Function getCommandDecision

src/core/auto-approval/commands.ts:257–305

(
	command: string,
	allowedCommands: string[],
	deniedCommands?: string[],
)

 * @returns Decision indicating whether to approve, deny, or ask user
 */
export function getCommandDecision(
	command: string,
	allowedCommands: string[],
	deniedCommands?: string[],
): CommandDecision {
	if (!command?.trim()) {
		return "auto_approve"
	}

	// Parse into sub-commands (split by &&, ||, ;, |). parseCommand also
	// detects shell syntax errors (unterminated quotes, unclosed heredocs) and
	// returns a non-null parseError in that case.
	const { commands: subCommands, parseError } = parseCommand(command)

	// Reject commands with a shell syntax error. An unterminated quote means
	// the shell would report a parse error; in a compound command it may
	// partially execute the well-formed prefix before aborting. Returning a
	// distinct decision lets callers surface a useful message to the agent
	// rather than silently presenting the command for user approval.
	if (parseError !== null) {
		return "malformed_command"
	}

	// Check each sub-command and collect decisions
	const decisions: CommandDecision[] = subCommands.map((cmd) => {
		// Remove simple PowerShell-like redirections (e.g. 2>&1) before checking
		const cmdWithoutRedirection = cmd.replace(/\d*>&\d*/, "").trim()

		return getSingleCommandDecision(cmdWithoutRedirection, allowedCommands, deniedCommands)
	})

	// If any sub-command is denied, deny the whole command
	if (decisions.includes("auto_deny")) {
		return "auto_deny"
	}

	// Require explicit user approval for dangerous patterns
	if (containsDangerousSubstitution(command)) {
		return "ask_user"
	}

	// If all sub-commands are approved, approve the whole command
	if (decisions.every((decision) => decision === "auto_approve")) {
		return "auto_approve"
	}

	// Otherwise, ask user
	return "ask_user"
}

/**
 * Get the decision for a single command using longest prefix match rule.