pi-command-guardian 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-26
+
+### Changed
+
+- Extension 入口改为 jiti 直接加载 TypeScript 源文件，`pi.extensions` 指向 `./src/index.ts`，不再预编译到 `dist`。
+- 分发包发布 `src` 源文件，安装后扩展显示名简化为 `pi-command-guardian`。
+- 测试改用 jiti 从 `src` 加载被测模块，移除 `build` 与 `clean` 脚本。
+
 ## [0.2.0] - 2026-07-26
 
 ### Changed
@@ -42,6 +50,7 @@
 - 增加 Pi package 与 Extension 入口。
 - 增加 Tree-sitter Bash 结构解析和初始通用 Guardian 实现。
 
-[Unreleased]: https://github.com/sunnyx11/pi-command-guardian/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/sunnyx11/pi-command-guardian/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/sunnyx11/pi-command-guardian/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/sunnyx11/pi-command-guardian/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/sunnyx11/pi-command-guardian/releases/tag/v0.1.0

package/README.md

@@ -85,7 +85,6 @@ src/
 
 ```bash
 npm install
-npm run build
 pi install .
 ```
 
@@ -98,7 +97,7 @@ pi -e .
 npm 发布后安装：
 
 ```bash
-pi install npm:pi-command-guardian@0.1.0
+pi install npm:pi-command-guardian@0.3.0
 ```
 
 ## 验证
@@ -120,4 +119,4 @@ pi remove npm:pi-command-guardian
 
 ## 许可证
 
-当前 package 标记为 `UNLICENSED`。
+本 package 以 MIT 许可证发布，详见 `LICENSE`。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-command-guardian",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Deterministic explicit deletion guard for Pi",
   "type": "module",
   "license": "MIT",
@@ -19,7 +19,7 @@
   },
   "homepage": "https://github.com/sunnyx11/pi-command-guardian#readme",
   "files": [
-    "dist",
+    "src",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
@@ -29,14 +29,12 @@
   },
   "pi": {
     "extensions": [
-      "./dist/index.js"
+      "./src/index.ts"
     ]
   },
   "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test",
+    "test": "node --test",
     "pack:check": "npm pack --dry-run",
     "spec:check": "node .agents/skills/spec-coding/scripts/check-spec-docs.mjs --root . --specs-dir docs --domain command-guarding --all-changes && node .agents/skills/spec-coding/scripts/check-change-summary.mjs --root . --specs-dir docs && node .agents/skills/spec-coding/scripts/check-changes-index.mjs --root . --specs-dir docs && node .agents/skills/spec-coding/scripts/check-requirements-format.mjs --root . --specs-dir docs --domain command-guarding --all-changes && node .agents/skills/spec-coding/scripts/build-specs-index.mjs --root . --specs-dir docs --dry-run",
     "prepublishOnly": "npm test && npm run typecheck && npm run spec:check && npm run pack:check"
@@ -50,6 +48,7 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.81.1",
     "@types/node": "22.19.0",
+    "jiti": "2.7.0",
     "typescript": "5.9.3"
   },
   "publishConfig": {

package/src/command-parser.ts

@@ -0,0 +1,178 @@
+import { createRequire } from "node:module";
+import type * as TreeSitterTypes from "@vscode/tree-sitter-wasm";
+
+const require = createRequire(import.meta.url);
+const TreeSitter = require("@vscode/tree-sitter-wasm") as typeof TreeSitterTypes;
+const runtimePath = require.resolve("@vscode/tree-sitter-wasm/wasm/tree-sitter.wasm");
+const bashGrammarPath = require.resolve("@vscode/tree-sitter-wasm/wasm/tree-sitter-bash.wasm");
+
+/** 与 Tree-sitter 生命周期解耦的 Bash 语法节点。 */
+export interface ShellSyntaxNode {
+  type: string;
+  named: boolean;
+  startByte: number;
+  endByte: number;
+  field?: string;
+  value?: string;
+  children: ShellSyntaxNode[];
+}
+
+/** Bash 语法错误或缺失节点的位置。 */
+export interface ShellSyntaxIssue {
+  type: string;
+  missing: boolean;
+  startByte: number;
+  endByte: number;
+}
+
+/** 成功解析的 Bash 命令。 */
+export interface ParsedShellCommand {
+  status: "parsed";
+  shell: "bash";
+  source: string;
+  root: ShellSyntaxNode;
+}
+
+/** 无法可靠解析的 Bash 命令。 */
+export interface UnparsedShellCommand {
+  status: "unparsed";
+  shell: "bash";
+  source: string;
+  reason: "empty_command" | "syntax_error" | "parser_unavailable" | "parse_failure";
+  issues: ShellSyntaxIssue[];
+}
+
+/** Bash 解析结果。 */
+export type ShellParseResult = ParsedShellCommand | UnparsedShellCommand;
+
+type ShellParser = Pick<TreeSitterTypes.Parser, "reset" | "parse">;
+
+/** Bash Parser 加载边界，只暴露当前解析流程需要的方法。 */
+export type ShellParserLoader = () => Promise<ShellParser>;
+
+async function loadBashParser(): Promise<TreeSitterTypes.Parser> {
+  await TreeSitter.Parser.init({ locateFile: () => runtimePath });
+  const language = await TreeSitter.Language.load(bashGrammarPath);
+  return new TreeSitter.Parser().setLanguage(language);
+}
+
+function unparsed(
+  source: string,
+  reason: UnparsedShellCommand["reason"],
+  issues: ShellSyntaxIssue[] = [],
+): UnparsedShellCommand {
+  return { status: "unparsed", shell: "bash", source, reason, issues };
+}
+
+function copySyntaxNode(node: TreeSitterTypes.Node, field?: string): ShellSyntaxNode {
+  const children: ShellSyntaxNode[] = [];
+  for (let index = 0; index < node.childCount; index += 1) {
+    const child = node.child(index);
+    if (child === null) {
+      continue;
+    }
+    const childField = node.fieldNameForChild(index) ?? undefined;
+    children.push(copySyntaxNode(child, childField));
+  }
+
+  const copied: ShellSyntaxNode = {
+    type: node.type,
+    named: node.isNamed,
+    startByte: node.startIndex,
+    endByte: node.endIndex,
+    children,
+  };
+  if (field !== undefined) {
+    copied.field = field;
+  }
+  if (children.length === 0) {
+    copied.value = node.text;
+  }
+  return copied;
+}
+
+function collectSyntaxIssues(node: TreeSitterTypes.Node, issues: ShellSyntaxIssue[]): void {
+  if (node.isError || node.isMissing) {
+    issues.push({
+      type: node.isError ? "ERROR" : node.type,
+      missing: node.isMissing,
+      startByte: node.startIndex,
+      endByte: node.endIndex,
+    });
+  }
+  for (const child of node.children) {
+    if (child !== null) {
+      collectSyntaxIssues(child, issues);
+    }
+  }
+}
+
+async function parseWith(
+  source: string,
+  getParser: () => Promise<ShellParser>,
+): Promise<ShellParseResult> {
+  let parser: ShellParser;
+  try {
+    parser = await getParser();
+  } catch {
+    return unparsed(source, "parser_unavailable");
+  }
+
+  let tree: TreeSitterTypes.Tree | null;
+  try {
+    parser.reset();
+    tree = parser.parse(source);
+  } catch {
+    return unparsed(source, "parse_failure");
+  }
+
+  if (tree === null) {
+    return unparsed(source, "parse_failure");
+  }
+
+  try {
+    const root = tree.rootNode;
+    if (root.hasError) {
+      const issues: ShellSyntaxIssue[] = [];
+      collectSyntaxIssues(root, issues);
+      return unparsed(source, "syntax_error", issues);
+    }
+
+    return {
+      status: "parsed",
+      shell: "bash",
+      source,
+      root: copySyntaxNode(root),
+    };
+  } finally {
+    tree.delete();
+  }
+}
+
+/** 创建具有独立初始化缓存和串行队列的 Shell 命令解析函数。 */
+export function createShellCommandParser(
+  loadParser: ShellParserLoader,
+): (source: string) => Promise<ShellParseResult> {
+  let parserPromise: ReturnType<ShellParserLoader> | undefined;
+  let parseQueue: Promise<void> = Promise.resolve();
+  const getParser = (): ReturnType<ShellParserLoader> => {
+    parserPromise ??= loadParser();
+    return parserPromise;
+  };
+
+  return (source: string): Promise<ShellParseResult> => {
+    if (typeof source !== "string" || source.trim().length === 0) {
+      return Promise.resolve(unparsed(source, "empty_command"));
+    }
+
+    const result = parseQueue.then(() => parseWith(source, getParser));
+    parseQueue = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  };
+}
+
+/** 使用进程内共享的 Tree-sitter Bash Parser 解析命令。 */
+export const parseShellCommand = createShellCommandParser(loadBashParser);

package/src/deletion-guard.ts

@@ -0,0 +1,433 @@
+import { homedir } from "node:os";
+import { basename, isAbsolute, parse, relative, resolve, sep } from "node:path";
+import { parseShellCommand } from "./command-parser.js";
+import type { ShellParseResult, ShellSyntaxNode } from "./command-parser.js";
+
+interface StaticText {
+  value: string;
+  dynamic: boolean;
+}
+
+interface StaticCommand {
+  executable: string;
+  args: StaticText[];
+}
+
+/** 显式删除命令的本地判断。 */
+export type DeletionDecision =
+  | { decision: "allow" }
+  | { decision: "block"; reason: string; guidance: "static-target" | "manual-review" }
+  | { decision: "forbidden"; reason: string };
+
+const ALLOW: DeletionDecision = { decision: "allow" };
+const BLOCK_EXTERNAL: DeletionDecision = {
+  decision: "block",
+  reason: "删除目标位于工作区和系统临时目录之外或是受控目录根",
+  guidance: "manual-review",
+};
+const BLOCK_DYNAMIC: DeletionDecision = {
+  decision: "block",
+  reason: "删除目标包含动态内容，无法静态确定",
+  guidance: "static-target",
+};
+const BLOCK_INDETERMINATE: DeletionDecision = {
+  decision: "block",
+  reason: "删除目标为空、缺失或无法静态确定",
+  guidance: "static-target",
+};
+const BLOCK_NESTED_DEPTH: DeletionDecision = {
+  decision: "block",
+  reason: "嵌套 Shell 层级超过静态分析上限",
+  guidance: "static-target",
+};
+const FORBIDDEN_SYSTEM: DeletionDecision = {
+  decision: "forbidden",
+  reason: "操作会删除系统关键目录、用户目录或数据库数据目录",
+};
+const FORBIDDEN_DISK: DeletionDecision = {
+  decision: "forbidden",
+  reason: "操作会格式化、擦除或覆盖磁盘设备",
+};
+const BLOCK_DATABASE: DeletionDecision = {
+  decision: "block",
+  reason: "操作包含显式数据库删除",
+  guidance: "manual-review",
+};
+const BLOCK_XARGS: DeletionDecision = {
+  decision: "block",
+  reason: "删除目标来自 xargs 输入，无法静态确定",
+  guidance: "static-target",
+};
+const BLOCK_POWERSHELL: DeletionDecision = {
+  decision: "block",
+  reason: "PowerShell 删除目标无法由 Bash 解析器静态确定",
+  guidance: "static-target",
+};
+
+const ENV_OPTIONS_WITH_VALUES = new Set([
+  "-a", "--argv0", "-C", "--chdir", "-S", "--split-string", "-u", "--unset",
+]);
+const SUDO_OPTIONS_WITH_VALUES = new Set([
+  "-a", "--auth-type", "-C", "--close-from", "-D", "--chdir", "-g", "--group",
+  "-h", "--host", "-p", "--prompt", "-R", "--chroot", "-r", "--role", "-t", "--type",
+  "-T", "--command-timeout", "-u", "--user",
+]);
+
+function normalizeExecutable(value: string): string {
+  return basename(value.replaceAll("\\", "/")).replace(/\.exe$/i, "").toLowerCase();
+}
+
+function containsBraceExpansion(value: string): boolean {
+  return /\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(value);
+}
+
+function staticText(node: ShellSyntaxNode): StaticText {
+  if (["simple_expansion", "expansion", "command_substitution", "process_substitution"].includes(node.type)) {
+    return { value: "", dynamic: true };
+  }
+  if (node.children.length === 0) {
+    const value = node.value ?? "";
+    if (node.type === "raw_string" && value.length >= 2) {
+      return { value: value.slice(1, -1), dynamic: false };
+    }
+    if ((node.type === "\"" || node.type === "'") && (value === "\"" || value === "'")) {
+      return { value: "", dynamic: false };
+    }
+    return { value, dynamic: node.type === "word" && value.startsWith("~") };
+  }
+
+  let value = "";
+  let dynamic = false;
+  for (const child of node.children) {
+    const part = staticText(child);
+    value += part.value;
+    dynamic ||= part.dynamic;
+  }
+  if (node.type === "concatenation" && containsBraceExpansion(value)) {
+    dynamic = true;
+  }
+  return { value, dynamic };
+}
+
+function commandFromArguments(args: StaticText[]): StaticCommand | undefined {
+  const [executable, ...commandArgs] = args;
+  if (executable === undefined || executable.dynamic || executable.value.length === 0) {
+    return undefined;
+  }
+  return {
+    executable: normalizeExecutable(executable.value),
+    args: commandArgs,
+  };
+}
+
+function unwrapCommandBuiltin(command: StaticCommand): StaticCommand | undefined {
+  let index = 0;
+  while (index < command.args.length) {
+    const argument = command.args[index];
+    if (argument === undefined) break;
+    if (argument.dynamic) return undefined;
+    if (argument.value === "--") {
+      index += 1;
+      break;
+    }
+    if (/^-[^-]*[vV]/.test(argument.value)) return undefined;
+    if (argument.value === "-p") {
+      index += 1;
+      continue;
+    }
+    if (argument.value.startsWith("-")) return undefined;
+    break;
+  }
+  return commandFromArguments(command.args.slice(index));
+}
+
+function unwrapEnv(command: StaticCommand): StaticCommand | undefined {
+  let index = 0;
+  while (index < command.args.length) {
+    const argument = command.args[index];
+    if (argument === undefined) break;
+    if (argument.dynamic) return undefined;
+    const value = argument.value;
+    if (value === "--") {
+      index += 1;
+      break;
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(value)) {
+      index += 1;
+      continue;
+    }
+    if (ENV_OPTIONS_WITH_VALUES.has(value)) {
+      index += 2;
+      continue;
+    }
+    if (/^(?:--(?:argv0|chdir|split-string|unset)=|-[aCSu].+)/.test(value) || ["-0", "--debug", "-i", "--ignore-environment", "--null"].includes(value)) {
+      index += 1;
+      continue;
+    }
+    if (value.startsWith("-")) return undefined;
+    break;
+  }
+  return commandFromArguments(command.args.slice(index));
+}
+
+function unwrapSudo(command: StaticCommand): StaticCommand | undefined {
+  let index = 0;
+  while (index < command.args.length) {
+    const argument = command.args[index];
+    if (argument === undefined) break;
+    if (argument.dynamic) return undefined;
+    const value = argument.value;
+    if (value === "--") {
+      index += 1;
+      break;
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(value)) {
+      index += 1;
+      continue;
+    }
+    if (SUDO_OPTIONS_WITH_VALUES.has(value)) {
+      index += 2;
+      continue;
+    }
+    if (/^--[^=]+=/.test(value) || /^-[aCDghpRrtTu].+/.test(value)) {
+      index += 1;
+      continue;
+    }
+    if (value.startsWith("-")) {
+      index += 1;
+      continue;
+    }
+    break;
+  }
+  return commandFromArguments(command.args.slice(index));
+}
+
+function unwrapTransparentCommand(command: StaticCommand): StaticCommand {
+  let current = command;
+  while (true) {
+    let unwrapped: StaticCommand | undefined;
+    switch (current.executable) {
+      case "command":
+        unwrapped = unwrapCommandBuiltin(current);
+        break;
+      case "env":
+        unwrapped = unwrapEnv(current);
+        break;
+      case "sudo":
+        unwrapped = unwrapSudo(current);
+        break;
+      default:
+        return current;
+    }
+    if (unwrapped === undefined) return current;
+    current = unwrapped;
+  }
+}
+
+function extractCommands(root: ShellSyntaxNode): StaticCommand[] {
+  const commands: StaticCommand[] = [];
+  const visit = (node: ShellSyntaxNode): void => {
+    if (node.type === "command") {
+      const nameNode = node.children.find((child) => child.field === "name");
+      if (nameNode !== undefined) {
+        const name = staticText(nameNode);
+        if (name.value.length > 0) {
+          commands.push({
+            executable: normalizeExecutable(name.value),
+            args: node.children
+              .filter((child) => child.field === "argument")
+              .map(staticText),
+          });
+        }
+      }
+    }
+    node.children.forEach(visit);
+  };
+  visit(root);
+  return commands;
+}
+
+function strictDescendant(root: string, target: string): boolean {
+  const child = relative(resolve(root), resolve(target));
+  return child.length > 0 && child !== ".." && !child.startsWith(`..${sep}`) && !isAbsolute(child);
+}
+
+function sameOrDescendant(root: string, target: string): boolean {
+  return resolve(root) === resolve(target) || strictDescendant(root, target);
+}
+
+function systemRoots(): string[] {
+  const roots = [homedir()];
+  if (process.platform === "win32") {
+    for (const value of [process.env.SystemRoot, process.env.ProgramFiles, process.env.ProgramData]) {
+      if (value !== undefined && value.length > 0) roots.push(value);
+    }
+  } else {
+    roots.push("/etc", "/usr", "/var", "/boot", "/bin", "/sbin", "/lib", "/lib64");
+  }
+  return roots;
+}
+
+function isDatabaseDataTarget(rawTarget: string, target: string): boolean {
+  const normalized = rawTarget.replaceAll("\\", "/").toLowerCase();
+  if (/^\/(?:var\/lib\/(?:postgresql|mysql|mongodb)|var\/opt\/mssql)(?:\/|$)/.test(normalized)) {
+    return true;
+  }
+  return process.platform === "win32" && /\/(?:postgresql|mysql|mongodb|mssql)(?:\/|$)/i.test(target.replaceAll("\\", "/"));
+}
+
+function classifyTarget(rawTarget: StaticText, cwd: string, tempDirectory: string): DeletionDecision {
+  if (rawTarget.dynamic) return BLOCK_DYNAMIC;
+  if (rawTarget.value.length === 0) return BLOCK_INDETERMINATE;
+  const target = resolve(cwd, rawTarget.value);
+  if (target === parse(target).root) return FORBIDDEN_SYSTEM;
+  if (isDatabaseDataTarget(rawTarget.value, target)) return FORBIDDEN_SYSTEM;
+  if (strictDescendant(cwd, target) || strictDescendant(tempDirectory, target)) return ALLOW;
+  if (systemRoots().some((root) => sameOrDescendant(root, target))) return FORBIDDEN_SYSTEM;
+  return BLOCK_EXTERNAL;
+}
+
+function deletionOperands(args: StaticText[]): StaticText[] {
+  const operands: StaticText[] = [];
+  let optionsEnded = false;
+  for (const argument of args) {
+    if (!optionsEnded && argument.value === "--") {
+      optionsEnded = true;
+    } else if (optionsEnded || !argument.value.startsWith("-")) {
+      operands.push(argument);
+    }
+  }
+  return operands;
+}
+
+function combine(decisions: readonly DeletionDecision[]): DeletionDecision {
+  return decisions.find((item) => item.decision === "forbidden")
+    ?? decisions.find((item) => item.decision === "block" && item.guidance === "manual-review")
+    ?? decisions.find((item) => item.decision === "block")
+    ?? ALLOW;
+}
+
+function assessFileDeletion(command: StaticCommand, cwd: string, tempDirectory: string): DeletionDecision | undefined {
+  if (!["rm", "rmdir", "unlink", "del", "erase", "rd"].includes(command.executable)) return undefined;
+  const targets = deletionOperands(command.args);
+  if (targets.length === 0) return BLOCK_INDETERMINATE;
+  return combine(targets.map((target) => classifyTarget(target, cwd, tempDirectory)));
+}
+
+function findDeletionRoots(command: StaticCommand): StaticText[] | undefined {
+  const deletesMatches = command.args.some((argument) => argument.value === "-delete");
+  const callbackIndex = command.args.findIndex((argument) =>
+    ["-exec", "-execdir", "-ok", "-okdir"].includes(argument.value));
+  const callback = callbackIndex < 0
+    ? undefined
+    : commandFromArguments(command.args.slice(callbackIndex + 1));
+  const callbackExecutable = callback === undefined
+    ? undefined
+    : unwrapTransparentCommand(callback).executable;
+  const deletesThroughCallback = callbackExecutable !== undefined &&
+    ["rm", "rmdir", "unlink"].includes(callbackExecutable);
+  if (!deletesMatches && !deletesThroughCallback) return undefined;
+
+  const expressionIndex = command.args.findIndex((argument) =>
+    argument.value.startsWith("-") || ["!", "("].includes(argument.value));
+  const roots = command.args.slice(0, expressionIndex < 0 ? command.args.length : expressionIndex);
+  return roots.length === 0 ? [{ value: ".", dynamic: false }] : roots;
+}
+
+function assessFindDeletion(command: StaticCommand, cwd: string, tempDirectory: string): DeletionDecision | undefined {
+  if (command.executable !== "find") return undefined;
+  const roots = findDeletionRoots(command);
+  return roots === undefined
+    ? undefined
+    : combine(roots.map((target) => classifyTarget(target, cwd, tempDirectory)));
+}
+
+function rawDevice(value: string): boolean {
+  return /^\/dev\/(?:sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d+n\d+|mmcblk\d+|disk\d+|rdisk\d+)(?:p?\d+)?$/i.test(value) ||
+    /^\\\\\.\\PhysicalDrive\d+$/i.test(value);
+}
+
+function assessRawDeviceRedirects(root: ShellSyntaxNode): DeletionDecision | undefined {
+  let destructive = false;
+  const visit = (node: ShellSyntaxNode): void => {
+    if (node.type === "file_redirect") {
+      const operator = node.children.find((child) => child.field === undefined)?.value ?? "";
+      const targets = node.children
+        .filter((child) => child.field === "destination")
+        .map(staticText);
+      if (/^(?:>|>>|>\||&>|&>>)$/.test(operator) && targets.some((target) => !target.dynamic && rawDevice(target.value))) {
+        destructive = true;
+      }
+    }
+    node.children.forEach(visit);
+  };
+  visit(root);
+  return destructive ? FORBIDDEN_DISK : undefined;
+}
+
+function assessFixedDestructiveCommand(command: StaticCommand): DeletionDecision | undefined {
+  const joined = command.args.map((argument) => argument.value).join(" ");
+  if (/^mkfs(?:\.|$)/.test(command.executable)) return FORBIDDEN_DISK;
+  if (command.executable === "wipefs" && /(?:^|\s)(?:-a|--all)(?:\s|$)/.test(joined)) return FORBIDDEN_DISK;
+  if (command.executable === "dd" && command.args.some((argument) => {
+    const output = argument.value.match(/^of=(.+)$/i)?.[1];
+    return output !== undefined && rawDevice(output);
+  })) {
+    return FORBIDDEN_DISK;
+  }
+  if (command.executable === "parted" && /(?:^|\s)(?:mklabel|mkpart|rm|resizepart)(?:\s|$)/i.test(joined)) return FORBIDDEN_DISK;
+  if (["fdisk", "sfdisk", "cfdisk"].includes(command.executable) && /(?:^|\s)(?:--delete|-d)(?:\s|$)/i.test(joined)) return FORBIDDEN_DISK;
+  if (command.executable === "diskpart" && /(?:^|\s)clean(?:\s|$)/i.test(joined)) return FORBIDDEN_DISK;
+  if (command.executable === "format" && command.args.some((argument) => /^[A-Za-z]:$/.test(argument.value))) return FORBIDDEN_DISK;
+  if (["psql", "mysql", "mariadb", "sqlcmd"].includes(command.executable) && /\b(?:DROP\s+(?:DATABASE|TABLE)|TRUNCATE(?:\s+TABLE)?)\b/i.test(joined)) {
+    return BLOCK_DATABASE;
+  }
+  if (command.executable === "xargs" && command.args.some((argument) => ["rm", "rmdir", "unlink"].includes(normalizeExecutable(argument.value)))) {
+    return BLOCK_XARGS;
+  }
+  if (["powershell", "pwsh"].includes(command.executable) && /\bRemove-Item\b/i.test(joined)) return BLOCK_POWERSHELL;
+  return undefined;
+}
+
+async function assessNestedShell(command: StaticCommand, cwd: string, tempDirectory: string, depth: number): Promise<DeletionDecision | undefined> {
+  if (!["bash", "sh", "dash", "zsh"].includes(command.executable)) return undefined;
+  const codeIndex = command.args.findIndex((argument) => argument.value === "-c");
+  const code = codeIndex < 0 ? undefined : command.args[codeIndex + 1];
+  if (code === undefined) return undefined;
+  if (code.dynamic) return BLOCK_DYNAMIC;
+  if (code.value.length === 0) return BLOCK_INDETERMINATE;
+  if (depth >= 8) return BLOCK_NESTED_DEPTH;
+  const nested = await parseShellCommand(code.value);
+  if (nested.status !== "parsed") return BLOCK_INDETERMINATE;
+  return assessParsed(nested, cwd, tempDirectory, depth + 1);
+}
+
+async function assessParsed(
+  parsed: Extract<ShellParseResult, { status: "parsed" }>,
+  cwd: string,
+  tempDirectory: string,
+  depth: number,
+): Promise<DeletionDecision> {
+  const decisions: DeletionDecision[] = [];
+  const redirectDecision = assessRawDeviceRedirects(parsed.root);
+  if (redirectDecision !== undefined) decisions.push(redirectDecision);
+  for (const extractedCommand of extractCommands(parsed.root)) {
+    const command = unwrapTransparentCommand(extractedCommand);
+    const nested = await assessNestedShell(command, cwd, tempDirectory, depth);
+    const decision = nested
+      ?? assessFileDeletion(command, cwd, tempDirectory)
+      ?? assessFindDeletion(command, cwd, tempDirectory)
+      ?? assessFixedDestructiveCommand(command);
+    if (decision !== undefined) decisions.push(decision);
+  }
+  return combine(decisions);
+}
+
+/** 判断已解析命令中的显式文件、数据库和磁盘破坏操作。 */
+export function assessDeletionCommand(
+  parsed: Extract<ShellParseResult, { status: "parsed" }>,
+  cwd: string,
+  tempDirectory: string,
+): Promise<DeletionDecision> {
+  return assessParsed(parsed, cwd, tempDirectory, 0);
+}