@dsalazardev/ai-hub-cli 0.0.0-stage → 0.1.0

package/dist/engine/gates.js

@@ -0,0 +1,93 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { isEngineCheckout } from '../source-checkout.js';
+const LEGACY_SOURCE_DIRS = ['core/presets', 'core/skills', 'core/agents'];
+const LEGACY_TARGET_DIRS = [
+    '.claude',
+    '.opencode',
+    '.pi',
+    '.cursor',
+    '.github/skills',
+    '.github/agents',
+    '.github/instructions',
+];
+const LEGACY_CONTENT = ['/opsx', 'opsx:', 'Bash(openspec:*)', 'Requires openspec CLI'];
+const TEXT_FILE = /\.(md|mdc|ya?ml|json|ts|js|mjs|sh|ps1|txt)$/i;
+function isLegacyName(name) {
+    return name === 'opsx' || name === 'openspec' || name.startsWith('opsx-') || name.startsWith('openspec-');
+}
+async function walk(dir, relative, findings) {
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => null);
+    if (entries === null) {
+        return;
+    }
+    for (const entry of entries) {
+        const childRelative = `${relative}/${entry.name}`;
+        if (isLegacyName(entry.name)) {
+            findings.push(`${childRelative} (nombre legacy)`);
+            continue;
+        }
+        if (entry.isDirectory()) {
+            await walk(path.join(dir, entry.name), childRelative, findings);
+            continue;
+        }
+        if (!entry.isFile() || !TEXT_FILE.test(entry.name)) {
+            continue;
+        }
+        const text = await fs.readFile(path.join(dir, entry.name), 'utf8').catch(() => '');
+        for (const marker of LEGACY_CONTENT) {
+            if (text.includes(marker)) {
+                findings.push(`${childRelative} (contiene "${marker}")`);
+                break;
+            }
+        }
+    }
+}
+export async function scanLegacyArtifacts(root) {
+    const findings = [];
+    // En el checkout del motor los destinos de agente son el taller del mantenedor,
+    // no salida de instalación: ahí OpenSpec es legítimo. En un consumidor sí se escanean.
+    const dirs = (await isEngineCheckout(root))
+        ? LEGACY_SOURCE_DIRS
+        : [...LEGACY_SOURCE_DIRS, ...LEGACY_TARGET_DIRS];
+    for (const relative of dirs) {
+        await walk(path.join(root, ...relative.split('/')), relative, findings);
+    }
+    return findings.sort();
+}
+const COUPLING_SOURCE_DIRS = ['core/src', 'core/engine', 'core/agents', 'core/skills/shared'];
+const COUPLING_EXCLUDED = new Set(['core/engine/coupling.json']);
+const COUPLING_TEXT = /\.(ts|js|mjs|md|ya?ml|json|sh|ps1)$/i;
+async function walkCoupling(dir, relative, terms, findings) {
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => null);
+    if (entries === null) {
+        return;
+    }
+    for (const entry of entries) {
+        const childRelative = `${relative}/${entry.name}`;
+        if (entry.isDirectory()) {
+            await walkCoupling(path.join(dir, entry.name), childRelative, terms, findings);
+            continue;
+        }
+        if (!entry.isFile() ||
+            COUPLING_EXCLUDED.has(childRelative) ||
+            !COUPLING_TEXT.test(entry.name)) {
+            continue;
+        }
+        const text = (await fs.readFile(path.join(dir, entry.name), 'utf8')).toLowerCase();
+        for (const term of terms) {
+            if (text.includes(term)) {
+                findings.push(`${childRelative} contiene "${term}"`);
+                break;
+            }
+        }
+    }
+}
+export async function scanCoupling(root, terms) {
+    const findings = [];
+    const normalized = terms.map((term) => term.toLowerCase());
+    for (const relative of COUPLING_SOURCE_DIRS) {
+        await walkCoupling(path.join(root, ...relative.split('/')), relative, normalized, findings);
+    }
+    return findings.sort();
+}

package/dist/frontmatter.d.ts

@@ -0,0 +1,11 @@
+export interface ParsedFrontmatter {
+    data: Record<string, unknown>;
+    body: string;
+}
+/**
+ * Parses the YAML frontmatter of a source file. Callers normalize CRLF when the
+ * body is going to be rendered; this parser accepts both line endings so it can
+ * also validate files directly from disk.
+ */
+export declare function splitFrontmatter(text: string, source: string): ParsedFrontmatter;
+export declare function frontmatterString(data: Record<string, unknown>, key: string, source: string): string;

package/dist/frontmatter.js

@@ -0,0 +1,30 @@
+import { parse } from 'yaml';
+/**
+ * Parses the YAML frontmatter of a source file. Callers normalize CRLF when the
+ * body is going to be rendered; this parser accepts both line endings so it can
+ * also validate files directly from disk.
+ */
+export function splitFrontmatter(text, source) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+    if (!match) {
+        throw new Error(`sin frontmatter: ${source}`);
+    }
+    let data;
+    try {
+        data = parse(match[1]);
+    }
+    catch (error) {
+        throw new Error(`frontmatter inválido: ${source}: ${error.message}`);
+    }
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+        throw new Error(`frontmatter inválido: ${source}: se esperaba un objeto`);
+    }
+    return { data: data, body: text.slice(match[0].length) };
+}
+export function frontmatterString(data, key, source) {
+    const value = data[key];
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new Error(`${source}: frontmatter.${key} debe ser texto no vacío`);
+    }
+    return value;
+}

package/dist/harness/guards/adapters/context.d.ts

@@ -0,0 +1,19 @@
+import { type PreflightOutcome } from '../preflight.js';
+import type { GuardContext, GuardMode, PresetDangerPattern } from '../types.js';
+export interface GuardBuildInput {
+    root: string;
+    preset: string;
+    languages: string[];
+    policy: GuardContext['policy'];
+    session?: GuardContext['session'];
+    presetPatterns?: PresetDangerPattern[];
+}
+/**
+ * IO boundary for the pure guard. If Git or the configuration cannot be read,
+ * the caller decides; `preflightFailOpen` treats that as allow.
+ */
+export declare function buildGuardContext(input: GuardBuildInput): Promise<GuardContext>;
+export interface FailOpenResult extends PreflightOutcome {
+    failedOpen: boolean;
+}
+export declare function preflightFailOpen(command: string, builder: () => Promise<GuardContext>, mode?: GuardMode): Promise<FailOpenResult>;

package/dist/harness/guards/adapters/context.js

@@ -0,0 +1,153 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { evaluatePreflight } from '../preflight.js';
+function git(root, args) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8', windowsHide: true });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+function present(root, relative) {
+    const full = path.join(root, ...relative.split('/'));
+    if (!existsSync(full)) {
+        return false;
+    }
+    try {
+        return readdirSync(full).length > 0;
+    }
+    catch {
+        return true;
+    }
+}
+const CI_FILES = [
+    '.github/workflows',
+    '.gitlab-ci.yml',
+    '.circleci',
+    'azure-pipelines.yml',
+    'Jenkinsfile',
+    'bitbucket-pipelines.yml',
+    '.buildkite',
+    '.travis.yml',
+];
+const DEPLOY_FILES = [
+    'Dockerfile',
+    'docker-compose.yml',
+    'docker-compose.yaml',
+    'compose.yml',
+    'compose.yaml',
+    'vercel.json',
+    'netlify.toml',
+    'fly.toml',
+    'render.yaml',
+    'railway.json',
+    'Procfile',
+    'serverless.yml',
+    'wrangler.toml',
+    'k8s',
+    'helm',
+];
+function signals(root) {
+    const hasCI = CI_FILES.some((file) => present(root, file));
+    const hasDeploy = DEPLOY_FILES.some((file) => present(root, file));
+    const authors = new Set((git(root, ['log', '-50', '--format=%ae']) ?? '').split('\n').filter(Boolean));
+    return { hasCI, hasDeploy, team: authors.size >= 2 };
+}
+function parseWorktrees(raw) {
+    const worktrees = [];
+    let current = {};
+    const flush = () => {
+        if (current.path) {
+            worktrees.push({
+                path: current.path,
+                branch: current.branch ?? 'detached',
+                dirty: false,
+                owned: false,
+            });
+        }
+        current = {};
+    };
+    for (const line of raw.split(/\r?\n/)) {
+        if (line.trim() === '') {
+            flush();
+            continue;
+        }
+        if (line.startsWith('worktree ')) {
+            current.path = line.slice('worktree '.length).trim();
+        }
+        else if (line.startsWith('branch ')) {
+            current.branch = line.slice('branch '.length).replace(/^refs\/heads\//, '').trim();
+        }
+    }
+    flush();
+    return worktrees;
+}
+function trunkPolicy(root, policy) {
+    const file = path.join(root, '.planning', 'trunk.json');
+    if (!existsSync(file)) {
+        return policy;
+    }
+    try {
+        const state = JSON.parse(readFileSync(file, 'utf8'));
+        if (state.closed === true) {
+            return { ...policy, trunk: 'closed' };
+        }
+        if (state.closed === false) {
+            return { ...policy, trunk: 'open' };
+        }
+    }
+    catch {
+        return policy;
+    }
+    return policy;
+}
+/**
+ * IO boundary for the pure guard. If Git or the configuration cannot be read,
+ * the caller decides; `preflightFailOpen` treats that as allow.
+ */
+export async function buildGuardContext(input) {
+    const branch = git(input.root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    const head = git(input.root, ['rev-parse', 'HEAD']);
+    if (branch === null || head === null) {
+        throw new Error('not a git repository or HEAD is unavailable');
+    }
+    const status = git(input.root, ['status', '--porcelain']) ?? '';
+    const aheadRaw = git(input.root, ['rev-list', '--count', '@{u}..HEAD']);
+    const worktrees = parseWorktrees(git(input.root, ['worktree', 'list', '--porcelain']) ?? '');
+    const defaultBranch = git(input.root, ['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'])?.replace(/^origin\//, '') ?? 'main';
+    return {
+        root: input.root,
+        git: {
+            branch,
+            defaultBranch,
+            head,
+            dirty: status.trim() !== '',
+            ahead: aheadRaw === null ? 0 : Number.parseInt(aheadRaw, 10) || 0,
+            worktrees,
+        },
+        project: {
+            preset: input.preset,
+            languages: input.languages,
+            ...signals(input.root),
+        },
+        session: input.session,
+        policy: trunkPolicy(input.root, input.policy),
+        preset: { dangerPatterns: input.presetPatterns ?? [] },
+    };
+}
+export async function preflightFailOpen(command, builder, mode = 'shadow') {
+    try {
+        const context = await builder();
+        return { ...evaluatePreflight(command, context, mode), failedOpen: false };
+    }
+    catch (error) {
+        return {
+            result: {
+                decision: 'allow',
+                rule: 'preflight:fail-open',
+                reason: `guard context unavailable: ${error.message}`,
+            },
+            mode,
+            blocked: false,
+            failedOpen: true,
+        };
+    }
+}

package/dist/harness/guards/adapters/hermes.d.ts

@@ -0,0 +1,13 @@
+import type { GuardContext, GuardMode, GuardResult } from '../types.js';
+export interface RunnerPreflight {
+    command: string;
+    result: GuardResult;
+    mode: GuardMode;
+    blocked: boolean;
+}
+/**
+ * Authoritative entrypoint for the Hermes runner. The runner builds GuardContext
+ * once per job and calls this before dispatch; shadow mode records, enforce blocks.
+ */
+export declare function preflightForRunner(command: string, ctx: GuardContext, mode?: GuardMode): RunnerPreflight;
+export declare function formatRunnerDecision(decision: RunnerPreflight): string;

package/dist/harness/guards/adapters/hermes.js

@@ -0,0 +1,18 @@
+import { evaluatePreflight } from '../preflight.js';
+/**
+ * Authoritative entrypoint for the Hermes runner. The runner builds GuardContext
+ * once per job and calls this before dispatch; shadow mode records, enforce blocks.
+ */
+export function preflightForRunner(command, ctx, mode = 'shadow') {
+    const outcome = evaluatePreflight(command, ctx, mode);
+    return {
+        command,
+        result: outcome.result,
+        mode: outcome.mode,
+        blocked: outcome.blocked,
+    };
+}
+export function formatRunnerDecision(decision) {
+    const prefix = decision.mode === 'shadow' ? '[shadow]' : '[enforce]';
+    return `${prefix} ${decision.result.decision} ${decision.result.rule}: ${decision.result.reason}`;
+}

package/dist/harness/guards/adapters/hooks.d.ts

@@ -0,0 +1,25 @@
+import type { GuardContext, GuardMode } from '../types.js';
+export interface ClaudePreToolUseInput {
+    tool_name?: unknown;
+    tool_input?: Record<string, unknown>;
+}
+export interface ClaudeHookOutput {
+    permissionDecision: 'allow' | 'deny';
+    permissionDecisionReason?: string;
+    systemMessage?: string;
+}
+export interface OpenCodeHookInput {
+    tool?: unknown;
+    args?: Record<string, unknown>;
+}
+export interface OpenCodeHookOutput {
+    blocked: boolean;
+    message?: string;
+}
+export declare function commandFromHookInput(input: ClaudePreToolUseInput | OpenCodeHookInput): string | null;
+/**
+ * Thin Claude adapter: translates the hook payload to runPreflight and back.
+ * It contains no policy of its own.
+ */
+export declare function claudePreToolUse(input: ClaudePreToolUseInput, ctx: GuardContext, mode?: GuardMode): ClaudeHookOutput | null;
+export declare function opencodeToolExecuteBefore(input: OpenCodeHookInput, ctx: GuardContext, mode?: GuardMode): OpenCodeHookOutput | null;

package/dist/harness/guards/adapters/hooks.js

@@ -0,0 +1,52 @@
+import { evaluatePreflight } from '../preflight.js';
+export function commandFromHookInput(input) {
+    const isClaude = 'tool_name' in input || 'tool_input' in input;
+    const tool = isClaude ? input.tool_name : input.tool;
+    const args = isClaude ? input.tool_input : input.args;
+    if (typeof tool !== 'string' || !args) {
+        return null;
+    }
+    if (!['Bash', 'bash', 'shell', 'run_command'].includes(tool)) {
+        return null;
+    }
+    const command = args.command;
+    return typeof command === 'string' ? command : null;
+}
+function message(rule, reason) {
+    return `${rule}: ${reason}`;
+}
+/**
+ * Thin Claude adapter: translates the hook payload to runPreflight and back.
+ * It contains no policy of its own.
+ */
+export function claudePreToolUse(input, ctx, mode = 'shadow') {
+    const command = commandFromHookInput(input);
+    if (command === null) {
+        return null;
+    }
+    const outcome = evaluatePreflight(command, ctx, mode);
+    const text = message(outcome.result.rule, outcome.result.reason);
+    if (mode === 'shadow') {
+        return { permissionDecision: 'allow', systemMessage: `[shadow] ${text}` };
+    }
+    if (outcome.result.decision === 'allow') {
+        return { permissionDecision: 'allow' };
+    }
+    return {
+        permissionDecision: 'deny',
+        permissionDecisionReason: text,
+        systemMessage: text,
+    };
+}
+export function opencodeToolExecuteBefore(input, ctx, mode = 'shadow') {
+    const command = commandFromHookInput(input);
+    if (command === null) {
+        return null;
+    }
+    const outcome = evaluatePreflight(command, ctx, mode);
+    const text = message(outcome.result.rule, outcome.result.reason);
+    if (mode === 'shadow') {
+        return { blocked: false, message: `[shadow] ${text}` };
+    }
+    return { blocked: outcome.result.decision !== 'allow', message: text };
+}

package/dist/harness/guards/branch.d.ts

@@ -0,0 +1,5 @@
+import type { GuardContext, GuardResult } from './types.js';
+/** Returns the branch a switch/checkout command would move to, or null. */
+export declare function branchSwitchTarget(command: string): string | null;
+export declare function normalizePath(value: string): string;
+export declare function classifyBranch(command: string, ctx: GuardContext): GuardResult | null;

package/dist/harness/guards/branch.js

@@ -0,0 +1,43 @@
+const RESERVED = new Set(['--', '-', 'HEAD', 'ORIG_HEAD', 'FETCH_HEAD']);
+/** Returns the branch a switch/checkout command would move to, or null. */
+export function branchSwitchTarget(command) {
+    const cleaned = command.replace(/\s+/g, ' ').trim();
+    const create = /\bgit\s+switch\s+(?:-c|--create)\s+([^\s;|&]+)/i.exec(cleaned);
+    if (create) {
+        return create[1];
+    }
+    const checkoutCreate = /\bgit\s+checkout\s+(?:-b|-B)\s+([^\s;|&]+)/i.exec(cleaned);
+    if (checkoutCreate) {
+        return checkoutCreate[1];
+    }
+    const switchPlain = /\bgit\s+switch\s+(?!--)([^\s;|&]+)/i.exec(cleaned);
+    if (switchPlain) {
+        const target = switchPlain[1];
+        return RESERVED.has(target) ? null : target;
+    }
+    const checkoutPlain = /\bgit\s+checkout\s+(?!--)([^\s;|&]+)/i.exec(cleaned);
+    if (checkoutPlain) {
+        const target = checkoutPlain[1];
+        return RESERVED.has(target) ? null : target;
+    }
+    return null;
+}
+export function normalizePath(value) {
+    return value.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+}
+export function classifyBranch(command, ctx) {
+    const target = branchSwitchTarget(command);
+    if (target === null) {
+        return null;
+    }
+    const mine = ctx.session ? normalizePath(ctx.session.checkout) : null;
+    const occupied = ctx.git.worktrees.find((worktree) => worktree.branch === target && (mine === null || normalizePath(worktree.path) !== mine));
+    if (!occupied) {
+        return null;
+    }
+    return {
+        decision: 'deny',
+        rule: 'branch:checked-out-elsewhere',
+        reason: `la rama "${target}" ya está activa en ${occupied.path}; usa otro nombre (git switch -c feat/<tema>) o elimina ese worktree antes de continuar.`,
+    };
+}

package/dist/harness/guards/danger.d.ts

@@ -0,0 +1,13 @@
+import type { GuardResult, PresetDangerPattern } from './types.js';
+/**
+ * Removes single-, double- and backtick-quoted spans so literal examples such as
+ * `echo "rm -rf /"` are not mistaken for commands.
+ */
+export declare function stripQuoted(command: string): string;
+/**
+ * Shells execute the string inside `bash -c "..."`, so that string must be judged
+ * as a command, not as quoted prose. `echo "rm -rf /"` stays ignored.
+ */
+export declare function expandShell(command: string): string[];
+export declare function classifyDanger(command: string, extra?: PresetDangerPattern[]): GuardResult | null;
+export declare const DANGER_RULE_IDS: string[];

package/dist/harness/guards/danger.js

@@ -0,0 +1,157 @@
+/**
+ * Removes single-, double- and backtick-quoted spans so literal examples such as
+ * `echo "rm -rf /"` are not mistaken for commands.
+ */
+export function stripQuoted(command) {
+    return command.replace(/(["'`])(?:\\.|(?!\1)[^\\])*\1/g, ' ');
+}
+function hasRecursiveForceDelete(command) {
+    const unix = /\brm\s+((?:-[a-zA-Z-]+\s+)+)(\S.*)?$/i.exec(command);
+    if (unix) {
+        const flags = unix[1].toLowerCase();
+        if (flags.includes('r') && flags.includes('f')) {
+            return true;
+        }
+    }
+    if (/\brm\s+(?:-[a-z-]*[rf][a-z-]*\s+){2,}\S/i.test(command)) {
+        return true;
+    }
+    if (/\b(?:rmdir|rd)\s+\/s\b[^\n]*\/q\b/i.test(command)) {
+        return true;
+    }
+    return /\bremove-item\b[^\n]*-recurse\b[^\n]*-force\b/i.test(command);
+}
+const RULES = [
+    {
+        id: 'danger:mkfs',
+        decision: 'deny',
+        reason: 'formatear un dispositivo destruye datos de forma irreversible; usa el disco o la ruta correcta y pide autorización humana.',
+        matches: (command) => /\bmkfs(?:\.[a-z0-9]+)?\b/i.test(command),
+    },
+    {
+        id: 'danger:raw-device-write',
+        decision: 'deny',
+        reason: 'escribir directamente en /dev/sd* o /dev/nvme* destruye el disco; revisa el destino antes de repetir.',
+        matches: (command) => /\bdd\b[^\n]*\bof=\/dev\/(?:sd|nvme|hd)/i.test(command) ||
+            />\s*\/dev\/(?:sd|nvme|hd)/i.test(command),
+    },
+    {
+        id: 'danger:fork-bomb',
+        decision: 'deny',
+        reason: 'la expresión es una fork bomb y agota el equipo; no se ejecuta.',
+        matches: (command) => /:\s*\(\s*\)\s*\{[^}]*\|[^}]*\}\s*;\s*:/i.test(command),
+    },
+    {
+        id: 'danger:recursive-force-delete',
+        decision: 'ask',
+        reason: 'un borrado recursivo y forzado no se puede deshacer; confirma la ruta exacta antes de continuar.',
+        matches: hasRecursiveForceDelete,
+    },
+    {
+        id: 'danger:force-push',
+        decision: 'ask',
+        reason: 'un push forzado reescribe historia remota; confirma la rama y avisa al equipo antes de continuar.',
+        matches: (command) => /\bgit\s+push\b[^\n]*(?:--force(?:-with-lease)?|-f)(?:\s|$)/i.test(command),
+    },
+    {
+        id: 'danger:hard-reset',
+        decision: 'ask',
+        reason: 'git reset --hard descarta cambios sin commit; guarda o confirma antes de continuar.',
+        matches: (command) => /\bgit\s+reset\s+--hard\b/i.test(command),
+    },
+    {
+        id: 'danger:git-clean',
+        decision: 'ask',
+        reason: 'git clean elimina archivos no rastreados; revisa la lista con --dry-run antes de continuar.',
+        matches: (command) => /\bgit\s+clean\s+-[a-z]*[fd]/i.test(command),
+    },
+    {
+        id: 'danger:discard-local-changes',
+        decision: 'ask',
+        reason: 'el comando descarta cambios locales; confirma que no hay trabajo sin guardar.',
+        matches: (command) => /\bgit\s+(?:checkout|restore)\s+--\s+\./i.test(command) ||
+            /\bgit\s+restore\s+\./i.test(command),
+    },
+    {
+        id: 'danger:pipe-to-shell',
+        decision: 'ask',
+        reason: 'ejecutar un script remoto sin revisarlo permite código arbitrario; descarga y revisa primero.',
+        matches: (command) => /\b(?:curl|wget)\b[^\n]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b/i.test(command),
+    },
+    {
+        id: 'danger:destructive-sql',
+        decision: 'ask',
+        reason: 'DROP o TRUNCATE elimina datos permanentemente; confirma la base y haz backup antes de continuar.',
+        matches: (command) => /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i.test(command),
+    },
+    {
+        id: 'danger:permissions-root',
+        decision: 'ask',
+        reason: 'chmod -R 777 sobre la raíz rompe la seguridad del sistema; aplica permisos mínimos.',
+        matches: (command) => /\bchmod\s+-R\s+777\s+\/(?:\s|$)/i.test(command),
+    },
+    {
+        id: 'danger:power-state',
+        decision: 'ask',
+        reason: 'apagar o reiniciar el equipo interrumpe el trabajo en curso; confirma antes de continuar.',
+        matches: (command) => /\b(?:shutdown|reboot|halt|poweroff)\b/i.test(command),
+    },
+    {
+        id: 'danger:disk-partition',
+        decision: 'deny',
+        reason: 'reparticionar discos puede destruir el sistema; requiere intervención humana fuera del agente.',
+        matches: (command) => /\b(?:fdisk|parted|diskpart)\b/i.test(command),
+    },
+    {
+        id: 'danger:npm-token-leak',
+        decision: 'ask',
+        reason: 'el comando imprime o publica credenciales; revisa que no exponga secretos en logs.',
+        matches: (command) => /\bnpm\s+token\s+(?:list|create|revoke)\b/i.test(command) || /\bcat\s+\.env\b/i.test(command),
+    },
+];
+/**
+ * Shells execute the string inside `bash -c "..."`, so that string must be judged
+ * as a command, not as quoted prose. `echo "rm -rf /"` stays ignored.
+ */
+export function expandShell(command) {
+    const expanded = [];
+    const shell = /\b(?:bash|sh|zsh|dash|ksh)\s+-c\s+(["'])([\s\S]*?)\1/g;
+    for (const match of command.matchAll(shell)) {
+        if (match[2].trim() !== '') {
+            expanded.push(match[2]);
+        }
+    }
+    return expanded.length > 0 ? expanded : [command];
+}
+export function classifyDanger(command, extra = []) {
+    for (const segment of expandShell(command)) {
+        const sanitized = stripQuoted(segment).replace(/\s+/g, ' ').trim();
+        if (sanitized === '') {
+            continue;
+        }
+        // Core rules run first: a preset may add stricter rules, never weaken one.
+        for (const rule of RULES) {
+            if (rule.matches(sanitized)) {
+                return { decision: rule.decision, rule: rule.id, reason: rule.reason };
+            }
+        }
+        for (const pattern of extra) {
+            let regex;
+            try {
+                regex = new RegExp(pattern.pattern, 'i');
+            }
+            catch {
+                continue;
+            }
+            if (regex.test(sanitized)) {
+                return {
+                    decision: pattern.decision,
+                    rule: `preset:${pattern.id}`,
+                    reason: pattern.reason,
+                };
+            }
+        }
+    }
+    return null;
+}
+export const DANGER_RULE_IDS = RULES.map((rule) => rule.id);

package/dist/harness/guards/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './danger.js';
+export * from './branch.js';
+export * from './trunk.js';
+export * from './ship.js';
+export * from './preflight.js';

package/dist/harness/guards/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './danger.js';
+export * from './branch.js';
+export * from './trunk.js';
+export * from './ship.js';
+export * from './preflight.js';

package/dist/harness/guards/preflight.d.ts

@@ -0,0 +1,14 @@
+import { type GuardContext, type GuardMode, type GuardResult } from './types.js';
+export declare const GUARD_RULE_IDS: string[];
+/**
+ * Pure policy evaluation. All IO (git, filesystem, config) belongs to the caller
+ * that builds GuardContext. No imports from node:fs, node:child_process or node:net.
+ */
+export declare function runPreflight(command: string, ctx: GuardContext): GuardResult;
+export interface PreflightOutcome {
+    result: GuardResult;
+    mode: GuardMode;
+    blocked: boolean;
+}
+export declare function evaluatePreflight(command: string, ctx: GuardContext, mode?: GuardMode): PreflightOutcome;
+export declare function requiresConfirmation(result: GuardResult): boolean;