Quick and dirty is to make a large field and then call QCMDEXC for whatever a user puts in the field.
Why give them a command line in the 1st place?
Alternatively, add a function key that simply causes CALL QSYS/QUSCMDLN. No need to handle much of anything in code with that. It’s a live command line that does essentially all of the work for you. The F-key can be enabled/disabled in whatever ways you choose.
More completely, have the F-key call a CL wrapper program that calls QUSCMDLN. Compile it and set its attributes as USRPRF(*USER) USEADPAUT(*NO). You want to ensure that no adopted authority gets snuck down to the command line.