Function isCommandAllowed

packages/cli/src/server/tools/exec-tools.ts:268–301

* Check if a command is allowed based on config patterns

(command: string)

 * Check if a command is allowed based on config patterns
 */
function isCommandAllowed(command: string): {allowed: boolean; reason?: string} {
	const config = getExecConfig();
	const allowPatterns = config.allow || [];
	const denyPatterns = config.deny || [];

	// Check default blocked patterns unless allowUnsafe is explicitly set
	if (!config.allowUnsafe) {
		for (const {pattern, reason} of DEFAULT_BLOCKED) {
			if (pattern.test(command)) {
				return {allowed: false, reason};
			}
		}
	}

	// Check user-configured deny patterns (takes precedence over allow)
	for (const pattern of denyPatterns) {
		if (matchesPattern(command, pattern)) {
			return {allowed: false, reason: `Command matches deny pattern: ${pattern}`};
		}
	}

	// If no allow patterns configured, allow by default (unless denied above)
	if (allowPatterns.length === 0) {
		return {allowed: true};
	}

	// Check if matches any allow pattern
	const isAllowed = allowPatterns.some((pattern) => matchesPattern(command, pattern));
	if (!isAllowed) {
		return {allowed: false, reason: 'Command not in allow list'};
	}

	return {allowed: true};
}

interface ExecuteResult {
	stdout: string;