feat(terminal): implement safety check for dangerous shell commands

#335

- Add ShellSyntaxSafetyCheck object to detect potentially harmful commands
- Integrate safety check in TerminalSketchProvider's onDoneStream method- Notify user and prevent auto-execution of dangerous commands
- Display warning message in terminal and result panel

Author: phodal

exts/ext-terminal/src/main/kotlin/cc/unitmesh/terminal/sketch/ShellSyntaxSafetyCheck.kt

@@ -0,0 +1,34 @@
+package cc.unitmesh.terminal.sketch
+
+object ShellSyntaxSafetyCheck {
+
+    /**
+     * Check if shell command contains dangerous operations
+     * @return Pair<Boolean, String> - first: is dangerous, second: reason message
+     */
+    fun checkDangerousCommand(command: String): Pair<Boolean, String> {
+        val dangerousPatterns = mapOf(
+            "\\brm\\s+(-[a-zA-Z]*f|-[a-zA-Z]*r|-[a-zA-Z]*(rf|fr))\\b.*".toRegex() to "Dangerous rm command with recursive or force flags",
+            "\\brm\\s+-[a-zA-Z]*\\s+/\\b.*".toRegex() to "Removing files from root directory",
+            "\\brmdir\\s+/\\b.*".toRegex() to "Removing directories from root",
+            "\\bmkfs\\b.*".toRegex() to "Filesystem formatting command",
+            "\\bdd\\b.*".toRegex() to "Low-level disk operation",
+            "\\b:[(][)][{]\\s*:|:&\\s*[}];:.*".toRegex() to "Potential fork bomb",
+            "\\bchmod\\s+-[a-zA-Z]*R\\b.*777\\b.*".toRegex() to "Recursive chmod with insecure permissions",
+            "\\bsudo\\s+rm\\b.*".toRegex() to "Removing files with elevated privileges",
+        )
+
+        // Also catch simpler rm commands (without flags but still potentially dangerous)
+        if (command.trim().startsWith("rm ") && !command.contains("-i") && !command.contains("--interactive")) {
+            return Pair(true, "Remove command detected, use with caution")
+        }
+
+        for ((pattern, message) in dangerousPatterns) {
+            if (pattern.containsMatchIn(command)) {
+                return Pair(true, message)
+            }
+        }
+
+        return Pair(false, "")
+    }
+}

exts/ext-terminal/src/main/kotlin/cc/unitmesh/terminal/sketch/TerminalSketchProvider.kt

@@ -207,8 +207,28 @@ class TerminalLangSketch(val project: Project, var content: String) : ExtensionL
     }
 
     override fun onDoneStream(allText: String) {
-        if (content.lines().size > 1) return
+        val (isDangerous, reason) = ShellSyntaxSafetyCheck.checkDangerousCommand(content)
+        if (isDangerous) {
+            AutoDevNotifications.notify(project, "Auto-execution has been disabled for safety: $reason")
+
+            ApplicationManager.getApplication().invokeLater {
+                terminalWidget!!.terminalStarter?.sendString(
+                    "echo \"⚠️ WARNING: $reason - Command not auto-executed for safety\"",
+                    false
+                )
 
+                // Set result panel with warning
+                resultSketch.updateViewText(
+                    "⚠️ WARNING: $reason\nThe command was not auto-executed for safety reasons.\nPlease review and run manually if you're sure.",
+                    true
+                )
+                collapsibleResultPanel.setTitle("Safety Warning")
+                collapsibleResultPanel.expand()
+            }
+            return
+        }
+
+        if (content.lines().size > 1) return
         ApplicationManager.getApplication().invokeLater {
             terminalWidget!!.terminalStarter?.sendString(content, false)