Claudio Ortolina
a88c704fe5
Replace regex-based command blocking with structural AST parsing using unbash (zero-dependency TypeScript bash parser). The walker collects command names only from executable positions (simple commands, pipelines, subshells, command substitutions, control-flow bodies), excluding arguments, comments, and quoted strings. - Convert to directory-style extension with pinned unbash@3.0.0 - Add AST walker (ast.ts) covering 15 shell construct types - Update blocked_commands to plain names instead of regexes - Keep regex fallback for parse failures (degradation path) - Path-based blocking unchanged for non-bash tools - 41 tests cover blocked/allowed cases including false positives
21 lines
521 B
JSON
21 lines
521 B
JSON
{
|
|
"_comment": "Blocked paths for pi. Glob-like patterns, matched case-insensitively against absolute paths. blocked_commands are exact command names (not regexes), matched case-insensitively against structurally parsed bash AST command names.",
|
|
"blocked_paths": [
|
|
"mise.local.toml",
|
|
"*.pem",
|
|
"*.key",
|
|
"*.key.pub",
|
|
"*secret*",
|
|
"*credential*",
|
|
"*credentials*",
|
|
".ssh/",
|
|
".aws/",
|
|
".gnupg/",
|
|
"~/.pi/agent/sessions/"
|
|
],
|
|
"blocked_commands": [
|
|
"printenv",
|
|
"env"
|
|
]
|
|
}
|