command-executionlisted

# Command Execution ``` ONE COMMAND. ONE RESULT. ONE EXIT CODE. Reach for the native flag before the pipe; the file tool before the shell. ``` The runtime hard-blocks pipes, redirects, and chaining for cloud/infra CLIs (gcloud, kubectl, terraform, and others across the cloud/k8s/iac families -- the authoritative, current set is `NATIVE_OUTPUT_FLAG_CLIS` in `hooks/modules/security/mutative_verbs.py`, not reproduced here since a hand-copied enumeration is exactly what went stale before) and blocks redirects and background `&` for every command — but the discipline applies to everything you run, not only what the hook catches. ## Mental Model When you reach for a pipe, you have not looked for the flag yet. CLIs have `--format`, `--filter`, `--limit` flags that do what pipes do — without hiding exit codes or triggering extra permission prompts. When you want to chain with `&&`, stop. Run one command, verify the exit code, then run the next. Two verified commands beat one fragile chain. For file I/O, always use Claude Code tools over Bash: | Bash | Claude Code tool | |---|---| | `cat`, `head`, `tail` | Read | | `echo >`, heredocs | Write | | `sed -i`, `awk` | Edit | | `grep -r`, `rg` | Grep | | `find` | Glob | The agent cwd resets between Bash calls, so a relative path resolves against an unknown directory — pass absolute paths or the CLI's `-chdir`. ## Rules 1. **No pipes** — find the CLI's native flag first. 2. **One command per step** — no `&&` or `;`. 2b. **No indire