shelltext

func IsGitHistoryRewriteCommand ¶

func IsGitHistoryRewriteCommand(command string) bool

IsGitHistoryRewriteCommand checks whether `command` contains a git invocation that can lose commit history (a ref moves backward, a branch/tag pointer disappears, a rebase rewrites commits). The change tracker can recover working-tree changes but cannot recover lost commits — only the reflog can — so these ops stay gated by default.

Specifically matches:

• `git reset --hard <commit-ish>` (backward ref-move)
• `git rebase` (any form — rewrites or drops commits)
• `git branch -d`/`-D`/`--delete` (deletes a branch ref)
• `git tag -d`/`--delete` (deletes a tag ref)

`git reset --hard` *without* an explicit commit-ish argument is equivalent to `reset --hard HEAD` — it only reverts the working tree and is fully recoverable. We err toward "gated" when the argument shape is ambiguous (cheap false positive, expensive false negative).

func StripHeredocAndQuotes ¶

func StripHeredocAndQuotes(cmd string) string

StripHeredocAndQuotes replaces heredoc bodies and quoted string content with spaces so risk pattern matchers don't scan DATA content as if it were a command. Without this, a heredoc writing a file whose source code mentions "git checkout" (or "rm -rf") would falsely match risk patterns.

Heredoc: `cat > file <<'EOF' ... git checkout ... EOF` — everything between the opening `<<DELIM` and the closing delimiter line is data. Quoted strings: content inside '...' or "..." is replaced with spaces.

func StripHeredocBodies ¶

func StripHeredocBodies(cmd string) string

StripHeredocBodies removes the content between heredoc delimiters, replacing it with spaces (preserving newlines so line-based structure is maintained for any downstream processing).

func StripQuotedContent ¶

func StripQuotedContent(s string) string

StripQuotedContent replaces all single-quoted and double-quoted string content in a shell command with spaces, preserving quote boundaries so token positions stay stable. This prevents false-positive git command detection when words like "git commit" appear inside JSON payloads or other quoted arguments.