Smith::Tools::AllowList

Shell metacharacters. The command is split on these and every resulting segment must match the allowlist on its own.

Splitting only ever produces more and smaller segments, never a larger one, so injected code can never hide inside an allowed prefix — it always becomes its own segment that must itself be listed.

This is deliberately not a shell parser: metacharacters inside quotes are split too, so echo "hi; there" falls through to the prompt. That errs towards asking too often, never towards allowing too much. Shared with the rule engine, which applies the same segmentation before matching a pattern against each part.