Constrain Bash date read-only flags

Author: SqlRush

docs/claude-code-go-rewrite-plan.md

@@ -256,6 +256,7 @@ test/parity/                 # golden tests against TS/official behavior
 - 本轮补充：Bash `grep`/`rg` read-only 分类现在会把 pattern-file 参数 `-f FILE`、`-fFILE` 和 `--file=FILE` 当作路径读取处理，缺值、绝对路径和 `..` 路径不再进入 read-only fast path。
 - 本轮补充：Bash `wc`/`du` 的 `--files0-from` 与 `find -files0-from` 不再进入 read-only fast path，避免通过受检列表文件间接读取未校验的绝对路径、父目录路径或敏感路径。
 - 本轮补充：Bash `file -f`/`--files-from` 这类间接路径列表读取，以及 `file -C`/`--compile` magic 编译形态不再进入 read-only fast path；普通 `file README.md` 和 `file --mime-type README.md` 保持只读。
+- 本轮补充：Bash `date` read-only 分类从无条件放行收敛到显示/解析/安全相对文件引用子集，拒绝 `date -s`/`--set`、legacy positional 设置时间和越界 `--reference`/`--file` 读取。
 - 本轮补充：Bash/PowerShell read-only 分类会先校验 tokenizer 视角的语法完整性，未闭合 quote 或末尾 escape/line-continuation 不再进入只读 fast path。
 - 本轮补充：Bash/PowerShell tokenizer 现在按 single-quoted literal 处理单引号内的 escape 字符，Bash 的 `\` 和 PowerShell 的 backtick 在单引号内不再导致错误的 quote/segment/token 状态。
 - 本轮补充：Bash/PowerShell 分类现在把未引用 newline 作为命令分隔符，并支持未引用 `#` 行注释剥离；注释文本不再污染分类，下一行命令仍保留 read-only/destructive 判断。

docs/first-second-parity-audit.md

@@ -214,6 +214,7 @@ Covered behavior:
 - `Bash` `find` read-only classification now rejects deleting or file-writing actions such as `-delete`, `-fprint`, `-fprint0`, `-fprintf`, and `-fls`, avoiding commands that mutate files being auto-allowed as read-only.
 - `Bash` safety classification now excludes `find -exec*` forms from read-only auto-allow and detects destructive commands passed through `find -exec*`/`xargs`, including shell `-c` scripts and safe-wrapper/env/assignment forms such as `env rm`, `timeout rm`, and `xargs -I{} env sh -c ...`.
 - `Bash` `file` read-only classification now rejects indirect `-f`/`--files-from` path-list reads and `-C`/`--compile` magic compilation forms while preserving ordinary relative-path file inspection.
+- `Bash` `date` read-only classification now allows only display, date-string parsing, and safe relative `--reference`/`--file` reads while rejecting `-s`/`--set`, legacy positional system-time setting, and absolute/parent date-file references.
 - `PowerShell` native/external file-reading/search read-only classification now applies relative-path guards to `where.exe /R`, `file`, `tree`, and `findstr` path positionals and path-valued flags, rejecting Windows-drive, UNC, URI/provider-like, parent-directory, and missing path-flag values before read-only auto-allow; `where.exe` no longer uses allow-all flag acceptance.
 - `PowerShell` native path guards now validate `findstr /D:` semicolon-separated directory lists item by item and treat `file -p` as a switch instead of a value-taking flag, closing path-guard bypasses through quoted directory lists or short-flag value misclassification.
 - `PowerShell` native `file` classification now rejects `-f`, attached `-ffile`, and `--files-from` indirect path-list reads, avoiding auto-allow for list-file contents that the classifier cannot inspect.

internal/tools/bash/tools.go

@@ -2139,7 +2139,9 @@ func readOnlyWords(words []string) bool {
 		return readOnlySed(words[1:])
 	case "awk", "gawk", "mawk", "nawk":
 		return readOnlyAwk(words[1:])
-	case "pwd", "printf", "echo", "date", "whoami", "id", "uname", "printenv", "which", "type":
+	case "date":
+		return readOnlyDate(words[1:])
+	case "pwd", "printf", "echo", "whoami", "id", "uname", "printenv", "which", "type":
 		return true
 	case "env":
 		return readOnlyEnv(words)
@@ -2152,6 +2154,93 @@ func readOnlyWords(words []string) bool {
 	}
 }
 
+func readOnlyDate(args []string) bool {
+	for i := 0; i < len(args); i++ {
+		arg := args[i]
+		switch {
+		case arg == "--":
+			for _, rest := range args[i+1:] {
+				if !safeDateFormat(rest) {
+					return false
+				}
+			}
+			return true
+		case arg == "-u" || arg == "--utc" || arg == "--universal" || arg == "-R" || arg == "--rfc-email" || arg == "--debug":
+			continue
+		case arg == "-s" || arg == "--set" || strings.HasPrefix(arg, "--set="):
+			return false
+		case arg == "-d" || arg == "--date":
+			i++
+			if i >= len(args) || !safeDateValue(args[i]) {
+				return false
+			}
+		case strings.HasPrefix(arg, "-d") && len(arg) > 2:
+			if !safeDateValue(arg[2:]) {
+				return false
+			}
+		case strings.HasPrefix(arg, "--date="):
+			if !safeDateValue(strings.TrimPrefix(arg, "--date=")) {
+				return false
+			}
+		case arg == "-r" || arg == "--reference" || arg == "-f" || arg == "--file":
+			i++
+			if i >= len(args) || !safeRelativeShellPathArg(args[i]) {
+				return false
+			}
+		case strings.HasPrefix(arg, "--reference="):
+			if !safeRelativeShellPathArg(strings.TrimPrefix(arg, "--reference=")) {
+				return false
+			}
+		case strings.HasPrefix(arg, "--file="):
+			if !safeRelativeShellPathArg(strings.TrimPrefix(arg, "--file=")) {
+				return false
+			}
+		case strings.HasPrefix(arg, "-"):
+			if !safeDateDisplayFlag(arg) {
+				return false
+			}
+		default:
+			if !safeDateFormat(arg) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func safeDateDisplayFlag(flag string) bool {
+	switch {
+	case flag == "-I":
+		return true
+	case strings.HasPrefix(flag, "-I"):
+		return safeDateValue(strings.TrimPrefix(flag, "-I"))
+	case strings.HasPrefix(flag, "--iso-8601"):
+		return safeOptionalDatePrecision(flag, "--iso-8601")
+	case strings.HasPrefix(flag, "--rfc-3339"):
+		return safeOptionalDatePrecision(flag, "--rfc-3339")
+	default:
+		return false
+	}
+}
+
+func safeOptionalDatePrecision(flag string, name string) bool {
+	if flag == name {
+		return true
+	}
+	value, ok := strings.CutPrefix(flag, name+"=")
+	return ok && safeDateValue(value)
+}
+
+func safeDateFormat(value string) bool {
+	value = strings.Trim(strings.TrimSpace(value), `"'`)
+	return strings.HasPrefix(value, "+") && safeDateValue(value[1:])
+}
+
+func safeDateValue(value string) bool {
+	value = strings.Trim(strings.TrimSpace(value), `"'`)
+	return value != "" && !strings.ContainsAny(value, "$`\x00><|;&\n\r")
+}
+
 func readOnlyPathCommand(words []string) bool {
 	command := filepathBase(words[0])
 	for i := 1; i < len(words); i++ {

internal/tools/bash/tools_test.go

@@ -266,6 +266,11 @@ func TestBashCommandClassification(t *testing.T) {
 		"pwd # rm -rf build",
 		"printf '# rm -rf build'",
 		"printf '$(rm -rf build)'",
+		"date",
+		"date -u +%Y-%m-%dT%H:%M:%SZ",
+		"date --date 'next friday' +%F",
+		"date --reference README.md +%s",
+		"date --file dates.txt +%F",
 		"pwd\nls -la",
 	}
 	for _, command := range readOnly {
@@ -400,6 +405,11 @@ func TestBashCommandClassification(t *testing.T) {
 		"cat 'README.md",
 		"git status --short \"",
 		"printf hello \\",
+		"date -s tomorrow",
+		"date --set=tomorrow",
+		"date 010112002026",
+		"date --reference=/etc/passwd +%s",
+		"date -f ../dates.txt",
 		"cat 'README.md; rm -rf build",
 		"pwd\nmake build",
 		"pwd & ls -la",