refactor: cut cyclomatic complexity of five hot spots and pin their behavior with tests

Risk labels, menu callback parsing, settings callbacks, table cell width and
markdown link targets now use tables and small helpers (CC <= 10).

tests/command-templates.test.ts

@@ -350,3 +350,47 @@ test("Command templates report missing required placeholders", () => {
     /Missing command template value: missing/,
   );
 });
+
+test("Command template risk labels cover each detection branch and its inverse", () => {
+  const cases: Array<[string, string[]]> = [
+    ["echo hello", []],
+    ["bash script.sh", ["risk.shell"]],
+    ["sh -c {script}", ["risk.shell", "risk.eval"]],
+    ["node app.js", []],
+    ["node -e {code}", ["risk.eval"]],
+    ["bun --eval {code}", ["risk.eval"]],
+    ["python3 script.py", []],
+    ["python3 -c {code}", ["risk.eval"]],
+    ["ruby -e {code}", ["risk.eval"]],
+    ["rm file.txt", []],
+    ["rm -rf build", ["risk.destructive_fs"]],
+    ["rm -f build", ["risk.destructive_fs"]],
+    ["rm /etc/hosts", ["risk.destructive_fs"]],
+    ["mv a.txt b.txt", []],
+    ["cp a.txt ~/b.txt", ["risk.broad_fs_write"]],
+    ["rsync a b", ["risk.network"]],
+    ["rsync a /dst", ["risk.broad_fs_write", "risk.network"]],
+    ["curl https://example.com", ["risk.network"]],
+    ["git status", []],
+    ["git clone {url}", ["risk.network"]],
+    ["git push origin main", ["risk.external_side_effect", "risk.network"]],
+    ["npm install", ["risk.network"]],
+    ["npm publish", ["risk.external_side_effect", "risk.network"]],
+    ["kubectl get pods", ["risk.external_side_effect"]],
+    ["sleep 5", ["risk.long_running"]],
+    ["tail file.log", []],
+    ["tail -f file.log", ["risk.long_running"]],
+    ["tool --serve", ["risk.long_running"]],
+    ["systemctl restart x", ["risk.platform_specific"]],
+    ["gpg --decrypt {file}", ["risk.secret_touching"]],
+    ["tool --api-key {key}", ["risk.secret_touching"]],
+    ["tool --name value", []],
+  ];
+  for (const [template, expected] of cases) {
+    assert.deepEqual(
+      getCommandTemplateRiskLabels(template),
+      expected,
+      template,
+    );
+  }
+});