Add per-command confirmation checkpoint for risky shell operations

[shivadeore111-design]

Status check

CommandGate in core/toolRegistry.ts:133 hard-blocks a fixed denylist. Global /permissions ask mode requires approval for all destructive ops. No middle ground: per-command inline confirmation before executing a specific command that looks risky but isn't on the hard-block list (e.g. rm specific-file.txt, git reset --hard).

Description

Users want to allow most shell commands but still get a confirmation prompt for anything that deletes or overwrites files. The current binary (block vs allow) is too coarse. A risk-scoring layer that intercepts medium-risk commands and asks "run this? y/n" before execution would cover the gap without requiring full /permissions ask mode.

Acceptance criteria

• Risk scorer identifies medium-risk patterns (delete specific file, overwrite, git destructive ops)
• Inline confirmation prompt shown in CLI before execution
• User can say y, n, or always (suppress future prompts for same pattern)
• Hard-block list (CommandGate) unchanged — this adds a soft-confirm layer above it
• Non-interactive / headless mode auto-declines or auto-confirms based on env var

Pointers

• core/toolRegistry.ts:133–200 — CommandGate; extend with a MEDIUM_RISK_PATTERNS set
• cli/aiden.ts — prompt/confirm UI; @inquirer/prompts is already a dep
• core/agentLoop.ts — tool dispatch; intercept before shell_exec / run_python calls

Effort

M

[shivadeore111-design]

v3.20 overlap note: The planner tool selection work (v3.20, #35) touches agentLoop.ts and the tool dispatch path. When that lands, it's a good moment to bundle the destructive-op warning hook — both changes touch the pre-execution path. Flagging for sequencing.