Function checkSubExpressions

src/tools/PowerShellTool/powershellSecurity.ts:714–724

* AST-only check: Detects subexpressions $() which can hide command execution.

(
  parsed: ParsedPowerShellCommand,
)

 * AST-only check: Detects subexpressions $() which can hide command execution.
 */
function checkSubExpressions(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  if (deriveSecurityFlags(parsed).hasSubExpressions) {
    return {
      behavior: 'ask',
      message: 'Command contains subexpressions $()',
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * AST-only check: Detects expandable strings (double-quoted) with embedded