Function isSimpleTarget

src/utils/bash/commands.ts:798–817

(target: ParseEntry | undefined)

}

function isSimpleTarget(target: ParseEntry | undefined): target is string {
  // SECURITY: Reject empty strings. isSimpleTarget('') passes every character-
  // class check below vacuously; path.resolve(cwd,'') returns cwd (always in
  // allowed root). An empty target can arise from shell-quote emitting '' for
  // `\<newline>`. In bash, `> \<newline>/etc/passwd` joins the continuation
  // and writes to /etc/passwd. Defense-in-depth with the line-continuation
  // join fix in extractOutputRedirections.
  if (typeof target !== 'string' || target.length === 0) return false
  return (
    !target.startsWith('!') && // History expansion patterns like !!, !-1, !foo
    !target.startsWith('=') && // Zsh equals expansion (=cmd expands to /path/to/cmd)
    !target.startsWith('~') && // Tilde expansion (~, ~/path, ~user/path)
    !target.includes('$') && // Variable/command substitution
    !target.includes('`') && // Backtick command substitution
    !target.includes('*') && // Glob wildcard
    !target.includes('?') && // Glob single char
    !target.includes('[') && // Glob character class
    !target.includes('{') // Brace expansion like {a,b} or {1..5}
  )
}

/**
 * Checks if a redirection target contains shell expansion syntax that could