Broaden command knowledge, refine high-traffic tools, harden risk (1.2.0)

[gmpassos]

Summary

Expands and deepens the command knowledge base and security detectors so an AI-agent / remote-executor consumer (e.g. omnyshell's :ai) reasons correctly about far more commands, and so genuinely dangerous tools no longer classify as "unknown → safe → read-only".

dart analyze clean · dart format applied · 394 tests pass (unit / regression / integration).

Breadth (new coverage)

• New plugins: DiskKnowledge, VcsKnowledge, ModernCliKnowledge, IacKnowledge (+ new infrastructure category).
• ~370 new commands across network inspection/transfer/cloud (incl. nmap, ip, ss, tcpdump, rclone, tailscale, cloud CLIs), build/test tooling (cmake, bazel, pytest, vite…), package/version managers (bun, uv, poetry, nix, rustup…), containers/orchestration (buildah, skopeo, minikube, kubectx…), databases, editors, crypto/secrets, process/hardware inspection, and archive/compression.

Depth (per-subcommand/argument refinement)

• kubectl/oc (read vs write vs delete[highRisk] vs exec), terraform/tofu/terragrunt/pulumi (plan read-only → apply mediumRisk → destroy/-auto-approve highRisk), systemctl (status read-only; reboot/poweroff highRisk), vault, npm/pnpm/yarn/bun run/exec, docker rm/prune, aws/gcloud/az delete-tokens, ansible-playbook --become.

Risk hardening (previously slipped through as safe)

• Disk-format/wipe (mkfs/mkfs.*/wipefs/blkdiscard) and dd of=/dev/... → critical (through wrappers like sudo); secure-delete srm/wipe; kernel-module / power / privileged-config tools; find / -delete; recursive chmod/chown on a system root; kill/pkill/killall catastrophic forms (PID 1 / -1 / pkill . / -u root); inline interpreter eval (python -c, node -e, osascript -e, deno eval, …).
• command -v/-V lookups no longer inherit the target's capabilities/risk (new WrapperSpec.lookupFlags), so command -v mkfs.ext4 is no longer a false critical.
• Normalization: batcat→bat, fdfind→fd, ripgrep→rg.

Notes

• Bumps version to 1.2.0 (see CHANGELOG).
• Consumer side (separate repo): omnyshell enables KnowledgeRiskDetector on its :ai shield so KB critical ratings hard-block; that change is not part of this PR.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 97.52475% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...capabilities/knowledge/plugins/disk_knowledge.dart	95.45%	1 Missing ⚠️
.../capabilities/knowledge/plugins/iac_knowledge.dart	93.33%	1 Missing ⚠️
...lities/knowledge/plugins/modern_cli_knowledge.dart	87.50%	1 Missing ⚠️
...abilities/knowledge/plugins/process_knowledge.dart	95.23%	1 Missing ⚠️
.../capabilities/knowledge/plugins/vcs_knowledge.dart	88.88%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!