Skip to content

06.Sensitive Commands Configuration.md

Latest commit

 

History

History
345 lines (223 loc) · 11.4 KB

06.Sensitive Commands Configuration.md

File metadata and controls

345 lines (223 loc) · 11.4 KB

Snow CLI User Guide - Sensitive Commands Configuration

Welcome to Snow CLI! Agentic coding in your terminal.

What are Sensitive Commands

Sensitive commands are those that may have a significant impact on the system, data, or project when executed. These commands require explicit user confirmation before execution to prevent accidental operations that could lead to data loss or system damage.

Snow CLI has a series of common sensitive command patterns built-in by default and supports users to add custom commands that need protection.

Why Sensitive Commands Configuration is Needed

When using AI-driven command line tools, the AI may suggest executing certain destructive commands. The sensitive commands configuration feature can:

  • Prevent accidental execution of dangerous commands (such as rm -rf, git reset --hard, etc.)
  • Provide users with confirmation opportunities before executing important operations
  • Provide customizable command protection mechanisms
  • Protect project and data security

System Built-in Sensitive Commands

Snow CLI protects the following types of commands by default:

Filesystem Operations

  • rm -rf - Recursive force delete
  • rmdir /s - Windows recursive directory deletion
  • del /f - Windows force delete

Git Operations

  • git reset --hard - Hard reset (discard all changes)
  • git clean -fd - Delete untracked files and directories
  • git push --force - Force push
  • git branch -D - Force delete branch
  • git rebase - Rebase operation
  • git checkout - Branch switching (may lose uncommitted changes)

System Administration

  • sudo rm - Delete with administrator privileges
  • chmod -R - Recursively modify file permissions
  • chown -R - Recursively modify file owner

Database Operations

  • DROP DATABASE - Delete database
  • DROP TABLE - Delete table
  • TRUNCATE - Clear table data

Sensitive Commands Configuration Management

Enter Configuration Interface

  1. Start Snow CLI
  2. Select "Sensitive Commands Configuration" in the main menu
  3. Enter the sensitive commands configuration interface

View Sensitive Commands List

The configuration interface displays all configured sensitive commands, including:

  • Command pattern (supports regular expressions)
  • Command description
  • Enabled/disabled status
  • Whether it is a system built-in command

Interface features:

  • Use [✓] to mark enabled commands
  • Use [ ] to mark disabled commands
  • Custom commands display (Custom) marker
  • Supports scrolling, displaying up to 13 commands at a time

Enable or Disable Command Protection

You can enable or disable protection for specific commands as needed.

Operation Steps

  1. Navigate to Target Command

    • Use ↑/↓ arrow keys to move through the command list
    • The currently selected command will be highlighted

  2. Toggle Enabled Status

    • Press Space to toggle the enabled/disabled status of the selected command
    • The system will display an operation success message (disappears automatically after 2 seconds)

  3. View Command Details

    • Below the list displays the description of the currently selected command
    • Shows the enabled status of the command
    • If it's a custom command, displays [Custom] marker

Add Custom Sensitive Commands

In addition to system built-in sensitive commands, you can add your own sensitive command patterns.

Operation Steps

  1. Enter Add Mode

    • Press A key in the command list interface
    • Enter "Add Custom Sensitive Command" interface

  2. Fill in Command Pattern

    • Enter the command to protect in the "Command Pattern" field
    • Supports regular expression matching
    • Examples:
      • npm uninstall - Exact match
      • ^docker rm - Commands starting with docker rm
      • .*--force.* - Commands containing --force parameter
    • Press Enter or Tab to move to the next field

  3. Fill in Command Description

    • Enter the command description in the "Description" field
    • Suggest clearly describing the danger or impact of this command
    • Examples:
      • "Uninstall npm package"
      • "Force delete Docker container"
      • "Commands containing force execution parameter"
    • Press Enter to submit

  4. Complete Addition

    • The system validates the input and saves the custom command
    • Displays addition success message
    • Automatically returns to the command list interface
    • Newly added commands are enabled by default

Command Pattern Writing Tips

  1. Exact Match

    git reset --hard

    Only matches the exact same command

  2. Prefix Match

    ^npm uninstall

    Matches all commands starting with "npm uninstall"

  3. Contains Match

    .*--force.*

    Matches all commands containing "--force"

  4. Multiple Options Match

    git (reset|clean|push --force)

    Matches multiple related git operations

Delete Custom Sensitive Commands

You can delete custom sensitive commands that are no longer needed. Note: System built-in commands cannot be deleted.

Operation Steps

  1. Select Command to Delete

    • Use ↑/↓ arrow keys to select a custom command
    • Only commands marked as (Custom) can be deleted

  2. Request Deletion

    • Press D key to request deletion

  3. Confirm Deletion

    • Press D key again to confirm deletion
    • Or press ESC to cancel deletion
    • Display confirmation message after successful deletion
    • Cursor automatically moves to the next command

Notes

  • System built-in commands cannot be deleted (will not respond to D key)
  • Requires double confirmation before deletion to prevent accidental operations
  • Deletion operations are irreversible, please operate carefully

Reset to Default Configuration

If you have made extensive modifications to the configuration, you can reset to the system default configuration with one click.

Operation Steps

  1. Request Reset

    • Press R key in the command list interface
    • The system will display a confirmation prompt: 
      Confirm reset to default configuration? All custom commands will be deleted, press R again to confirm, press ESC to cancel

  2. Confirm Reset

    • Press R key again to confirm reset
    • Or press ESC to cancel reset
    • Display confirmation message after successful reset

  3. Reset Effects

    • Delete all custom commands
    • Restore all system built-in commands to enabled status
    • Configuration takes effect immediately

Notes

  • Reset operation will delete all custom commands
  • Reset operation is irreversible
  • Requires double confirmation before execution
  • Suggest recording important custom configurations before resetting

Keyboard Shortcuts

Command List Interface

  • ↑/↓: Navigate through the command list
  • Space: Enable/disable selected command
  • A: Add custom sensitive command
  • D: Delete custom command (requires double confirmation)
  • R: Reset to default configuration (requires double confirmation)
  • ESC: Return to main menu or cancel confirmation operation

Add Command Interface

  • Tab: Switch between input fields
  • Enter: Confirm input and move to next field (last field submits)
  • ESC: Cancel addition and return to list interface

Configuration Best Practices

1. Protect Critical Operations

Ensure the following types of commands are protected:

  • Delete operations (files, directories, databases)
  • Git destructive operations (reset, clean, force push)
  • Permission modification operations
  • Batch operation commands

2. Reasonable Use of Regular Expressions

  • Avoid overly broad matching patterns (like .*), which may cause all commands to require confirmation
  • Use precise prefix or keyword matching
  • Test regular expressions to ensure they only match expected commands

3. Clear Command Descriptions

  • Descriptions should explain the command's function and potential risks
  • Help you quickly understand the command's impact when confirming
  • Example: "Force delete all untracked files, irreversible"

4. Regularly Review Configuration

  • Regularly check configured sensitive commands
  • Delete custom rules that are no longer needed
  • Adjust protection scope according to project needs

5. Team Collaboration Suggestions

If using in a team environment:

  • Share commonly used custom sensitive command configurations
  • Unify team command protection standards
  • Train team members to understand the importance of sensitive commands

How Sensitive Commands Work

When the AI suggests executing a command, Snow CLI will:

  1. Check if Command Matches Sensitive Pattern

    • Iterate through all enabled sensitive command rules
    • Use regular expressions to match command content

  2. Trigger Confirmation Process

    • If the command matches any sensitive pattern
    • Pause execution and display confirmation dialog
    • Display command content and warning information

  3. Wait for User Decision

    • User can choose to execute or cancel
    • After cancellation, AI receives feedback and may suggest alternatives
    • After execution, command runs normally

  4. Execute Directly if Not Matched

    • If the command does not match any sensitive pattern
    • Execute directly without additional confirmation

Common Questions

Q: Does sensitive commands configuration affect all projects?

A: Yes. Sensitive commands configuration is global and applies to all projects using Snow CLI. This ensures consistent security protection.

Q: Can I temporarily disable protection for a specific sensitive command?

A: Yes. Enter the sensitive commands configuration interface, find the corresponding command and press Space to disable it. After completing the operation, it is recommended to re-enable the protection.

Q: Is regular expression matching case-sensitive?

A: This depends on how you write your regular expression. If you need case-insensitive matching, you can use case-insensitive patterns or match both uppercase and lowercase variants simultaneously.

Q: What if I accidentally delete a custom command?

A: Deletion operations are irreversible, but you can re-add the command. It is recommended to record important custom configurations or regularly backup the configuration file.

Q: Can sensitive commands protection completely prevent command execution?

A: No. Sensitive commands protection only provides confirmation prompts; whether to execute is ultimately decided by the user. This is to maintain flexibility while ensuring security.

Q: Can system built-in commands be permanently deleted?

A: No, but you can disable them. If you need to restore them, use the "Reset to Default Configuration" function.

Q: Do I need to restart Snow CLI after adding a custom command?

A: No. Configuration changes take effect immediately and will be applied the next time the AI suggests executing a command.

Configuration File Location

Sensitive commands configuration is stored in the Snow CLI configuration directory:

  • Windows: %USERPROFILE%\.snow\sensitive-commands.json
  • macOS/Linux: ~/.snow/sensitive-commands.json

You can directly edit this file for batch configuration, but it is recommended to use the configuration interface to ensure correct formatting.

Related Features