COMMAND_SEPARATOR_CLASS

const COMMAND_SEPARATOR_CLASS: “;&|\n\r” = ‘;&|\n\r’

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/shell/normalize.ts:49

SECURITY / EXT-55 — the single source of truth for where a new command begins.

This is a regex character-class BODY (embed it as `[${COMMAND_SEPARATOR_CLASS}]`) listing every character at which the shell stops one command and starts the next: ;, & (hence &&), | (hence ||), and a LINE BREAK. Both consumers of the normalized form build their patterns from it — the allow-list classifier’s fail-closed check (import(‘./arity.js’).classifyCommand) and the hardline blocklist’s pattern terminators (core/shell/hardline) — so the two layers can never again disagree about what a separator is.

The layers disagreed before EXT-55: ;/&&/| made a command ambiguous (fail-closed) but a newline did not, because normalizeCommand folded it to a SPACE. ls -la\nrm -rf / was therefore classified as the single command ls, and an ordinary ls grant auto-approved it.

\r is listed defensively: normalizeCommand canonicalizes CR/CRLF to LF, so a normalized string never contains one — but a pattern matched against a RAW command still fails closed.