{"version":"2.1.213","anchor":"shell-safety-test-command-gap-analysis","canonical_anchor":"shell-safety-test-command-gap-analysis","heading":"Shell Safety: Test Command Gap Analysis","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.213\/e\/shell-safety-test-command-gap-analysis","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.213","markdown":"### Shell Safety: Test Command Gap Analysis\n\n**What**\n\nThe Bash safety parser now checks test commands (`[[ ... ]]`) for unparsed bytes between children or after the last child, which would indicate the parser missed content the shell will actually see.\n\n**Details**\n\n- A new recursive function `dnu()` walks `test_command` AST nodes and their four nested compound-expression node types: `unary_expression`, `binary_expression`, `negated_expression`, and `parenthesized_expression`\n- For each node the function tracks a byte-position cursor from `startIndex` to `endIndex` and measures the gap before each child and after the last child; gaps that contain only whitespace (spaces, tabs), backslash-newline continuations, or (in bash mode) comment characters are allowed\n- **Between-children gap**: if the bytes between two adjacent parsed children are non-trivial, the function returns `{ kind: \"too-complex\", reason: \"Test command has unparsed bytes between children \u2014 parser dropped content that shell will see\" }`\n- **After-last-child gap**: if bytes remain between the last child's `endIndex` and the node's own `endIndex`, the function returns `{ kind: \"too-complex\", reason: \"Test command has unparsed bytes after its last child \u2014 parser dropped content that shell will see\" }`\n- **Child out-of-bounds**: if a child's span extends outside the parent's span, the function returns `{ kind: \"too-complex\", reason: \"Test command child extends past the node span \u2014 gap byte accounting is untrustworthy\" }`\n- All three cases produce a `\"too-complex\"` result; the safety classifier treats `\"too-complex\"` as inability to determine read-only status, so the command is not automatically approved \u2014 the user sees the standard \"approve this command?\" prompt rather than a silent pass-through\n- This closes a semantic gap where a tree-sitter parse failure inside `[[ ]]` could have caused the classifier to analyse a truncated\/simplified version of the condition and incorrectly allow a command that the shell would evaluate differently\n\n**Evidence**\n\nTest command validation (search for `\"Test command has unparsed bytes between children\"`, `\"Test command has unparsed bytes after its last child\"`); gap-check implementation (search for `dnu`, `Zru`, `unu`)"}