harden(danger): address code-review cleanup/altitude findings

Follow-up to the Unknown-class fixes — the lower-severity review items:

5. shell tool description (cmd/odek/shell.go): add the `unknown` class and
   state the fail-closed default, so the model driving the tool can reason
   about why an unrecognised command was denied.

6. sensitivePathFragments (classifier.go): document why it is deliberately
   separate from ClassifyPath's home-sensitive-dir list (token-substring,
   credential reads vs absolute-path write-risk) so the overlap doesn't get
   "deduped" into a behavior change, and so a maintainer updating one
   considers the other.

7. safeCommands (classifier.go): extend the read-only allowlist with common
   modern CLIs (fd, eza/exa/lsd, htop/btop/glances, pstree/procs, duf, dust,
   delta, hexyl, glow) so fail-closed doesn't deny routine inspection.

8. classifyStage (classifier.go): pass a pipedInto flag instead of having
   classifyPipeline re-run unwrapWrappers on each non-head stage purely to
   read the head command — one unwrap per stage now.

9. hasSystemRedirectTarget → touchesSystemPath (classifier.go): the function
   flags ANY system-path token, not just redirect targets, and is NOT
   redundant with isSystemWrite (verified: it catches `cat /etc/foo` and
   unknown tools pointed at /usr, and runs after isLocalWrite). Renamed for
   accuracy with a comment on why both checks exist.

Behavior change is limited to #7 (more tools classify Safe). Regression test
for the new safe tools added. Full suite green; go vet clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jkyberneees

cmd/odek/shell.go

@@ -71,8 +71,9 @@ Use for: reading files, listing directories, running tests, building code, and g
 In sandbox mode (--sandbox), commands run inside the Docker container with restricted permissions.
 In host mode (default), commands run with the same permissions as the odek process.
 
-Risk classes: safe, local_write, system_write, destructive, network_egress, code_execution, install, blocked
-High-risk operations may prompt for approval (configurable via dangerous section in odek.json).`
+Risk classes: safe, local_write, system_write, destructive, network_egress, code_execution, install, unknown, blocked
+High-risk operations may prompt for approval (configurable via dangerous section in odek.json).
+The gate fails closed: an unrecognised command classifies as "unknown" and is denied by default.`
 }
 
 func (t *shellTool) Schema() any {

internal/danger/classifier.go

@@ -668,6 +668,10 @@ var safeCommands = map[string]bool{
 	"local": true, "declare": true, "typeset": true, "readonly": true,
 	"alias": true, "unalias": true, "jobs": true, "bg": true, "fg": true,
 	"disown": true, "let": true, "ulimit": true, "times": true,
+	// common modern read-only CLIs (ls/find/cat/ps/df/du/diff/hex viewers)
+	"fd": true, "fdfind": true, "eza": true, "exa": true, "lsd": true,
+	"htop": true, "btop": true, "glances": true, "pstree": true, "procs": true,
+	"duf": true, "dust": true, "delta": true, "hexyl": true, "glow": true,
 }
 
 // ── Classifier ─────────────────────────────────────────────────────────
@@ -744,15 +748,8 @@ func classifyPipeline(tokens []string) RiskClass {
 	stages := splitPipes(tokens)
 	worst := Safe
 	for idx, stage := range stages {
-		cls := classifyStage(stage)
-		if idx > 0 {
-			// Data piped into a shell interpreter executes fetched code.
-			cmdTokens, _ := unwrapWrappers(stage)
-			if len(cmdTokens) > 0 && pipedShells[commandName(cmdTokens[0])] {
-				cls = worstOf(cls, CodeExecution)
-			}
-		}
-		worst = worstOf(worst, cls)
+		// idx > 0 means this stage receives piped input from the previous one.
+		worst = worstOf(worst, classifyStage(stage, idx > 0))
 	}
 	return worst
 }
@@ -762,7 +759,9 @@ func classifyPipeline(tokens []string) RiskClass {
 // underneath is the one classified, while privileged wrappers still set a
 // system_write floor. It then escalates for shell `-c` payloads, `find
 // -exec`, and any reverse-shell or sensitive-resource tokens in the stage.
-func classifyStage(tokens []string) RiskClass {
+// pipedInto reports whether the stage's stdin comes from an upstream pipe, in
+// which case feeding it to a shell interpreter is code execution.
+func classifyStage(tokens []string, pipedInto bool) RiskClass {
 	if len(tokens) == 0 {
 		return Safe
 	}
@@ -772,9 +771,12 @@ func classifyStage(tokens []string) RiskClass {
 		cls = worstOf(cls, classifyCommand(cmdTokens))
 
 		name := commandName(cmdTokens[0])
-		// A shell interpreter given something to execute — a -c payload, a
-		// script file, or a process substitution like <(curl …) — runs code.
+		// A shell interpreter that executes code: piped-in data (`… | bash`),
+		// a -c payload, a script file, or a process substitution `<(curl …)`.
 		if pipedShells[name] {
+			if pipedInto {
+				cls = worstOf(cls, CodeExecution)
+			}
 			if arg := flagArg(cmdTokens, "-c"); arg != "" {
 				cls = worstOf(cls, CodeExecution)
 				cls = worstOf(cls, Classify(arg))
@@ -1256,6 +1258,13 @@ func classifyResourceToken(tok string) RiskClass {
 // Matching is substring-based so it catches ~, /root, /home/<user>, and
 // absolute variants alike. /etc/passwd is intentionally excluded — it is
 // world-readable and accessed routinely, so flagging it is pure noise.
+//
+// This is deliberately distinct from ClassifyPath's home-sensitive-dir list:
+// that classifies the *write* risk of an absolute filesystem path (for the
+// file tool), whereas this flags *credential reads/writes* in a raw shell
+// token (which may be ~-relative or carry an `of=`-style prefix). They
+// overlap (~/.ssh, ~/.aws, ~/.gnupg) but are not interchangeable; if you add
+// a credential location to one, consider whether the other needs it too.
 var sensitivePathFragments = []string{
 	"/etc/shadow", "/etc/gshadow", "/etc/sudoers", "/etc/ssl/private",
 	"/.ssh", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519",
@@ -1402,8 +1411,10 @@ func classifyCommand(tokens []string) RiskClass {
 		return LocalWrite
 	}
 
-	// Check for redirect targets that are system paths
-	if hasSystemRedirectTarget(tokens) {
+	// Any argument that names a system path (read or write) — broader than
+	// isSystemWrite's redirect-only check above, which runs earlier so a
+	// redirect to a system path beats the LocalWrite classification.
+	if touchesSystemPath(tokens) {
 		return SystemWrite
 	}
 
@@ -1734,8 +1745,11 @@ func hasArgAfter(tokens []string, after, target string) bool {
 	return false
 }
 
-// hasSystemRedirectTarget checks if any redirect target is a system path.
-func hasSystemRedirectTarget(tokens []string) bool {
+// touchesSystemPath reports whether any token names a system path (an
+// argument or a redirect target alike). It is intentionally broader than the
+// redirect-only scan in isSystemWrite — it catches reads/args such as
+// `cat /etc/foo` or an unknown tool pointed at /usr — so both checks exist.
+func touchesSystemPath(tokens []string) bool {
 	for _, tok := range tokens {
 		if tok == ">" || tok == ">>" {
 			continue

internal/danger/classifier_test.go

@@ -764,9 +764,9 @@ func TestHasSystemRedirectTarget(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := hasSystemRedirectTarget(tt.tokens)
+			got := touchesSystemPath(tt.tokens)
 			if got != tt.want {
-				t.Errorf("hasSystemRedirectTarget(%v) = %v, want %v", tt.tokens, got, tt.want)
+				t.Errorf("touchesSystemPath(%v) = %v, want %v", tt.tokens, got, tt.want)
 			}
 		})
 	}
@@ -893,7 +893,7 @@ func TestClassify_ForkBomb_StillDetected(t *testing.T) {
 }
 
 func TestClassify_SystemRedirectTarget(t *testing.T) {
-	// Regression: isSystemWrite and hasSystemRedirectTarget now share
+	// Regression: isSystemWrite and touchesSystemPath now share
 	// isSystemPath. Verify system path redirect detection works.
 	tests := []struct {
 		cmd string

internal/danger/hardening_test.go

@@ -231,6 +231,8 @@ func TestHardening_SafeAllowlistStillSafe(t *testing.T) {
 		"printf '%s' x", "date", "uname -a", "id", "whoami", "ps aux",
 		"which go", "type ls", "sha256sum f", "xxd f", "cd /etc", "export FOO=1",
 		"true", "test -f x", "seq 1 5", "sleep 1",
+		// common modern read-only CLIs added to the allowlist
+		"fd pattern", "eza -la", "delta a b", "procs", "duf", "dust", "htop",
 	}
 	for _, cmd := range safe {
 		if got := Classify(cmd); got != Safe {