wormclaude 1.0.145 → 1.0.146

package/dist/cmdsec.js

@@ -167,6 +167,23 @@ const DANGER = [
     { re: /\bmv\s+[^\n]*\s+\/dev\/null\b/, reason: 'Veriyi /dev/null\'a taşıma' },
     { re: />\s*\/dev\/null\s+2>&1\s*;\s*rm/, reason: 'Gizli silme' },
 ];
+// ── Windows tehlikeli komutlar (HARD DENY) — kullanıcı Windows'ta ──────────
+// Yalnız SİSTEM / sürücü-kökü hedefleri engellenir; proje altı (C:\Users\...\build)
+// silmeleri meşrudur → onay akışına düşer, hard-deny EDİLMEZ.
+const WIN_SYS = '(?:[a-zA-Z]:\\\\?(?:windows\\b|program\\s?files(?:\\s?\\(x86\\))?\\b|programdata\\b)' + // C:\Windows, C:\Program Files, C:\ProgramData
+    '|[a-zA-Z]:\\\\?(?:["\'\\s]|$)' + // C:\ (sürücü kökü)
+    '|system32\\b|%(?:systemroot|windir|systemdrive)%|\\$env:(?:windir|systemroot|systemdrive))';
+const WIN_DANGER = [
+    // del / erase / rd / rmdir  /s  → sistem ya da sürücü kökü
+    { re: new RegExp('\\b(?:del|erase|rd|rmdir)\\b(?=[\\s\\S]*\\s/s\\b)[\\s\\S]*?' + WIN_SYS, 'i'),
+        reason: 'Windows sistem/sürücü kökünde özyinelemeli silme (del/rd /s)' },
+    // Remove-Item (alias ri/rm/del) -Recurse [-Force]  → sistem ya da sürücü kökü
+    { re: new RegExp('\\b(?:remove-item|ri|rm|rmdir|rd|del)\\b(?=[\\s\\S]*-(?:recurse|r)\\b)[\\s\\S]*?' + WIN_SYS, 'i'),
+        reason: 'Windows kök/sistem yolunda Remove-Item -Recurse' },
+    { re: /\bformat\b\s+[a-zA-Z]:/i, reason: 'Disk biçimlendirme (format)' },
+    { re: /\bFormat-Volume\b/i, reason: 'Disk biçimlendirme (Format-Volume)' },
+    { re: /\b(?:Stop-Computer|Restart-Computer|shutdown(?:\.exe)?\b|Clear-Disk|Remove-Partition)\b/i, reason: 'Sistemi kapatma/disk temizleme' },
+];
 // ── Read-only komut tespiti (shellReadOnlyChecker.js'ten — sağlam) ──────────
 const READONLY_ROOTS = new Set([
     'awk', 'basename', 'cat', 'cd', 'column', 'cut', 'df', 'dirname', 'du', 'echo', 'env', 'find',
@@ -278,15 +295,17 @@ export function isShellCommandReadOnly(command) {
     return segs.length > 0 && segs.every(cmdIsReadOnly);
 }
 // ── Asıl güvenlik motoru ───────────────────────────────────────────────────
-export function checkCommand(rawCommand) {
+export function checkCommand(rawCommand, opts) {
     const command = stripShellWrapper(String(rawCommand || ''));
     const roots = getCommandRoots(command);
-    // 1) Command substitution -> HARD DENY
-    if (detectCommandSubstitution(command)) {
+    const shell = opts?.shell;
+    // 1) Command substitution -> HARD DENY (yalnız bash/sh için; PowerShell'de `$()` ve backtick
+    //    NORMAL sözdizimidir — alt-ifade / escape — bash komut-ikamesi değil → atla).
+    if (shell !== 'powershell' && detectCommandSubstitution(command)) {
         return { decision: 'deny', reason: 'Komut ikamesi ($(), <(), backtick) güvenlik nedeniyle engellendi', roots };
     }
-    // 2) Tehlikeli blocklist -> HARD DENY
-    for (const d of DANGER) {
+    // 2) Tehlikeli blocklist (POSIX + Windows) -> HARD DENY
+    for (const d of [...DANGER, ...WIN_DANGER]) {
         try {
             if (d.re instanceof RegExp && d.re.test(command))
                 return { decision: 'deny', reason: d.reason, roots };

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.145';
+export const VERSION = '1.0.146';

package/dist/tools.js

@@ -694,7 +694,7 @@ async function execOne(call, hooks) {
     }
     // 3.5) Komut güvenliği (Bash/PowerShell) — cmdsec: deny→blokla, allow→izinsiz, confirm→izin akışı
     if ((call.name === 'Bash' || call.name === 'PowerShell') && args && args.command) {
-        const chk = checkCommand(String(args.command));
+        const chk = checkCommand(String(args.command), { shell: call.name === 'PowerShell' ? 'powershell' : 'bash' });
         if (chk.decision === 'deny') {
             return { ok: false, output: `⛔ Güvenlik: komut engellendi — ${chk.reason || 'tehlikeli komut'}`, args };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.145",
+  "version": "1.0.146",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {