Command mode: a structural design for the destructive-command gate

[postoso]

Command mode's confirm gate (isDestructiveCommand) currently detects destructive shapes with regex heuristics over masked text. Working on #434, every review pass surfaced another valid shell-grammar family (env option forms, quoted redirect targets, fd redirects, now sudo/precommand wrappers). The pattern will continue because the classifier has no model of shell structure, and the commands come from the model loop, so they use idiomatic shell forms.

I'd like to build a small structural core to replace the heuristics: a quote-aware tokenizer (word splitting, segmentation on ; && || | |&, redirect operand parsing) plus a table-driven wrapper resolver (env, sudo, nohup, nice, timeout, command, exec, xargs, zsh precommands) that walks to the effective command of each segment. Since commands run via /bin/zsh -c (no .zshrc, so no user aliases), static analysis of this kind is reliable here. New wrapper classes become table entries instead of new regexes.

On top of that core there are two possible policies, and this is your call:

1. Keep today's default-allow policy: flag known-destructive shapes, everything else runs. No behavior change, strictly better coverage than the current heuristics. Still fail-open by nature.
2. Flip to default-confirm with a safe allowlist (read-only commands run free, everything else confirms). This is how coding agents like Claude Code and Codex CLI gate LLM-generated commands, and command mode is the same shape of problem. Sound by construction, but it adds confirms and that UX trade-off is yours to weigh. It could also be an opt-in strict mode on top of option 1.

Happy to build either (or 1 now with 2 as a setting later). Context: #434 covers the immediate heuristic gaps and is ready for review independently of this.