fix: 收紧危险命令检测正则，防止文本描述误报

[lishuceo]

Summary

• 用户发送包含 agent 分析输出的消息，文中出现 "shutdown"（graceful shutdown 描述）被误判为危险命令
• 收紧 shutdown/reboot/init 的正则：仅匹配实际关机命令（如 shutdown -h now），不再匹配自然语言中的普通文本
• 补充误报场景的测试用例（15/15 通过）

Test plan

• shutdown -h now / shutdown -r 5 / shutdown now → 检测为危险命令
• graceful shutdown handling / the shutdown process → 不触发检测
• reboot（独立行）→ 检测为危险命令
• reboot the system after update → 不触发检测
• init 0 → 检测为危险命令，reinit 0 times → 不触发
• 全量测试 988/989 通过（唯一失败为无关的 LLM 质量测试）

🤖 Generated with Claude Code

[claude]

Claude finished @lishuceo's task in 1m 39s —— View job

---

Review of PR #134

• Gather context and read changed files
• Check for previous review comments (none found)
• Review regex changes for correctness and bypasses
• Post review summary

---

⚠️ Issues Found

Overall assessment: Good direction — tightening the regex to avoid false positives on natural language text is the right call. The test coverage for false-positive scenarios is solid. However, the tightening may have gone slightly too far, creating bypasses for legitimate dangerous commands.

Severity	Issue	Confidence
🟡 Warning	reboot -f / reboot now / sudo reboot -f bypass the reboot regex	85
🟡 Warning	bare shutdown and shutdown +5 bypass the shutdown regex	80

See inline comment on security.ts L30-31 for details and a suggested fix.

What works well:

• \b word boundary on init correctly prevents "reinit 0" false positive
• \bshutdown\s+(-\w|now\b) correctly catches the most common forms (-h now, -r 5, now)
• /m flag on reboot regex correctly handles multiline input
• Test coverage is thorough for the cases it does cover

[claude]

Claude finished @lishuceo's task in 1m 16s —— View job

---

Review of PR #134 (post-update)

• Check previous review comments and resolve fixed issues
• Read current changed files
• Review regex changes for correctness
• Post review summary

---

✅ Approved — Previous issues fixed, no new issues found

1 previous issue fixed: The reboot/shutdown regex gaps (missing reboot -f, reboot now, bare shutdown, shutdown +5) are now properly handled.

Current regex analysis:

Pattern	Catches	Avoids false positive on
\bshutdown(\s+([+\-]\w|now\b)|\s*$)/m	shutdown, shutdown -h now, shutdown +5, shutdown now	graceful shutdown handling, the shutdown process
\breboot\b(\s+(-\w|now\b)|\s*$)/m	reboot, reboot -f, reboot now	reboot the system, auto-reboot is disabled
\binit\s+0/	init 0	reinit 0 times

What works well:

• \b word boundaries prevent matching inside compound words (auto-reboot, reinit)
• /m multiline flag ensures $ matches end-of-line, not just end-of-string — critical for multiline input
• [+\-]\w in shutdown regex correctly catches both -h/-r flags and +5 delay syntax
• Test coverage is thorough: 15 assertions covering both true positives and false-positive scenarios

No new issues found with confidence ≥ 75.

[claude]

Claude finished @lishuceo's task in 1m 45s —— View job

---

Review of PR #134 (post-sync)

• Check previous review comments and resolve fixed issues
• Read current changed files and full source
• Review regex changes for correctness
• Post review summary

---

✅ Approved — No new issues found

1 previous issue resolved: The reboot -f/reboot now/bare shutdown/shutdown +5 gaps flagged in the first review are all fixed and the thread is already resolved.

Current regex analysis:

Pattern	Catches	Avoids false positive on
\bshutdown(\s+([+-]\w|now\b)|\s*$)/m	shutdown, shutdown -h now, shutdown +5, shutdown now	graceful shutdown handling, the shutdown process
\breboot\b(\s+(-\w|now\b)|\s*$)/m	reboot, reboot -f, reboot now	reboot the system, auto-reboot is disabled
\binit\s+0	init 0	reinit 0 times

Details:

• Word boundaries (\b) correctly prevent matching inside compound words (auto-reboot, reinit)
• /m multiline flag ensures $ matches end-of-line, so bare shutdown/reboot at the end of any line in multiline input is caught
• [+-]\w in the shutdown regex correctly handles both -h/-r flags and +5 delay syntax
• Minor note: shutdown --no-wall (double dash) would not be caught since [+-]\w requires the char after the sign to be a word char (- is not \w). This is acceptable — --no-wall is just a display flag, and the truly dangerous forms are all covered.
• Test coverage is thorough: 15+ assertions covering both true positives and false-positive scenarios across all three patterns

No issues found with confidence ≥ 75.