Smarter bash grouping: filter compound cmds, exclude dangerous flags, clearer UI

chook.mjs

···
         ),
     );
 
+    // Dangerous flag patterns per command — these get an exclude regex
+    // so the broad allow doesn't cover dangerous variants
+    const dangerousFlags = {
+      rm: "-r|-rf|--recursive",
+      chmod: "-R|--recursive",
+      chown: "-R|--recursive",
+    };
+
     // Group bash by first word (the command)
+    // Filter out compound commands (already blocked by metachar deny)
+    const metaCharRe = /[&;|`]|\$\(/;
     const bashByCmd = new Map();
     for (const e of bashEntries) {
       const cmd = e.tool_input.command || "";
+      // Skip compound commands — they're blocked separately
+      if (metaCharRe.test(cmd)) continue;
       const firstWord = cmd.split(/\s+/)[0];
       if (!firstWord) continue;
       if (!bashByCmd.has(firstWord)) bashByCmd.set(firstWord, []);
···
           ? subcommands.join(", ")
           : subcommands.slice(0, 3).join(", ") + `, +${subcommands.length - 3} more`;
 
+      let rule = `[[allow]]\ntool = "Bash"\ncommand_regex = "^${tomlEscape(regexEscape(cmd))} "`;
+      if (dangerousFlags[cmd]) {
+        rule += `\ncommand_exclude_regex = "${tomlEscape(dangerousFlags[cmd])}"`;
+      }
+
       groups.push({
         label: `Bash: ${cmd} (${cmdEntries.length} hits: ${summary})`,
-        rule: `[[allow]]\ntool = "Bash"\ncommand_regex = "^${tomlEscape(regexEscape(cmd))} "`,
+        rule,
         entries: cmdEntries,
       });
     }
···
 
     // Footer: examples + proposed rule + keys
     console.log("");
-    console.log("  \x1b[2mExamples:\x1b[0m");
+    console.log("  \x1b[2mSeen in audit log:\x1b[0m");
     for (let i = 0; i < exampleCount; i++) {
       const e = currentGroup.entries[i];
       const ti = e.tool_input;
       let detail =
         ti.command || ti.file_path || ti.notebook_path || ti.subagent_type || "";
       if (detail.length > cols - 8) detail = detail.slice(0, cols - 11) + "...";
-      console.log(`    ${detail}`);
+      console.log(`    \x1b[2m${detail}\x1b[0m`);
     }
     if (currentGroup.entries.length > exampleCount) {
       console.log(
···
       );
     }
     console.log("");
-    console.log("  \x1b[2mProposed rule:\x1b[0m");
+    console.log("  Rule to add (simple, non-compound commands only):");
     for (const line of ruleLines) {
-      console.log(`  ${line}`);
+      console.log(`  \x1b[1m${line}\x1b[0m`);
     }
     console.log("");
     console.log(