@aetherai/aether 0.0.7 → 0.0.9

package/dist/CLI/packages/core/src/utils/shellAstParser.js

@@ -1,1140 +0,0 @@
-/**
- * @license
- * Copyright 2026 OEvortex
- * SPDX-License-Identifier: Apache-2.0
- */
-/**
- * Shell AST Parser — powered by web-tree-sitter + tree-sitter-bash.
- *
- * Provides:
- *   1. `initParser()`           – lazy singleton Parser initialisation
- *   2. `parseShellCommand()`    – parse a command string into a tree-sitter Tree
- *   3. `isShellCommandReadOnlyAST()` – AST-based read-only command detection
- *   4. `extractCommandRules()`  – extract minimum-scope wildcard permission rules
- */
-import Parser from 'web-tree-sitter';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { isShellCommandReadOnly } from './shellReadOnlyChecker.js';
-// ---------------------------------------------------------------------------
-// Constants
-// ---------------------------------------------------------------------------
-function resolveModuleFilePath(moduleFilePath) {
-    try {
-        const resolved = fs.realpathSync(moduleFilePath);
-        // Guard against test environments where `fs` is mocked and realpathSync
-        // returns undefined rather than throwing.
-        return typeof resolved === 'string' ? resolved : moduleFilePath;
-    }
-    catch {
-        return moduleFilePath;
-    }
-}
-/**
- * Root commands considered read-only by default (no sub-command analysis needed
- * unless explicitly listed in COMMANDS_WITH_SUBCOMMANDS).
- */
-const READ_ONLY_ROOT_COMMANDS = new Set([
-    'awk',
-    'basename',
-    'cat',
-    'cd',
-    'column',
-    'cut',
-    'df',
-    'dirname',
-    'du',
-    'echo',
-    'env',
-    'find',
-    'git',
-    'grep',
-    'head',
-    'less',
-    'ls',
-    'more',
-    'printenv',
-    'printf',
-    'ps',
-    'pwd',
-    'rg',
-    'ripgrep',
-    'sed',
-    'sort',
-    'stat',
-    'tail',
-    'tree',
-    'uniq',
-    'wc',
-    'which',
-    'where',
-    'whoami',
-]);
-/** Git sub-commands considered read-only. */
-const READ_ONLY_GIT_SUBCOMMANDS = new Set([
-    'blame',
-    'branch',
-    'cat-file',
-    'diff',
-    'grep',
-    'log',
-    'ls-files',
-    'remote',
-    'rev-parse',
-    'show',
-    'status',
-    'describe',
-]);
-/** git remote actions that mutate state. */
-const BLOCKED_GIT_REMOTE_ACTIONS = new Set([
-    'add',
-    'remove',
-    'rename',
-    'set-url',
-    'prune',
-    'update',
-]);
-/** git branch flags that mutate state. */
-const BLOCKED_GIT_BRANCH_FLAGS = new Set([
-    '-d',
-    '-D',
-    '--delete',
-    '--move',
-    '-m',
-]);
-/** find flags that have side-effects. */
-const BLOCKED_FIND_FLAGS = new Set([
-    '-delete',
-    '-exec',
-    '-execdir',
-    '-ok',
-    '-okdir',
-]);
-const BLOCKED_FIND_PREFIXES = ['-fprint', '-fprintf'];
-/** sed flags that cause in-place editing. */
-const BLOCKED_SED_PREFIXES = ['-i'];
-/** AWK side-effect patterns that can execute commands or write files. */
-const AWK_SIDE_EFFECT_PATTERNS = [
-    /system\s*\(/,
-    /print\s+[^>|]*>\s*"[^"]*"/,
-    /printf\s+[^>|]*>\s*"[^"]*"/,
-    /print\s+[^>|]*>>\s*"[^"]*"/,
-    /printf\s+[^>|]*>>\s*"[^"]*"/,
-    /print\s+[^|]*\|\s*"[^"]*"/,
-    /printf\s+[^|]*\|\s*"[^"]*"/,
-    /getline\s*<\s*"[^"]*"/,
-    /"[^"]*"\s*\|\s*getline/,
-    /close\s*\(/,
-];
-/** SED side-effect patterns. */
-const SED_SIDE_EFFECT_PATTERNS = [
-    /[^\\]e\s/,
-    /^e\s/,
-    /[^\\]w\s/,
-    /^w\s/,
-    /[^\\]r\s/,
-    /^r\s/,
-];
-/**
- * Write-redirection operators in file_redirect nodes.
- * Input-only redirections (`<`, `<<`, `<<<`) are safe.
- */
-const WRITE_REDIRECT_OPERATORS = new Set(['>', '>>', '&>', '&>>', '>|']);
-/**
- * Map of root command → known sub-command sets.
- * Used by `extractCommandRules()` to identify sub-commands vs arguments.
- */
-const KNOWN_SUBCOMMANDS = {
-    git: new Set([
-        'add',
-        'am',
-        'archive',
-        'bisect',
-        'blame',
-        'branch',
-        'bundle',
-        'cat-file',
-        'checkout',
-        'cherry-pick',
-        'clean',
-        'clone',
-        'commit',
-        'config',
-        'describe',
-        'diff',
-        'fetch',
-        'format-patch',
-        'gc',
-        'grep',
-        'init',
-        'log',
-        'ls-files',
-        'ls-remote',
-        'merge',
-        'mv',
-        'notes',
-        'pull',
-        'push',
-        'range-diff',
-        'rebase',
-        'reflog',
-        'remote',
-        'reset',
-        'restore',
-        'revert',
-        'rev-parse',
-        'rm',
-        'shortlog',
-        'show',
-        'stash',
-        'status',
-        'submodule',
-        'switch',
-        'tag',
-        'worktree',
-    ]),
-    npm: new Set([
-        'access',
-        'adduser',
-        'audit',
-        'bugs',
-        'cache',
-        'ci',
-        'completion',
-        'config',
-        'create',
-        'dedupe',
-        'deprecate',
-        'diff',
-        'dist-tag',
-        'docs',
-        'doctor',
-        'edit',
-        'exec',
-        'explain',
-        'explore',
-        'find-dupes',
-        'fund',
-        'help',
-        'hook',
-        'init',
-        'install',
-        'install-ci-test',
-        'install-test',
-        'link',
-        'login',
-        'logout',
-        'ls',
-        'org',
-        'outdated',
-        'owner',
-        'pack',
-        'ping',
-        'pkg',
-        'prefix',
-        'profile',
-        'prune',
-        'publish',
-        'query',
-        'rebuild',
-        'repo',
-        'restart',
-        'root',
-        'run',
-        'run-script',
-        'search',
-        'set-script',
-        'shrinkwrap',
-        'star',
-        'stars',
-        'start',
-        'stop',
-        'team',
-        'test',
-        'token',
-        'uninstall',
-        'unpublish',
-        'unstar',
-        'update',
-        'version',
-        'view',
-        'whoami',
-    ]),
-    yarn: new Set([
-        'add',
-        'autoclean',
-        'bin',
-        'cache',
-        'check',
-        'config',
-        'create',
-        'generate-lock-entry',
-        'global',
-        'help',
-        'import',
-        'info',
-        'init',
-        'install',
-        'licenses',
-        'link',
-        'list',
-        'login',
-        'logout',
-        'outdated',
-        'owner',
-        'pack',
-        'policies',
-        'publish',
-        'remove',
-        'run',
-        'tag',
-        'team',
-        'test',
-        'unlink',
-        'unplug',
-        'upgrade',
-        'upgrade-interactive',
-        'version',
-        'versions',
-        'why',
-        'workspace',
-        'workspaces',
-    ]),
-    pnpm: new Set([
-        'add',
-        'audit',
-        'create',
-        'dedupe',
-        'deploy',
-        'dlx',
-        'env',
-        'exec',
-        'fetch',
-        'import',
-        'init',
-        'install',
-        'install-test',
-        'licenses',
-        'link',
-        'list',
-        'ls',
-        'outdated',
-        'pack',
-        'patch',
-        'patch-commit',
-        'prune',
-        'publish',
-        'rebuild',
-        'remove',
-        'root',
-        'run',
-        'server',
-        'setup',
-        'store',
-        'test',
-        'uninstall',
-        'unlink',
-        'update',
-        'why',
-    ]),
-    docker: new Set([
-        'attach',
-        'build',
-        'commit',
-        'compose',
-        'container',
-        'context',
-        'cp',
-        'create',
-        'diff',
-        'events',
-        'exec',
-        'export',
-        'history',
-        'image',
-        'images',
-        'import',
-        'info',
-        'inspect',
-        'kill',
-        'load',
-        'login',
-        'logout',
-        'logs',
-        'manifest',
-        'network',
-        'node',
-        'pause',
-        'plugin',
-        'port',
-        'ps',
-        'pull',
-        'push',
-        'rename',
-        'restart',
-        'rm',
-        'rmi',
-        'run',
-        'save',
-        'search',
-        'secret',
-        'service',
-        'stack',
-        'start',
-        'stats',
-        'stop',
-        'swarm',
-        'system',
-        'tag',
-        'top',
-        'trust',
-        'unpause',
-        'update',
-        'version',
-        'volume',
-        'wait',
-    ]),
-    pip: new Set([
-        'install',
-        'download',
-        'uninstall',
-        'freeze',
-        'inspect',
-        'list',
-        'show',
-        'check',
-        'config',
-        'search',
-        'cache',
-        'index',
-        'wheel',
-        'hash',
-        'completion',
-        'debug',
-        'help',
-    ]),
-    pip3: new Set([
-        'install',
-        'download',
-        'uninstall',
-        'freeze',
-        'inspect',
-        'list',
-        'show',
-        'check',
-        'config',
-        'search',
-        'cache',
-        'index',
-        'wheel',
-        'hash',
-        'completion',
-        'debug',
-        'help',
-    ]),
-    cargo: new Set([
-        'add',
-        'bench',
-        'build',
-        'check',
-        'clean',
-        'clippy',
-        'doc',
-        'fetch',
-        'fix',
-        'fmt',
-        'generate-lockfile',
-        'init',
-        'install',
-        'locate-project',
-        'login',
-        'metadata',
-        'new',
-        'owner',
-        'package',
-        'pkgid',
-        'publish',
-        'read-manifest',
-        'remove',
-        'report',
-        'run',
-        'rustc',
-        'rustdoc',
-        'search',
-        'test',
-        'tree',
-        'uninstall',
-        'update',
-        'vendor',
-        'verify-project',
-        'version',
-        'yank',
-    ]),
-    kubectl: new Set([
-        'annotate',
-        'api-resources',
-        'api-versions',
-        'apply',
-        'attach',
-        'auth',
-        'autoscale',
-        'certificate',
-        'cluster-info',
-        'completion',
-        'config',
-        'cordon',
-        'cp',
-        'create',
-        'debug',
-        'delete',
-        'describe',
-        'diff',
-        'drain',
-        'edit',
-        'events',
-        'exec',
-        'explain',
-        'expose',
-        'get',
-        'kustomize',
-        'label',
-        'logs',
-        'patch',
-        'plugin',
-        'port-forward',
-        'proxy',
-        'replace',
-        'rollout',
-        'run',
-        'scale',
-        'set',
-        'taint',
-        'top',
-        'uncordon',
-        'version',
-        'wait',
-    ]),
-    make: new Set([]), // make targets are positional, not subcommands
-};
-/** Docker multi-level sub-command support (e.g., `docker compose up`). */
-const DOCKER_COMPOSE_SUBCOMMANDS = new Set([
-    'build',
-    'config',
-    'cp',
-    'create',
-    'down',
-    'events',
-    'exec',
-    'images',
-    'kill',
-    'logs',
-    'ls',
-    'pause',
-    'port',
-    'ps',
-    'pull',
-    'push',
-    'restart',
-    'rm',
-    'run',
-    'start',
-    'stop',
-    'top',
-    'unpause',
-    'up',
-    'version',
-    'wait',
-    'watch',
-]);
-// ---------------------------------------------------------------------------
-// Parser Singleton
-// ---------------------------------------------------------------------------
-let parserInstance = null;
-let bashLanguage = null;
-let initPromise = null;
-/** Set to true permanently once WASM initialisation fails. */
-let parserInitFailed = false;
-/**
- * Resolve the path to a WASM file inside vendor/tree-sitter/.
- * Handles three deployment scenarios:
- *   - Source (src/utils/*.ts): 2 levels up to package root
- *   - Transpiled (dist/src/utils/*.js): 3 levels up
- *   - Bundle (dist/cli.js): vendor at same level (0 levels)
- *
- * For the bundle scenario the vendor directory must be located next to
- * the cli.js bundle file.  The challenge is that `import.meta.url` may
- * point to a symlink (e.g. `/usr/bin/qwen`) rather than the real file
- * (`/usr/lib/node_modules/@aether-cli/aether-cli/cli.js`), and whether
- * Node.js automatically resolves symlinks for `import.meta.url` depends
- * on the version and OS.  We therefore probe several candidate directories
- * and return the first path where the vendor file actually exists.
- */
-function resolveWasmPath(filename) {
-    const rawPath = fileURLToPath(import.meta.url);
-    // Source / transpiled case: vendor is at a fixed relative depth.
-    if (rawPath.includes(path.join('src', 'utils'))) {
-        const levelsUp = rawPath.endsWith('.ts') ? 2 : 3;
-        return path.join(path.dirname(rawPath), ...Array(levelsUp).fill('..'), 'vendor', 'tree-sitter', filename);
-    }
-    // Bundle case: probe candidate directories so that symlinked installations
-    // and non-standard installs (e.g. direct binary copy) are handled robustly.
-    const candidateDirs = getWasmCandidateDirs(rawPath);
-    for (const dir of candidateDirs) {
-        const candidate = path.join(dir, 'vendor', 'tree-sitter', filename);
-        try {
-            if (fs.existsSync(candidate))
-                return candidate;
-        }
-        catch {
-            /* ignore */
-        }
-    }
-    // Fallback: first candidate (caller will receive ENOENT if file is missing).
-    return path.join(candidateDirs[0] ?? path.dirname(rawPath), 'vendor', 'tree-sitter', filename);
-}
-/**
- * Return an ordered, deduplicated list of directories where the bundled
- * vendor directory might live.  We try multiple sources because:
- *
- *  1. `import.meta.url` may already be the real path (Node.js 18+ resolves
- *     symlinks for the entry module on most platforms).
- *  2. On some Linux configurations the symlink is NOT resolved, so we
- *     additionally try `fs.realpathSync` on the raw path.
- *  3. `process.argv[1]` is the path Node.js was actually invoked with and
- *     can differ from `import.meta.url` in certain execution environments.
- */
-function getWasmCandidateDirs(rawModulePath) {
-    const unique = new Set();
-    const add = (p) => {
-        if (p)
-            unique.add(p);
-    };
-    // Candidate 1: directory of import.meta.url as-is.
-    add(path.dirname(rawModulePath));
-    // Candidate 2: realpath of import.meta.url (resolves symlinks when
-    // Node.js has not already done so).
-    try {
-        const real = fs.realpathSync(rawModulePath);
-        if (typeof real === 'string')
-            add(path.dirname(real));
-    }
-    catch {
-        /* ignore */
-    }
-    // Candidate 3 & 4: same two approaches but using process.argv[1], which
-    // may point to the real file even when import.meta.url does not.
-    if (process.argv[1]) {
-        add(path.dirname(process.argv[1]));
-        try {
-            const real = fs.realpathSync(process.argv[1]);
-            if (typeof real === 'string')
-                add(path.dirname(real));
-        }
-        catch {
-            /* ignore */
-        }
-    }
-    return [...unique];
-}
-function resolveWasmPathForModule(filename, moduleFilePath, resolvePath = resolveModuleFilePath) {
-    const resolvedModuleFilePath = resolvePath(moduleFilePath);
-    const moduleDir = path.dirname(resolvedModuleFilePath);
-    const inSrcUtils = resolvedModuleFilePath.includes(path.join('src', 'utils'));
-    const levelsUp = !inSrcUtils
-        ? 0
-        : resolvedModuleFilePath.endsWith('.ts')
-            ? 2
-            : 3;
-    return path.join(moduleDir, ...Array(levelsUp).fill('..'), 'vendor', 'tree-sitter', filename);
-}
-/**
- * Initialise the tree-sitter Parser singleton.
- * Safe to call multiple times – only the first call does real work.
- */
-export async function initParser() {
-    if (parserInstance)
-        return;
-    // Once init has permanently failed, skip retrying to prevent hangs.
-    if (parserInitFailed)
-        throw new Error('tree-sitter WASM failed to initialise; using regex-based fallback');
-    if (initPromise)
-        return initPromise;
-    initPromise = (async () => {
-        const treeSitterWasm = resolveWasmPath('tree-sitter.wasm');
-        await Parser.init({
-            locateFile: () => treeSitterWasm,
-        });
-        parserInstance = new Parser();
-        bashLanguage = await Parser.Language.load(resolveWasmPath('tree-sitter-bash.wasm'));
-        parserInstance.setLanguage(bashLanguage);
-    })().catch((err) => {
-        // Mark as permanently failed so callers can use the regex fallback
-        // instead of retrying (which could cause the agent to hang).
-        parserInitFailed = true;
-        initPromise = null;
-        throw err;
-    });
-    return initPromise;
-}
-/**
- * Parse a shell command string into a tree-sitter Tree.
- * Initialises the parser lazily if needed.
- */
-export async function parseShellCommand(command) {
-    await initParser();
-    return parserInstance.parse(command);
-}
-/** Collect all descendant nodes of given types. */
-function collectDescendants(node, types) {
-    const result = [];
-    const stack = [node];
-    while (stack.length > 0) {
-        const current = stack.pop();
-        if (types.has(current.type)) {
-            result.push(current);
-        }
-        for (let i = current.childCount - 1; i >= 0; i--) {
-            stack.push(current.child(i));
-        }
-    }
-    return result;
-}
-/** Check if a tree contains any command_substitution or process_substitution node. */
-function containsCommandSubstitutionAST(node) {
-    return (collectDescendants(node, new Set(['command_substitution', 'process_substitution'])).length > 0);
-}
-/** Check if a redirected_statement contains a write-redirection. */
-function hasWriteRedirection(node) {
-    if (node.type !== 'redirected_statement')
-        return false;
-    for (let i = 0; i < node.childCount; i++) {
-        const child = node.child(i);
-        if (child.type === 'file_redirect') {
-            // The operator is the first non-descriptor child
-            for (let j = 0; j < child.childCount; j++) {
-                const op = child.child(j);
-                if (op.type === 'file_descriptor')
-                    continue;
-                // operator token
-                if (WRITE_REDIRECT_OPERATORS.has(op.type))
-                    return true;
-                break; // only check the operator position
-            }
-        }
-    }
-    return false;
-}
-/**
- * Extract the command_name text from a `command` node.
- * Handles leading variable_assignment(s) gracefully.
- */
-function getCommandName(commandNode) {
-    const nameNode = commandNode.childForFieldName('name');
-    if (!nameNode)
-        return null;
-    return nameNode.text.toLowerCase();
-}
-/**
- * Argument node extraction using field name iteration.
- */
-function getArgumentNodes(commandNode) {
-    const args = [];
-    for (let i = 0; i < commandNode.childCount; i++) {
-        const fieldName = commandNode.fieldNameForChild(i);
-        if (fieldName === 'argument') {
-            args.push(commandNode.child(i));
-        }
-    }
-    return args;
-}
-/**
- * Strip outer quotes from a token text.
- * tree-sitter preserves quotes in argument text (e.g., `'s/foo/bar/e'`),
- * but for pattern matching we need the unquoted content.
- */
-function stripOuterQuotes(text) {
-    if (text.length >= 2) {
-        if ((text.startsWith("'") && text.endsWith("'")) ||
-            (text.startsWith('"') && text.endsWith('"'))) {
-            return text.slice(1, -1);
-        }
-    }
-    return text;
-}
-// ---------------------------------------------------------------------------
-// Read-Only Analysis (per-command)
-// ---------------------------------------------------------------------------
-/**
- * Evaluate whether a single `command` node (simple command) is read-only.
- */
-function evaluateCommandReadOnly(commandNode) {
-    const root = getCommandName(commandNode);
-    if (!root)
-        return true; // pure variable assignment
-    const argNodes = getArgumentNodes(commandNode);
-    const argTexts = argNodes.map((n) => stripOuterQuotes(n.text));
-    if (!READ_ONLY_ROOT_COMMANDS.has(root))
-        return false;
-    // Command-specific analysis
-    if (root === 'git')
-        return evaluateGitReadOnly(argTexts);
-    if (root === 'find')
-        return evaluateFindReadOnly(argTexts);
-    if (root === 'sed')
-        return evaluateSedReadOnly(argTexts);
-    if (root === 'awk')
-        return evaluateAwkReadOnly(argTexts);
-    return true;
-}
-function evaluateGitReadOnly(args) {
-    // Skip global flags to find subcommand
-    let idx = 0;
-    while (idx < args.length && args[idx].startsWith('-')) {
-        const flag = args[idx].toLowerCase();
-        if (flag === '--version' || flag === '--help')
-            return true;
-        idx++;
-    }
-    if (idx >= args.length)
-        return true; // `git` with only flags
-    const subcommand = args[idx].toLowerCase();
-    if (!READ_ONLY_GIT_SUBCOMMANDS.has(subcommand))
-        return false;
-    const rest = args.slice(idx + 1);
-    if (subcommand === 'remote') {
-        return !rest.some((a) => BLOCKED_GIT_REMOTE_ACTIONS.has(a.toLowerCase()));
-    }
-    if (subcommand === 'branch') {
-        return !rest.some((a) => BLOCKED_GIT_BRANCH_FLAGS.has(a));
-    }
-    return true;
-}
-function evaluateFindReadOnly(args) {
-    for (const arg of args) {
-        const lower = arg.toLowerCase();
-        if (BLOCKED_FIND_FLAGS.has(lower))
-            return false;
-        if (BLOCKED_FIND_PREFIXES.some((p) => lower.startsWith(p)))
-            return false;
-    }
-    return true;
-}
-function evaluateSedReadOnly(args) {
-    for (const arg of args) {
-        if (BLOCKED_SED_PREFIXES.some((p) => arg.startsWith(p)) ||
-            arg === '--in-place') {
-            return false;
-        }
-    }
-    const scriptContent = args.join(' ');
-    return !SED_SIDE_EFFECT_PATTERNS.some((p) => p.test(scriptContent));
-}
-function evaluateAwkReadOnly(args) {
-    const scriptContent = args.join(' ');
-    return !AWK_SIDE_EFFECT_PATTERNS.some((p) => p.test(scriptContent));
-}
-// ---------------------------------------------------------------------------
-// Statement-level read-only analysis
-// ---------------------------------------------------------------------------
-/**
- * Recursively evaluate whether a statement AST node is read-only.
- *
- * Handles: command, pipeline, list, redirected_statement, subshell,
- * variable_assignment, negated_command, and compound statements.
- */
-function evaluateStatementReadOnly(node) {
-    switch (node.type) {
-        case 'command':
-            // Check for command substitution anywhere inside the command
-            if (containsCommandSubstitutionAST(node))
-                return false;
-            return evaluateCommandReadOnly(node);
-        case 'pipeline': {
-            // All commands in the pipeline must be read-only
-            for (const child of node.namedChildren) {
-                if (!evaluateStatementReadOnly(child))
-                    return false;
-            }
-            return true;
-        }
-        case 'list': {
-            // All commands joined by && / || must be read-only
-            for (const child of node.namedChildren) {
-                if (!evaluateStatementReadOnly(child))
-                    return false;
-            }
-            return true;
-        }
-        case 'redirected_statement': {
-            // Write redirections make it non-read-only
-            if (hasWriteRedirection(node))
-                return false;
-            // Evaluate the body statement
-            const body = node.namedChildren[0];
-            return body ? evaluateStatementReadOnly(body) : true;
-        }
-        case 'subshell': {
-            // Evaluate all statements inside the subshell
-            for (const child of node.namedChildren) {
-                if (!evaluateStatementReadOnly(child))
-                    return false;
-            }
-            return true;
-        }
-        case 'compound_statement': {
-            // { cmd1; cmd2; } – evaluate each inner statement
-            for (const child of node.namedChildren) {
-                if (!evaluateStatementReadOnly(child))
-                    return false;
-            }
-            return true;
-        }
-        case 'variable_assignment':
-        case 'variable_assignments':
-            // Pure assignments without a command – read-only (just sets env)
-            return true;
-        case 'negated_command': {
-            const inner = node.namedChildren[0];
-            return inner ? evaluateStatementReadOnly(inner) : true;
-        }
-        case 'function_definition':
-            // Function definitions are not read-only operations per se
-            return false;
-        case 'if_statement':
-        case 'while_statement':
-        case 'for_statement':
-        case 'case_statement':
-        case 'c_style_for_statement':
-            // Control flow constructs – conservatively non-read-only
-            return false;
-        case 'declaration_command':
-            // export/declare/local/readonly/typeset – can modify env
-            return false;
-        default:
-            // Unknown node types – conservatively non-read-only
-            return false;
-    }
-}
-// ---------------------------------------------------------------------------
-// Public API: isShellCommandReadOnlyAST
-// ---------------------------------------------------------------------------
-/**
- * AST-based check whether a shell command is read-only.
- *
- * Replaces the regex-based `isShellCommandReadOnly()` from shellReadOnlyChecker.ts.
- * This version uses tree-sitter-bash for accurate parsing of:
- *   - Compound commands (&&, ||, ;, |)
- *   - Redirections (>, >>)
- *   - Command substitution ($(), ``)
- *   - Sub-shells, heredocs, etc.
- *
- * @param command - The shell command string to evaluate.
- * @returns `true` if the command only performs read-only operations.
- */
-export async function isShellCommandReadOnlyAST(command) {
-    if (typeof command !== 'string' || !command.trim())
-        return false;
-    // If the WASM parser is permanently unavailable (e.g. WASM file missing
-    // after a symlinked install), fall back to the regex-based checker so the
-    // agent remains functional instead of hanging or crashing.
-    if (parserInitFailed) {
-        return isShellCommandReadOnly(command);
-    }
-    try {
-        const tree = await parseShellCommand(command);
-        const root = tree.rootNode;
-        // Empty program
-        if (root.namedChildCount === 0)
-            return false;
-        // Evaluate every top-level statement
-        for (const stmt of root.namedChildren) {
-            if (!evaluateStatementReadOnly(stmt)) {
-                tree.delete();
-                return false;
-            }
-        }
-        tree.delete();
-        return true;
-    }
-    catch {
-        // Unexpected runtime failure (e.g. WASM init error on first call) –
-        // fall back to the regex-based checker rather than propagating the error.
-        return isShellCommandReadOnly(command);
-    }
-}
-// ---------------------------------------------------------------------------
-// Public API: extractCommandRules
-// ---------------------------------------------------------------------------
-/**
- * Extract a simple command's root + subcommand from a `command` AST node.
- *
- * Returns a rule string following the minimum-scope principle:
- *   - root + known subcommand + `*` if there are remaining args
- *   - root + `*` if no known subcommand but has args
- *   - root only if the command has no args at all
- */
-function extractRuleFromCommand(commandNode) {
-    const rootName = getCommandName(commandNode);
-    if (!rootName)
-        return null;
-    const argNodes = getArgumentNodes(commandNode);
-    const argTexts = argNodes.map((n) => n.text);
-    // Skip leading flags to find potential subcommand
-    let idx = 0;
-    while (idx < argTexts.length && argTexts[idx].startsWith('-')) {
-        idx++;
-    }
-    const knownSubs = KNOWN_SUBCOMMANDS[rootName];
-    let rule = rootName;
-    if (knownSubs && knownSubs.size > 0 && idx < argTexts.length) {
-        const potentialSub = argTexts[idx].toLowerCase();
-        if (knownSubs.has(potentialSub)) {
-            rule = `${rootName} ${argTexts[idx]}`;
-            // Docker multi-level: docker compose <sub>
-            if (rootName === 'docker' &&
-                potentialSub === 'compose' &&
-                idx + 1 < argTexts.length) {
-                const composeSub = argTexts[idx + 1].toLowerCase();
-                if (DOCKER_COMPOSE_SUBCOMMANDS.has(composeSub)) {
-                    rule = `${rootName} compose ${argTexts[idx + 1]}`;
-                    // Remaining args after compose sub
-                    if (idx + 2 < argTexts.length) {
-                        rule += ' *';
-                    }
-                    return rule;
-                }
-            }
-            // Remaining args after subcommand
-            if (idx + 1 < argTexts.length) {
-                rule += ' *';
-            }
-            return rule;
-        }
-    }
-    // No known subcommand – if there are any args, append *
-    if (argTexts.length > 0) {
-        rule += ' *';
-    }
-    return rule;
-}
-/**
- * Recursively extract rules from a statement node.
- * Handles pipeline, list, redirected_statement, etc.
- */
-function extractRulesFromStatement(node) {
-    switch (node.type) {
-        case 'command':
-            return [extractRuleFromCommand(node)].filter(Boolean);
-        case 'pipeline':
-        case 'list':
-        case 'compound_statement':
-        case 'subshell': {
-            const rules = [];
-            for (const child of node.namedChildren) {
-                rules.push(...extractRulesFromStatement(child));
-            }
-            return rules;
-        }
-        case 'redirected_statement': {
-            const body = node.namedChildren[0];
-            return body ? extractRulesFromStatement(body) : [];
-        }
-        case 'negated_command': {
-            const inner = node.namedChildren[0];
-            return inner ? extractRulesFromStatement(inner) : [];
-        }
-        case 'variable_assignment':
-        case 'variable_assignments':
-            // Pure assignments – no rule needed
-            return [];
-        default:
-            // For complex constructs (if/while/for/case), try to extract from
-            // named children conservatively
-            return [];
-    }
-}
-/**
- * Extract minimum-scope wildcard permission rules from a shell command.
- *
- * Rules follow the minimum-scope principle:
- *   - Preserve root command + sub-command, replace arguments with `*`
- *   - Compound commands are split → separate rules for each part
- *   - No arguments → no wildcard suffix
- *
- * @param command - The full shell command string.
- * @returns Deduplicated list of permission rule strings.
- *
- * @example
- * extractCommandRules('git clone https://github.com/foo/bar.git')
- * // → ['git clone *']
- *
- * extractCommandRules('npm install express')
- * // → ['npm install *']
- *
- * extractCommandRules('npm outdated')
- * // → ['npm outdated']
- *
- * extractCommandRules('cat /etc/passwd')
- * // → ['cat *']
- *
- * extractCommandRules('git clone foo && npm install')
- * // → ['git clone *', 'npm install']
- *
- * extractCommandRules('ls -la /tmp')
- * // → ['ls *']
- *
- * extractCommandRules('docker compose up -d')
- * // → ['docker compose up *']
- */
-export async function extractCommandRules(command) {
-    if (typeof command !== 'string' || !command.trim())
-        return [];
-    const tree = await parseShellCommand(command);
-    const root = tree.rootNode;
-    const rules = [];
-    for (const stmt of root.namedChildren) {
-        rules.push(...extractRulesFromStatement(stmt));
-    }
-    tree.delete();
-    // Deduplicate while preserving order
-    return [...new Set(rules)];
-}
-// ---------------------------------------------------------------------------
-// Reset (for testing)
-// ---------------------------------------------------------------------------
-/**
- * Reset the parser singleton. Only intended for testing.
- * @internal
- */
-export function _resetParser() {
-    if (parserInstance) {
-        parserInstance.delete();
-        parserInstance = null;
-    }
-    bashLanguage = null;
-    initPromise = null;
-    parserInitFailed = false;
-}
-/**
- * Force the parser into the "init failed" state. Only intended for testing
- * fallback behaviour without actually breaking WASM loading.
- * @internal
- */
-export function _setParserFailedForTesting() {
-    parserInitFailed = true;
-    initPromise = null;
-    if (parserInstance) {
-        parserInstance.delete();
-        parserInstance = null;
-    }
-    bashLanguage = null;
-}
-/**
- * Internal helper exposed for tests.
- * @internal
- */
-export function _resolveWasmPathForTesting(filename, moduleFilePath, resolvePath) {
-    return resolveWasmPathForModule(filename, moduleFilePath, resolvePath);
-}
-//# sourceMappingURL=shellAstParser.js.map