Function collectCommandSubstitution

src/utils/bash/ast.ts:1374–1393

* Recurse into a command_substitution node's inner command(s). If the inner * command(s) parse cleanly (simple), add them to the innerCommands * accumulator and return null (success). If the inner command is itself * too-complex (e.g., nested arith expansion, process sub), return the error. * Th

(
  csNode: Node,
  innerCommands: SimpleCommand[],
  varScope: Map<string, string>,
)

 * (inner) — permission rules must match BOTH for the whole command to allow.
 */
function collectCommandSubstitution(
  csNode: Node,
  innerCommands: SimpleCommand[],
  varScope: Map<string, string>,
): ParseForSecurityResult | null {
  // Vars set BEFORE the $() are visible inside (bash subshell semantics),
  // but vars set INSIDE don't leak out. Pass a COPY of the outer scope so
  // inner assignments don't mutate the outer map.
  const innerScope = new Map(varScope)
  // command_substitution children: `$(` or `` ` ``, inner statement(s), `)`
  for (const child of csNode.children) {
    if (!child) continue
    if (child.type === '$(' || child.type === '`' || child.type === ')') {
      continue
    }
    const err = collectCommands(child, innerCommands, innerScope)
    if (err) return err
  }
  return null
}

/**
 * Convert an argument node to its literal string value. Quotes are resolved.