Interface CommandView

Readonlyraw

isSideEffecting

• isSideEffecting(): boolean

  True iff the command is provably side-effecting (bash-effects classifier).

  Returns boolean

pipesToShell

• pipesToShell(): boolean

  True iff the command pipes into a BARE shell interpreter (curl … | sh, … | bash -s) — the remote-code-execution shape. High-signal: a shell leaf WITH a script-file argument (sh deploy.sh) is NOT flagged; only a shell reading from stdin is, which only happens downstream of a pipe.

  Returns boolean

runs

• runs(program: string, opts?: { force?: boolean }): boolean

  True iff a leaf command runs program (e.g. "git push"), optionally with --force/-f.

  Parameters

  • program: string
  • Optionalopts: { force?: boolean }

  Returns boolean

touches

• touches(prefixes: readonly string[]): boolean

  True iff a leaf command references a path under one of the prefixes (e.g. ~/.ssh, .env) — the secret-read / sensitive-path matcher. Sees the path however the command is wrapped (cd x && cat ~/.ssh/id_rsa).

  Parameters

  • prefixes: readonly string[]

  Returns boolean