Build the main validator chain and hard path constraints

One attack class per validator, plus constraints nothing can override.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

Implement single-purpose main-chain validators, each with its own tests: shell metacharacters that split commands (';', '|', '&' outside quotes), IFS-injection, redirection detection (informational severity), sub-command extraction for compound commands so each piece is checked (a benign-looking second command reading credentials is the classic leak). Then implement the hard constraints layer: a protected-path denylist (system roots, credential directories) that blocks removal operations regardless of any permission rule, correct handling of the '--' separator so flags cannot smuggle paths past extraction, and for your riskiest allowed tool (e.g. sed-like editors), a whitelist of safe forms plus a denylist of dangerous sub-features (write-file and execute commands, non-ASCII lookalikes, multiline programs). Keep validators stateless and independent.

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

A chain of tested single-purpose validators plus unoverridable path constraints.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Each validator targets exactly one attack classCompound commands are split and each part validatedProtected paths block removal even with explicit permission

Do not continue if…

! One mega-function of nested ifs where fixing one check breaks another
! Validators that mutate shared parse state, creating order-dependent bugs
! Path checks that trust permission rules over the hard denylist
! First-match-wins reporting that surfaces a warning while hiding a critical finding

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

Two validators disagree on the same command. That is by design - selection handles it. But if one validator's correctness depends on another running first, you have hidden coupling: move the shared work into preprocessing so each validator reads the same immutable context.