HARDLINE_PATTERNS

const HARDLINE_PATTERNS: ReadonlyArray<readonly [RegExp, string]>

Defined in: _worktrees/docs-release/gaunt-sloth/packages/agent/src/tools/shell/hardline.ts:351

Hardline patterns: [regex, human description]. Matched case-insensitively against the normalized command.

Every destructive-verb pattern is anchored at CMD_POS, and must stay anchored. A word boundary (\brm) — or no anchor at all — matches the verb ANYWHERE, including inside prose and inside another command’s arguments. Measured over 30 legitimate commands, the unanchored floor refused 10 of them: echo never run rm -rf /, grep -c mkfs docs/*.md, rg -n "dd of=/dev/sd" scripts/, grep -rn "kill -1" packages/ and more. The floor refused commands that merely talk about the floor, unappealably, at every rung including bypass.

CMD_POS consumes the wrapper programs and admits every separator position, so sudo rm -rf /, ls -la; rm -rf / and ls\nrm -rf / all keep refusing.

What anchoring gives up is the interpreter-wrapper forms — sh -c "rm -rf /", bash -c "mkfs.ext4 /dev/sda1". classifyCommand resolves those to the prefixes sh and bash, so no deterministic layer sees them; what covers them is the RATER, which rates them catastrophic, so both rated rungs escalate. Only bypass is unguarded, and there the user has asked for no gate. A false positive in this layer has no recovery at any rung; a miss still has the layers above it. The floor stays narrow and accepts the misses.

Two patterns are deliberately NOT anchored, because neither is a command-position construct: the >-redirect-to-device arm (a redirection operator appears mid-command by definition) and the fork-bomb literal (the string is the fork bomb).