* SECURITY: Extract positional (non-flag) arguments, correctly handling the * POSIX `--` end-of-options delimiter. * * Most commands (rm, cat, touch, etc.) stop parsing options at `--` and treat * ALL subsequent arguments as positional, even if they start with `-`. Naive * `!arg.startsWith('-')
(args: string[])
| 124 | * validated (blocked by isClaudeConfigFilePath / pathInAllowedWorkingPath). |
| 125 | */ |
| 126 | function filterOutFlags(args: string[]): string[] { |
| 127 | const result: string[] = [] |
| 128 | let afterDoubleDash = false |
| 129 | for (const arg of args) { |
| 130 | if (afterDoubleDash) { |
| 131 | result.push(arg) |
| 132 | } else if (arg === '--') { |
| 133 | afterDoubleDash = true |
| 134 | } else if (!arg?.startsWith('-')) { |
| 135 | result.push(arg) |
| 136 | } |
| 137 | } |
| 138 | return result |
| 139 | } |
| 140 | |
| 141 | // Helper: Parse grep/rg style commands (pattern then paths) |
| 142 | function parsePatternCommand( |