[Bug] AI command blocklist applies POSIX patterns to PowerShell sessions and misses PowerShell-specific dangerous commands

[JasonWenTheFox]

NET-003 上游 Issue 草稿（脱敏）

Title: [Bug] AI command blocklist applies POSIX patterns to PowerShell sessions and misses PowerShell-specific dangerous commands

Operating system

macOS

Netcatty version

1.1.82

How did you install Netcatty?

GitHub Release (.dmg / .exe / .AppImage / .deb / .rpm / .pacman)

Affected area

AI assistant; terminal command safety

Can you reproduce it?

Always (100%)

Steps to reproduce

1. Connect to a Windows host whose interactive shell is PowerShell 7 (Windows OpenSSH + pwsh.exe -NoLogo startup command).
2. Via External MCP (or the built-in agent), run terminal_execute with:
   Write-Host "now: $(Get-Date)"
3. Observe the tool result.

Expected behavior

Legal PowerShell commands execute normally. Dangerous PowerShell-native commands (recursive force deletes, Invoke-Expression, download-and-execute pipes) are blocked by the safety policy.

Actual behavior

Error: Command blocked by safety policy. Pattern: \$\(

The $( ) subexpression operator and backtick escapes are POSIX semantics, but the blocklist is a flat, shell-agnostic pattern list, so perfectly legal PowerShell commands are always rejected. At the same time the table contains no PowerShell-native dangerous patterns, so Remove-Item -Recurse -Force, Invoke-Expression, or curl ... | iex are not covered at all.

Relevant current code:

• lib/commandBlocklist.json — one flat pattern list; \$\( and the backtick rule are POSIX-only semantics.
• infrastructure/ai/cattyAgent/safety.ts — checkCommandSafety(command, blocklist) has no shell parameter.
• infrastructure/ai/shared/toolExecutors.ts — the executor already resolves the target session (whose shellType is available) but does not pass it to the check.

Note: the blocklist is defense-in-depth on top of the permission/confirmation system, so this does not widen the security boundary — it only makes the guard usable on Windows shells while PowerShell-native dangers are currently uncovered.

Suggested fix direction

• Group the default table into common (shell-independent), posix, and powershell patterns.
• Select the groups by the session's shell kind, falling back to the full table when the shell cannot be determined (strict).
• Keep user-added patterns applying on every shell.
• Add PowerShell-native dangerous patterns (Remove-Item -Recurse -Force, Invoke-Expression/iex, download-pipe-to-iex, Set-ExecutionPolicy Bypass, Format-Volume/Clear-Disk/Stop-Computer/Restart-Computer).

Before submitting

• I searched existing issues and did not find a duplicate
• I removed passwords, private keys, host addresses, usernames, session IDs, and other secrets from this report

[netcatty-bot]

自动分类在读取附件或外部资料时失败，Issue 已保留并转给维护者继续处理。

查看本次运行：https://github.com/binaricat/Netcatty/actions/runs/33674876272