Allow silent file-output curl/wget downloads (#166)
Binary file downloads (CLI tools, archives) are no longer blocked when output goes to a file.
Algorithm
Each chained command segment is evaluated independently:
- ALLOW when ALL: file output (
-o/>) + silent (-s) + no verbose + no stdout alias - BLOCK otherwise (stdout flood risk)
Examples
# ALLOWED (silent + file output)
curl -sLo /tmp/stripe.tar.gz https://github.com/stripe/stripe-cli/releases/...
curl -s --output /tmp/data.json https://api.example.com/data
wget -qO /tmp/terraform.zip https://releases.hashicorp.com/...
# STILL BLOCKED
curl https://example.com # stdout flood
curl -o file url # no -s, progress bar floods stderr
curl -s -o - url # -o - = stdout alias
curl -sLo file url && curl https://api.com # second command floods9 new tests. Safety reviewed by Principal Engineer (10 adversarial cases evaluated).