Function walkCommand

src/utils/bash/ast.ts:1237–1363

* Walk a `command` node and extract argv. Children appear in order: * [variable_assignment...] command_name [argument...] [file_redirect...] * Any child type not explicitly handled triggers too-complex.

(
  node: Node,
  extraRedirects: Redirect[],
  innerCommands: SimpleCommand[],
  varScope: Map<string, string>,
)

 * Any child type not explicitly handled triggers too-complex.
 */
function walkCommand(
  node: Node,
  extraRedirects: Redirect[],
  innerCommands: SimpleCommand[],
  varScope: Map<string, string>,
): ParseForSecurityResult {
  const argv: string[] = []
  const envVars: { name: string; value: string }[] = []
  const redirects: Redirect[] = [...extraRedirects]

  for (const child of node.children) {
    if (!child) continue

    switch (child.type) {
      case 'variable_assignment': {
        const ev = walkVariableAssignment(child, innerCommands, varScope)
        if ('kind' in ev) return ev
        // SECURITY: Env-prefix assignments (`VAR=x cmd`) are command-local in
        // bash — VAR is only visible to `cmd` as an env var, NOT to
        // subsequent commands. Do NOT add to global varScope — that would
        // let `VAR=safe cmd1 && rm $VAR` resolve $VAR when bash has unset it.
        envVars.push({ name: ev.name, value: ev.value })
        break
      }
      case 'command_name': {
        const arg = walkArgument(
          child.children[0] ?? child,
          innerCommands,
          varScope,
        )
        if (typeof arg !== 'string') return arg
        argv.push(arg)
        break
      }
      case 'word':
      case 'number':
      case 'raw_string':
      case 'string':
      case 'concatenation':
      case 'arithmetic_expansion': {
        const arg = walkArgument(child, innerCommands, varScope)
        if (typeof arg !== 'string') return arg
        argv.push(arg)
        break
      }
      // NOTE: command_substitution as a BARE argument (not inside a string)
      // is intentionally NOT handled here — the $() output IS the argument,
      // and for path-sensitive commands (cd, rm, chmod) the placeholder would
      // hide the real path from downstream checks. `cd $(echo /etc)` must
      // stay too-complex so the path-check can't be bypassed. $() inside
      // strings ("Timer: $(date)") is handled in walkString where the output
      // is embedded in a longer string (safer).
      case 'simple_expansion': {
        // Bare `$VAR` as an argument. Tracked static vars return the ACTUAL
        // value (e.g. VAR=/etc → '/etc'). Values with IFS/glob chars or
        // placeholders reject. See resolveSimpleExpansion.
        const v = resolveSimpleExpansion(child, varScope, false)
        if (typeof v !== 'string') return v