@bridge4dev/runner 0.11.0

package/dist/journal.js

@@ -0,0 +1,300 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { journalDir } from './paths.js';
+/**
+ * Compact once the file grows past this — a chatty agent (Codex streams far
+ * more item events than Claude) otherwise leaves a file that both the replay on
+ * open and every reconnect have to read in full (QA-99 MINOR-6).
+ */
+const COMPACT_THRESHOLD_BYTES = 512 * 1024;
+export class SessionJournal {
+    sessionId;
+    file;
+    nextSeq = 1;
+    unackedBySeq = new Map();
+    /** Messages accepted from the API but not yet handed to an agent. */
+    pendingById = new Map();
+    pendingCounter = 0;
+    /** Bytes written since the file was last rewritten from live state. */
+    bytesOnDisk = 0;
+    /** Last status reported for this session — replayed after a reconnect. */
+    lastStatus = null;
+    constructor(sessionId, dir = journalDir()) {
+        this.sessionId = sessionId;
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        this.file = path.join(dir, `${sessionId}.ndjson`);
+        this.replay();
+    }
+    replay() {
+        if (!fs.existsSync(this.file))
+            return;
+        const raw = fs.readFileSync(this.file, 'utf8');
+        this.bytesOnDisk = Buffer.byteLength(raw);
+        for (const line of raw.split('\n')) {
+            if (!line.trim())
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                continue; // torn tail write after a crash — ignore
+            }
+            if (parsed.kind === 'event') {
+                this.unackedBySeq.set(parsed.seq, {
+                    seq: parsed.seq,
+                    eventType: parsed.eventType,
+                    payload: parsed.payload,
+                });
+                if (parsed.seq >= this.nextSeq)
+                    this.nextSeq = parsed.seq + 1;
+            }
+            else if (parsed.kind === 'ack') {
+                this.unackedBySeq.delete(parsed.seq);
+            }
+            else if (parsed.kind === 'status') {
+                this.lastStatus = {
+                    status: parsed.status,
+                    ...(parsed.extra ? { extra: parsed.extra } : {}),
+                    ...(parsed.epoch === undefined ? {} : { epoch: parsed.epoch }),
+                };
+            }
+            else if (parsed.kind === 'pending') {
+                this.pendingById.set(parsed.id, {
+                    id: parsed.id,
+                    text: parsed.text,
+                    ...(parsed.attachments?.length ? { attachments: parsed.attachments } : {}),
+                });
+                // Ids are `p<n>`; keep the counter above whatever the file holds so a
+                // restarted runner cannot mint an id that is already in flight.
+                const n = Number.parseInt(parsed.id.slice(1), 10);
+                if (Number.isFinite(n) && n >= this.pendingCounter)
+                    this.pendingCounter = n + 1;
+            }
+            else if (parsed.kind === 'pending_done') {
+                this.pendingById.delete(parsed.id);
+            }
+            else if (parsed.kind === 'seq') {
+                if (parsed.next > this.nextSeq)
+                    this.nextSeq = parsed.next;
+            }
+        }
+    }
+    write(line) {
+        const encoded = JSON.stringify(line) + '\n';
+        fs.appendFileSync(this.file, encoded);
+        this.bytesOnDisk += Buffer.byteLength(encoded);
+    }
+    /**
+     * Rewrite the file from live state: the seq counter, the events still waiting
+     * for an ack, and the last reported status. Everything else is history the
+     * runner never reads again.
+     *
+     * Atomic (tmp + rename) so a crash mid-compaction leaves the previous file
+     * intact rather than a truncated one.
+     */
+    compact() {
+        const lines = [{ kind: 'seq', next: this.nextSeq }];
+        for (const event of this.unacked()) {
+            lines.push({ kind: 'event', ...event, ts: new Date().toISOString() });
+        }
+        if (this.lastStatus) {
+            lines.push({
+                kind: 'status',
+                status: this.lastStatus.status,
+                ...(this.lastStatus.extra ? { extra: this.lastStatus.extra } : {}),
+                ...(this.lastStatus.epoch === undefined ? {} : { epoch: this.lastStatus.epoch }),
+                ts: new Date().toISOString(),
+            });
+        }
+        // Undelivered messages are live state too — compaction that dropped them
+        // would lose exactly what this queue exists to protect.
+        for (const record of this.pendingById.values()) {
+            lines.push({
+                kind: 'pending',
+                id: record.id,
+                text: record.text,
+                ...(record.attachments?.length ? { attachments: record.attachments } : {}),
+                ts: new Date().toISOString(),
+            });
+        }
+        const body = lines.map((line) => JSON.stringify(line) + '\n').join('');
+        const tmp = `${this.file}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, body, { mode: 0o600 });
+        fs.renameSync(tmp, this.file);
+        this.bytesOnDisk = Buffer.byteLength(body);
+    }
+    compactIfLarge() {
+        if (this.bytesOnDisk <= COMPACT_THRESHOLD_BYTES)
+            return;
+        try {
+            this.compact();
+        }
+        catch {
+            // Compaction is an optimisation — a failure must never lose events.
+        }
+    }
+    /**
+     * Statuses are fire-and-forget on the wire; journaling the latest one lets
+     * the supervisor re-report it after a reconnect (QA-96 F1).
+     */
+    recordStatus(status, extra, epoch) {
+        this.lastStatus = {
+            status,
+            ...(extra ? { extra } : {}),
+            ...(epoch === undefined ? {} : { epoch }),
+        };
+        this.write({
+            kind: 'status',
+            status,
+            ...(extra ? { extra } : {}),
+            ...(epoch === undefined ? {} : { epoch }),
+            ts: new Date().toISOString(),
+        });
+    }
+    /** Assign the next seq and persist the event before it is sent. */
+    append(eventType, payload) {
+        const event = { seq: this.nextSeq++, eventType, payload };
+        this.write({ kind: 'event', ...event, ts: new Date().toISOString() });
+        this.unackedBySeq.set(event.seq, event);
+        return event;
+    }
+    /**
+     * Never reuse a seq the API already stored: after a runner state-dir wipe the
+     * local counter restarts at 1 and every replayed event would collide with an
+     * existing (sessionId, seq) row and be swallowed as a duplicate — the session
+     * would look mute in the dashboard (QA-99 MAJOR-3).
+     */
+    ensureSeqAbove(lastStoredSeq) {
+        if (Number.isFinite(lastStoredSeq) && lastStoredSeq >= this.nextSeq) {
+            this.nextSeq = lastStoredSeq + 1;
+        }
+    }
+    ack(seq) {
+        if (!this.unackedBySeq.has(seq))
+            return;
+        this.unackedBySeq.delete(seq);
+        this.write({ kind: 'ack', seq });
+        // Acks are the point where history becomes dead weight — check here rather
+        // than on append so compaction actually drops something.
+        this.compactIfLarge();
+    }
+    unacked() {
+        return [...this.unackedBySeq.values()].sort((a, b) => a.seq - b.seq);
+    }
+    /**
+     * Record a message that could not be handed to an agent yet. Persisted before
+     * it is queued in memory, so the ordering is "on disk, then held" — a crash
+     * between the two costs a duplicate delivery at worst, never a lost message.
+     */
+    appendPending(text, attachments) {
+        const id = `p${this.pendingCounter++}`;
+        const record = {
+            id,
+            text,
+            ...(attachments?.length ? { attachments } : {}),
+        };
+        this.write({
+            kind: 'pending',
+            id,
+            text,
+            ...(attachments?.length ? { attachments } : {}),
+            ts: new Date().toISOString(),
+        });
+        this.pendingById.set(id, record);
+        return record;
+    }
+    /** The message reached an agent — stop replaying it after a restart. */
+    resolvePending(id) {
+        if (!this.pendingById.has(id))
+            return;
+        this.pendingById.delete(id);
+        this.write({ kind: 'pending_done', id });
+    }
+    /** Messages still waiting, oldest first (ids are minted in order). */
+    pending() {
+        return [...this.pendingById.values()];
+    }
+    get lastAssignedSeq() {
+        return this.nextSeq - 1;
+    }
+    /** Delete the journal file — used when a terminal session is fully acked. */
+    destroy() {
+        fs.rmSync(this.file, { force: true });
+        this.unackedBySeq.clear();
+        this.pendingById.clear();
+    }
+}
+export class JournalStore {
+    dir;
+    journals = new Map();
+    constructor(dir = journalDir()) {
+        this.dir = dir;
+    }
+    open(sessionId) {
+        let journal = this.journals.get(sessionId);
+        if (!journal) {
+            journal = new SessionJournal(sessionId, this.dir);
+            this.journals.set(sessionId, journal);
+        }
+        return journal;
+    }
+    exists(sessionId) {
+        return (this.journals.has(sessionId) || fs.existsSync(path.join(this.dir, `${sessionId}.ndjson`)));
+    }
+    /** Sessions with journal files on disk (used for redelivery on reconnect). */
+    persistedSessionIds() {
+        if (!fs.existsSync(this.dir))
+            return [];
+        return fs
+            .readdirSync(this.dir)
+            .filter((f) => f.endsWith('.ndjson'))
+            .map((f) => f.slice(0, -'.ndjson'.length));
+    }
+    closeAndDelete(sessionId) {
+        const journal = this.journals.get(sessionId);
+        if (journal) {
+            journal.destroy();
+            this.journals.delete(sessionId);
+        }
+        else {
+            fs.rmSync(path.join(this.dir, `${sessionId}.ndjson`), { force: true });
+        }
+    }
+    /**
+     * Drop journals of sessions that ended long ago.
+     *
+     * Two ages, on purpose. A journal with unacked events is the *only* copy of
+     * those events, and the recorded terminal status is what gets replayed after
+     * a reconnect (QA-96 F1) — so within `maxAgeMs` a non-empty journal is never
+     * touched. `hardMaxAgeMs` is the backstop for a session whose events the API
+     * will never accept (an org deleted server-side, say), so the directory
+     * cannot grow without bound.
+     *
+     * Returns the ids actually removed.
+     */
+    prune(options) {
+        const now = options.now ?? Date.now();
+        const removed = [];
+        for (const sessionId of this.persistedSessionIds()) {
+            if (options.skip.has(sessionId))
+                continue;
+            const file = path.join(this.dir, `${sessionId}.ndjson`);
+            let ageMs;
+            try {
+                ageMs = now - fs.statSync(file).mtimeMs;
+            }
+            catch {
+                continue; // vanished under us
+            }
+            if (ageMs < options.maxAgeMs)
+                continue;
+            if (ageMs < options.hardMaxAgeMs && this.open(sessionId).unacked().length > 0)
+                continue;
+            this.closeAndDelete(sessionId);
+            removed.push(sessionId);
+        }
+        return removed;
+    }
+}
+//# sourceMappingURL=journal.js.map

package/dist/log.d.ts

@@ -0,0 +1,7 @@
+export declare const log: {
+    debug: (msg: string, extra?: Record<string, unknown>) => void;
+    info: (msg: string, extra?: Record<string, unknown>) => void;
+    warn: (msg: string, extra?: Record<string, unknown>) => void;
+    error: (msg: string, extra?: Record<string, unknown>) => void;
+};
+//# sourceMappingURL=log.d.ts.map

package/dist/log.js

@@ -0,0 +1,19 @@
+// Minimal stderr logger — the daemon runs under systemd, journald picks stderr up.
+const LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+function currentLevel() {
+    const env = (process.env['DEVBRIDGE_RUNNER_LOG'] ?? 'info').toLowerCase();
+    return LEVELS[env] ?? LEVELS.info;
+}
+function write(level, msg, extra) {
+    if (LEVELS[level] < currentLevel())
+        return;
+    const line = `${new Date().toISOString()} [${level.toUpperCase()}] ${msg}${extra ? ' ' + JSON.stringify(extra) : ''}\n`;
+    process.stderr.write(line);
+}
+export const log = {
+    debug: (msg, extra) => write('debug', msg, extra),
+    info: (msg, extra) => write('info', msg, extra),
+    warn: (msg, extra) => write('warn', msg, extra),
+    error: (msg, extra) => write('error', msg, extra),
+};
+//# sourceMappingURL=log.js.map

package/dist/paths.d.ts

@@ -0,0 +1,7 @@
+export declare function configDir(): string;
+export declare function stateDir(): string;
+export declare function configFilePath(): string;
+export declare function statusFilePath(): string;
+export declare function journalDir(): string;
+export declare function worktreesDir(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.js

@@ -0,0 +1,33 @@
+import os from 'node:os';
+import path from 'node:path';
+// XDG-style locations; overridable for tests via DEVBRIDGE_RUNNER_HOME.
+function baseDir() {
+    return process.env['DEVBRIDGE_RUNNER_HOME'] ?? null;
+}
+export function configDir() {
+    const override = baseDir();
+    if (override)
+        return path.join(override, 'config');
+    const xdg = process.env['XDG_CONFIG_HOME'] ?? path.join(os.homedir(), '.config');
+    return path.join(xdg, 'devbridge-runner');
+}
+export function stateDir() {
+    const override = baseDir();
+    if (override)
+        return path.join(override, 'state');
+    const xdg = process.env['XDG_STATE_HOME'] ?? path.join(os.homedir(), '.local', 'state');
+    return path.join(xdg, 'devbridge-runner');
+}
+export function configFilePath() {
+    return path.join(configDir(), 'config.toml');
+}
+export function statusFilePath() {
+    return path.join(stateDir(), 'status.json');
+}
+export function journalDir() {
+    return path.join(stateDir(), 'journal');
+}
+export function worktreesDir() {
+    return path.join(stateDir(), 'worktrees');
+}
+//# sourceMappingURL=paths.js.map

package/dist/policy.d.ts

@@ -0,0 +1,17 @@
+export type TrustMode = 'STRICT' | 'NORMAL' | 'AUTO';
+export interface PolicyContext {
+    trustMode: TrustMode;
+    /** The session worktree — the only place the agent may write. */
+    worktreePath: string;
+}
+export interface PolicyDecision {
+    decision: 'allow' | 'deny' | 'ask';
+    reason: string;
+}
+export declare function maskString(value: string): string;
+/** Deep-mask every string in a JSON-ish structure (payloads leaving the server). */
+export declare function maskSecrets<T>(value: T): T;
+export declare function isSecretPath(p: string): boolean;
+export declare function isInsideWorktree(p: string, worktreePath: string): boolean;
+export declare function evaluateToolUse(toolName: string, input: Record<string, unknown>, ctx: PolicyContext): PolicyDecision;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.js

@@ -0,0 +1,272 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+// ─── Secret masking (plan §8.7) ──────────────────────────────────────
+const SECRET_PATTERNS = [
+    {
+        label: 'private-key',
+        re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+    },
+    { label: 'devbridge-key', re: /db[kr]_[A-Za-z0-9_-]{8,}/g },
+    { label: 'anthropic-key', re: /sk-ant-[A-Za-z0-9_-]{8,}/g },
+    { label: 'openai-key', re: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
+    {
+        label: 'github-token',
+        re: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}/g,
+    },
+    { label: 'aws-key-id', re: /\bAKIA[0-9A-Z]{16}\b/g },
+    { label: 'jwt', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    { label: 'bearer', re: /\b[Bb]earer\s+[A-Za-z0-9._~+/-]{16,}=*/g },
+    // QA-99 MAJOR-5: registry/CI/cloud tokens that showed up in real repos.
+    { label: 'npm-token', re: /\bnpm_[A-Za-z0-9]{20,}\b/g },
+    { label: 'gitlab-token', re: /\bglpat-[A-Za-z0-9_-]{16,}\b/g },
+    { label: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { label: 'google-key', re: /\bAIza[A-Za-z0-9_-]{30,}\b/g },
+    { label: 'stripe-key', re: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+    // Credentials embedded in connection strings (postgres://user:pass@host) —
+    // the structure is kept so a diff stays readable.
+    {
+        label: 'url-credentials',
+        re: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+):[^\s@/]{3,}@/g,
+        to: '$1:[MASKED:url-credentials]@',
+    },
+    // key=value secrets (.env, config dumps). Deliberately narrow: a value of at
+    // least 12 chars behind an obviously secret-looking name.
+    {
+        label: 'secret-assignment',
+        // The negative lookahead keeps an already-masked value from being masked a
+        // second time under a less precise label.
+        re: /\b([A-Za-z0-9_]*(?:SECRET|PASSWORD|PASSWD|TOKEN|API_?KEY|APIKEY|ACCESS_?KEY|PRIVATE_?KEY)[A-Za-z0-9_]*)(\s*[:=]\s*)['"]?(?!\[MASKED:)[^\s'"]{12,}['"]?/gi,
+        to: '$1$2[MASKED:secret-assignment]',
+    },
+];
+export function maskString(value) {
+    let masked = value;
+    for (const { label, re, to } of SECRET_PATTERNS) {
+        masked = masked.replace(re, to ?? `[MASKED:${label}]`);
+    }
+    return masked;
+}
+/** Deep-mask every string in a JSON-ish structure (payloads leaving the server). */
+export function maskSecrets(value) {
+    if (typeof value === 'string')
+        return maskString(value);
+    if (Array.isArray(value))
+        return value.map((v) => maskSecrets(v));
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = maskSecrets(v);
+        }
+        return out;
+    }
+    return value;
+}
+// ─── Path rules ──────────────────────────────────────────────────────
+// Files that must never be read or written, wherever they live.
+const SECRET_PATH_PATTERNS = [
+    /(^|\/)\.env(\.[A-Za-z0-9._-]+)?$/,
+    /(^|\/)\.ssh(\/|$)/,
+    /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\.pub)?$/,
+    /\.pem$/,
+    /(^|\/)\.aws\/credentials$/,
+    /(^|\/)\.claude\/\.credentials\.json$/,
+    /(^|\/)\.codex\/auth\.json$/,
+    /(^|\/)devbridge-runner\/config\.toml$/,
+    /(^|\/)(shadow|passwd|sudoers)$/,
+    /(^|\/)\.netrc$/,
+    /(^|\/)\.git-credentials$/,
+    // QA-99 MAJOR-5: the human-facing Files/Changes panels used to be laxer than
+    // the agent's own command denylist — these are now blocked for both.
+    /(^|\/)\.npmrc$/,
+    /(^|\/)\.yarnrc(\.yml)?$/,
+    /(^|\/)\.pypirc$/,
+    /(^|\/)\.docker\/config\.json$/,
+    /(^|\/)\.kube(\/|$)/,
+    /(^|\/)\.gnupg(\/|$)/,
+    /(^|\/)\.aws(\/|$)/,
+    /(^|\/)\.pgpass$/,
+    /(^|\/)\.my\.cnf$/,
+    /(^|\/)\.htpasswd$/,
+    /(^|\/)\.terraformrc$/,
+    /(^|\/)terraform\.tfstate(\.backup)?$/,
+    /(^|\/)[^/]*credentials[^/]*\.(json|ya?ml|ini|txt)$/i,
+    /\.(key|p12|pfx|jks|keystore)$/i,
+];
+function normalize(p, cwd) {
+    const expanded = p.startsWith('~') ? path.join(os.homedir(), p.slice(1)) : p;
+    const resolved = path.resolve(cwd, expanded);
+    // Resolve symlinks so a link inside the worktree can't smuggle a read of
+    // ~/.aws & co. past the containment check (QA-96 F13).
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        // Target doesn't exist yet (e.g. a new Write) — still resolve the parent.
+        try {
+            return path.join(fs.realpathSync(path.dirname(resolved)), path.basename(resolved));
+        }
+        catch {
+            return resolved;
+        }
+    }
+}
+export function isSecretPath(p) {
+    return SECRET_PATH_PATTERNS.some((re) => re.test(p));
+}
+export function isInsideWorktree(p, worktreePath) {
+    const rel = path.relative(path.resolve(worktreePath), p);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+// ─── Command rules (Bash tool) ───────────────────────────────────────
+// String-level checks can never be a perfect shell parser (QA-96 F8/F9), so
+// the model is: deny patterns run against BOTH the raw command and a
+// "dequoted" copy (quote-splitting like `cat "/etc/pass""wd"` collapses),
+// and the NORMAL-mode safe list applies ONLY to commands with no shell
+// metacharacters at all — anything with ; & | $( ` > < newline falls
+// through to "ask". A prompt-injected agent can therefore at worst ask.
+// `git <flags> push` — flags like -C/-c must not hide the subcommand.
+const GIT_PUSH = String.raw `git\s+(?:-\S+\s+|-C\s+\S+\s+|-c\s+\S+\s+)*push`;
+const DENIED_COMMAND_PATTERNS = [
+    // `(`/`$(`/backtick before sudo covers command substitution.
+    { reason: 'sudo is not allowed', re: /(^|[\s;&|`(])sudo\b/ },
+    {
+        reason: 'force-push is not allowed',
+        re: new RegExp(`${GIT_PUSH}[^;&|]*(\\s--force\\b|\\s-f\\b|\\s\\+\\S+)`),
+    },
+    // `[\s:]main` also matches refspec form `git push origin HEAD:main`.
+    {
+        reason: 'push to a protected branch is not allowed',
+        re: new RegExp(`${GIT_PUSH}[^;&|]*[\\s:](main|master)\\b`),
+    },
+    {
+        reason: 'service control is not allowed',
+        re: /\b(systemctl|service)\s+(stop|disable|mask|restart|kill)\b/,
+    },
+    { reason: 'host power control is not allowed', re: /\b(shutdown|reboot|poweroff|halt)\b/ },
+    {
+        reason: 'recursive delete from root is not allowed',
+        re: /rm\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)\s+["']?\/(\s|$|["'])/,
+    },
+    {
+        reason: 'disk-level tools are not allowed',
+        re: /\b(mkfs|dd\s+[^;&|]*of=\/dev\/|fdisk|parted)\b/,
+    },
+    { reason: 'cron modification is not allowed', re: /\bcrontab\b|\/etc\/cron/ },
+    {
+        reason: 'user/permission management is not allowed',
+        re: /\b(useradd|userdel|usermod|passwd|chown\s+[^;&|]*root)\b/,
+    },
+    { reason: 'firewall changes are not allowed', re: /\b(iptables|nft|ufw|firewall-cmd)\b/ },
+    {
+        reason: 'docker control is not allowed',
+        re: /\bdocker\s+(stop|rm|kill|restart|compose\s+down)\b/,
+    },
+];
+// Commands considered safe enough to run without asking under NORMAL trust.
+// Interpreters (node/python/…) and find (-exec) are NOT here: they execute
+// arbitrary code. `env` is not here: it dumps the environment (QA-96 F12).
+const SAFE_COMMAND_PATTERNS = [
+    /^git\s+(status|diff|log|show|branch|add|commit|stash|restore|checkout|switch|fetch|pull|worktree)\b/,
+    /^(ls|cat|head|tail|grep|rg|wc|pwd|echo|which|tsc)\b/,
+    // Package managers: everyday subcommands only — publish/login/adduser must ask.
+    /^(npm|pnpm|yarn)\s+(install|ci|add|remove|run|test|ls|list|view|why|outdated|build)\b/,
+];
+// Shell metacharacters that can smuggle a second command past the safe list.
+const SHELL_METACHARS = /[;&|`$<>\n]/;
+// Claude Code's idiomatic commit body — `$(cat <<'EOF' … EOF\n)` with a
+// QUOTED delimiter runs exactly `cat` on a literal heredoc; whitelisting it
+// keeps `git commit` auto-allowed under NORMAL without opening $() in general.
+const SAFE_COMMIT_HEREDOC = /\$\(cat <<'EOF'\n[\s\S]*?\nEOF\n\s*\)/g;
+function isSafeCommand(command) {
+    // `a && b` / `a; b` chains are safe only when EVERY segment is safe on its
+    // own; any other metacharacter ( | $( ` > < & \n ) disqualifies outright.
+    const stripped = command.trim().replace(SAFE_COMMIT_HEREDOC, '""');
+    const segments = stripped
+        .split(/&&|;/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (segments.length === 0)
+        return false;
+    return segments.every((segment) => SAFE_COMMAND_PATTERNS.some((re) => re.test(segment)) && !SHELL_METACHARS.test(segment));
+}
+/** Collapse quotes so `"/etc/pass""wd"` and `'.s'sh` match path rules. */
+function dequote(command) {
+    return command.replace(/["']/g, '');
+}
+const SECRET_COMMAND_PATTERNS = [
+    /\.env\b/,
+    /(^|[\s"'/=~])\.ssh\b/,
+    /\.pem\b/,
+    /\bid_(rsa|ed25519|ecdsa|dsa)\b/,
+    /(^|[\s"'/=~])\.aws\b/,
+    /(^|[\s"'/=~])\.kube\b/,
+    /\.credentials\.json/,
+    /\.codex\/auth\.json/,
+    /\.docker\/config\.json/,
+    /devbridge-runner\/config\.toml/,
+    /\/etc\/(shadow|passwd|sudoers)/,
+    /\.git-credentials/,
+    /\.netrc\b/,
+];
+function commandMentionsSecretPath(command) {
+    return SECRET_COMMAND_PATTERNS.some((re) => re.test(command));
+}
+// ─── Tool-use evaluation ─────────────────────────────────────────────
+const READ_TOOLS = new Set(['Read', 'Glob', 'Grep', 'NotebookRead']);
+const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit']);
+export function evaluateToolUse(toolName, input, ctx) {
+    // DevBridge MCP tools are the agent's job interface — always fine.
+    if (toolName.startsWith('mcp__devbridge__')) {
+        return { decision: 'allow', reason: 'devbridge mcp' };
+    }
+    if (toolName === 'Bash') {
+        const command = String(input['command'] ?? '');
+        // Deny rules run on the raw AND the dequoted command (quote-splitting).
+        for (const variant of [command, dequote(command)]) {
+            for (const { re, reason } of DENIED_COMMAND_PATTERNS) {
+                if (re.test(variant))
+                    return { decision: 'deny', reason };
+            }
+            if (commandMentionsSecretPath(variant)) {
+                return { decision: 'deny', reason: 'command touches protected secret paths' };
+            }
+        }
+        if (ctx.trustMode === 'STRICT')
+            return { decision: 'ask', reason: 'strict mode' };
+        if (ctx.trustMode === 'AUTO')
+            return { decision: 'allow', reason: 'auto mode' };
+        if (isSafeCommand(command)) {
+            return { decision: 'allow', reason: 'safe command' };
+        }
+        return { decision: 'ask', reason: 'command needs approval' };
+    }
+    if (READ_TOOLS.has(toolName) || WRITE_TOOLS.has(toolName)) {
+        const rawPath = String(input['file_path'] ?? input['path'] ?? input['notebook_path'] ?? '');
+        const resolved = rawPath ? normalize(rawPath, ctx.worktreePath) : ctx.worktreePath;
+        if (isSecretPath(resolved)) {
+            return { decision: 'deny', reason: 'protected secret path' };
+        }
+        if (WRITE_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
+            return { decision: 'deny', reason: 'writes outside the session worktree are not allowed' };
+        }
+        if (ctx.trustMode === 'STRICT')
+            return { decision: 'ask', reason: 'strict mode' };
+        if (READ_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
+            return ctx.trustMode === 'AUTO'
+                ? { decision: 'allow', reason: 'auto mode' }
+                : { decision: 'ask', reason: 'read outside the worktree' };
+        }
+        return { decision: 'allow', reason: 'inside worktree' };
+    }
+    if (toolName === 'WebFetch' || toolName === 'WebSearch') {
+        if (ctx.trustMode === 'STRICT')
+            return { decision: 'ask', reason: 'strict mode' };
+        return { decision: 'allow', reason: 'network read' };
+    }
+    // Unknown tools: ask unless the workspace is fully trusted.
+    if (ctx.trustMode === 'AUTO')
+        return { decision: 'allow', reason: 'auto mode' };
+    return { decision: 'ask', reason: `unrecognized tool ${toolName}` };
+}
+//# sourceMappingURL=policy.js.map