Security Check Order (run_shell_command)

• allowAutoExecution master kill switch
• cd {sandboxRoot} exception — cd target validated; any chained part (&& cmd) still runs through blacklist/whitelist before execution
• Blacklist check (checkBlacklist()) — catches command at start, middle, and end of chained commands
• Whitelist check (checkWhitelist()) — if policy === allow_only
• Sandbox path validation — blocks .. traversal and absolute paths (drive letters after ;, |, &&)
• Test mode short-circuit (returns "COMMAND ALLOWED" without executing)
• Actual exec() call → result formatted by formatResult()

Key Behaviors

• Stdout returned in full — no truncation
• Exit code 1 treated as non-error (Number(exitCode) !== 1 — handles both numeric and string codes like 'ENOENT')
• Stderr always returned when present, including alongside stdout
• Timed-out commands return TIMEOUT: prefix immediately (checked before error handling in formatResult)
• Shell: cmd.exe for Windows, /bin/bash for Linux/macOS
• cd commands only allowed to exact sandbox root (not subdirectories); chained commands after && are still security-checked
• Windows drive letter detection matches C:\/D:/ after start-of-command, ;, |, or && — does NOT match colons in sed patterns
• Config re-read per-invocation so live LM Studio config changes take effect without restart

Helper Functions (toolsProvider.ts)

• formatResult(result) — single place for all output formatting; handles timeout, errors, stderr, stdout truncation
• checkBlacklist(commandLower, forbiddenStr) — reused for both main commands and chained parts of cd exceptions
• checkWhitelist(commandLower, allowedStr) — same reuse pattern