",
+        "~/.config/google-chrome",
+        "~/.config/chromium",
+        "~/.mozilla/firefox",
+        "~/.config/Slack",
+        "~/.config/discord",
+        "~/.local/share/TelegramDesktop",
+        "~/.zshrc",
+        "~/.bashrc",
+        "~/.bash_profile",
+        "~/.profile",
+        "~/.env",
+        "~/.env.*",
+        "~/.gitconfig",
+        "~/.git-credentials",
+        "~/.npmrc",
+        "~/.pnpmrc",
+        "~/.yarnrc",
+        "~/.pypirc",
+        "~/.m2",
+        "~/.gradle",
+        "~/.terraform",
+        "~/.config/gh",
+        "~/.config/gitlab",
+        "~/.circleci",
+        "~/.vercel",
+        "~/.netlify",
+        "/etc/shadow",
+        "/etc/sudoers",
+        "/proc",
+        "/sys",
+        "/var/lib",
+        "/root"
+    ],
+    "windows": [
+        "%USERPROFILE%\\.ssh",
+        "%USERPROFILE%\\.gnupg",
+        "%USERPROFILE%\\.aws",
+        "%USERPROFILE%\\.azure",
+        "%USERPROFILE%\\.kube",
+        "%USERPROFILE%\\.docker",
+        "%LOCALAPPDATA%\\Google\\Chrome\\User Data",
+        "%LOCALAPPDATA%\\Chromium\\User Data",
+        "%APPDATA%\\Mozilla\\Firefox",
+        "%APPDATA%\\Slack",
+        "%APPDATA%\\Discord",
+        "%APPDATA%\\Telegram Desktop",
+        "%USERPROFILE%\\.gitconfig",
+        "%USERPROFILE%\\.git-credentials",
+        "%USERPROFILE%\\.npmrc",
+        "%USERPROFILE%\\.pnpmrc",
+        "%USERPROFILE%\\.yarnrc",
+        "%USERPROFILE%\\.m2",
+        "%USERPROFILE%\\.gradle",
+        "%APPDATA%",
+        "%LOCALAPPDATA%",
+        "C:\\Windows\\System32",
+        "C:\\Windows\\System32\\config\\SAM",
+        "C:\\Windows\\System32\\config\\SECURITY",
+        "C:\\Windows\\System32\\config\\SYSTEM"
+    ]
+}

package/dist/agent/permission/util/detect-dangerous-operation.js

@@ -0,0 +1,230 @@
+import { isDangerousPath } from './is-dangerous-path.js';
+// Command-name blacklist. Keys are lowercased before lookup so that
+// Windows-style mixed-case invocations (`DEL`, `Remove-Item`) are caught.
+const DANGEROUS_COMMANDS = {
+    // ---- 超级权限 ----
+    sudo: { category: 'sudo', description: '使用超级权限' },
+    su: { category: 'sudo', description: '切换到超级用户' },
+    doas: { category: 'sudo', description: '使用超级权限(BSD)' },
+    runas: { category: 'sudo', description: '以其他用户身份运行(Windows)' },
+    // ---- 删除文件/目录 ----
+    rm: { category: 'delete', description: '删除文件/目录' },
+    rmdir: { category: 'delete', description: '删除空目录' },
+    del: { category: 'delete', description: '删除文件(Windows CMD)' },
+    erase: { category: 'delete', description: '删除文件(Windows CMD)' },
+    rd: { category: 'delete', description: '删除目录(Windows CMD)' },
+    rmdir_cmd: { category: 'delete', description: '删除目录(Windows CMD)' },
+    'remove-item': { category: 'delete', description: '删除项目(PowerShell)' },
+    ri: { category: 'delete', description: '删除项目(PowerShell, Remove-Item 的别名)' },
+    del_cmd: { category: 'delete', description: '删除项目(PowerShell)' },
+    // ---- 修改文件/目录 ----
+    mv: { category: 'modify', description: '移动/重命名文件' },
+    'move-item': { category: 'modify', description: '移动/重命名项目(PowerShell)' },
+    mi: { category: 'modify', description: '移动/重命名项目(PowerShell, Move-Item 的别名)' },
+    'rename-item': { category: 'modify', description: '重命名项目(PowerShell)' },
+    rni: { category: 'modify', description: '重命名项目(PowerShell, Rename-Item 的别名)' },
+    'set-content': { category: 'modify', description: '覆盖写入文件(PowerShell)' },
+    sc_powershell: {
+        category: 'modify',
+        description: '覆盖写入文件(PowerShell, Set-Content 的别名)',
+    },
+    'add-content': { category: 'modify', description: '追加写入文件(PowerShell)' },
+    ac: { category: 'modify', description: '追加写入文件(PowerShell, Add-Content 的别名)' },
+    'clear-content': { category: 'modify', description: '清空文件内容(PowerShell)' },
+    clc: { category: 'modify', description: '清空文件内容(PowerShell, Clear-Content 的别名)' },
+    'out-file': { category: 'modify', description: '写入文件(PowerShell)' },
+    of: { category: 'modify', description: '写入文件(PowerShell, Out-File 的别名)' },
+    'new-item': { category: 'modify', description: '新建项目(PowerShell)' },
+    ni: { category: 'modify', description: '新建项目(PowerShell, New-Item 的别名)' },
+    tee: { category: 'modify', description: '从 stdin 写入文件' },
+    truncate: { category: 'modify', description: '截断文件' },
+    dd: { category: 'modify', description: '转换/复制文件' },
+    install: { category: 'modify', description: '复制文件并设置属性' },
+    // ---- 修改权限 ----
+    chmod: { category: 'permissions', description: '修改文件权限' },
+    chown: { category: 'permissions', description: '修改文件所有者' },
+    chgrp: { category: 'permissions', description: '修改文件所属组' },
+    icacls: { category: 'permissions', description: '修改文件 ACL(Windows)' },
+    cacls: { category: 'permissions', description: '修改文件 ACL(Windows 旧)' },
+    takeown: { category: 'permissions', description: '夺取文件所有权(Windows)' },
+    'set-acl': { category: 'permissions', description: '设置文件 ACL(PowerShell)' },
+    setfacl: { category: 'permissions', description: '设置文件 ACL(Linux)' },
+    // ---- 控制进程/服务 ----
+    kill: { category: 'process', description: '结束进程' },
+    killall: { category: 'process', description: '按名称结束进程' },
+    pkill: { category: 'process', description: '按模式结束进程' },
+    'stop-process': { category: 'process', description: '结束进程(PowerShell)' },
+    spps: { category: 'process', description: '结束进程(PowerShell, Stop-Process 的别名)' },
+    taskkill: { category: 'process', description: '结束进程(Windows)' },
+    sc: { category: 'process', description: '服务控制(Windows)' },
+    systemctl: { category: 'process', description: '系统服务管理(Linux)' },
+    launchctl: { category: 'process', description: '服务管理(macOS)' },
+    'start-service': { category: 'process', description: '启动服务(PowerShell)' },
+    sasv: { category: 'process', description: '启动服务(PowerShell, Start-Service 的别名)' },
+    'stop-service': { category: 'process', description: '停止服务(PowerShell)' },
+    spsv: { category: 'process', description: '停止服务(PowerShell, Stop-Service 的别名)' },
+    'restart-service': { category: 'process', description: '重启服务(PowerShell)' },
+    rspsv: { category: 'process', description: '重启服务(PowerShell, Restart-Service 的别名)' },
+    service: { category: 'process', description: '服务管理(Linux 旧)' },
+    // ---- 修改用户信息 ----
+    useradd: { category: 'user', description: '添加用户' },
+    usermod: { category: 'user', description: '修改用户' },
+    userdel: { category: 'user', description: '删除用户' },
+    groupadd: { category: 'user', description: '添加组' },
+    groupmod: { category: 'user', description: '修改组' },
+    groupdel: { category: 'user', description: '删除组' },
+    passwd: { category: 'user', description: '修改密码' },
+    chsh: { category: 'user', description: '修改默认 shell' },
+    chfn: { category: 'user', description: '修改用户信息' },
+    gpasswd: { category: 'user', description: '管理组密码/成员' },
+    'new-localuser': { category: 'user', description: '新建本地用户(PowerShell)' },
+    'set-localuser': { category: 'user', description: '修改本地用户(PowerShell)' },
+    'remove-localuser': { category: 'user', description: '删除本地用户(PowerShell)' },
+    'add-localgroupmember': { category: 'user', description: '添加本地组成员(PowerShell)' },
+    'remove-localgroupmember': { category: 'user', description: '移除本地组成员(PowerShell)' },
+    // ---- 网络/远程控制 ----
+    ssh: { category: 'network', description: '远程登录' },
+    scp: { category: 'network', description: '安全复制(远程)' },
+    sftp: { category: 'network', description: '安全 FTP' },
+    rsync: { category: 'network', description: '远程同步' },
+    curl: { category: 'network', description: '网络请求' },
+    wget: { category: 'network', description: '网络下载' },
+    nc: { category: 'network', description: '网络工具(netcat)' },
+    ncat: { category: 'network', description: '网络工具(ncat)' },
+    netcat: { category: 'network', description: '网络工具(netcat)' },
+    telnet: { category: 'network', description: '远程登录(telnet)' },
+    ftp: { category: 'network', description: 'FTP 客户端' },
+    'ssh-keygen': { category: 'network', description: '生成 SSH 密钥' },
+    'ssh-add': { category: 'network', description: '添加 SSH 密钥到 agent' },
+    'ssh-agent': { category: 'network', description: 'SSH 密钥代理' },
+    'invoke-webrequest': { category: 'network', description: '网络请求(PowerShell)' },
+    iwr: { category: 'network', description: '网络请求(PowerShell, Invoke-WebRequest 的别名)' },
+    curl_alias: {
+        category: 'network',
+        description: '网络请求(PowerShell, Invoke-WebRequest 的别名)',
+    },
+    'invoke-restmethod': { category: 'network', description: 'REST 请求(PowerShell)' },
+    irm: { category: 'network', description: 'REST 请求(PowerShell, Invoke-RestMethod 的别名)' },
+    'invoke-expression': {
+        category: 'network',
+        description: '执行表达式(PowerShell,常被远程命令利用)',
+    },
+    iex: { category: 'network', description: '执行表达式(PowerShell, Invoke-Expression 的别名)' },
+    downloadstring: { category: 'network', description: '下载字符串(WebClient,常被远程命令利用)' },
+    downloadfile: { category: 'network', description: '下载文件(WebClient,常被远程命令利用)' },
+};
+// Read-style commands whose arguments should be scanned for sensitive
+// paths. Entries include both the canonical names and the common
+// PowerShell aliases (lowercased).
+const SENSITIVE_PATH_COMMANDS = new Set([
+    // POSIX
+    'cat',
+    'less',
+    'more',
+    'head',
+    'tail',
+    'strings',
+    'file',
+    'stat',
+    'ls',
+    'dir',
+    'find',
+    'tree',
+    'pwd',
+    'grep',
+    'egrep',
+    'fgrep',
+    'awk',
+    'cut',
+    'tac',
+    'rev',
+    'sort',
+    'uniq',
+    'wc',
+    'xxd',
+    'od',
+    'hexdump',
+    'base64',
+    'md5sum',
+    'sha256sum',
+    // Windows CMD
+    'type',
+    // PowerShell
+    'get-content',
+    'gc',
+    'cat',
+    'select-string',
+    'sls',
+    'get-childitem',
+    'gci',
+    'ls',
+    'dir',
+    'get-item',
+    'gi',
+    'get-acl',
+    'read-host',
+]);
+/**
+ * Check whether a shell command string performs one of the dangerous
+ * operations enumerated in `DANGEROUS_COMMANDS`, or whether a
+ * read-style command targets a sensitive filesystem location.
+ *
+ * First-token comparison is case-insensitive so that `DEL`, `Del`, and
+ * `del` are all recognized on Windows. Only the first match per chain
+ * segment is reported.
+ */
+export function detectDangerousOperation(command) {
+    const segments = command.split(/&&|\|\||;|\||&/);
+    for (const raw of segments) {
+        const segment = raw.trim();
+        if (!segment)
+            continue;
+        const firstTokenMatch = segment.match(/^([^\s"']+)/);
+        if (!firstTokenMatch)
+            continue;
+        const firstToken = firstTokenMatch[1].toLowerCase();
+        // 1. Direct command-name blacklist hit.
+        const info = DANGEROUS_COMMANDS[firstToken];
+        if (info) {
+            return {
+                found: true,
+                category: info.category,
+                description: info.description,
+                segment,
+            };
+        }
+        // 2. Read-style command whose arguments touch a sensitive path.
+        if (SENSITIVE_PATH_COMMANDS.has(firstToken)) {
+            const tail = segment.slice(firstToken.length);
+            for (const token of extractPathTokens(tail)) {
+                if (isDangerousPath(token)) {
+                    return {
+                        found: true,
+                        category: 'sensitive',
+                        description: '访问敏感路径',
+                        segment,
+                        path: token,
+                    };
+                }
+            }
+        }
+    }
+    return { found: false };
+}
+// Tokenize the argument tail of a command into candidate paths. Quoted
+// strings stay together, flags (`-x`, `--foo`) are dropped, and the
+// shell redirect operator `>` is included so that
+// `cat foo > /etc/passwd` still surfaces the sensitive target.
+function extractPathTokens(args) {
+    const matches = args.match(/(?:"[^"]*"|'[^']*'|\S+)/g) ?? [];
+    const out = [];
+    for (const raw of matches) {
+        const stripped = raw.replace(/^["']|["']$/g, '');
+        if (stripped.length === 0)
+            continue;
+        if (stripped.startsWith('-'))
+            continue;
+        out.push(stripped);
+    }
+    return out;
+}