Function ghIsDangerousCallback

src/utils/shell/readOnlyCommandValidation.ts:944–982

(_rawCommand: string, args: string[])

// This covers BOTH --repo values AND positional URL/repo arguments, INCLUDING
// the equals-attached form `--repo=HOST/OWNER/REPO` (cobra accepts both forms).
function ghIsDangerousCallback(_rawCommand: string, args: string[]): boolean {
  for (const token of args) {
    if (!token) continue
    // For flag tokens, extract the VALUE after `=` for inspection. Without this,
    // `--repo=evil.com/SECRET/x` (single token starting with `-`) gets skipped
    // entirely, bypassing the HOST check. Cobra treats `--flag=val` identically
    // to `--flag val`; we must inspect both forms.
    let value = token
    if (token.startsWith('-')) {
      const eqIdx = token.indexOf('=')
      if (eqIdx === -1) continue // flag without inline value, nothing to inspect
      value = token.slice(eqIdx + 1)
      if (!value) continue
    }
    // Skip values that are clearly not repo specs (no `/` at all, or pure numbers)
    if (
      !value.includes('/') &&
      !value.includes('://') &&
      !value.includes('@')
    ) {
      continue
    }
    // URL schemes: https://, http://, git://, ssh://
    if (value.includes('://')) {
      return true
    }
    // SSH-style: git@host:owner/repo
    if (value.includes('@')) {
      return true
    }
    // 3+ segments = HOST/OWNER/REPO (normal gh format is OWNER/REPO, 1 slash)
    // Count slashes: 2+ slashes means 3+ segments
    const slashCount = (value.match(/\//g) || []).length
    if (slashCount >= 2) {
      return true
    }
  }
  return false
}

export const GH_READ_ONLY_COMMANDS: Record<string, ExternalCommandConfig> = {
  // gh pr view is read-only — displays pull request details