# ADR-v2-065 — Terminal Command Safety Gate

**Status:** Accepted (2026-07-02) · Wave I
**Context links:** [[adr-v2-047-field-aware-dictation]] (refuses password fields), [[adr-v2-050-redaction-ink]], [[adr-011]]

## Context

Wave I research (#6) — when dictation targets a terminal, a destructive command
(`rm -rf`, `dd of=…`, `mkfs`, `git push --force`, `curl … | sh`, fork bomb) should be held until
you say "confirm", so a misrecognition can't fire an irreversible action. Distinct from every
existing feature: none inspects *command semantics* before injection (Field-Aware refuses
password *fields*; Redaction masks *PII text*).

## Decision

Add an opt-in **Terminal Command Safety Gate**: `[cmdsafety] enabled=false`. The pure core
`assess_command(text)` returns a `RiskAssessment(level, reason)` where level is
`safe` | `caution` | `dangerous`, from an ordered regex ruleset (destructive deletes, disk
writes, filesystem format, force-push/hard-reset, pipe-to-shell, fork bomb, recursive chmod 777;
`sudo`/`mv`-overwrite → caution). A `ConfirmGate` state machine holds a dangerous command until
`confirm()` is called (spoken "confirm"). Dependency-free. Focus-is-a-terminal detection and an
optional small classifier for fuzzy cases are deferred. OFF by default.

## Consequences

- First execution-risk gate; a safety win a cloud dictation tool structurally cannot offer (it
  has no view of your terminal).
- Pure ruleset + state machine → fully testable with no shell.
- Caveat: regex rules are conservative and can miss obfuscated commands → the gate is an aid, not
  a sandbox; off by default, and only ever *delays* injection pending confirmation.