@deftai/directive-runtime 0.129.4 → 0.129.5

package/vendor/directive-core/dist/authz/classify.d.ts

@@ -50,6 +50,12 @@ export declare function hasProtectedDestOfWriteUnknown(command: string): boolean
  * realpath against an explicit payload root closes non-lexical symlink aliases.
  */
 export declare function inactiveShellTargetsProtectedStore(command: string): boolean;
+/**
+ * First matched protected dest/token from the same classify/harvest routes that
+ * set protected_store (#5970 P3). Lexical dest-of-write first; #4188 realpath
+ * harvest when projectRoot is provided. Proven readers yield null.
+ */
+export declare function matchProtectedStoreShellDest(command: string, projectRoot?: string | null): string | null;
 /** Re-export #2711 classifiers for composition docs/tests. */
 export { classifyMcpTool, classifyShellCommand, listShellOps };
 //# sourceMappingURL=classify.d.ts.map

package/vendor/directive-core/dist/authz/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/authz/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,GACT,iBAAiB,CAAC;AA28FtB,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BxE;AA+5CD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAgH1E;AAyOD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC,GAAG,iBAAiB,EAAE,CAkDtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/authz/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AAKxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,GACT,iBAAiB,CAAC;AA2gGtB,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BxE;AA+5CD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAgH1E;AA+OD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC,GAAG,iBAAiB,EAAE,CAkDtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,MAAM,GAAG,IAAI,CAkEf;AAED,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC"}

package/vendor/directive-core/dist/authz/classify.js

@@ -13,7 +13,7 @@
  */
 import { isShellTool } from "../hooks/tools.js";
 import { classifyMcpTool, classifyShellCommand, listShellOps, } from "../policy/runtime-authority.js";
-import { shellCommandHasPayloadRootProtectedDestAfterRealpath } from "./protected-dest-realpath.js";
+import { resolvedDestIsPayloadRootProtected, shellCommandHasPayloadRootProtectedDestAfterRealpath, } from "./protected-dest-realpath.js";
 /**
  * Split on whitespace without nested quantifiers (O(n)).
  * Newlines become `;` segment breaks so compound lists like
@@ -1488,6 +1488,49 @@ function zipShellWithoutLineContinuations(command) {
     }
     return result;
 }
+/**
+ * True for executable command substitution (`$(…)` / backticks) outside single
+ * quotes. Arithmetic `$((…))` and plain `$VAR` / `${VAR}` do not qualify —
+ * those cannot run a nested writer before the outer argv0 (#5970 P1).
+ */
+function zipShellWordHasCommandSubstitution(raw) {
+    let quote = null;
+    for (let i = 0; i < raw.length; i++) {
+        const char = raw[i];
+        if (char === "\\" && quote !== "'" && i + 1 < raw.length) {
+            i++;
+            continue;
+        }
+        if (quote === null && char === "$" && raw[i + 1] === "'") {
+            quote = "$'";
+            i++;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            if (quote === null)
+                quote = char;
+            else if (quote === "$'" && char === "'")
+                quote = null;
+            else if (quote === char)
+                quote = null;
+            continue;
+        }
+        if (quote === "'" || quote === "$'")
+            continue;
+        if (char === "`")
+            return true;
+        if (char === "$" && raw[i + 1] === "(" && raw[i + 2] !== "(")
+            return true;
+    }
+    return false;
+}
+function argvHasCommandSubstitution(words, execIndex) {
+    for (let i = execIndex + 1; i < words.length; i++) {
+        if (zipShellWordHasCommandSubstitution(words[i]))
+            return true;
+    }
+    return false;
+}
 /** True for shell expansion syntax outside single quotes and not escaped. */
 function zipShellWordHasExpansion(raw) {
     let quote = null;
@@ -2194,6 +2237,22 @@ const READ_ONLY_PROOF_BINS = new Set([
     "gawk",
     "nawk",
 ]);
+/**
+ * #5970 Approach1 existence probes. Sole classify carve for relative dest-of-write
+ * and #4188 harvest (no second harvest-only skip list). test/[ ignore POSIX -o OR;
+ * dir/Get-ChildItem still refuse sort/awk-style output-dest flags.
+ */
+const EXISTENCE_PROBE_READ_ONLY_BINS = new Set([
+    "test-path",
+    "test",
+    "[",
+    "get-item",
+    "gi",
+    "dir",
+    "get-childitem",
+    "gci",
+]);
+const EXISTENCE_PROBE_IGNORE_OUTPUT_DEST_FLAGS = new Set(["test", "["]);
 const READ_ONLY_PROOF_OUTPUT_DEST_FLAGS = new Set(["-o", "--output", "--pretty-print"]);
 function argvHasOutputDestFlag(words, execIndex) {
     for (let i = execIndex + 1; i < words.length; i++) {
@@ -2281,6 +2340,9 @@ function isProvenReadOnlyArgv(words, execIndex) {
     const literal = argv0Literal(words, execIndex);
     if (literal === null || argv0IsPathQualified(literal))
         return false;
+    // Nested writers in argv (`$(mkfile …)` / backticks) void the reader proof (#5970 P1).
+    if (argvHasCommandSubstitution(words, execIndex))
+        return false;
     const name = writeBinName(literal);
     if (isArStyleArchiveBin(name)) {
         const rawMode = words[execIndex + 1];
@@ -2290,6 +2352,14 @@ function isProvenReadOnlyArgv(words, execIndex) {
         return (/^[abcdfilmnpqrstuvx]+$/.test(mode) &&
             ![...mode].some((letter) => ARCHIVE_WRITE_OPERATIONS.has(letter)));
     }
+    if (EXISTENCE_PROBE_READ_ONLY_BINS.has(name)) {
+        // Visible refuse for nested writers (Greptile #5970 P1); also gated above.
+        if (argvHasCommandSubstitution(words, execIndex))
+            return false;
+        if (EXISTENCE_PROBE_IGNORE_OUTPUT_DEST_FLAGS.has(name))
+            return true;
+        return !argvHasOutputDestFlag(words, execIndex);
+    }
     if (READ_ONLY_PROOF_BINS.has(name)) {
         if (name === "sort" || name === "awk" || name === "gawk" || name === "nawk") {
             return !argvHasOutputDestFlag(words, execIndex);
@@ -4729,7 +4799,11 @@ function isCargoArgv0(name) {
 const EMPTY_OPS_DEST_ASSIGNMENT_KEYS = new Set(["of"]);
 function emptyOpsSegmentIsReadShaped(tokens, index) {
     const first = firstCommandBin(segmentSliceAround(tokens, index));
-    return READ_SHAPED_FILE_FLAG_BINS.has(first) || DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(first);
+    // #5970: POSIX test/[ use -f/-o as predicates, not EMPTY_OPS_DEST_FLAGS writers.
+    // dir/Get-ChildItem stay off this carve so -o/--output dest plants still deny.
+    return (READ_SHAPED_FILE_FLAG_BINS.has(first) ||
+        DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(first) ||
+        EXISTENCE_PROBE_IGNORE_OUTPUT_DEST_FLAGS.has(first));
 }
 function destFlagOperandIsProtectedSettings(tokens) {
     for (let i = 0; i < tokens.length; i++) {
@@ -4892,6 +4966,86 @@ export function hasProtectedDestOfWriteUnknown(command) {
 export function inactiveShellTargetsProtectedStore(command) {
     return hasAuthzDirShellWrite(command) || hasProtectedDestOfWriteUnknown(command);
 }
+/**
+ * First matched protected dest/token from the same classify/harvest routes that
+ * set protected_store (#5970 P3). Lexical dest-of-write first; #4188 realpath
+ * harvest when projectRoot is provided. Proven readers yield null.
+ */
+export function matchProtectedStoreShellDest(command, projectRoot) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return null;
+    for (const segment of zipStyleCommandSegments(cmd)) {
+        if (isProvenReadOnlyArgv(segment.words, segment.execIndex))
+            continue;
+        const jarDest = jarCreateArchiveDest(segment.words, segment.execIndex);
+        if (jarDest !== null && isRelativePayloadProtectedDest(jarDest))
+            return jarDest;
+        const archiveDest = firstArchiveOperandDest(segment.words, segment.execIndex);
+        if (archiveDest !== null && isRelativePayloadProtectedDest(archiveDest))
+            return archiveDest;
+        for (const doubleColonDest of doubleColonCreateArchiveDests(segment.words, segment.execIndex)) {
+            if (isRelativePayloadProtectedDest(doubleColonDest))
+                return doubleColonDest;
+        }
+        for (const dest of harvestInterpreterPayloadDests(segment.words, segment.execIndex)) {
+            if (isRelativePayloadProtectedDest(dest))
+                return dest;
+        }
+        const name = argv0BareName(segment.words, segment.execIndex);
+        if (name !== null) {
+            for (const dest of harvestUnknownDestFlagValues(segment.words, segment.execIndex, name)) {
+                if (isRelativePayloadProtectedDest(dest))
+                    return dest;
+            }
+        }
+        const last = lastDestOfWritePositional(segment.words, segment.execIndex);
+        if (last !== null && isRelativePayloadProtectedDest(last)) {
+            const lit = zipShellWordLiteral(last);
+            return lit ?? last;
+        }
+    }
+    const tokens = shellTokens(cmd);
+    if (hasWriteShapedProtectedSettingsDest(cmd, tokens)) {
+        // Prefer redirect destinations over earlier read operands (#5970 P2).
+        for (let i = 0; i < cmd.length; i++) {
+            if (cmd[i] !== ">")
+                continue;
+            const dest = redirectDestSlice(cmd.toLowerCase().replace(/\\/g, "/"), i).trim();
+            if (dest.length > 0 && pathishIsProtectedMutationDest(dest))
+                return dest;
+        }
+        for (const raw of tokens) {
+            const pathish = pathishToken(raw);
+            if (pathishIsProtectedMutationDest(pathish))
+                return pathish;
+        }
+    }
+    if (commandHasAuthzDirShellWrite(cmd, tokens)) {
+        for (const raw of tokens) {
+            const pathish = pathishToken(raw);
+            if (pathishIsAuthzDir(pathish) || pathishIsApprovedScopeDir(pathish))
+                return pathish;
+        }
+    }
+    if (hasKillSwitchShellWrite(cmd, tokens)) {
+        for (const raw of tokens) {
+            const pathish = pathishToken(raw);
+            if (pathishMentionsKillSwitch(pathish))
+                return pathish;
+        }
+    }
+    const harvestRoot = (projectRoot ?? "").trim();
+    if (harvestRoot.length > 0) {
+        for (const dest of harvestDestsOfWriteForRealpath(cmd)) {
+            if (destLiteralIsRelativeProtected(dest))
+                continue;
+            if (resolvedDestIsPayloadRootProtected(harvestRoot, dest))
+                return dest;
+        }
+    }
+    return null;
+}
 /** Re-export #2711 classifiers for composition docs/tests. */
 export { classifyMcpTool, classifyShellCommand, listShellOps };
 //# sourceMappingURL=classify.js.map