Repository: GoogleCloudPlatform/kubectl-ai
File: pkg/tools/kubectl_filter.go (Go)

Code before:
	if len(args) == 0 {
		klog.Warning("analyzeCall: no arguments extracted from call")
		return "unknown"
	}

	// Check if first argument is kubectl
	firstArg := args[0]

	// Reject quoted arguments (e.g., '"/path/kubectl"')
	if (strings.HasPrefix(firstArg, "'") && strings.HasSuffix(firstArg, "'")) || (strings.HasPrefix(firstArg, "\"") && strings.HasSuffix(firstArg, "\"")) {
		klog.V(2).Infof("analyzeCall: first arg is quoted: %q", firstArg)
		return "unknown"
	}

	// Check if this is kubectl
	if !strings.Contains(firstArg, "kubectl") {
		klog.V(2).Infof("analyzeCall: first arg does not contain kubectl: %q", firstArg)
		return "unknown"
	}

	klog.V(2).Infof("analyzeCall: found kubectl: %q", firstArg)

	// Find the verb: first non-flag argument after "kubectl"
	verb := ""
	subVerb := ""
	for i := 1; i < len(args); i++ {
		if !strings.HasPrefix(args[i], "-") {
			if verb == "" {
				verb = args[i]
			} else {
				subVerb = args[i]
				break
			}
		}
	}
	if verb == "" {
		klog.Warningf("analyzeCall: no verb found after kubectl in args: %v", args)
		return "unknown"
	}

	hasDryRun := hasDryRunFlag(strings.Join(args, " "))

	// Check standard operations - write operations first (prioritize immediate detection)
	if (writeOps[verb] || writeSubOps[verb][subVerb]) && !hasDryRun {
		klog.V(1).Infof("analyzeCall: write op for verb=%q subVerb=%q", verb, subVerb)
		return "yes"
	}

	// Check read-only operations or dry-run write operations
	if (readOnlyOps[verb] || readOnlySubOps[verb][subVerb]) || ((writeOps[verb] || writeSubOps[verb][subVerb]) && hasDryRun) {
		klog.V(1).Infof("analyzeCall: read op for verb=%q subVerb=%q (dry-run=%v)", verb, subVerb, hasDryRun)

Review comment (suggestion):
nit: you can simply use range here because indices are no longer useful in this case :)

```Go

for _, arg := range args {

}

```

Code after:
	if len(args) == 0 {
		klog.Warning("analyzeCall: no arguments extracted from call")
		return "unknown"
	}

	// Check if first argument is kubectl
	firstArg := args[0]

	// Reject quoted arguments (e.g., '"/path/kubectl"')
	if (strings.HasPrefix(firstArg, "'") && strings.HasSuffix(firstArg, "'")) || (strings.HasPrefix(firstArg, "\"") && strings.HasSuffix(firstArg, "\"")) {
		klog.V(2).Infof("analyzeCall: first arg is quoted: %q", firstArg)
		return "unknown"
	}

	// Check if this is kubectl
	if !strings.Contains(firstArg, "kubectl") {
		klog.V(2).Infof("analyzeCall: first arg does not contain kubectl: %q", firstArg)
		return "unknown"
	}

	klog.V(2).Infof("analyzeCall: found kubectl: %q", firstArg)

	// Parse kubectl arguments to extract verb, subverb, and flags
	verb, subVerb, hasDryRun := parseKubectlArgs(args[1:])
	if verb == "" {
		klog.Warningf("analyzeCall: no verb found after kubectl in args: %v", args)
		return "unknown"
	}

	// Check standard operations - write operations first (prioritize immediate detection)
	if (writeOps[verb] || writeSubOps[verb][subVerb]) && !hasDryRun {
		klog.V(1).Infof("analyzeCall: write op for verb=%q subVerb=%q", verb, subVerb)
		return "yes"
	}

	// Check read-only operations or dry-run write operations
	if (readOnlyOps[verb] || readOnlySubOps[verb][subVerb]) || ((writeOps[verb] || writeSubOps[verb][subVerb]) && hasDryRun) {
		klog.V(1).Infof("analyzeCall: read op for verb=%q subVerb=%q (dry-run=%v)", verb, subVerb, hasDryRun)
		return "no"
	}

	klog.V(1).Infof("analyzeCall: unknown op for verb=%q subVerb=%q", verb, subVerb)
	return "unknown"
}

// parseKubectlArgs extracts verb, subverb, and dry-run flag from kubectl arguments
func parseKubectlArgs(args []string) (verb, subVerb string, hasDryRun bool) {
	for _, arg := range args {
		if strings.HasPrefix(arg, "--dry-run") {
			hasDryRun = true
		}