@eddacraft/anvil-runtime 0.1.0

package/dist/gate/rules/default-git-rules.js

@@ -0,0 +1,192 @@
+export const DEFAULT_GIT_RULES = [
+    {
+        id: 'git-reset-hard',
+        category: 'git',
+        command: 'git',
+        subcommand: 'reset',
+        flags: { dangerous: ['--hard'] },
+        action: 'block',
+        severity: 'error',
+        reason: 'git reset --hard permanently destroys uncommitted changes',
+        suggestion: 'Use "git stash" first to preserve your work, or "git reset --soft" for a safer alternative',
+        references: [
+            'https://git-scm.com/docs/git-reset',
+            'https://ohshitgit.com/#accidental-commit-wrong-branch',
+        ],
+    },
+    {
+        id: 'git-reset-merge',
+        category: 'git',
+        command: 'git',
+        subcommand: 'reset',
+        flags: { dangerous: ['--merge'] },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git reset --merge can lose uncommitted changes during conflict resolution',
+        suggestion: 'Ensure all changes are committed or stashed before using --merge',
+    },
+    {
+        id: 'git-checkout-discard',
+        category: 'git',
+        command: 'git',
+        subcommand: 'checkout',
+        flags: { dangerous: ['--'] },
+        action: 'block',
+        severity: 'error',
+        reason: 'git checkout -- discards uncommitted changes permanently',
+        suggestion: 'Use "git stash" to preserve changes, or "git diff" to review first',
+        references: ['https://git-scm.com/docs/git-checkout'],
+    },
+    {
+        id: 'git-checkout-all',
+        category: 'git',
+        command: 'git',
+        subcommand: 'checkout',
+        args: { pattern: /^\.$/ },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git checkout . discards all uncommitted changes in the working tree',
+        suggestion: 'Use "git stash" to preserve changes, or "git diff" to review first',
+    },
+    {
+        id: 'git-restore-worktree',
+        category: 'git',
+        command: 'git',
+        subcommand: 'restore',
+        flags: { forbidden: ['--staged'] },
+        action: 'block',
+        severity: 'error',
+        reason: 'git restore discards uncommitted changes permanently',
+        suggestion: 'Use "git stash" first, or "git restore --staged" to only unstage',
+    },
+    {
+        id: 'git-clean-force',
+        category: 'git',
+        command: 'git',
+        subcommand: 'clean',
+        flags: { dangerous: ['-f', '--force'], forbidden: ['-n', '--dry-run'] },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git clean -f permanently removes untracked files',
+        suggestion: 'Preview with "git clean -n" (dry-run) first',
+    },
+    {
+        id: 'git-push-force',
+        category: 'git',
+        command: 'git',
+        subcommand: 'push',
+        flags: { dangerous: ['-f', '--force'], forbidden: ['--force-with-lease'] },
+        action: 'block',
+        severity: 'error',
+        reason: 'git push --force rewrites remote history and can cause data loss for collaborators',
+        suggestion: 'Use "git push --force-with-lease" for safer force pushing, or coordinate with your team',
+        references: [
+            'https://git-scm.com/docs/git-push#Documentation/git-push.txt---force-with-leaseltrefnamegt',
+        ],
+    },
+    {
+        id: 'git-branch-force-delete',
+        category: 'git',
+        command: 'git',
+        subcommand: 'branch',
+        flags: { dangerous: ['-D'] },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git branch -D force-deletes branches without merge verification',
+        suggestion: 'Use "git branch -d" for safe deletion with merge checks',
+    },
+    {
+        id: 'git-stash-drop',
+        category: 'git',
+        command: 'git',
+        subcommand: 'stash',
+        args: { pattern: /^drop$/, position: 0 },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git stash drop permanently deletes stashed changes',
+        suggestion: 'Review stashed changes with "git stash show -p" before dropping',
+    },
+    {
+        id: 'git-stash-clear',
+        category: 'git',
+        command: 'git',
+        subcommand: 'stash',
+        args: { pattern: /^clear$/, position: 0 },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git stash clear permanently deletes all stashed changes',
+        suggestion: 'Review stashes with "git stash list" before clearing',
+    },
+    {
+        id: 'git-rebase-abort',
+        category: 'git',
+        command: 'git',
+        subcommand: 'rebase',
+        flags: { dangerous: ['--abort'] },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git rebase --abort discards rebase progress',
+        suggestion: 'Ensure you want to discard all rebase progress before aborting',
+    },
+    {
+        id: 'git-merge-abort',
+        category: 'git',
+        command: 'git',
+        subcommand: 'merge',
+        flags: { dangerous: ['--abort'] },
+        action: 'warn',
+        severity: 'warning',
+        reason: 'git merge --abort discards merge progress',
+        suggestion: 'Ensure you want to discard all merge progress before aborting',
+    },
+    {
+        id: 'git-checkout-branch',
+        category: 'git',
+        command: 'git',
+        subcommand: 'checkout',
+        flags: { required: ['-b', '-B', '--orphan'] },
+        action: 'allow',
+        severity: 'info',
+        reason: 'Branch creation is a safe operation',
+    },
+    {
+        id: 'git-restore-staged',
+        category: 'git',
+        command: 'git',
+        subcommand: 'restore',
+        flags: { required: ['--staged'] },
+        action: 'allow',
+        severity: 'info',
+        reason: 'Unstaging changes is a safe operation',
+    },
+    {
+        id: 'git-push-force-with-lease',
+        category: 'git',
+        command: 'git',
+        subcommand: 'push',
+        flags: { required: ['--force-with-lease'] },
+        action: 'allow',
+        severity: 'info',
+        reason: 'Force-with-lease is a safer alternative to --force',
+    },
+    {
+        id: 'git-branch-safe-delete',
+        category: 'git',
+        command: 'git',
+        subcommand: 'branch',
+        flags: { required: ['-d'], forbidden: ['-D'] },
+        action: 'allow',
+        severity: 'info',
+        reason: 'Safe branch deletion with merge verification',
+    },
+    {
+        id: 'git-clean-dry-run',
+        category: 'git',
+        command: 'git',
+        subcommand: 'clean',
+        flags: { required: ['-n', '--dry-run'] },
+        action: 'allow',
+        severity: 'info',
+        reason: 'Dry-run preview is safe',
+    },
+];

package/dist/gate/rules/index.d.ts

@@ -0,0 +1,5 @@
+export type { CommandCategory, CommandAction, CommandSeverity, CommandFlagConfig, CommandArgConfig, CommandConditions, CommandRule, CommandRuleset, ParsedCommand, CommandAnalysisResult, CommandAnalysisSummary, CommandRuleOverride, CommandRulesConfig, WorkingDirectoryConfig, CommandSafetyOutputConfig, CommandSafetyConfig, ResolvedCommandSafetyConfig, CommandSafetyFinding, CommandSafetyDetails, } from './types.js';
+export { findMatchingRule, analyseCommand, calculateSpecificity, RuleMatcher, } from './rule-matcher.js';
+export { DEFAULT_GIT_RULES } from './default-git-rules.js';
+export { DEFAULT_FILESYSTEM_RULES } from './default-filesystem-rules.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/gate/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gate/rules/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/gate/rules/index.js

@@ -0,0 +1,3 @@
+export { findMatchingRule, analyseCommand, calculateSpecificity, RuleMatcher, } from './rule-matcher.js';
+export { DEFAULT_GIT_RULES } from './default-git-rules.js';
+export { DEFAULT_FILESYSTEM_RULES } from './default-filesystem-rules.js';

package/dist/gate/rules/rule-matcher.d.ts

@@ -0,0 +1,27 @@
+import type { CommandRule, ParsedCommand, CommandAnalysisResult, WorkingDirectoryConfig } from './types.js';
+export interface MatcherContext {
+    strict?: boolean;
+    workingDirectory?: WorkingDirectoryConfig;
+    cwd?: string;
+}
+declare function calculateSpecificity(rule: CommandRule): number;
+export declare function findMatchingRule(parsed: ParsedCommand, rules: CommandRule[], context?: MatcherContext): CommandRule | undefined;
+export declare function analyseCommand(command: string, parsed: ParsedCommand, rules: CommandRule[], context?: MatcherContext): CommandAnalysisResult;
+export declare class RuleMatcher {
+    private rules;
+    private context?;
+    constructor(rules?: CommandRule[], context?: MatcherContext);
+    setContext(context: MatcherContext): void;
+    addRule(rule: CommandRule): void;
+    addRules(rules: CommandRule[]): void;
+    setRules(rules: CommandRule[]): void;
+    getRules(): CommandRule[];
+    findMatchingRule(parsed: ParsedCommand, context?: MatcherContext): CommandRule | undefined;
+    analyse(command: string, parsed: ParsedCommand, context?: MatcherContext): CommandAnalysisResult;
+    analyseMultiple(commands: Array<{
+        command: string;
+        parsed: ParsedCommand;
+    }>, context?: MatcherContext): CommandAnalysisResult[];
+}
+export { calculateSpecificity };
+//# sourceMappingURL=rule-matcher.d.ts.map

package/dist/gate/rules/rule-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-matcher.d.ts","sourceRoot":"","sources":["../../../src/gate/rules/rule-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAOD,iBAAS,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAuBvD;AA0KD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,GAAG,SAAS,CAmBzB;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,CAAC,EAAE,cAAc,GACvB,qBAAqB,CA2BvB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAiB;gBAErB,KAAK,GAAE,WAAW,EAAO,EAAE,OAAO,CAAC,EAAE,cAAc;IAK/D,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIzC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAIhC,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;IAIpC,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;IAIpC,QAAQ,IAAI,WAAW,EAAE;IAIzB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS;IAI1F,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,qBAAqB;IAIhG,eAAe,CACb,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,EAC3D,OAAO,CAAC,EAAE,cAAc,GACvB,qBAAqB,EAAE;CAI3B;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/gate/rules/rule-matcher.js

@@ -0,0 +1,228 @@
+import { createDebugger } from '@eddacraft/anvil-core';
+const debug = createDebugger('gate');
+const SPECIFICITY_COMMAND = 1;
+const SPECIFICITY_SUBCOMMAND = 2;
+const SPECIFICITY_FLAGS = 4;
+const SPECIFICITY_ARGS = 8;
+function calculateSpecificity(rule) {
+    let score = SPECIFICITY_COMMAND;
+    if (rule.subcommand) {
+        score += SPECIFICITY_SUBCOMMAND;
+    }
+    if (rule.flags) {
+        const hasFlags = (rule.flags.required && rule.flags.required.length > 0) ||
+            (rule.flags.requiredAll && rule.flags.requiredAll.length > 0) ||
+            (rule.flags.forbidden && rule.flags.forbidden.length > 0) ||
+            (rule.flags.dangerous && rule.flags.dangerous.length > 0);
+        if (hasFlags) {
+            score += SPECIFICITY_FLAGS;
+        }
+    }
+    if (rule.args?.pattern) {
+        score += SPECIFICITY_ARGS;
+    }
+    return score;
+}
+function normaliseFlag(flag) {
+    if (flag.startsWith('--')) {
+        return flag;
+    }
+    return flag.toLowerCase();
+}
+function hasFlag(parsedFlags, ruleFlag) {
+    const normalised = normaliseFlag(ruleFlag);
+    return parsedFlags.some((f) => normaliseFlag(f) === normalised);
+}
+function hasAnyFlag(parsedFlags, ruleFlags) {
+    return ruleFlags.some((f) => hasFlag(parsedFlags, f));
+}
+function hasAllFlags(parsedFlags, ruleFlags) {
+    return ruleFlags.every((f) => hasFlag(parsedFlags, f));
+}
+function matchFlags(parsed, rule) {
+    if (!rule.flags) {
+        return true;
+    }
+    const { required, requiredAll, forbidden, dangerous } = rule.flags;
+    if (required && required.length > 0) {
+        if (!hasAnyFlag(parsed.flags, required)) {
+            return false;
+        }
+    }
+    if (requiredAll && requiredAll.length > 0) {
+        if (!hasAllFlags(parsed.flags, requiredAll)) {
+            return false;
+        }
+    }
+    if (forbidden && forbidden.length > 0) {
+        if (hasAnyFlag(parsed.flags, forbidden)) {
+            return false;
+        }
+    }
+    if (dangerous && dangerous.length > 0) {
+        if (!hasAnyFlag(parsed.flags, dangerous)) {
+            return false;
+        }
+    }
+    return true;
+}
+function isPathInTempDir(path, context) {
+    const tempPatterns = context?.workingDirectory?.tempDirPatterns ?? ['/tmp', '/var/tmp'];
+    return isTempPath(path, tempPatterns);
+}
+function matchArgs(parsed, rule, context) {
+    if (!rule.args?.pattern) {
+        return true;
+    }
+    const allArgs = [...parsed.args];
+    if (parsed.subcommand) {
+        allArgs.unshift(parsed.subcommand);
+    }
+    if (rule.args.position !== undefined) {
+        const arg = allArgs[rule.args.position];
+        if (arg === undefined) {
+            return false;
+        }
+        if (context?.workingDirectory?.allowDeleteInCwd && isPathInTempDir(arg, context)) {
+            return false;
+        }
+        return rule.args.pattern.test(arg);
+    }
+    return allArgs.some((arg) => {
+        if (context?.workingDirectory?.allowDeleteInCwd && isPathInTempDir(arg, context)) {
+            return false;
+        }
+        return rule.args.pattern.test(arg);
+    });
+}
+function isHomePath(path) {
+    return (path.startsWith('/home/') || path.startsWith('/Users/') || path === '~' || path.startsWith('~/'));
+}
+function isRootPath(path) {
+    return path === '/' || path === '/root';
+}
+function isTempPath(path, tempPatterns) {
+    return tempPatterns.some((pattern) => path.startsWith(pattern));
+}
+function matchWorkingDirectory(ruleCondition, context) {
+    if (ruleCondition === 'any') {
+        return true;
+    }
+    const cwd = context?.cwd;
+    if (!cwd) {
+        return true;
+    }
+    if (ruleCondition === 'home') {
+        return isHomePath(cwd);
+    }
+    if (ruleCondition === 'root') {
+        return isRootPath(cwd);
+    }
+    return true;
+}
+function matchConditions(rule, context) {
+    if (!rule.conditions) {
+        return true;
+    }
+    if (rule.conditions.strictModeOnly && !context?.strict) {
+        return false;
+    }
+    if (rule.conditions.workingDirectory) {
+        if (!matchWorkingDirectory(rule.conditions.workingDirectory, context)) {
+            return false;
+        }
+    }
+    return true;
+}
+function matchRule(parsed, rule, context) {
+    if (!matchConditions(rule, context)) {
+        return false;
+    }
+    if (parsed.command !== rule.command) {
+        return false;
+    }
+    if (rule.subcommand && parsed.subcommand !== rule.subcommand) {
+        return false;
+    }
+    if (!matchFlags(parsed, rule)) {
+        return false;
+    }
+    if (!matchArgs(parsed, rule, context)) {
+        return false;
+    }
+    return true;
+}
+export function findMatchingRule(parsed, rules, context) {
+    debug(`findMatchingRule: command=${parsed.command} subcommand=${parsed.subcommand} rules=${rules.length}`);
+    const sorted = [...rules].sort((a, b) => {
+        const scoreA = calculateSpecificity(a);
+        const scoreB = calculateSpecificity(b);
+        return scoreB - scoreA;
+    });
+    for (const rule of sorted) {
+        if (matchRule(parsed, rule, context)) {
+            debug(`findMatchingRule: matched rule=${rule.id} action=${rule.action}`);
+            return rule;
+        }
+    }
+    debug('findMatchingRule: no rule matched');
+    return undefined;
+}
+export function analyseCommand(command, parsed, rules, context) {
+    debug(`analyseCommand: command=${command}`);
+    const matchedRule = findMatchingRule(parsed, rules, context);
+    if (!matchedRule) {
+        debug('analyseCommand: allowed (no matching rule)');
+        return {
+            command,
+            parsedCommand: parsed,
+            action: 'allow',
+            severity: 'info',
+        };
+    }
+    debug(`analyseCommand: result action=${matchedRule.action} severity=${matchedRule.severity} rule=${matchedRule.id}`);
+    return {
+        command,
+        parsedCommand: parsed,
+        matchedRule,
+        action: matchedRule.action,
+        severity: matchedRule.severity,
+        reason: matchedRule.reason,
+        suggestion: matchedRule.suggestion,
+        references: matchedRule.references,
+    };
+}
+export class RuleMatcher {
+    rules;
+    context;
+    constructor(rules = [], context) {
+        this.rules = rules;
+        this.context = context;
+    }
+    setContext(context) {
+        this.context = context;
+    }
+    addRule(rule) {
+        this.rules.push(rule);
+    }
+    addRules(rules) {
+        this.rules.push(...rules);
+    }
+    setRules(rules) {
+        this.rules = [...rules];
+    }
+    getRules() {
+        return [...this.rules];
+    }
+    findMatchingRule(parsed, context) {
+        return findMatchingRule(parsed, this.rules, context ?? this.context);
+    }
+    analyse(command, parsed, context) {
+        return analyseCommand(command, parsed, this.rules, context ?? this.context);
+    }
+    analyseMultiple(commands, context) {
+        const ctx = context ?? this.context;
+        return commands.map(({ command, parsed }) => analyseCommand(command, parsed, this.rules, ctx));
+    }
+}
+export { calculateSpecificity };