fix(core): handle heredoc in command substitution guard

packages/core/src/utils/shell-utils.test.ts

@@ -169,6 +169,121 @@ describe('isCommandAllowed', () => {
       const result = isCommandAllowed("echo '$(pwd)'", config);
       expect(result.allowed).toBe(true);
     });
+
+    describe('heredocs', () => {
+      it('should allow substitution-like content in a quoted heredoc delimiter', () => {
+        const cmd = [
+          "cat <<'EOF' > user_session.md",
+          '```',
+          '$(rm -rf /)',
+          '`not executed`',
+          '```',
+          'EOF',
+        ].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(true);
+      });
+
+      it('should block command substitution in an unquoted heredoc body', () => {
+        const cmd = [
+          'cat <<EOF > user_session.md',
+          "'$(rm -rf /)'",
+          'EOF',
+        ].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Command substitution');
+      });
+
+      it('should block backtick command substitution in an unquoted heredoc body', () => {
+        const cmd = ['cat <<EOF > user_session.md', '`rm -rf /`', 'EOF'].join(
+          '\n',
+        );
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Command substitution');
+      });
+
+      it('should allow escaped command substitution in an unquoted heredoc body', () => {
+        const cmd = [
+          'cat <<EOF > user_session.md',
+          '\\$(rm -rf /)',
+          'EOF',
+        ].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(true);
+      });
+
+      it('should support tab-stripping heredocs (<<-)', () => {
+        const cmd = [
+          "cat <<-'EOF' > user_session.md",
+          '\t$(rm -rf /)',
+          '\tEOF',
+        ].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(true);
+      });
+
+      it('should block command substitution split by line continuation in an unquoted heredoc body', () => {
+        const cmd = [
+          'cat <<EOF > user_session.md',
+          '$\\',
+          '(rm -rf /)',
+          'EOF',
+        ].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Command substitution');
+      });
+
+      it('should allow escaped command substitution split by line continuation in an unquoted heredoc body', () => {
+        const cmd = [
+          'cat <<EOF > user_session.md',
+          '\\$\\',
+          '(rm -rf /)',
+          'EOF',
+        ].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(true);
+      });
+    });
+
+    describe('comments', () => {
+      it('should ignore heredoc operators inside comments', () => {
+        const cmd = ["# Fake heredoc <<'EOF'", '$(rm -rf /)', 'EOF'].join('\n');
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Command substitution');
+      });
+
+      it('should allow command substitution patterns inside full-line comments', () => {
+        const cmd = ['# Note: $(rm -rf /) is dangerous', 'echo hello'].join(
+          '\n',
+        );
+
+        const result = isCommandAllowed(cmd, config);
+        expect(result.allowed).toBe(true);
+      });
+
+      it('should allow command substitution patterns inside inline comments', () => {
+        const result = isCommandAllowed('echo hello # $(rm -rf /)', config);
+        expect(result.allowed).toBe(true);
+      });
+
+      it('should not treat # inside a word as a comment starter', () => {
+        const result = isCommandAllowed('echo foo#$(rm -rf /)', config);
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Command substitution');
+      });
+    });
   });
 });