Function analyzeSingleCommand

tools/bash/permissions.go:139–187

(command string)

}

func analyzeSingleCommand(command string) PermissionResult {
	cleaned := strings.TrimSpace(command)
	if cleaned == "" {
		return PermissionResult{
			Allowed: true, Risk: RiskSafe, Reason: "Empty command",
			NeedsUserDecision: false, ParseResult: ParseSimple,
		}
	}
	if appsecurity.IsDangerous(cleaned) {
		return PermissionResult{
			Allowed: false, Risk: RiskHigh, Reason: "Command matches dangerous pattern",
			NeedsUserDecision: true, ParseResult: ParseSimple,
		}
	}
	semantic := CheckSemantics(cleaned)
	if semantic == "dangerous" {
		return PermissionResult{
			Allowed: false, Risk: RiskHigh,
			Reason:            "Command contains dangerous patterns (AST)",
			NeedsUserDecision: true, ParseResult: ParseSimple,
		}
	}
	if semantic == "too-complex" {
		return PermissionResult{
			Allowed: false, Risk: RiskHigh,
			Reason:            "Command is too complex for automated analysis",
			NeedsUserDecision: true, ParseResult: ParseTooComplex,
		}
	}
	secResult := RunAllSecurityChecks(cleaned)
	if IsBlocking(secResult) {
		return PermissionResult{
			Allowed: false, Risk: RiskCritical,
			Reason:            "Security check failed: " + joinFindingDescriptions(secResult.Findings, 3),
			NeedsUserDecision: true, ParseResult: ParseSimple,
		}
	}
	if len(secResult.Findings) > 0 {
		return PermissionResult{
			Allowed: false, Risk: RiskNormal,
			Reason:            "Security warnings: " + joinFindingDescriptions(secResult.Findings, 3),
			NeedsUserDecision: true, ParseResult: ParseSimple,
		}
	}
	return PermissionResult{
		Allowed: true, Risk: RiskSafe, Reason: "All checks passed",
		NeedsUserDecision: false, ParseResult: ParseSimple,
	}
}

func generateRuleSuggestions(subcommands []string) []string {
	var suggestions []string