P0: Shell parsing — structured argv or real shell parser

[galic1987]

Source

ChatGPT security review feedback

Problem

split_shell_commands() doesn't handle subshell, process substitution, or heredocs, meaning policy checks can be bypassed with crafted shell input.

Fix — two viable directions:

Option A (security-first):

• Make the tool accept { program, args[], cwd, env } (structured argv)
• Only allow shell strings in YOLO / user-confirmed modes
• Eliminates parsing ambiguity entirely

Option B (power-user):

• Integrate a real shell parser (parse to AST)
• Apply safety rules on AST nodes
• Reject unknown/unsupported AST nodes by default

Note: Whitespace normalization for the denylist was already added (collapsing runs of whitespace before pattern matching). This issue tracks the deeper structural fix.

Relevant Code

• src/tools/shell.rs
• src/safety/checker.rs

Priority

P0 — defense-in-depth

Labels

security, P0