@agent-beam/beam 0.2.37 → 0.2.39

package/dist/mitigation-pattern.js

@@ -0,0 +1,140 @@
+/** A bounded suggestion for commands with a concrete, stable target. */
+function basicPattern(command) {
+    if (!command || command.length > 4000 || /\[(?:REDACTED|TRUNCATED)[^\]]*\]|…|[$`\\\n\r]/i.test(command))
+        return null;
+    const source = command.trim();
+    if (/^(?:(?:sudo|command)\s+)?(?:env|printenv)(?:\s+-0)?$/i.test(source))
+        return String.raw `(?:^|[;&|]\s*)(?:(?:sudo|command)\s+)?(?:env|printenv)(?:\s+-0)?(?=\s*(?:[;&|]|$))`;
+    const ping = /^(?:(?:sudo|command)\s+)?(?:\/[A-Za-z0-9_.\/-]+\/)?ping(?:\s+(?:--|-[A-Za-z][A-Za-z0-9-]*(?:=\d{1,6})?|\d{1,6}))*\s+(['"]?)([A-Za-z0-9.-]+)\1$/i.exec(source);
+    const host = ping?.[2]?.replace(/\.$/, "");
+    if (!host || host.length > 200 || !/^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(host))
+        return null;
+    const pattern = String.raw `(?:^|[;&|]\s*)(?:(?:sudo|command)\s+)?(?:\/?[A-Za-z0-9_.-]+\/)*ping(?:\s+(?:--|-[A-Za-z][A-Za-z0-9-]*(?:=\d{1,6})?|\d{1,6}))*\s+['"]?${host.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\.?['"]?(?=$|[\s;&|])`;
+    return pattern.length <= 1000 ? pattern : null;
+}
+const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const cleanTarget = (value) => value.length >= 2 && !/\[(?:REDACTED|TRUNCATED)|…|[$`\r\n]/i.test(value);
+const executablePrefix = String.raw `(?:^|[;&|\n]\s*)(?:(?:sudo|command|exec)\s+)?(?:[\w./\\-]*[/\\])?`;
+function scopedPattern(executable, target, operation, inlineCode = false) {
+    if (!cleanTarget(target))
+        return null;
+    const targetSource = escape(target).replace(/\\\*/g, String.raw `[^\s"';|&]*`);
+    const range = inlineCode ? String.raw `[\s\S]{0,16000}` : String.raw `[^;&|\n]{0,4000}`;
+    const pattern = executablePrefix + executable + String.raw `\b` +
+        (operation ? "(?=" + range + operation + ")" : "") +
+        "(?=" + range + String.raw `(?:[\s"'=(@]|^)` + targetSource + String.raw `(?=$|[\s"';|&,?)\]}]))`;
+    return pattern.length <= 1000 ? pattern : null;
+}
+/** Derive stable operation + target patterns. Never execute or evaluate the command. */
+function derivePattern(command) {
+    if (!command.trim() || command.length > 16000 || /\[TRUNCATED[^\]]*\]|…/i.test(command))
+        return null;
+    const basic = basicPattern(command);
+    if (basic)
+        return basic;
+    // Interpreter file operations: retain the path and operation, not the changing payload.
+    const interpreter = /^\s*(?:(?:sudo|command)\s+)?(?:[\w./\\-]*[/\\])?(python[23]?|node|bun|ruby|perl|pwsh|powershell)\b/i.exec(command)?.[1];
+    if (interpreter) {
+        const pathOperation = /(?:Path|open|readFileSync|readFile|writeFileSync|writeFile|appendFileSync|appendFile|read_text|write_text)\s*\(\s*['"]([^'"\r\n]{2,200})['"]/g;
+        for (const match of command.matchAll(pathOperation)) {
+            const target = match[1] ?? "";
+            if (!/(?:[\\/]|\.[A-Za-z0-9_*.-]+$)/.test(target))
+                continue;
+            const write = /(?:write_text|write_bytes|writeFile|appendFile|\.write\s*\(|open\s*\([^\n]{0,220},\s*['"][wax])/i.test(command);
+            const read = /(?:read_text|read_bytes|readFile|\.read\s*\(|open\s*\([^\n]{0,220},\s*['"]r)/i.test(command);
+            const operation = write ? String.raw `(?:write_text|write_bytes|writeFile|appendFile|\.write\s*\(|['"][wax][+b]?['"])` : read ? String.raw `(?:read_text|read_bytes|readFile|\.read\s*\(|['"]r[+b]?['"])` : undefined;
+            if (operation) {
+                const pattern = scopedPattern(escape(interpreter), target, operation, true);
+                if (pattern)
+                    return pattern;
+            }
+        }
+        return null;
+    }
+    // Parse quoted words without evaluating substitutions, variables or script bodies.
+    const segments = [];
+    let start = 0, quote = "";
+    for (let i = 0; i < command.length && segments.length < 40; i++) {
+        const c = command[i] ?? "";
+        if (c === "\\" && quote !== "'") {
+            i++;
+            continue;
+        }
+        if (quote) {
+            if (c === quote)
+                quote = "";
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            quote = c;
+            continue;
+        }
+        if (/[;|&\n]/.test(c)) {
+            segments.push(command.slice(start, i));
+            start = i + 1;
+        }
+    }
+    segments.push(command.slice(start));
+    for (const segment of segments) {
+        const words = segment.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+/g)?.map(w => w.replace(/^(['"])([\s\S]*)\1$/, "$2")) ?? [];
+        let at = 0;
+        while (/^(?:sudo|command|exec)$/.test(words[at] ?? "") || /^[A-Za-z_]\w*=/.test(words[at] ?? ""))
+            at++;
+        const executable = (words[at] ?? "").split(/[\\/]/).pop()?.toLowerCase() ?? "";
+        const args = words.slice(at + 1);
+        if (/^(?:curl|wget|invoke-webrequest|invoke-restmethod)$/.test(executable)) {
+            const destination = args.find(a => /^https?:\/\//i.test(a));
+            if (destination) {
+                try {
+                    const url = new URL(destination);
+                    if (url.username || url.password)
+                        continue;
+                    const target = `${url.protocol}//${url.host}${url.pathname}`;
+                    const pattern = scopedPattern("(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod)", target);
+                    if (pattern)
+                        return pattern;
+                }
+                catch { /* no complete destination */ }
+            }
+        }
+        if (/^(?:cat|head|tail|less|more|sed|grep|rg|rm|unlink|rmdir|chmod|chown|cp|mv|tee|touch|truncate|Get-Content|Set-Content|Remove-Item|Select-String)$/i.test(executable)) {
+            const targets = args.filter(a => !a.startsWith("-") && cleanTarget(a) && /(?:[\\/]|\.[A-Za-z0-9_*.-]+$)/.test(a));
+            const target = targets.find(a => /(?:^|[\\/])(?:\.env|\.ssh|\.aws|credentials|id_(?:rsa|ed25519))/i.test(a)) ?? targets.at(-1);
+            if (target) {
+                const pattern = scopedPattern(escape(executable), target);
+                if (pattern)
+                    return pattern;
+            }
+        }
+        if (executable === "git" && /^(?:push|reset|clean|checkout|restore)$/.test(args[0] ?? "")) {
+            const behavior = args.includes("--hard") ? "--hard" : args.includes("--force") ? "--force" : args.find((a, i) => i > 0 && !a.startsWith("-"));
+            if (behavior) {
+                const pattern = scopedPattern("git", behavior, escape(args[0] ?? "") + String.raw `\b`);
+                if (pattern)
+                    return pattern;
+            }
+        }
+        if (/^(?:npm|pnpm|yarn|pip|pip3|uv|cargo|gem)$/.test(executable) && /^(?:install|add|remove|uninstall)$/.test(args[0] ?? "")) {
+            const target = args.slice(1).find(a => !a.startsWith("-") && cleanTarget(a));
+            if (target) {
+                const pattern = scopedPattern(escape(executable), target, escape(args[0] ?? "") + String.raw `\b`);
+                if (pattern)
+                    return pattern;
+            }
+        }
+    }
+    return null;
+}
+export function commandBehaviorRegex(command) {
+    const pattern = derivePattern(command);
+    if (!pattern || pattern.length > 1000 || /\[(?:REDACTED|TRUNCATED)/i.test(pattern))
+        return null;
+    try {
+        const regex = new RegExp(pattern, "i");
+        return !regex.test("") && regex.test(command) ? pattern : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=mitigation-pattern.js.map

package/dist/mitigation-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mitigation-pattern.js","sourceRoot":"","sources":["../src/mitigation-pattern.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,uDAAuD,CAAC,IAAI,CAAC,MAAM,CAAC;QACtE,OAAO,MAAM,CAAC,GAAG,CAAA,oFAAoF,CAAC;IAExG,MAAM,IAAI,GAAG,iJAAiJ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5K,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,qGAAqG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjK,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA,wIAAwI,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACrO,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAC/E,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChH,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAA,mEAAmE,CAAC;AAEvG,SAAS,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,SAAkB,EAAE,UAAU,GAAG,KAAK;IAC/F,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAA,aAAa,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,CAAC;IACtF,MAAM,OAAO,GAAG,gBAAgB,GAAG,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI;QAC5D,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,iBAAiB,GAAG,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA,wBAAwB,CAAC;IAClG,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,wFAAwF;IACxF,MAAM,WAAW,GAAG,qGAAqG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7I,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,aAAa,GAAG,+IAA+I,CAAC;QACtK,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC5D,MAAM,KAAK,GAAG,kGAAkG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/H,MAAM,IAAI,GAAG,+EAA+E,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3G,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,iFAAiF,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,8DAA8D,CAAC,CAAC,CAAC,SAAS,CAAC;YACpN,IAAI,SAAS,EAAE,CAAC;gBAAC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAAC,CAAC;QAC9H,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;IACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvH,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAAE,EAAE,EAAE,CAAC;QACvG,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,qDAAqD,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;oBAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;wBAAE,SAAS;oBAC7E,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;oBAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,mDAAmD,EAAE,MAAM,CAAC,CAAC;oBAC3F,IAAI,OAAO;wBAAE,OAAO,OAAO,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,IAAI,mJAAmJ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzK,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/H,IAAI,MAAM,EAAE,CAAC;gBAAC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAAC,CAAC;QACzG,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9I,IAAI,QAAQ,EAAE,CAAC;gBAAC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAAC,CAAC;QACxI,CAAC;QACD,IAAI,2CAA2C,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7H,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,CAAC;gBAAC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAAC,CAAC;QACjJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACxI,CAAC"}

package/dist/package-risk-rules.js

@@ -21,7 +21,7 @@ export const codeRules = [
         find: regex(/discord(?:app)?\.com\/api\/webhooks\/\d{15,20}\/[\w-]{30,}|api\.telegram\.org\/bot\d{6,12}:[\w-]{30,}|\bwebhook\.site\/[\w-]{8,}|\.m\.pipedream\.net\b|\b(?:interact\.sh|oast\.(?:fun|live|me|online|pro|site)|burpcollaborator\.net|requestbin\.(?:net|com)|requestcatcher\.com|canarytokens\.com)\b|\b[\w-]+\.ngrok(?:-free)?\.(?:io|app)\b|\btransfer\.sh\b|\bpastebin\.com\/raw\b/) },
     { id: "pkg.env_harvest", title: "Serializes the whole environment", severity: "high", explanation: "Every environment variable, which on a developer machine or CI runner includes API keys and tokens, is turned into one string. Ordinary code reads the variables it needs by name.",
         hints: ["process.env", "os.environ"],
-        find: regex(/JSON\.stringify\(\s*process\.env\b|json\.dumps\(\s*(?:dict\(\s*)?os\.environ\b|\bstr\(\s*os\.environ\s*\)/) },
+        find: regex(/JSON\.stringify\(\s*process\.env\b|json\.dumps\(\s*(?:dict\(\s*)?os\.environ\b|\bstr\(\s*os\.environ\s*\)|Object\.(?:entries|keys|values|assign)\(\s*process\.env\b/) },
     { id: "pkg.obfuscated", title: "Obfuscated code", severity: "high", explanation: "The file looks like javascript-obfuscator output or a long run of hex escapes. Published libraries are minified, not obfuscated; obfuscation exists to stop a reviewer from reading the code.",
         hints: ["_0x", "\\x"],
         find: content => Math.max(many(/\b_0x[0-9a-f]{4,6}\b/g, 40)(content), regex(/(?:\\x[2-7][0-9a-fA-F]){40,}/)(content)) },
@@ -42,7 +42,7 @@ export const codeRules = [
         } },
     { id: "pkg.network", title: "Makes network calls", severity: "info", explanation: "The file sends requests or opens sockets.", signal: true,
         hints: ["http", "fetch", "axios", "XMLHttpRequest", "net", "dns", "WebSocket", "requests.", "urlopen", "socket.", "curl", "wget"],
-        find: regex(/\brequire\(\s*["'](?:node:)?(?:https?|net|dns|tls|dgram)["']\s*\)\.\w+\s*\(|\bhttps?\.(?:request|get)\s*\(|\bfetch\s*\(|\baxios(?:\.\w+)?\s*\(|\bXMLHttpRequest\b|\bnet\.(?:connect|createConnection)\s*\(|\bdns\.(?:lookup|resolve\w*)\s*\(|\bnew\s+WebSocket\s*\(|\brequests\.(?:get|post|put)\s*\(|\burlopen\s*\(|\burllib\.request\.Request\b|\bhttp\.client\.HTTPS?Connection\b|\bsocket\.(?:socket|create_connection)\s*\(|\bhttpx\.(?:get|post|Client)\b|\b(?:curl|wget)\s[^\n]{0,80}https?:\/\//) },
+        find: regex(/\brequire\(\s*["'](?:node:)?(?:https?|net|dns|tls|dgram)["']\s*\)\.\w+\s*\(|\bhttps?\.(?:request|get)\s*\(|\bfetch\s*\(|\baxios(?:\.\w+)?\s*\(|\bXMLHttpRequest\b|\bnet\.(?:connect|createConnection)\s*\(|\bnew\s+(?:net\.)?Socket\s*\(|\bdns\.(?:lookup|resolve\w*)\s*\(|\bnew\s+WebSocket\s*\(|\brequests\.(?:get|post|put)\s*\(|\burlopen\s*\(|\burllib\.request\.Request\b|\bhttp\.client\.HTTPS?Connection\b|\bsocket\.(?:socket|create_connection)\s*\(|\bhttpx\.(?:get|post|Client)\b|\b(?:curl|wget)\s[^\n]{0,80}https?:\/\//) },
 ];
 // Shell-shaped rules borrowed from the skill scanner. They only run on code that executes at
 // install time and on bundled shell scripts: `launchctl load` in pm2's runtime code is its job; in

package/dist/package-risk-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-risk-rules.js","sourceRoot":"","sources":["../src/package-risk-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAiBlD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;AACjF,oGAAoG;AACpG,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE;IAC5D,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAAC,IAAI,EAAE,KAAK,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IAChH,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAe;IACnC,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,kLAAkL;QACxR,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;QACzF,IAAI,EAAE,KAAK,CAAC,4VAA4V,CAAC,EAAE;IAC7W,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,gMAAgM;QACtS,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC;QAC3L,IAAI,EAAE,KAAK,CAAC,uXAAuX,CAAC,EAAE;IACxY,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,oLAAoL;QACrR,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,2GAA2G,CAAC,EAAE;IAC5H,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,+LAA+L;QAC9Q,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;IACzH,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,wKAAwK;QAC7Q,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC;QACxP,IAAI,EAAE,KAAK,CAAC,mZAAmZ,CAAC,EAAE;IACpa,+FAA+F;IAC/F,+FAA+F;IAC/F,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,uEAAuE,EAAE,MAAM,EAAE,IAAI;QAC5L,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC,EAAE;IACvC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,6DAA6D,EAAE,MAAM,EAAE,IAAI;QAC3J,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC;QAC5F,IAAI,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;iBACtL,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,EAAE;IACL,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,2CAA2C,EAAE,MAAM,EAAE,IAAI;QACzI,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;QACjI,IAAI,EAAE,KAAK,CAAC,yeAAye,CAAC,EAAE;CAC3f,CAAC;AAEF,6FAA6F;AAC7F,mGAAmG;AACnG,wDAAwD;AACxD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACzH,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC9F,qGAAqG;AACrG,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEzJ,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,UAA+B,EAAE;IACzE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACnL,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,gGAAgG;AAChG,2FAA2F;AAC3F,MAAM,MAAM,GAA4H;IACtI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,wGAAwG,EAAE;IACnR,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,iHAAiH,EAAE;IAC3R,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,qIAAqI,EAAE;IAC3U,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,mFAAmF,EAAE;IAChR,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,sDAAsD,EAAE;IAClO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,wFAAwF,EAAE;IACvS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,EAAE,EAAE,mCAAmC,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,oIAAoI,EAAE;IACvT,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,kFAAkF,EAAE;IACpS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,2FAA2F,EAAE;IACzR,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,8JAA8J,EAAE;CACzV,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,OAAkD,EAAE,UAAuB;IAC9G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3K,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvK,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,2FAA2F;AAC3F,MAAM,OAAO,GAAoC;IAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC;IAClyC,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;CACpnC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAE7F,4FAA4F;AAC5F,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,KAAK,GAAa,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,KAAK,GAAG,IAAI,CAAC;QAAC,IAAI,GAAG,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAwB;IAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,+GAA+G;IAC/G,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC"}
+{"version":3,"file":"package-risk-rules.js","sourceRoot":"","sources":["../src/package-risk-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAiBlD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;AACjF,oGAAoG;AACpG,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE;IAC5D,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAAC,IAAI,EAAE,KAAK,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IAChH,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAe;IACnC,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,kLAAkL;QACxR,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;QACzF,IAAI,EAAE,KAAK,CAAC,4VAA4V,CAAC,EAAE;IAC7W,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,gMAAgM;QACtS,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC;QAC3L,IAAI,EAAE,KAAK,CAAC,uXAAuX,CAAC,EAAE;IACxY,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,oLAAoL;QACrR,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,qKAAqK,CAAC,EAAE;IACtL,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,+LAA+L;QAC9Q,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;IACzH,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,wKAAwK;QAC7Q,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC;QACxP,IAAI,EAAE,KAAK,CAAC,mZAAmZ,CAAC,EAAE;IACpa,+FAA+F;IAC/F,+FAA+F;IAC/F,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,uEAAuE,EAAE,MAAM,EAAE,IAAI;QAC5L,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC,EAAE;IACvC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,6DAA6D,EAAE,MAAM,EAAE,IAAI;QAC3J,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC;QAC5F,IAAI,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;iBACtL,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,EAAE;IACL,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,2CAA2C,EAAE,MAAM,EAAE,IAAI;QACzI,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;QACjI,IAAI,EAAE,KAAK,CAAC,ugBAAugB,CAAC,EAAE;CACzhB,CAAC;AAEF,6FAA6F;AAC7F,mGAAmG;AACnG,wDAAwD;AACxD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACzH,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC9F,qGAAqG;AACrG,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEzJ,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,UAA+B,EAAE;IACzE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACnL,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,gGAAgG;AAChG,2FAA2F;AAC3F,MAAM,MAAM,GAA4H;IACtI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,wGAAwG,EAAE;IACnR,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,iHAAiH,EAAE;IAC3R,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,qIAAqI,EAAE;IAC3U,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,mFAAmF,EAAE;IAChR,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,sDAAsD,EAAE;IAClO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,wFAAwF,EAAE;IACvS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,EAAE,EAAE,mCAAmC,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,oIAAoI,EAAE;IACvT,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,kFAAkF,EAAE;IACpS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,2FAA2F,EAAE;IACzR,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,8JAA8J,EAAE;CACzV,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,OAAkD,EAAE,UAAuB;IAC9G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3K,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvK,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,2FAA2F;AAC3F,MAAM,OAAO,GAAoC;IAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC;IAClyC,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;CACpnC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAE7F,4FAA4F;AAC5F,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,KAAK,GAAa,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,KAAK,GAAG,IAAI,CAAC;QAAC,IAAI,GAAG,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAwB;IAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,+GAA+G;IAC/G,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC"}

package/dist/policy-paths.d.ts

@@ -0,0 +1,20 @@
+export type PolicyPathTarget = {
+    path: string;
+    eventType: string;
+};
+type Request = {
+    path?: string;
+    cwd?: string;
+    command: string;
+    tool: string;
+    eventType?: string;
+    input?: Record<string, unknown>;
+};
+/** Resolve aliases without opening file contents, including a missing leaf below a symlink. */
+export declare function canonicalPolicyPath(value: string, cwd?: string): string | undefined;
+/** Canonicalize the static part of a policy pattern; preserve its glob suffix. */
+export declare function canonicalPolicyPattern(pattern: string, cwd?: string): string | undefined;
+/** Targets visible in hook arguments or static shell syntax, shared by every agent adapter.
+ * This is a preflight check, not an OS sandbox for arbitrary programs. */
+export declare function policyPathTargets(request: Request): PolicyPathTarget[];
+export {};

package/dist/policy-paths.js

@@ -0,0 +1,145 @@
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { classifyActionContext } from "./action-context.js";
+import { shellActionCommands } from "./credential-egress.js";
+const PATH_KEYS = /^(?:file_path|filePath|file_paths|filePaths|absolute_path|absolutePath|relative_path|relativePath|path|paths|files|filename|fileName|file|target_file|targetPath|directory|directory_path|directories|directoryPath|dir|folder|folders|target|source|destination|root_path|rootPath|search_path|searchPath|uri)$/;
+const CODE_KEYS = /^(?:code|script|expression|patch|patchText|patch_text|diff)$/;
+/** Resolve aliases without opening file contents, including a missing leaf below a symlink. */
+export function canonicalPolicyPath(value, cwd) {
+    if (!value || value.includes("\0"))
+        return undefined;
+    if (value.startsWith("file://")) {
+        try {
+            value = fileURLToPath(value);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (value === "~" || value.startsWith("~/"))
+        value = homedir() + value.slice(1);
+    if (!isAbsolute(value) && !cwd)
+        return undefined;
+    const absolute = resolve(cwd || "/", value);
+    const suffix = [];
+    let parent = absolute;
+    for (;;) {
+        try {
+            return resolve(realpathSync(parent), ...suffix);
+        }
+        catch { /* look for an existing ancestor */ }
+        const next = dirname(parent);
+        if (next === parent)
+            return absolute;
+        suffix.unshift(basename(parent));
+        parent = next;
+    }
+}
+/** Canonicalize the static part of a policy pattern; preserve its glob suffix. */
+export function canonicalPolicyPattern(pattern, cwd) {
+    const wildcard = pattern.search(/[*?]/);
+    if (wildcard < 0)
+        return canonicalPolicyPath(pattern, cwd);
+    const slash = pattern.lastIndexOf("/", wildcard);
+    if (slash < 0)
+        return undefined;
+    const root = canonicalPolicyPath(pattern.slice(0, slash) || "/", cwd);
+    return root === undefined ? undefined : `${root === "/" ? "" : root}/${pattern.slice(slash + 1)}`;
+}
+/** Targets visible in hook arguments or static shell syntax, shared by every agent adapter.
+ * This is a preflight check, not an OS sandbox for arbitrary programs. */
+export function policyPathTargets(request) {
+    const targets = [];
+    const seen = new Set();
+    const cwd = request.cwd;
+    const add = (path, eventType = request.eventType || "file.read", working = cwd) => {
+        if (typeof path !== "string" || !path || path.length > 16384 || /^https?:\/\//i.test(path))
+            return;
+        const key = `${eventType}\0${working}\0${path}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            targets.push({ path: canonicalPolicyPath(path, working) ?? path, eventType });
+        }
+    };
+    const readType = /^(?:command.exec|tool.call|directory.read|file.search)$/.test(request.eventType ?? "") ? "file.read" : request.eventType;
+    add(request.path, readType);
+    const walk = (value, depth, pathField = false) => {
+        if (depth > 12)
+            return;
+        if (typeof value === "string") {
+            if (pathField)
+                add(value, readType);
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                walk(entry, depth + 1, pathField);
+            return;
+        }
+        if (value && typeof value === "object") {
+            for (const [key, entry] of Object.entries(value)) {
+                if (CODE_KEYS.test(key) && typeof entry === "string")
+                    literals(entry);
+                walk(entry, depth + 1, PATH_KEYS.test(key));
+            }
+        }
+    };
+    // Literal file paths in scripts/patches can be checked even for unfamiliar tools.
+    const literals = (code, working = cwd) => {
+        for (const match of code.matchAll(/["'`]([^"'`\n]+)["'`]/g)) {
+            if (/^(?:\/|\.\.?\/|~\/|file:\/\/)/.test(match[1]))
+                add(match[1], "file.read", working);
+        }
+        for (const match of code.matchAll(/^\*\*\* (?:Update|Add|Delete) File:\s*(.+)$/gm))
+            add(match[1].trim(), "file.write", working);
+        for (const match of code.matchAll(/(?:\bopen|\breadFile(?:Sync)?|\bPath)\s*\(\s*["']([^"'\n]+)["']/g))
+            add(match[1], "file.read", working);
+    };
+    walk(request.input, 0);
+    if (!request.command)
+        return targets;
+    const classified = classifyActionContext(request.tool, request.input ?? {}, cwd ?? "", request.command, (s) => s, false);
+    for (const action of classified.actions) {
+        const type = { "file-read": "file.read", "file-search": "file.read", "source-search": "file.read", "file-write": "file.write", delete: "file.write" }[action.operation];
+        if (type && action.target !== "standard input")
+            add(action.resolvedPath ?? action.target, type);
+    }
+    let working = cwd;
+    for (const command of shellActionCommands(request.command)) {
+        const tokens = command.tokens.map((token) => token.value);
+        let index = 0;
+        while (/^[A-Za-z_]\w*=/.test(tokens[index] ?? "") || /^(?:sudo|command|exec|env)$/.test(tokens[index] ?? ""))
+            index++;
+        const executable = basename(tokens[index] ?? "").toLowerCase();
+        const args = tokens.slice(index + 1);
+        if (executable === "cd") {
+            working = canonicalPolicyPath(args[0] ?? "~", working);
+            continue;
+        }
+        // Check explicit path arguments conservatively, including interpreter script files,
+        // upload sources and input redirection, without disabling the shell tool itself.
+        for (const argument of args) {
+            const path = argument.replace(/^\d*[<>]+/, "");
+            if (/^(?:\/|\.\.?\/|~\/|file:\/\/)/.test(path))
+                add(path, "file.read", working);
+            else if (working && !path.startsWith("-") && existsSync(resolve(working, path)))
+                add(path, "file.read", working);
+        }
+        if (/^(?:ls|find|grep|rg|cat|head|tail|sed|awk|wc|cp|scp|tar|zip|python[23]?|node|bun|ruby|perl|bash|sh|zsh)$/.test(executable)) {
+            literals(args.join(" "), working);
+            if (/^(?:ls|find|rg|grep)$/.test(executable))
+                add(working, "file.read", working);
+            // Relative filenames without a ./ prefix, including shell input redirection.
+            for (let i = 0; i < args.length; i++) {
+                if (args[i] === "<")
+                    add(args[i + 1], "file.read", working);
+                if (/^(?:cat|head|tail|wc|cp|scp)$/.test(executable) && !args[i].startsWith("-") && !/^\d+$/.test(args[i]))
+                    add(args[i], "file.read", working);
+            }
+        }
+    }
+    return targets;
+}
+//# sourceMappingURL=policy-paths.js.map

package/dist/policy-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-paths.js","sourceRoot":"","sources":["../src/policy-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,MAAM,SAAS,GAAG,kTAAkT,CAAC;AACrU,MAAM,SAAS,GAAG,8DAA8D,CAAC;AAEjF,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,GAAY;IAC7D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YAAC,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,KAAK,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YAAC,OAAO,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,GAAY;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,IAAa,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE;QACzF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QACnG,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;IACvH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3I,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,KAAa,EAAE,SAAS,GAAG,KAAK,EAAE,EAAE;QAChE,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,IAAI,SAAS;gBAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnG,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,kFAAkF;IAClF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC5D,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAChI,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,kEAAkE,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7I,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzH,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAI,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAA6B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;YAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,KAAK,EAAE,CAAC;QACtH,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9F,oFAAoF;QACpF,iFAAiF;QACjF,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;iBAC3E,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,0GAA0G,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAClC,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACjF,6EAA6E;YAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,IAAI,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACjJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/policy.d.ts

@@ -6,10 +6,13 @@ export interface PolicyRule {
     id: string;
     title?: string;
     action: PolicyAction;
+    enforce?: true;
     risk?: number;
+    eventType?: string;
     tool?: string;
     command?: string;
     commandLine?: string;
+    commandRegex?: string;
     args?: string[];
     path?: string;
     url?: string;
@@ -50,6 +53,8 @@ export declare function lastGoodPolicyPath(): string;
 export declare function readPolicy(): Promise<PolicyBundle | null>;
 export type DecisionAction = "allow" | "ask" | "block" | "redact" | "audit" | "warn" | "deny";
 export interface ActionContext {
+    eventType?: string;
+    input?: Record<string, unknown>;
     agent: string;
     tool: string;
     command: string;

package/dist/policy.js

@@ -1,6 +1,11 @@
+import { activityType } from "./activity.js";
+import { classifyActionContext } from "./action-context.js";
+import { environmentRisk } from "./access-risk.js";
+import { builtinRulesById } from "./rule-catalog.js";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { getDataDirectory } from "./config.js";
+import { canonicalPolicyPath, canonicalPolicyPattern, policyPathTargets } from "./policy-paths.js";
 const EMPTY = { mode: "observe", blockedTools: [], blockedCommandPatterns: [], disabledAgents: [], rules: [], customDetectors: [] };
 export function policyPath() { return join(getDataDirectory(), "policy.json"); }
 export function lastGoodPolicyPath() { return join(getDataDirectory(), "policy.last-good.json"); }
@@ -19,6 +24,30 @@ function validRule(v, index, errors) {
         errors.push(`rules[${index}] (${r.id}) has an invalid action`);
         return undefined;
     }
+    if (r.enforce !== undefined && (r.enforce !== true || String(r.action).toUpperCase() !== "BLOCK")) {
+        errors.push(`rules[${index}] (${r.id}).enforce is only supported for explicit BLOCK rules`);
+        return undefined;
+    }
+    if (r.eventType !== undefined && (typeof r.eventType !== "string" || !r.eventType.trim())) {
+        errors.push(`rules[${index}] (${r.id}).eventType must be a non-empty string`);
+        return undefined;
+    }
+    if (r.commandRegex !== undefined) {
+        if (typeof r.commandRegex !== "string" || r.commandRegex.length < 3 || r.commandRegex.length > 1000) {
+            errors.push(`rules[${index}] (${r.id}).commandRegex must be 3-1000 characters`);
+            return undefined;
+        }
+        try {
+            if (new RegExp(r.commandRegex, "i").test("")) {
+                errors.push(`rules[${index}] (${r.id}).commandRegex matches every command`);
+                return undefined;
+            }
+        }
+        catch {
+            errors.push(`rules[${index}] (${r.id}).commandRegex is invalid`);
+            return undefined;
+        }
+    }
     if (r.args !== undefined && (!Array.isArray(r.args) || r.args.some(a => typeof a !== "string"))) {
         errors.push(`rules[${index}] (${r.id}).args must be strings`);
         return undefined;
@@ -69,7 +98,11 @@ export async function readPolicy() {
 const safety = { ALLOW: 0, AUDIT: 1, REDACT: 2, ASK: 3, BLOCK: 4 };
 function glob(pattern, value) { const e = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "§§").replace(/\*/g, "[^/]*").replace(/§§/g, ".*").replace(/\?/g, "."); return new RegExp(`^${e}$`, "i").test(value); }
 function same(a, b) { return !a || (b ?? "").toLowerCase() === a.toLowerCase(); }
-function riskInfo(c) { const s = `${c.command} ${c.path ?? ""} ${c.url ?? ""}`; const factors = []; let n = 0; if (/\brm\s+.*-rf\s+\//i.test(s)) {
+function riskInfo(c) { const s = `${c.command} ${c.path ?? ""} ${c.url ?? ""}`; const factors = []; const accessContext = classifyActionContext(c.tool, { file_path: c.path }, c.cwd ?? "", c.command, v => v, false); const access = environmentRisk(accessContext); const routineNamed = !!access && "severity" in access && access.severity === "info" && accessContext.actions.every(a => a.operation === "environment-lookup"); let n = 0; if (builtinRulesById(["destructive.delete"])[0]?.severityFor?.(c.command) === "medium") {
+    n += 35;
+    factors.push("scoped temporary test cleanup");
+}
+else if (/\brm\s+.*-rf\s+\//i.test(s)) {
     n += 98;
     factors.push("destructive operation");
 }
@@ -83,12 +116,14 @@ else if (/\brm\b/i.test(s)) {
     n += 25;
     factors.push("external destination");
 } if (/\.env|\.ssh|\.aws|private.?key|api.?key|token|secret/i.test(s)) {
-    n += 35;
-    factors.push("sensitive data or file");
+    n += routineNamed ? 5 : 35;
+    factors.push(routineNamed ? "scoped named environment lookup" : "sensitive data or file");
 } const score = Math.min(100, n); return { score, level: score >= 90 ? "CRITICAL" : score >= 70 ? "HIGH" : score >= 30 ? "MEDIUM" : "LOW", factors }; }
 function matches(r, c) {
     // r.tool supports glob wildcards (e.g. "mcp__posthog__*") so a dashboard rule can target one
     // MCP server's tools without matching every MCP call; other identity fields stay exact-match.
+    if (!r.path && r.eventType && !glob(r.eventType, c.eventType ?? ""))
+        return false;
     if (r.tool && !glob(r.tool, c.tool))
         return false;
     if (!same(r.role, c.role) || !same(r.user, c.user) || !same(r.agent, c.agent) || !same(r.repository, c.repository) || !same(r.branch, c.branch) || !same(r.environment, c.environment))
@@ -99,8 +134,28 @@ function matches(r, c) {
         return false;
     if (r.commandLine && !glob(r.commandLine, c.command))
         return false;
-    if (r.path && !glob(r.path, c.path ?? ""))
-        return false;
+    if (r.commandRegex) {
+        try {
+            if (!new RegExp(r.commandRegex, "i").test(c.command))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (r.path) {
+        const rulePath = r.path;
+        const pattern = canonicalPolicyPattern(rulePath, c.cwd) ?? rulePath;
+        const targets = c.pathTargets ?? (c.path ? [{ path: c.path, eventType: c.eventType ?? "" }] : []);
+        if (!targets.some((target) => {
+            if (r.eventType && !glob(r.eventType, target.eventType) && !glob(r.eventType, c.eventType ?? ""))
+                return false;
+            const path = canonicalPolicyPath(target.path, c.cwd) ?? target.path;
+            // A subtree restriction covers both the directory itself and its contents.
+            return glob(pattern, path) || (pattern.endsWith("/**") && glob(pattern.slice(0, -3), path)) || glob(rulePath, target.path);
+        }))
+            return false;
+    }
     if (r.url && !glob(r.url, c.url ?? ""))
         return false;
     if (r.args && r.args.some((a, i) => !glob(a, c.args?.[i] ?? "")))
@@ -114,8 +169,10 @@ function matches(r, c) {
     }
     return true;
 }
-function specificity(r) { return [r.tool, r.command, r.commandLine, r.args?.length, r.path, r.url, r.role, r.user, r.agent, r.cwd, r.repository, r.branch, r.environment, r.time].filter(Boolean).length; }
+function specificity(r) { return [r.eventType, r.tool, r.command, r.commandLine, r.commandRegex, r.args?.length, r.path, r.url, r.role, r.user, r.agent, r.cwd, r.repository, r.branch, r.environment, r.time].filter(Boolean).length; }
 export function evaluate(bundle, ctx) {
+    // Use the same classifier as Activity, including argument-dependent web tools.
+    ctx = { ...ctx, eventType: ctx.eventType ?? activityType({ tool_name: ctx.tool, tool_input: ctx.input }, "tool.call") };
     const info = riskInfo(ctx);
     const score = info.score;
     const base = { mode: bundle?.rules.mode ?? "observe", policyVersion: bundle?.version ?? 0, riskScore: score, riskLevel: info.level, riskFactors: info.factors, customDetectors: bundle?.rules.customDetectors ?? [], actor: ctx.user, role: ctx.role, agent: ctx.agent, tool: ctx.tool, command: ctx.command, args: ctx.args, resource: ctx.path ?? ctx.url, errors: bundle?.errors };
@@ -123,19 +180,30 @@ export function evaluate(bundle, ctx) {
         return { action: "allow", ...base };
     if (bundle.errors?.length)
         return { action: "deny", ...base, reason: `Security policy rejected: ${bundle.errors.join("; ")}`, rule: "policy.invalid" };
-    if (bundle.rules.mode === "observe" || (bundle.notAfter && Date.parse(bundle.notAfter) < Date.now()))
+    if (bundle.notAfter && Date.parse(bundle.notAfter) < Date.now())
         return { action: "allow", ...base };
+    const pathTargets = bundle.rules.rules?.some((r) => r.path && (bundle.rules.mode !== "observe" || r.enforce)) ? policyPathTargets(ctx) : undefined;
+    // A manager can enforce a narrow mitigation without enabling unrelated policy
+    // rules or risk thresholds for this member's other tools and agents.
+    const mandatory = (bundle.rules.rules ?? []).filter((r) => r.enforce === true && r.action === "BLOCK" && matches(r, { ...ctx, riskScore: score, pathTargets })).sort((a, b) => specificity(b) - specificity(a))[0];
+    if (mandatory)
+        return { ...base, mode: "enforce", action: "deny", reason: mandatory.reason, policy: "local policy", rule: mandatory.id };
+    if (bundle.rules.mode === "observe")
+        return { action: "allow", ...base };
+    // A disabled agent is a suspension, so a more specific command ALLOW must not
+    // re-enable it. User-scoped bundles limit this suspension to their recipient.
+    if (bundle.rules.disabledAgents.some(a => a.toLowerCase() === ctx.agent.toLowerCase())) {
+        return { ...base, action: bundle.rules.mode === "enforce" ? "deny" : "ask", reason: `${ctx.agent} is disabled by workspace policy.`, policy: "local policy", rule: "legacy.disabled-agent" };
+    }
     const candidates = [];
     for (const r of bundle.rules.rules ?? [])
-        if (matches(r, { ...ctx, riskScore: score }))
+        if (matches(r, { ...ctx, riskScore: score, pathTargets }))
             candidates.push({ r, rank: specificity(r) });
     for (const tool of bundle.rules.blockedTools) {
         const r = { id: `legacy.tool.${tool}`, tool, action: "BLOCK", reason: `The ${tool} tool is blocked by workspace policy.` };
         if (matches(r, { ...ctx, riskScore: score }))
             candidates.push({ r, rank: 1 });
     }
-    if (bundle.rules.disabledAgents.some(a => a.toLowerCase() === ctx.agent.toLowerCase()))
-        candidates.push({ r: { id: "legacy.disabled-agent", agent: ctx.agent, action: "BLOCK", reason: `${ctx.agent} is disabled by workspace policy.` }, rank: 1 });
     for (const pattern of bundle.rules.blockedCommandPatterns) {
         try {
             if (new RegExp(pattern, "i").test(ctx.command))