ML-175: parse bash commands structurally via unbash

Replace regex-based command blocking with structural AST parsing
using unbash (zero-dependency TypeScript bash parser). The walker
collects command names only from executable positions (simple
commands, pipelines, subshells, command substitutions, control-flow
bodies), excluding arguments, comments, and quoted strings.

- Convert to directory-style extension with pinned unbash@3.0.0
- Add AST walker (ast.ts) covering 15 shell construct types
- Update blocked_commands to plain names instead of regexes
- Keep regex fallback for parse failures (degradation path)
- Path-based blocking unchanged for non-bash tools
- 41 tests cover blocked/allowed cases including false positives

This commit is contained in:

Claudio Ortolina

2026-05-11 17:42:48 +01:00

parent 79d821e70f

commit a88c704fe5

8 changed files with 1062 additions and 19 deletions

.gitignore

View File

@@ -56,3 +56,4 @@ npm-debug.log
 # Superpowers brainstorming mockups
 /.superpowers/
 /.pi/extensions/s3-browser/node_modules
 /.pi/extensions/sensitive-file-guard/node_modules