@agent-beam/beam 0.2.39 → 0.2.41

package/dist/repo-remote.js

@@ -0,0 +1,191 @@
+import { closeSync, existsSync, openSync, readSync, statSync } from "node:fs";
+import { join } from "node:path";
+const SAFE_SEGMENT = /^[A-Za-z0-9._~@+-]+$/;
+const cleanPath = (p) => p.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "");
+const okPath = (p) => p.length > 0 && p.length <= 200 && p.split("/").every(s => SAFE_SEGMENT.test(s) && s !== "." && s !== "..");
+function providerOf(host) {
+    const h = host.toLowerCase();
+    if (/(^|\.)github\./.test(h) || h === "github.com" || h.endsWith(".github.com"))
+        return "github";
+    if (/(^|\.)gitlab\./.test(h) || h.includes("gitlab"))
+        return "gitlab";
+    if (/(^|\.)bitbucket\./.test(h) || h.includes("bitbucket"))
+        return "bitbucket";
+    if (h === "dev.azure.com" || h === "ssh.dev.azure.com" || h.endsWith(".visualstudio.com"))
+        return "azure-devops";
+    if (/^git-codecommit(?:-fips)?\.[a-z0-9-]+\.amazonaws\.com(?:\.cn)?$/.test(h))
+        return "aws-codecommit";
+    if (h === "codeberg.org")
+        return "codeberg";
+    if (h === "git.sr.ht" || h === "sr.ht")
+        return "sourcehut";
+    if (h === "huggingface.co" || h.endsWith(".hf.co"))
+        return "huggingface";
+    if (h.includes("gitea") || h.includes("forgejo"))
+        return "gitea";
+    return "other";
+}
+function browse(provider, host, path, region) {
+    switch (provider) {
+        case "azure-devops": {
+            const [org, project, repo] = path.split("/");
+            return org && project && repo ? `https://dev.azure.com/${org}/${project}/_git/${repo}` : undefined;
+        }
+        case "aws-codecommit":
+            return region ? `https://${region}.console.aws.amazon.com/codesuite/codecommit/repositories/${path}/browse?region=${region}` : undefined;
+        case "sourcehut":
+            return `https://git.sr.ht/${path}`;
+        default:
+            return `https://${host}/${path}`;
+    }
+}
+/** Parses any git remote URL form. Returns undefined for local paths and anything unrecognisable. */
+export function parseRemoteUrl(input) {
+    const raw = input.trim();
+    if (!raw || raw.length > 500)
+        return undefined;
+    // codecommit::us-east-1://my-repo  or  codecommit://profile@my-repo
+    const cc = /^codecommit(?:::([a-z0-9-]+))?:\/\/(?:[^@/]+@)?([A-Za-z0-9._-]+)\/?$/.exec(raw);
+    if (cc) {
+        const region = cc[1];
+        return { provider: "aws-codecommit", host: region ? `git-codecommit.${region}.amazonaws.com` : "git-codecommit.amazonaws.com", path: cc[2], protocol: "codecommit", ...(region ? { region } : {}), ...(region ? { url: browse("aws-codecommit", "", cc[2], region) } : {}) };
+    }
+    let host = "", path = "", protocol = "https";
+    const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(raw);
+    if (scheme) {
+        let u;
+        try {
+            u = new URL(raw);
+        }
+        catch {
+            return undefined;
+        }
+        const proto = u.protocol.replace(":", "").toLowerCase();
+        if (proto === "file")
+            return undefined;
+        protocol = proto === "http" ? "http" : proto === "https" ? "https" : proto === "git" ? "git" : "ssh";
+        host = u.hostname.toLowerCase(); // port, user and password are dropped here
+        path = decodeURIComponent(u.pathname);
+    }
+    else {
+        // scp-like: git@github.com:owner/repo.git   (but not C:\path or ./relative)
+        const scp = /^(?:[^@/\s]+@)?([A-Za-z0-9.-]+):(?!\/\/)(.+)$/.exec(raw);
+        if (!scp || /^[A-Za-z]$/.test(scp[1]))
+            return undefined;
+        host = scp[1].toLowerCase();
+        path = scp[2];
+        protocol = "ssh";
+    }
+    if (!host || !/^[a-z0-9.-]+$/.test(host))
+        return undefined;
+    let provider = providerOf(host);
+    let region;
+    path = cleanPath(path);
+    if (provider === "azure-devops") {
+        // https://dev.azure.com/org/project/_git/repo   |   git@ssh.dev.azure.com:v3/org/project/repo
+        path = path.replace(/^v3\//, "").replace(/\/_git\//, "/");
+        const vs = /^([a-z0-9-]+)\.visualstudio\.com$/.exec(host);
+        if (vs)
+            path = `${vs[1]}/${path}`;
+    }
+    else if (provider === "aws-codecommit") {
+        region = /^git-codecommit(?:-fips)?\.([a-z0-9-]+)\./.exec(host)?.[1];
+        path = path.replace(/^v1\/repos\//, "");
+    }
+    else if (provider === "sourcehut") {
+        path = path.replace(/^~/, "~");
+    }
+    if (!okPath(path))
+        return undefined;
+    if (protocol === "http")
+        provider = providerOf(host);
+    return {
+        provider, host, path, protocol,
+        ...(region ? { region } : {}),
+        ...(protocol !== "http" ? { url: browse(provider, host, path, region) } : {}),
+    };
+}
+function readSmall(file, max = 65536) {
+    try {
+        if (!existsSync(file) || statSync(file).size > max)
+            return undefined;
+        const fd = openSync(file, "r");
+        try {
+            const buf = Buffer.alloc(max);
+            const n = readSync(fd, buf, 0, max, 0);
+            return buf.subarray(0, n).toString("utf8");
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The origin remote (or the first remote) from a git directory's config. */
+export function readOriginRemote(gitDir) {
+    const config = readSmall(join(gitDir, "config"));
+    if (!config)
+        return undefined;
+    const remotes = [];
+    let current;
+    for (const line of config.split(/\r?\n/)) {
+        const section = /^\s*\[\s*remote\s+"([^"]+)"\s*\]\s*$/.exec(line);
+        if (section) {
+            current = { name: section[1] };
+            remotes.push(current);
+            continue;
+        }
+        if (/^\s*\[/.test(line)) {
+            current = undefined;
+            continue;
+        }
+        const url = current && !current.url ? /^\s*url\s*=\s*(.+?)\s*$/.exec(line) : null;
+        if (current && url)
+            current.url = url[1];
+    }
+    const pick = remotes.find(r => r.name === "origin" && r.url) ?? remotes.find(r => r.url);
+    return pick?.url ? parseRemoteUrl(pick.url) : undefined;
+}
+// ---- container registries ---------------------------------------------------------------------
+const TAG = "(?::([A-Za-z0-9_][A-Za-z0-9_.-]{0,127}))?";
+const REGISTRIES = [
+    { provider: "aws-ecr", re: new RegExp(`\\b(\\d{12})\\.dkr\\.ecr(?:-fips)?\\.([a-z0-9-]+)\\.amazonaws\\.com(?:\\.cn)?/([a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "aws-ecr", host: `${m[1]}.dkr.ecr.${m[2]}.amazonaws.com`, path: m[3], account: m[1], region: m[2], ...(m[4] ? { tag: m[4] } : {}) }) },
+    { provider: "aws-ecr-public", re: new RegExp(`\\bpublic\\.ecr\\.aws/([a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "aws-ecr-public", host: "public.ecr.aws", path: m[1], ...(m[2] ? { tag: m[2] } : {}) }) },
+    { provider: "ghcr", re: new RegExp(`\\bghcr\\.io/([a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "ghcr", host: "ghcr.io", path: m[1], ...(m[2] ? { tag: m[2] } : {}) }) },
+    { provider: "gcp-artifact-registry", re: new RegExp(`\\b([a-z0-9-]+)-docker\\.pkg\\.dev/([a-z0-9][a-z0-9.:-]*/[a-z0-9._-]+/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "gcp-artifact-registry", host: `${m[1]}-docker.pkg.dev`, path: m[2], region: m[1], ...(m[3] ? { tag: m[3] } : {}) }) },
+    { provider: "gcr", re: new RegExp(`\\b((?:[a-z]+\\.)?gcr\\.io)/([a-z0-9][a-z0-9.:-]*/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "gcr", host: m[1].toLowerCase(), path: m[2], ...(m[3] ? { tag: m[3] } : {}) }) },
+    { provider: "azure-acr", re: new RegExp(`\\b([a-z0-9]{5,50})\\.azurecr\\.io/([a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "azure-acr", host: `${m[1]}.azurecr.io`, path: m[2], ...(m[3] ? { tag: m[3] } : {}) }) },
+    { provider: "quay", re: new RegExp(`\\bquay\\.io/([a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "quay", host: "quay.io", path: m[1], ...(m[2] ? { tag: m[2] } : {}) }) },
+    { provider: "gitlab-registry", re: new RegExp(`\\bregistry\\.gitlab\\.com/([a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "gitlab-registry", host: "registry.gitlab.com", path: m[1], ...(m[2] ? { tag: m[2] } : {}) }) },
+    { provider: "docker-hub", re: new RegExp(`\\b(?:docker\\.io|index\\.docker\\.io|registry-1\\.docker\\.io)/([a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._/-]*)${TAG}`, "i"),
+        build: m => ({ provider: "docker-hub", host: "docker.io", path: m[1], ...(m[2] ? { tag: m[2] } : {}) }) },
+];
+/** Container registries named in a command (docker push/pull/build, aws ecr, ...). At most 4, no duplicates. */
+export function registriesIn(text) {
+    const out = [];
+    const seen = new Set();
+    for (const { re, build } of REGISTRIES) {
+        for (const m of text.matchAll(new RegExp(re.source, "gi"))) {
+            const ref = build(m);
+            const key = `${ref.provider}|${ref.host}|${ref.path}`;
+            if (seen.has(key) || !okPath(ref.path.replace(/:/g, "")))
+                continue;
+            seen.add(key);
+            out.push(ref);
+            if (out.length >= 4)
+                return out;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=repo-remote.js.map

package/dist/repo-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-remote.js","sourceRoot":"","sources":["../src/repo-remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqCjC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAClG,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;AAE1I,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtE,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/E,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,mBAAmB,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,cAAc,CAAC;IACjH,IAAI,iEAAiE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACvG,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC3D,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,CAAC;IACzE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAY,EAAE,MAAe;IAC3E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,yBAAyB,GAAG,IAAI,OAAO,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,6DAA6D,IAAI,kBAAkB,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3I,KAAK,WAAW;YACd,OAAO,qBAAqB,IAAI,EAAE,CAAC;QACrC;YACE,OAAO,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAE/C,oEAAoE;IACpE,MAAM,EAAE,GAAG,sEAAsE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5F,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,MAAM,gBAAgB,CAAC,CAAC,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/Q,CAAC;IAED,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,GAA2B,OAAO,CAAC;IACrE,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QACvC,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QACrG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,2CAA2C;QAC5E,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,MAAM,GAAG,GAAG,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,IAAI,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,8FAA8F;QAC9F,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,EAAE;YAAE,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,CAAC;SAAM,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACzC,MAAM,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,QAAQ,KAAK,MAAM;QAAE,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ;QAC9B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAG,GAAG,KAAK;IAC1C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC;QACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC;YAAC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACvJ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,IAAI,OAAmD,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,SAAS,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,OAAO,IAAI,GAAG;YAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,kGAAkG;AAElG,MAAM,GAAG,GAAG,2CAA2C,CAAC;AACxD,MAAM,UAAU,GAAmF;IACjG,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,wGAAwG,GAAG,EAAE,EAAE,GAAG,CAAC;QACvJ,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IACjK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,qEAAqE,GAAG,EAAE,EAAE,GAAG,CAAC;QAC3H,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IACpH,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,4DAA4D,GAAG,EAAE,EAAE,GAAG,CAAC;QACxG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IACnG,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,+FAA+F,GAAG,EAAE,EAAE,GAAG,CAAC;QAC5J,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IACjJ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,2EAA2E,GAAG,EAAE,EAAE,GAAG,CAAC;QACtH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IAC3G,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,6DAA6D,GAAG,EAAE,EAAE,GAAG,CAAC;QAC9G,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IACnH,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,4DAA4D,GAAG,EAAE,EAAE,GAAG,CAAC;QACxG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IACnG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,0EAA0E,GAAG,EAAE,EAAE,GAAG,CAAC;QACjI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;IAC1H,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,+GAA+G,GAAG,EAAE,EAAE,GAAG,CAAC;QACjK,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;CAC5G,CAAC;AAEF,gHAAgH;AAChH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAAC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9D,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAoB,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAAE,SAAS;YACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rule-catalog.d.ts

@@ -1,5 +1,5 @@
 import { type Matcher } from "./rule-matches.js";
-export type Severity = "critical" | "high" | "medium" | "info";
+export type Severity = "critical" | "high" | "medium" | "low" | "info";
 export type RuleCategory = "exec" | "exfil" | "impact" | "integrity" | "persistence" | "privilege" | "recon" | "secrets" | "source_control" | "custom";
 export type Rule = {
     id: string;

package/dist/rule-catalog.js

@@ -2,7 +2,7 @@
 // the same catalog backs agent hooks (core.ts) and the in-app SDK (sdk.ts), which can run in
 // edge runtimes.
 import { promptAttack } from "./prompt-attacks.js";
-import { isScopedTemporaryCleanup } from "./destructive-risk.js";
+import { isScopedTemporaryCleanup, isLowRiskCleanup, isProjectScopedCleanup, isSymlinkOnlyDelete } from "./destructive-risk.js";
 import { patternMatch, anyMatch, allMatch, functionalMatch } from "./rule-matches.js";
 import { credentialExposureSpans, possibleCredentialExposure } from "./credential-egress.js";
 const secret = /(?:\.env(?:\b|[./])|\.ssh[\\/]|id_rsa|id_ed25519|\.aws[\\/]credentials|\.pgpass\b|\.docker[\\/]config\.json|\.gnupg[\\/]|credentials\.json|(?:api[_-]?key|access[_-]?token|password|secret)\b)/i;
@@ -11,14 +11,104 @@ const secret = /(?:\.env(?:\b|[./])|\.ssh[\\/]|id_rsa|id_ed25519|\.aws[\\/]crede
 // rules also run on attacker-written text inside customer apps (App monitoring). Each line's
 // pipes are split once and scanned in order.
 const EXEC_AFTER_PIPE = /^\s*(?:sudo\s+)?(?:(?:ba|z|fi)?sh|python3?|node|ruby|perl|pwsh|powershell)\b/i;
+// "curl ... | python3 -c '...'" or "| node script.js" feeds the download to a program you already
+// have as plain input; only an interpreter that reads its PROGRAM from stdin (bash, sh -s,
+// python3 -, node -) runs what was downloaded.
+const wordsOf = (s) => s.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+const scriptArg = (t) => /^[A-Za-z0-9_.\/~$][\w.\/~${}@:+-]*$/.test(t);
+function execAfterPipe(segment) {
+    const m = EXEC_AFTER_PIPE.exec(segment);
+    if (!m)
+        return null;
+    const name = m[0].trim().split(/\s+/).pop().toLowerCase();
+    const rest = wordsOf(segment.slice(m[0].length));
+    if (/^(?:pwsh|powershell)$/.test(name))
+        return m;
+    for (const t of rest) {
+        if (/^(?:ba|z|fi)?sh$/.test(name)) {
+            if (t === "-s")
+                return m;
+            if (/^-[a-z]*c[a-z]*$/i.test(t))
+                return null;
+            if (scriptArg(t) && !t.startsWith("-"))
+                return null;
+            if (!t.startsWith("-"))
+                return m;
+        }
+        else if (/^python/.test(name)) {
+            if (t === "-")
+                return m;
+            if (/^-[a-z]*[cm][a-z]*$/i.test(t) || (scriptArg(t) && !t.startsWith("-")))
+                return null;
+            if (!t.startsWith("-"))
+                return m;
+        }
+        else if (name === "node") {
+            if (t === "-")
+                return m;
+            if (/^(?:-e|-p|-pe|--eval|--print)$/.test(t) || (scriptArg(t) && !t.startsWith("-")))
+                return null;
+            if (!t.startsWith("-"))
+                return m;
+        }
+        else {
+            if (/^-[a-z]*[eEr][a-z]*$/.test(t) || (scriptArg(t) && !t.startsWith("-")))
+                return null;
+            if (!t.startsWith("-"))
+                return m;
+        }
+    }
+    return m;
+}
+// Split a line at single pipes (not `||`). A `|` inside quotes still counts -- it is a real pipe
+// when the quoted text is shell code (subprocess.run("curl ... | bash"), bash -c "...", ssh host
+// "...") -- except where the quote holds a regex for grep/sed/awk/etc., where `|` is alternation.
+const REGEX_CONTEXT = /(?:\b(?:e?grep|rg|ag|ack|sed|awk|gawk|pgrep|pkill|jq|rename)\b|\s-[eE]\s*|--regexp(?:=|\s+)|--include=|--exclude=|--glob[= ]|\s-g\s*)[^|]*$/;
+function splitPipes(line) {
+    const parts = [];
+    let quote = "";
+    let from = 0;
+    let regexQuote = false;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (c === "\\" && quote !== "'") {
+            i++;
+            continue;
+        }
+        if (quote) {
+            if (c === quote) {
+                quote = "";
+                regexQuote = false;
+                continue;
+            }
+            if (!(c === "|" && !regexQuote))
+                continue;
+        }
+        else if (c === "'" || c === '"') {
+            quote = c;
+            regexQuote = REGEX_CONTEXT.test(line.slice(from, i));
+            continue;
+        }
+        if (c !== "|")
+            continue;
+        if (line[i + 1] === "|") {
+            i++;
+            continue;
+        }
+        parts.push(line.slice(from, i));
+        from = i + 1;
+    }
+    parts.push(line.slice(from));
+    return parts;
+}
 function pipesIntoShell(s, newArmer) {
     for (const line of s.split("\n")) {
         if (!line.includes("|"))
             continue;
         const arms = newArmer();
         let armed = false;
-        for (const [i, segment] of line.split("|").entries()) {
-            if (i > 0 && armed && EXEC_AFTER_PIPE.test(segment))
+        for (const [i, segment] of splitPipes(line).entries()) {
+            if (i > 0 && armed && execAfterPipe(segment))
                 return true;
             armed = arms(segment) || armed;
         }
@@ -33,8 +123,8 @@ function pipelineMatcher(newArmer) {
             const arms = newArmer();
             let armedAt;
             let cursor = 0;
-            for (const segment of line.split("|")) {
-                const executed = EXEC_AFTER_PIPE.exec(segment);
+            for (const segment of splitPipes(line)) {
+                const executed = execAfterPipe(segment);
                 if (armedAt !== undefined && executed) {
                     spans.push({ start: offset + armedAt, end: offset + cursor + executed[0].length, label: "Pipeline into an interpreter" });
                     break;
@@ -88,12 +178,105 @@ function recursiveDeleteSpans(s) {
 function rmRecursiveForce(s) { return recursiveDeleteSpans(s).length > 0; }
 // Download-then-execute split across a command chain instead of a pipe: `curl -o x.sh ... && chmod
 // +x x.sh && ./x.sh`. One segment fetches, a later segment (joined by && or ;) runs what it fetched.
-const DOWNLOAD_THEN_EXEC = /\b(?:curl|wget)\b[^\n]{0,300}?(?:\s-[oO]\s|--output\b)[^\n]{0,300}?(?:&&|;)[^\n]{0,300}?(?:chmod\s+\+x|\.\/\S|(?:ba|z)?sh\b|python3?\b|node\b)/i;
+// "curl -o f URL && bash f": the file that was downloaded is the file that runs. A -o that belongs
+// to another program (grep -o), a download to /dev/null, or an unrelated later python3/node is not.
+function splitCommands(line) {
+    const out = [];
+    let from = 0;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (c === "\\") {
+            i++;
+            continue;
+        }
+        const sep = c === ";" ? 1 : c === "&" && line[i + 1] === "&" ? 2 : 0;
+        if (!sep)
+            continue;
+        out.push({ text: line.slice(from, i), start: from });
+        i += sep - 1;
+        from = i + 1;
+    }
+    out.push({ text: line.slice(from), start: from });
+    return out;
+}
+// `sh -c "curl ... && bash f"` / `ssh host "..."`: look inside the quoted command.
+const unwrap = (segment) => segment.trim()
+    .replace(/^(?:sudo\s+)?(?:(?:ba|z|da)?sh\s+-[a-z]*c|ssh\s+(?:-\S+\s+)*\S+)\s+["']/, "")
+    .replace(/["')\s]+$/, "");
+const unquote = (t) => t.replace(/^(["'])(.*)\1$/, "$2");
+const baseName = (p) => p.replace(/[?#].*$/, "").split("/").filter(Boolean).pop() ?? "";
+function downloadedFile(segment) {
+    if (splitPipes(segment).length > 1)
+        return undefined;
+    const w = wordsOf(unwrap(segment)).map(unquote);
+    let at = 0;
+    while (/^\w+=/.test(w[at] ?? "") || w[at] === "sudo")
+        at++;
+    const tool = w[at]?.split("/").pop();
+    if (tool !== "curl" && tool !== "wget")
+        return undefined;
+    const url = w.find(t => /^https?:\/\//i.test(t));
+    for (let i = at + 1; i < w.length; i++) {
+        const t = w[i];
+        let file;
+        if (t === "-o" || t === "--output" || (tool === "curl" && /^-[a-zA-Z]+o$/.test(t)) || (tool === "wget" && /^-[a-zA-Z]*O$/.test(t)))
+            file = w[i + 1];
+        else if (/^--output=/.test(t))
+            file = t.slice(9);
+        else if (tool === "curl" && (/^-[a-zA-Z]*O$/.test(t) || t === "--remote-name"))
+            file = url ? baseName(url) : undefined;
+        if (file !== undefined)
+            return file === "-" || file === "/dev/null" ? undefined : file;
+    }
+    return tool === "wget" && url ? baseName(url) || undefined : undefined;
+}
+function runsFile(segment, files) {
+    const w = wordsOf(unwrap(segment)).map(unquote);
+    let at = 0;
+    while (/^\w+=/.test(w[at] ?? "") || w[at] === "sudo")
+        at++;
+    const head = w[at];
+    if (!head)
+        return false;
+    const isIt = (t) => !!t && files.some(f => t === f || t.endsWith("/" + f.replace(/^\.?\//, "")) || t === "./" + f);
+    if (head === "chmod")
+        return w.slice(at + 1).some(isIt);
+    if (/^(?:(?:ba|z|fi|da)?sh|python[\d.]*|node|ruby|perl|php|source|\.)$/.test(head.split("/").pop()))
+        return isIt(w.slice(at + 1).find(t => !t.startsWith("-")));
+    return (head.includes("/") || head.startsWith("./")) && isIt(head);
+}
+function downloadThenExecSpans(text) {
+    const spans = [];
+    let offset = 0;
+    for (const line of text.split("\n")) {
+        const files = [];
+        let from = -1;
+        for (const seg of splitCommands(line)) {
+            const file = downloadedFile(seg.text);
+            if (file) {
+                files.push(file);
+                if (from < 0)
+                    from = seg.start;
+                continue;
+            }
+            if (files.length && runsFile(seg.text, files)) {
+                spans.push({ start: offset + from, end: offset + seg.start + seg.text.length, label: "Downloaded file is run" });
+                break;
+            }
+        }
+        offset += line.length + 1;
+    }
+    return spans;
+}
+const DOWNLOAD_THEN_EXEC = functionalMatch(text => downloadThenExecSpans(text).length > 0, downloadThenExecSpans);
 // PowerShell's `IEX (New-Object Net.WebClient).DownloadString(...)` / `iwr ... | iex`, the
 // single most common Windows download-and-run one-liner; and a Python process that fetches and
 // executes in the same call instead of piping to a shell.
 const POWERSHELL_DOWNLOAD_EXEC = /\bdownloadstring\s*\(|\b(?:iex|invoke-expression)\b[^\n]{0,300}?(?:iwr|invoke-webrequest|downloadstring)\b|\b(?:iwr|invoke-webrequest)\b[^\n]{0,300}?\|\s*(?:iex|invoke-expression)\b/i;
-const PYTHON_FETCH_EXEC = /\b(?:exec|eval)\s*\(\s*(?:compile\s*\(\s*)?(?:urllib\.request\.urlopen|urlopen|requests\.get|urlretrieve)\b/i;
+const PYTHON_FETCH_EXEC = /\b(?:exec|eval)\s*\(\s*(?:compile\s*\(\s*)?(?:[\w.]*\.)?(?:urlopen|urlretrieve)\b|\b(?:exec|eval)\s*\(\s*(?:compile\s*\(\s*)?(?:requests|httpx)\.(?:get|post)\b/i;
+// bash <(curl ...), sh -c "$(curl ...)", eval "$(curl ...)", source <(curl ...), . <(curl ...);
+// node fetch(...).then(r => r.text()).then(eval); deno run https://...
+const FETCH_AND_RUN = /(?:\b(?:(?:ba|z|fi|da|k)?sh|source|eval|python[\d.]*|node|ruby|perl|php)\b(?:\s+-[a-z]*c)?|(?:^|[;&|\s])\.)\s+["']?(?:<\(|\$\(|`)\s*(?:sudo\s+)?(?:curl|wget)\b|\bfetch\s*\([^\n]{0,400}?\)\s*\.then\s*\([^\n]{0,200}?text\(\)\s*\)\s*\.then\s*\(\s*(?:eval|new\s+Function)\b|\beval\s*\(\s*await\s+[^\n]{0,80}?fetch\b|\bdeno\s+(?:run|eval)\b[^\n]{0,200}?\bhttps?:\/\//i;
 // Disk, partition and filesystem-level wipes: destroy an entire volume rather than files inside
 // it, and are unrecoverable even with the deleted file still referenced elsewhere.
 const DISK_WIPE = /\bdd\b[^\n]{0,300}?\bof=\/dev\/(?:[sh]d|nvme|disk)\w*|\bmkfs\b|\bmke2fs\b|\bwipefs\b|\bblkdiscard\b|\b(?:fdisk|gdisk|sgdisk|parted)\b|\bdiskutil\s+(?:eraseDisk|eraseVolume|reformat)\b|\bdiskpart\b[\s\S]{0,200}?\bclean\b|\bClear-Disk\b[^\n]{0,300}?-RemoveData|\bRemove-Partition\b|\bcipher\s+\/w:|\bformat\s+[a-z]:\s*\/y\b/i;
@@ -101,7 +284,7 @@ const DISK_WIPE = /\bdd\b[^\n]{0,300}?\bof=\/dev\/(?:[sh]d|nvme|disk)\w*|\bmkfs\
 const FORK_BOMB = /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/;
 // Dropping an entire datastore instead of rows in it: Redis/Mongo have no SQL DROP/TRUNCATE syntax.
 const DATASTORE_WIPE = /\bFLUSHALL\b|\bFLUSHDB\b|db\.dropDatabase\s*\(\)/i;
-const otherDestructiveMatcher = anyMatch(patternMatch(/\bfind\b[^\n]{0,300}?-delete\b|\brsync\b[^\n]{0,300}?--delete\b|\bshred\b[^\n]{0,100}?-\w*u|\bshutil\.rmtree\s*\(|(?:\bfs\.)?\brm(?:dir)?Sync\s*\([^\n]{0,200}?recursive\s*:\s*true|\brd\s+\/s\s+\/q\b|\bRemove-Item\b[^\n]{0,1000}?(?:-Recurse|-Force)|\b(?:drop\s+(?:table|database)|truncate\s+(?:table\s+)?\w+)|\bgit\s+(?:reset\s+--hard|clean\s+-[^\n]{0,1000}?f)/i), patternMatch(DATASTORE_WIPE));
+const otherDestructiveMatcher = anyMatch(patternMatch(/\bfind\b[^\n]{0,300}?-delete\b|\brsync\b[^\n]{0,300}?--delete\b|\bshred\b[^\n]{0,100}?-\w*u|\bshutil\.rmtree\s*\(|(?:\bfs\.)?\brm(?:dir)?Sync\s*\([^\n]{0,200}?recursive\s*:\s*true|\brd\s+\/s\s+\/q\b|\bRemove-Item\b[^\n]{0,1000}?(?:-Recurse|-Force)|\b(?:drop\s+(?:table|database)|truncate\s+table\s+\w+)|(?:^|[;&|\n]\s*)(?:sudo\s+)?truncate\s+-s\s*0\b|(?:^|[;\n("'])\s*truncate\s+(?:only\s+)?\w+(?:\.\w+)?\s*(?:;|\bcascade\b|\brestart\b)|\bgit\s+(?:reset\s+--hard|clean\s+-[^\n]{0,1000}?f)/i), patternMatch(DATASTORE_WIPE));
 function otherDestructiveOperation(s) { return otherDestructiveMatcher(s); }
 // A vault/secret-manager reference (op://, Azure Key Vault, HashiCorp Vault, Infisical, Doppler,
 // a GitHub Actions secrets expression, or a generic broker placeholder) typed literally into a
@@ -113,8 +296,12 @@ function otherDestructiveOperation(s) { return otherDestructiveMatcher(s); }
 // real service (with its own resolver already wired up) is what should happen next, not the agent
 // improvising. Mirrors the CREDENTIAL_REFERENCE check in data-detectors.ts.
 const UNRESOLVED_REFERENCE = /\bop:\/\/|@Microsoft\.KeyVault\(|\bvault:[\w/-]|\binfisical:\/\/|\bdoppler:\/\/|\$\{\{\s*secrets\.|__[A-Z][A-Z0-9_]*_REF_[\w-]+__/i;
+// Shared by destructive.production below: split out so the heading-aware matcher can reuse the
+// same two patterns the old allMatch(...) used.
+const PROD_TARGET = /\b(?:production|prod|prd)\b/i;
+const PROD_VERB = /\b(?:deploy|delete|drop|truncate|migrate|apply|destroy|restart|rollback|scale)\b/i;
 export const builtinRules = [
-    { id: "destructive.delete", title: "Destructive operation", severity: "high", category: "impact", explanation: "Recursive deletion or a destructive data operation. Scoped temporary test cleanup is MEDIUM; broad or uncertain targets remain HIGH. Review the target before allowing it.", match: anyMatch(functionalMatch(rmRecursiveForce, recursiveDeleteSpans), otherDestructiveMatcher), severityFor: s => !otherDestructiveOperation(s) && isScopedTemporaryCleanup(s) ? "medium" : "high" },
+    { id: "destructive.delete", title: "Destructive operation", severity: "high", category: "impact", explanation: "Recursive deletion or a destructive data operation. Scoped temporary test cleanup is MEDIUM; broad or uncertain targets remain HIGH. Review the target before allowing it.", match: anyMatch(functionalMatch(rmRecursiveForce, recursiveDeleteSpans), otherDestructiveMatcher), severityFor: s => isSymlinkOnlyDelete(s) ? "low" : otherDestructiveOperation(s) ? "high" : isLowRiskCleanup(s) ? "low" : isScopedTemporaryCleanup(s) || isProjectScopedCleanup(s) ? "medium" : "high" },
     { id: "destructive.disk_wipe", title: "Disk or partition wipe", severity: "critical", category: "impact", explanation: "This targets an entire disk, partition or filesystem rather than individual files, and is unrecoverable. Confirm this is an authorized, intentional wipe.", match: patternMatch(DISK_WIPE) },
     { id: "destructive.fork_bomb", title: "Fork bomb", severity: "critical", category: "impact", explanation: "This pattern spawns processes exponentially and can make the machine unresponsive.", match: patternMatch(FORK_BOMB) },
     { id: "destructive.audit_trail", title: "Audit trail or recovery point erased", severity: "critical", category: "integrity", explanation: "This clears shadow copies, event logs or shell history. It is also the standard precursor to covering up a destructive or malicious action; confirm the reason before allowing it.", match: patternMatch(/\bvssadmin\b[^\n]{0,100}?delete\s+shadows|\bwevtutil\b[^\n]{0,50}?\bcl\b|\bClear-EventLog\b|\bhistory\s+-c\b|\bunset\s+HISTFILE\b|\bHISTSIZE\s*=\s*0\b|\bbcdedit\b[^\n]{0,50}?\/deletevalue/i) },
@@ -123,7 +310,11 @@ export const builtinRules = [
     { id: "destructive.account", title: "Deletes a system account", severity: "high", category: "impact", explanation: "This removes a user or group account, which can include its home directory and files. Confirm the account is no longer needed.", match: patternMatch(/\buserdel\s+-r\b|\bgroupdel\b|\bRemove-LocalUser\b|\bnet\s+user\s+\S+\s+\/delete\b|\bdscl\s+\.\s+-delete\s+\/Users\//i) },
     { id: "integrity.protection_disabled", title: "OS security control disabled", severity: "critical", category: "integrity", explanation: "This turns off a platform security control (System Integrity Protection, Gatekeeper, execution policy, or System Restore), which weakens the machine's security posture beyond this one action.", match: patternMatch(/\bcsrutil\s+disable\b|\bspctl\s+--master-disable\b|\bsecurity\s+delete-keychain\b|\bSet-ExecutionPolicy\s+Unrestricted\b|\bDisable-WindowsOptionalFeature\b|\bDisable-ComputerRestore\b/i) },
     { id: "network.firewall_disabled", title: "Firewall rules flushed or disabled", severity: "high", category: "integrity", explanation: "This removes or disables firewall protection on the host. Confirm the host doesn't need it, or that replacement rules are applied immediately.", match: patternMatch(/\biptables\s+-F\b|\bufw\s+(?:--force\s+reset|disable)\b|\bnetsh\s+advfirewall\s+set\s+allprofiles\s+state\s+off\b/i) },
-    { id: "destructive.production", title: "Production change", severity: "high", category: "impact", explanation: "This action targets a production environment. Confirm the scope and rollback plan before proceeding.", match: allMatch(patternMatch(/\b(?:production|prod|prd)\b/i), patternMatch(/\b(?:deploy|delete|drop|truncate|migrate|apply|destroy|restart|rollback|scale)\b/i)) },
+    { id: "destructive.production", title: "Production change", severity: "high", category: "impact", explanation: "This action targets a production environment. Confirm the scope and rollback plan before proceeding.",
+        // Both words can co-occur in a markdown heading or doc title ("# Deploy production") that is
+        // not itself a command. Require the co-occurrence on one line that isn't a heading, so prose
+        // describing production deploys doesn't read the same as a command that performs one.
+        match: functionalMatch(s => s.split(/\r?\n/).some(line => { const t = line.trim(); return !/^#{1,6}\s/.test(t) && PROD_TARGET.test(t) && PROD_VERB.test(t); }), text => allMatch(patternMatch(PROD_TARGET), patternMatch(PROD_VERB)).spans?.(text) ?? []) },
     // Dumping the *whole* environment (every var, name and value) is the risky shape: that's what
     // can hand over credentials the agent was never told about. Referencing one named variable
     // ($PORT, $NODE_ENV, ${DATABASE_URL}) is how every normal dev workflow reads its own config and
@@ -131,20 +322,51 @@ export const builtinRules = [
     // called out as noisy. That case now only shows up (at "info", logged but not an approval gate)
     // in credentials.environment_ref below, and only for the few var-name shapes anyone would
     // actually call a credential; everyday vars like $PORT or $NODE_ENV don't get flagged anywhere.
-    { id: "credentials.environment", title: "Environment variable access", severity: "high", category: "secrets", explanation: "The action reads every exported environment variable at once (not one named variable), which can expose credentials the agent was never told about.", match: patternMatch(/\b(?:printenv|env|export\s+-p|process\.env|os\.environ|System\.getenv|declare\s+-x|Get-ChildItem\s+env:)\b|\/proc\/self\/environ\b|(?:^|[;&|]\s*)set(?:\s*$|\s+-o\b)/i) },
+    { id: "credentials.environment", title: "Environment variable access", severity: "high", category: "secrets", explanation: "The action reads every exported environment variable at once (not one named variable), which can expose credentials the agent was never told about.",
+        // Bare "env" used to be a plain \b...\b alternative, so it matched the standalone token inside
+        // "env.FLAGS", "this.env.AI.run(...)", or a TypeScript "Env" binding/generic -- none of which
+        // dump the environment. It now needs its own boundaries: not preceded by "." or a word char
+        // (so it isn't someone's property/namespace access), and not immediately followed by ".", "(",
+        // or "<" (a method call, property access, or generic type argument), so only the bare shell
+        // command or standalone identifier still matches.
+        // Cloudflare Workers code conventionally declares "interface Env { ... }" and takes a
+        // lowercase "env" binding parameter ("fetch(request, env, ctx)", "(req, env) =>",
+        // "import { env } from ..."). That is every Workers-based skill's docs, and a boundary-only
+        // exclusion list can't keep up with every syntactic shape "env" shows up adjacent to as an
+        // identifier (":" for a type, "," in a param list, "}" closing a destructure, "=>", ...).
+        // The real "env" command is only ever meaningful as the first word of a shell command, so
+        // this now requires exactly that shape -- optionally after a command separator -- instead of
+        // trying to list every JS/TS context where "env" is just a parameter name.
+        match: anyMatch(
+        // process.env.CF_ACCOUNT_ID / os.environ["R2_WAREHOUSE"] read one named property, same as
+        // $PORT or ${DATABASE_URL} below -- not the bulk dump this rule means to catch. Only the
+        // bare object (passed, spread, or iterated whole) still counts.
+        patternMatch(/\b(?:printenv|export\s+-p|process\.env(?![.[])|os\.environ(?![.[])|System\.getenv|declare\s+-x|Get-ChildItem\s+env:)\b|\/proc\/self\/environ\b|(?:^|[;&|]\s*)set(?:\s*$|\s+-o\b)/i), patternMatch(/(?:^|\n|[;&|]\s*)env\b(?![.\w(<])/)) },
     { id: "credentials.environment_ref", title: "Named credential variable referenced", severity: "info", category: "secrets", explanation: "A single environment variable whose name looks like a credential (KEY/SECRET/TOKEN/PASSWORD/CREDENTIAL) is referenced by name. Logged for visibility; this alone isn't a reason to block the ordinary case of an app reading its own configured secret.", match: patternMatch(/\$\{?[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*_(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)S?\}?\b/) },
     { id: "credentials.access", title: "Sensitive credential reference", severity: "medium", category: "secrets", explanation: "This action or instruction references a credential location. Confirm the agent needs access.", match: patternMatch(secret) },
-    { id: "source.private_files", title: "Private source or configuration access", severity: "high", category: "secrets", explanation: "This action accesses a private credential or configuration file. Confirm that the agent needs the contents.", match: patternMatch(/(?:\.env(?:\.[\w.-]+)?|\.ssh[\\/]|\.aws[\\/]credentials|id_(?:rsa|ed25519)|\.npmrc|\.netrc|kubeconfig|private.?key|\.pgpass\b|\.docker[\\/]config\.json|\.gnupg[\\/]|credentials\.json)/i) },
+    { id: "source.private_files", title: "Private source or configuration access", severity: "high", category: "secrets", explanation: "This action accesses a private credential or configuration file. Confirm that the agent needs the contents.",
+        // \.env(?:\.[\w.-]+)? had no boundaries, so it matched the literal substring ".env" inside
+        // "this.env.AI.run(...)" (a property access, not a dotenv file) and inside ".environment" (a
+        // different word entirely, since nothing required the match to end at "env"). It now needs
+        // "not preceded by a word character" (so a leading property-access dot like "this.env" is
+        // excluded) and "not followed by a word character unless it's another dotted extension" (so
+        // ".environment" doesn't partially match as ".env").
+        match: patternMatch(/(?:(?<!\w)\.env(?:\.[\w-]+)?(?!\w)|\.ssh[\\/]|\.aws[\\/]credentials|id_(?:rsa|ed25519)|\.npmrc|\.netrc|kubeconfig|private.?key|\.pgpass\b|\.docker[\\/]config\.json|\.gnupg[\\/]|credentials\.json)/i) },
     { id: "mcp.write", title: "MCP write operation", severity: "high", category: "impact", explanation: "The MCP tool appears to modify data or send an external side effect. Require approval before allowing it.", match: patternMatch(/\bmcp(?:__|:)[^\s]*(?:create|update|delete|write|send|post|put|patch|execute|run|publish|deploy|remove|save|insert|add|grant|revoke|assign)\b/i) },
     { id: "credentials.egress", title: "Possible credential exposure", severity: "critical", category: "exfil", explanation: "A transfer command carries a sensitive payload, or sensitive output feeds an outbound command. This is a possible exposure, not proof of delivery; check the destination and authorization.", match: functionalMatch(possibleCredentialExposure, credentialExposureSpans) },
     { id: "secrets.unresolved_reference_launch", title: "Vault reference used directly instead of resolved", severity: "medium", category: "secrets", explanation: "This command includes a secret-manager reference (op://, Azure Key Vault, Vault, Infisical, Doppler, a GitHub Actions secrets expression, or a broker placeholder) typed in literally rather than resolved by its own CLI or platform. The agent cannot resolve it into the real value -- have a human or CI process start the real service instead, with its existing resolver already wired up.", match: patternMatch(UNRESOLVED_REFERENCE) },
-    { id: "execution.remote", title: "Remote code execution pattern", severity: "high", category: "exec", explanation: "Downloaded content is fetched and run without review: piped into a shell or interpreter, fetched and executed in one step, or downloaded and run as separate chained commands.", match: anyMatch(anyMatch(anyMatch(pipelineMatcher(downloads), patternMatch(DOWNLOAD_THEN_EXEC)), patternMatch(POWERSHELL_DOWNLOAD_EXEC)), patternMatch(PYTHON_FETCH_EXEC)) },
+    { id: "execution.remote", title: "Remote code execution pattern", severity: "high", category: "exec", explanation: "Downloaded content is fetched and run without review: piped into a shell or interpreter, fetched and executed in one step, or downloaded and run as separate chained commands.", match: anyMatch(anyMatch(anyMatch(anyMatch(pipelineMatcher(downloads), DOWNLOAD_THEN_EXEC), patternMatch(POWERSHELL_DOWNLOAD_EXEC)), patternMatch(PYTHON_FETCH_EXEC)), patternMatch(FETCH_AND_RUN)) },
     { id: "execution.obfuscated", title: "Encoded execution", severity: "high", category: "exec", explanation: "Encoded content is decoded for execution. Review the decoded payload separately; Beam never executes it.", match: anyMatch(pipelineMatcher(decodes), patternMatch(/\b(?:powershell|pwsh)\b[^\n]{0,500}?\s-(?:enc|encodedcommand)\b/i)) },
     { id: "recon.network_sweep", title: "Network sweep", severity: "medium", category: "recon", explanation: "A scanner targets a network range. Verify scope and authorization before the agent probes other systems (ATT&CK T1046).", match: allMatch(patternMatch(/\b(?:nmap|masscan|rustscan)\b/i), patternMatch(/(?:\d{1,3}\.){3}\d{1,3}\/\d{1,2}|(?:\d{1,3}\.){3}\d{1,3}-\d{1,3}/)) },
     { id: "privilege.elevation", title: "Elevated privileges", severity: "medium", category: "privilege", explanation: "The action requests elevated privileges or broad write permissions.", match: patternMatch(/\bsudo\s|\bdoas\s|(?:^|[\s;&|`(])su\s+(?:-\s*\w*|root)\b|\bpkexec\b|\brunas\s+\/user:|\bchmod\s+(?:-R\s+)?(?:777\b|[ugoa]*\+s\b|[2467][0-7]{3}\b)/i) },
     { id: "network.metadata", title: "Cloud metadata access", severity: "high", category: "secrets", explanation: "Cloud metadata endpoints can expose temporary instance credentials.", match: patternMatch(/169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200/i) },
-    { id: "persistence.config", title: "Security-sensitive configuration", severity: "high", category: "persistence", explanation: "A persistence or agent configuration target is referenced. Check the intended change and trust boundary.", match: patternMatch(/authorized_keys|\bcrontab\b|LaunchAgents[\\/]|ANTHROPIC_BASE_URL/i) },
-    { id: "network.reverse-shell", title: "Reverse shell pattern", severity: "critical", category: "exec", explanation: "This pattern can connect a command shell to another machine.", match: patternMatch(/\/dev\/tcp\/|\bnc\b[^\n]{0,300}?\s-e\s|socket[\s\S]{0,200}?subprocess|\bNew-Object\s+(?:System\.)?Net\.Sockets\.TCPClient\b|\bsocat\b[^\n]{0,300}?\bexec[:=]|\bsocket\([^\n]{0,150}?getprotobyname\(["']tcp["']\)[\s\S]{0,200}?\bconnect\(/i) },
+    { id: "persistence.config", title: "Security-sensitive configuration", severity: "high", category: "persistence", explanation: "A persistence or agent configuration target is referenced. Check the intended change and trust boundary.",
+        // \bcrontab\b matched the "crontab" in crontab.guru (a validator website, not the command), so
+        // the bare word needs a guard against being immediately followed by a domain-style ".word".
+        // "[Crontab Guru](https://crontab.guru/)" -- a markdown link to the validator site -- still
+        // matched via its link *text* ("Crontab Guru"), not just the URL the first guard covers.
+        match: patternMatch(/authorized_keys|\bcrontab\b(?!\.\w)(?!\s+Guru\b)|LaunchAgents[\\/]|ANTHROPIC_BASE_URL/i) },
+    { id: "network.reverse-shell", title: "Reverse shell pattern", severity: "critical", category: "exec", explanation: "This pattern can connect a command shell to another machine.", match: patternMatch(/\/dev\/tcp\/|\bnc\b[^\n]{0,300}?\s-e\s|\bsocket\b(?=[\s\S]{0,400}?\.connect\s*\()[\s\S]{0,400}?(?:subprocess|pty\.spawn|dup2|\/bin\/(?:ba)?sh)|\bNew-Object\s+(?:System\.)?Net\.Sockets\.TCPClient\b|\bsocat\b[^\n]{0,300}?\bexec[:=]|\bsocket\([^\n]{0,150}?getprotobyname\(["']tcp["']\)[\s\S]{0,200}?\bconnect\(/i) },
     { id: "instructions.override", title: "Instruction override attempt", severity: "high", category: "integrity", explanation: "Instructions attempt to override existing safeguards or conceal activity from the user. Checked against the same folded view used for prompt-injection monitoring (Unicode/width normalization and base64 decoding), not a literal-text match, so stylized or encoded phrasing is caught too.", match: functionalMatch(promptAttack.override) },
     { id: "source_control.history_rewrite", title: "Git history rewrite", severity: "medium", category: "source_control", explanation: "Force-pushing or rewriting shared history can silently discard other people's commits. Confirm the branch isn't shared before proceeding.", match: patternMatch(/\bgit\s+push\s+[^\n]{0,1000}?(?:--force(?:-with-lease)?|-f\b)|\bgit\s+filter-(?:branch|repo)\b/i) },
     { id: "integrity.tls_bypass", title: "Certificate or signature verification disabled", severity: "medium", category: "integrity", explanation: "Disabling TLS/certificate verification removes protection against a tampered or impersonated destination.", match: patternMatch(/\bcurl\b[^\n]{0,1000}?(?:-k\b|--insecure)|\bwget\b[^\n]{0,1000}?--no-check-certificate|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|\bgit\b[^\n]{0,1000}?-c\s+http\.sslVerify=false|\bverify\s*=\s*False\b|\brejectUnauthorized\s*:\s*false\b/i) },