Method Execute

cli/agent/command_executor.go:55–133

Execute executa um comando e retorna o resultado

(ctx context.Context, command string, interactive bool)

// Execute executa um comando e retorna o resultado
func (e *CommandExecutor) Execute(ctx context.Context, command string, interactive bool) (*ExecutionResult, error) {
	// Security (H8): Allowlist-based command validation (defense in depth)
	if e.allowlist.GetMode() == SecurityModeStrict {
		if allowed, _, reason := e.allowlist.IsAllowed(command); !allowed {
			e.logger.Warn("Command blocked by allowlist", zap.String("command", command), zap.String("reason", reason))
			return &ExecutionResult{
				Command: command,
				Error:   reason,
			}, fmt.Errorf("command blocked: %s (set CHATCLI_AGENT_SECURITY_MODE=permissive to use denylist fallback)", reason)
		}
	} else if e.allowlist.GetMode() == SecurityModePermissive {
		// In permissive mode, check allowlist first; if not allowed, fall through to denylist
		if allowed, _, _ := e.allowlist.IsAllowed(command); !allowed {
			e.logger.Debug("Command not in allowlist, falling through to denylist", zap.String("command", command))
		}
	}

	// Legacy denylist validation (always active as second layer)
	if err := e.validator.ValidateCommand(command); err != nil {
		e.logger.Warn("Comando inválido", zap.String("command", command), zap.Error(err))
		return &ExecutionResult{
			Command: command,
			Error:   err.Error(),
		}, err
	}

	// --- LÓGICA DE SELEÇÃO DE SHELL E FLAG ---
	shell := os.Getenv("SHELL")
	shellFlag := "-c" // Padrão Unix (bash, zsh, sh)

	if shell == "" {
		if runtime.GOOS == "windows" {
			shell = "powershell.exe" // Fallback seguro para Windows
		} else {
			shell = "/bin/sh"
		}
	}

	// Validate $SHELL against known shell binaries to prevent env manipulation
	if runtime.GOOS != "windows" {
		shellBase := filepath.Base(shell)
		allowedShells := map[string]bool{
			"sh": true, "bash": true, "zsh": true, "dash": true,
			"fish": true, "ksh": true, "csh": true, "tcsh": true,
		}
		if !allowedShells[shellBase] {
			e.logger.Warn("Unrecognized shell, falling back to /bin/sh",
				zap.String("shell", shell))
			shell = "/bin/sh"
		}
	}

	// Ajuste da flag baseado no binário do shell
	if runtime.GOOS == "windows" {
		lowerShell := strings.ToLower(shell)
		if strings.Contains(lowerShell, "powershell") || strings.Contains(lowerShell, "pwsh") {
			shellFlag = "-Command"
		} else if strings.Contains(lowerShell, "cmd") {