@gaunt-sloth/core 2.0.0-alpha.24 → 2.0.0-alpha.26

package/dist/core/shell/approvalStop.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @module core/shell/approvalStop
+ *
+ * CFG-27 — the two ways the approvals gate **ends a run** rather than answering a tool call.
+ * Both are thrown from `GthAgentRunner.decideToolApproval`, both carry the command and the reason
+ * a person needs to see, and both are re-thrown UNCHANGED by `processMessages` (which otherwise
+ * wraps failures as `Agent processing failed: …`) so the explanation reaches the user intact.
+ *
+ * They are errors rather than {@link ../types.js ToolApprovalDecision}s on purpose. A decision is
+ * something the model observes as a `ToolMessage` and can respond to; these two are precisely the
+ * cases where the spec says the model gets no move at all:
+ *
+ * - **{@link AttackHaltError}** (§4.2) — an `attack` outcome *halts the run*. "A halt ends the
+ *   agent loop. It is not a rejection the model can respond to, and no rung except `bypass` can
+ *   turn it into anything else."
+ * - **{@link NonInteractiveEscalationError}** (§6.2) — where no human can answer, *every*
+ *   escalation is an immediate non-zero exit carrying the command, the rating and its reason.
+ *   There is no prompt, no waiting, and never a timeout into approval. Teams that need specific
+ *   commands to run unattended declare them in `approvals.allow` (§3), which is consulted before
+ *   the rater and therefore never escalates.
+ *
+ * Exit code: neither class sets one. The single-shot runtime (`runSingleShot`) already reports a
+ * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
+ * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
+ * exit path that could diverge from the existing one.
+ */
+/**
+ * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
+ * an ending rather than a crash can catch both with one `instanceof`. Nothing does that today —
+ * every surface currently shows the message as-is, which is already the whole explanation — and
+ * [[TUI-C26]] is the node that will catch it to render the §6.1 banner.
+ */
+export declare abstract class ApprovalStopError extends Error {
+    /** The command that ended the run. */
+    readonly command: string;
+    protected constructor(message: string, command: string);
+}
+/**
+ * §4.2 — an `attack` outcome: the command's own **structure** evidenced compromise (§4.1.1 —
+ * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
+ * loop; the model is told nothing and offered nothing.
+ *
+ * [[TUI-C26]] will present this interactively as the §6.1 red banner — any key stops, typing
+ * `run anyway` runs this one command — BEFORE the throw; until then the run simply ends with this
+ * message, which is what a non-interactive session gets either way (§6.2).
+ *
+ * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
+ * `approvals.allow` the supported way to run such a command unattended (it is consulted before the
+ * rater, so it never reaches a halt at all); `bypass` also works and is far blunter — it turns off
+ * the rater, the escalation and the halt together, for every command, for the whole run. It is a
+ * last resort, not the answer, and the wording says so in that order.
+ */
+export declare class AttackHaltError extends ApprovalStopError {
+    /** The rater's explanation of what the command's structure showed. */
+    readonly reason: string;
+    constructor(command: string, reason: string);
+}
+/**
+ * §6.2 — an escalation with nobody to ask (CI, one-shot runs, servers). Fails the build loudly,
+ * with everything a person needs in order to see why.
+ */
+export declare class NonInteractiveEscalationError extends ApprovalStopError {
+    /** The rater's outcome, when a rating existed (the unrated rungs have none). */
+    readonly outcome: string | undefined;
+    /** The rater's explanation, when a rating existed. */
+    readonly reason: string | undefined;
+    /**
+     * EXT-71 §3.2 — the declared `approvals.escalate` entry that sent this call to a human, when one
+     * did. It changes the recovery the message names: pointing someone at `approvals.allow` when they
+     * themselves wrote an escalate entry sends them to a list that cannot win, since a match on
+     * `escalate` outranks a match on `allow`.
+     */
+    readonly escalatedBy: string | undefined;
+    constructor(command: string, outcome?: string, reason?: string, escalatedBy?: string);
+}

package/dist/core/shell/approvalStop.js

@@ -0,0 +1,108 @@
+/**
+ * @module core/shell/approvalStop
+ *
+ * CFG-27 — the two ways the approvals gate **ends a run** rather than answering a tool call.
+ * Both are thrown from `GthAgentRunner.decideToolApproval`, both carry the command and the reason
+ * a person needs to see, and both are re-thrown UNCHANGED by `processMessages` (which otherwise
+ * wraps failures as `Agent processing failed: …`) so the explanation reaches the user intact.
+ *
+ * They are errors rather than {@link ../types.js ToolApprovalDecision}s on purpose. A decision is
+ * something the model observes as a `ToolMessage` and can respond to; these two are precisely the
+ * cases where the spec says the model gets no move at all:
+ *
+ * - **{@link AttackHaltError}** (§4.2) — an `attack` outcome *halts the run*. "A halt ends the
+ *   agent loop. It is not a rejection the model can respond to, and no rung except `bypass` can
+ *   turn it into anything else."
+ * - **{@link NonInteractiveEscalationError}** (§6.2) — where no human can answer, *every*
+ *   escalation is an immediate non-zero exit carrying the command, the rating and its reason.
+ *   There is no prompt, no waiting, and never a timeout into approval. Teams that need specific
+ *   commands to run unattended declare them in `approvals.allow` (§3), which is consulted before
+ *   the rater and therefore never escalates.
+ *
+ * Exit code: neither class sets one. The single-shot runtime (`runSingleShot`) already reports a
+ * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
+ * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
+ * exit path that could diverge from the existing one.
+ */
+/**
+ * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
+ * an ending rather than a crash can catch both with one `instanceof`. Nothing does that today —
+ * every surface currently shows the message as-is, which is already the whole explanation — and
+ * [[TUI-C26]] is the node that will catch it to render the §6.1 banner.
+ */
+export class ApprovalStopError extends Error {
+    /** The command that ended the run. */
+    command;
+    constructor(message, command) {
+        super(message);
+        this.command = command;
+        // Restore the prototype chain across the ES5 `extends Error` downlevel, so `instanceof` works.
+        Object.setPrototypeOf(this, new.target.prototype);
+        this.name = new.target.name;
+    }
+}
+/**
+ * §4.2 — an `attack` outcome: the command's own **structure** evidenced compromise (§4.1.1 —
+ * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
+ * loop; the model is told nothing and offered nothing.
+ *
+ * [[TUI-C26]] will present this interactively as the §6.1 red banner — any key stops, typing
+ * `run anyway` runs this one command — BEFORE the throw; until then the run simply ends with this
+ * message, which is what a non-interactive session gets either way (§6.2).
+ *
+ * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
+ * `approvals.allow` the supported way to run such a command unattended (it is consulted before the
+ * rater, so it never reaches a halt at all); `bypass` also works and is far blunter — it turns off
+ * the rater, the escalation and the halt together, for every command, for the whole run. It is a
+ * last resort, not the answer, and the wording says so in that order.
+ */
+export class AttackHaltError extends ApprovalStopError {
+    /** The rater's explanation of what the command's structure showed. */
+    reason;
+    constructor(command, reason) {
+        super(`Run halted: the auto-rater rated this command as an attack, which ends the run.\n` +
+            `  Command: ${command}\n` +
+            `  Reason: ${reason}\n` +
+            `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
+            `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
+            `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
+            `the prompts and the halt for every command in the run.`, command);
+        this.reason = reason;
+    }
+}
+/**
+ * §6.2 — an escalation with nobody to ask (CI, one-shot runs, servers). Fails the build loudly,
+ * with everything a person needs in order to see why.
+ */
+export class NonInteractiveEscalationError extends ApprovalStopError {
+    /** The rater's outcome, when a rating existed (the unrated rungs have none). */
+    outcome;
+    /** The rater's explanation, when a rating existed. */
+    reason;
+    /**
+     * EXT-71 §3.2 — the declared `approvals.escalate` entry that sent this call to a human, when one
+     * did. It changes the recovery the message names: pointing someone at `approvals.allow` when they
+     * themselves wrote an escalate entry sends them to a list that cannot win, since a match on
+     * `escalate` outranks a match on `allow`.
+     */
+    escalatedBy;
+    constructor(command, outcome, reason, escalatedBy) {
+        super(`Approval required, but this session has no one to ask.\n` +
+            `  Command: ${command}\n` +
+            (outcome ? `  Rating: ${outcome}\n` : '') +
+            (reason ? `  Reason: ${reason}\n` : '') +
+            (escalatedBy
+                ? `  Matched approvals.escalate: ${escalatedBy}\n` +
+                    `An escalate entry always asks a human, whatever the rung would have done, so no ` +
+                    `entry in approvals.allow can answer it. Remove the escalate entry if this command ` +
+                    `should run unattended.`
+                : `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
+                    `one as an explicit entry, for example { "type": "shell", "matcher": "exact", ` +
+                    `"pattern": "npm test" }. That list is consulted before the auto-rater and never ` +
+                    `escalates.`), command);
+        this.outcome = outcome;
+        this.reason = reason;
+        this.escalatedBy = escalatedBy;
+    }
+}
+//# sourceMappingURL=approvalStop.js.map

package/dist/core/shell/approvalStop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;GAKG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,sCAAsC;IAC7B,OAAO,CAAS;IAEzB,YAAsB,OAAe,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH,mFAAmF;YACjF,cAAc,OAAO,IAAI;YACzB,aAAa,MAAM,IAAI;YACvB,wFAAwF;YACxF,oFAAoF;YACpF,yFAAyF;YACzF,wDAAwD,EAC1D,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC,YAAY,OAAe,EAAE,OAAgB,EAAE,MAAe,EAAE,WAAoB;QAClF,KAAK,CACH,0DAA0D;YACxD,cAAc,OAAO,IAAI;YACzB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC,WAAW;gBACV,CAAC,CAAC,iCAAiC,WAAW,IAAI;oBAChD,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;gBAC1B,CAAC,CAAC,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY,CAAC,EACnB,OAAO,CACR,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}

package/dist/core/shell/arity.d.ts

@@ -18,6 +18,12 @@
  * redirections. Such commands NEVER auto-match an allow-list entry — they always go to
  * fresh human approval. This is what stops `git checkout x; rm -rf /` from matching an
  * approved `git checkout *`.
+ *
+ * EXT-55: "newlines" in that list was aspirational until this node. `normalizeCommand` folded
+ * a line break to a SPACE, so the check below never saw one and `ls -la\nrm -rf /` classified
+ * as the single command `ls`. The separator set now lives in ONE place
+ * ({@link import('./normalize.js').COMMAND_SEPARATOR_CLASS}) and a line break survives
+ * normalization, so a multi-line command is categorically ambiguous — exactly like `;`.
  */
 /**
  * Result of classifying a command for allow-list matching.

package/dist/core/shell/arity.js

@@ -18,7 +18,14 @@
  * redirections. Such commands NEVER auto-match an allow-list entry — they always go to
  * fresh human approval. This is what stops `git checkout x; rm -rf /` from matching an
  * approved `git checkout *`.
+ *
+ * EXT-55: "newlines" in that list was aspirational until this node. `normalizeCommand` folded
+ * a line break to a SPACE, so the check below never saw one and `ls -la\nrm -rf /` classified
+ * as the single command `ls`. The separator set now lives in ONE place
+ * ({@link import('./normalize.js').COMMAND_SEPARATOR_CLASS}) and a line break survives
+ * normalization, so a multi-line command is categorically ambiguous — exactly like `;`.
  */
+import { COMMAND_SEPARATOR_RE, LINE_BREAK_RE } from '#src/core/shell/normalize.js';
 /**
  * Arity table: command-prefix string → number of leading tokens (binary + subcommands,
  * flags excluded) that define the "human-understandable command". Longest matching
@@ -181,11 +188,9 @@ const ARITY = {
  * Note: `&&`/`||`/`|` are covered by the bare `&`/`|` character scan; listed conceptually.
  */
 function hasUnsafeComposition(normalized) {
-    // Newlines are folded by normalizeCommand, but guard anyway in case a raw string is passed.
-    if (/[\n\r]/.test(normalized))
-        return true;
-    // Shell control / separator operators and background.
-    if (/[;|&]/.test(normalized))
+    // Shell control / separator operators, background, AND line breaks — one shared definition of
+    // "a new command begins here" (EXT-55), so this can never drift from the hardline floor's.
+    if (COMMAND_SEPARATOR_RE.test(normalized))
         return true;
     // Command substitution: $(...) or `...`.
     if (/\$\(/.test(normalized))
@@ -235,7 +240,9 @@ export function tokenize(command) {
             inToken = true;
             continue;
         }
-        if (ch === ' ' || ch === '\t') {
+        // EXT-55: line breaks are whitespace here too, so a token can never be glued across a line
+        // (`ls\n-o` must tokenize as `ls` + `-o`, or a caller inspecting the argv would miss the flag).
+        if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
             if (inToken) {
                 tokens.push(current);
                 current = '';
@@ -294,6 +301,13 @@ export function meaningfulPrefixTokens(argv) {
  * @param normalize Normalizer to apply for the detection form (inject normalizeCommand).
  */
 export function classifyCommand(command, normalize) {
+    // EXT-55 — the boundary question is answered HERE, not delegated to the injected normalizer.
+    // `normalize` is a parameter, so this function cannot assume it preserved the command
+    // separators (folding them away is exactly the bug this node fixed). A line break anywhere
+    // INSIDE the command means more than one command → never classifiable. `.trim()` first: a
+    // purely leading/trailing break separates nothing, and models routinely emit `"npm test\n"`.
+    if (LINE_BREAK_RE.test(command.trim()))
+        return null;
     const normalized = normalize(command);
     if (!normalized)
         return null;

package/dist/core/shell/arity.js.map

@@ -1 +1 @@
-{"version":3,"file":"arity.js","sourceRoot":"","sources":["../../../src/core/shell/arity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;;GASG;AACH,MAAM,KAAK,GAAqC;IAC9C,qFAAqF;IACrF,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,EAAE,EAAE,CAAC;IACL,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;IACV,EAAE,EAAE,CAAC;IACL,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,EAAE,EAAE,CAAC;IACL,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,sBAAsB;IACtB,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,SAAS,EAAE,CAAC;IACZ,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,CAAC;IACd,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,CAAC;IACnB,kBAAkB,EAAE,CAAC;IACrB,cAAc,EAAE,CAAC;IACjB,gBAAgB,EAAE,CAAC;IACnB,eAAe,EAAE,CAAC;IAClB,MAAM,EAAE,CAAC;IACT,eAAe,EAAE,CAAC;IAClB,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,EAAE,EAAE,CAAC;IACL,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,EAAE,EAAE,CAAC;IACL,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,CAAC;IACP,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,mBAAmB,EAAE,CAAC;IACtB,iBAAiB,EAAE,CAAC;IACpB,SAAS,EAAE,CAAC;IACZ,IAAI,EAAE,CAAC;IACP,EAAE,EAAE,CAAC;IACL,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,CAAC;IAChB,cAAc,EAAE,CAAC;IACjB,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,kBAAkB,EAAE,CAAC;IACrB,cAAc,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,cAAc,EAAE,CAAC;IACjB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,CAAC;IACZ,qBAAqB,EAAE,CAAC;IACxB,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,EAAE,EAAE,CAAC;IACL,IAAI,EAAE,CAAC;IACP,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;CACd,CAAC;AAqBF;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,4FAA4F;IAC5F,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,sDAAsD;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,yCAAyC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,mEAAmE;IACnE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,0CAA0C;IAC1C,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,0FAA0F;IAC1F,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAqB,IAAI,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;IAC3C,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,qFAAqF;IACrF,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,mDAAmD;IACnD,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,0EAA0E;YAC1E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,sDAAsD;IACtD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAkC;IAElC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,sFAAsF;IACtF,iEAAiE;IACjE,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"arity.js","sourceRoot":"","sources":["../../../src/core/shell/arity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAEnF;;;;;;;;;GASG;AACH,MAAM,KAAK,GAAqC;IAC9C,qFAAqF;IACrF,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,EAAE,EAAE,CAAC;IACL,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;IACV,EAAE,EAAE,CAAC;IACL,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,EAAE,EAAE,CAAC;IACL,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,sBAAsB;IACtB,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,SAAS,EAAE,CAAC;IACZ,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,CAAC;IACd,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,CAAC;IACnB,kBAAkB,EAAE,CAAC;IACrB,cAAc,EAAE,CAAC;IACjB,gBAAgB,EAAE,CAAC;IACnB,eAAe,EAAE,CAAC;IAClB,MAAM,EAAE,CAAC;IACT,eAAe,EAAE,CAAC;IAClB,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,EAAE,EAAE,CAAC;IACL,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,EAAE,EAAE,CAAC;IACL,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,CAAC;IACP,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,mBAAmB,EAAE,CAAC;IACtB,iBAAiB,EAAE,CAAC;IACpB,SAAS,EAAE,CAAC;IACZ,IAAI,EAAE,CAAC;IACP,EAAE,EAAE,CAAC;IACL,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,CAAC;IACN,EAAE,EAAE,CAAC;IACL,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,CAAC;IAChB,cAAc,EAAE,CAAC;IACjB,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,kBAAkB,EAAE,CAAC;IACrB,cAAc,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,cAAc,EAAE,CAAC;IACjB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,CAAC;IACZ,qBAAqB,EAAE,CAAC;IACxB,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,EAAE,EAAE,CAAC;IACL,IAAI,EAAE,CAAC;IACP,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;CACd,CAAC;AAqBF;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,8FAA8F;IAC9F,2FAA2F;IAC3F,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,yCAAyC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,mEAAmE;IACnE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,0CAA0C;IAC1C,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,0FAA0F;IAC1F,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAqB,IAAI,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,2FAA2F;QAC3F,gGAAgG;QAChG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;IAC3C,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,qFAAqF;IACrF,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,mDAAmD;IACnD,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,0EAA0E;YAC1E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,sDAAsD;IACtD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAkC;IAElC,6FAA6F;IAC7F,sFAAsF;IACtF,2FAA2F;IAC3F,0FAA0F;IAC1F,6FAA6F;IAC7F,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,sFAAsF;IACtF,iEAAiE;IACjE,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/core/shell/denylist.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Split a raw command into the segments a shell would run, normalized and **case preserved**.
+ *
+ * Substitution bodies are segments in their own right: `echo $(npm publish)` runs `npm publish`,
+ * so a deny entry for `npm publish` must see it. Splitting on `$(`, `` ` `` and `)` yields the
+ * body as its own segment (and leaves harmless empty fragments, which are dropped).
+ *
+ * Case is preserved because the matcher folds it per list and per matcher — a `regexp` entry is
+ * compiled exactly as the user wrote it, and folding here would decide that for it.
+ */
+export declare function commandSegments(command: string): string[];

package/dist/core/shell/denylist.js

@@ -0,0 +1,37 @@
+/**
+ * @module core/shell/denylist
+ *
+ * **Command segmentation** — splitting a command into every command a shell would actually run.
+ *
+ * This is what lets a restrictive rule (`deny`, `escalate`) see inside a compound command. The
+ * asymmetry it serves lives in `core/approvals/matcher.ts`, which is the one comparison engine:
+ *
+ * - **No allow entry matches a command that does not statically resolve.** Composition,
+ *   substitution and redirection are a non-match for every allow entry, so a grant can never be
+ *   extended with a `; rm -rf /`.
+ * - **A deny or escalate entry MAY match one**, and is compared against every segment as well as
+ *   the whole string, because a prohibition that catches something unresolvable errs in the
+ *   direction that costs nothing. Without that, `git push --force; ls` would sail straight past a
+ *   declared deny entry for `git push --force` — a prohibition any trailing `; ls` defeats is not a
+ *   prohibition.
+ */
+import { COMMAND_SEPARATOR_CLASS, normalizeCommand } from '#src/core/shell/normalize.js';
+/** Splits the normalized command at every point where a shell would begin a NEW command. */
+const SEGMENT_SPLIT_RE = new RegExp(`[${COMMAND_SEPARATOR_CLASS}]|\\$\\(|\\)|\``, 'g');
+/**
+ * Split a raw command into the segments a shell would run, normalized and **case preserved**.
+ *
+ * Substitution bodies are segments in their own right: `echo $(npm publish)` runs `npm publish`,
+ * so a deny entry for `npm publish` must see it. Splitting on `$(`, `` ` `` and `)` yields the
+ * body as its own segment (and leaves harmless empty fragments, which are dropped).
+ *
+ * Case is preserved because the matcher folds it per list and per matcher — a `regexp` entry is
+ * compiled exactly as the user wrote it, and folding here would decide that for it.
+ */
+export function commandSegments(command) {
+    return normalizeCommand(command)
+        .split(SEGMENT_SPLIT_RE)
+        .map((segment) => segment.trim())
+        .filter((segment) => segment.length > 0);
+}
+//# sourceMappingURL=denylist.js.map

package/dist/core/shell/denylist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denylist.js","sourceRoot":"","sources":["../../../src/core/shell/denylist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,uBAAuB,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAEvF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,gBAAgB,CAAC,OAAO,CAAC;SAC7B,KAAK,CAAC,gBAAgB,CAAC;SACvB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/core/shell/normalize.d.ts

@@ -10,6 +10,34 @@
  *
  * Patterned after hermes-agent `tools/approval.py:_normalize_command_for_detection`.
  */
+/**
+ * SECURITY / EXT-55 — the single source of truth for **where a new command begins**.
+ *
+ * This is a regex character-class BODY (embed it as `` `[${COMMAND_SEPARATOR_CLASS}]` ``) listing
+ * every character at which the shell stops one command and starts the next: `;`, `&` (hence
+ * `&&`), `|` (hence `||`), and a LINE BREAK. Both consumers of the normalized form build their
+ * patterns from it — the allow-list classifier's fail-closed check
+ * ({@link import('./arity.js').classifyCommand}) and the agent hardline blocklist's pattern
+ * terminators (`@gaunt-sloth/agent` `tools/shell/hardline`) — so the two layers can never again
+ * disagree about what a separator is.
+ *
+ * The layers disagreed before EXT-55: `;`/`&&`/`|` made a command ambiguous (fail-closed) but a
+ * newline did not, because {@link normalizeCommand} folded it to a SPACE. `ls -la\nrm -rf /` was
+ * therefore classified as the single command `ls`, and an ordinary `ls` grant auto-approved it.
+ *
+ * `\r` is listed defensively: {@link normalizeCommand} canonicalizes CR/CRLF to LF, so a
+ * normalized string never contains one — but a pattern matched against a RAW command still fails
+ * closed.
+ */
+export declare const COMMAND_SEPARATOR_CLASS = ";&|\\n\\r";
+/** {@link COMMAND_SEPARATOR_CLASS} as a ready-made single-character matcher. */
+export declare const COMMAND_SEPARATOR_RE: RegExp;
+/**
+ * Matches any line break — the separator {@link normalizeCommand} used to destroy (EXT-55).
+ * Exported so a caller can ask "is this more than one command?" of a RAW string without
+ * depending on someone else's normalizer having preserved the boundary.
+ */
+export declare const LINE_BREAK_RE: RegExp;
 /**
  * Normalize a command string before dangerous-pattern matching.
  *
@@ -17,9 +45,21 @@
  * - strip ANSI escape sequences (CSI / OSC / lone-escape),
  * - drop null bytes,
  * - Unicode NFKC fold (fullwidth `ｒｍ` → `rm`, etc.),
+ * - canonicalize every line ending (CRLF / lone CR) to a bare `\n`,
  * - collapse shell backslash-escapes (`r\m` → `rm`, `\-rf` → `-rf`),
  * - drop empty-string literals that split tokens (`r''m` / `r""m` → `rm`),
- * - fold runs of whitespace (incl. tabs/newlines) to single spaces and trim.
+ * - fold runs of HORIZONTAL whitespace (spaces/tabs) to single spaces,
+ * - collapse each run of line breaks to a single `\n` — **which survives**, because a line break
+ *   is a command separator, not padding (EXT-55) — and trim the ends.
+ *
+ * EXT-55: the last two steps used to be one `\s+ → ' '` fold, which erased the command boundary
+ * and let `ls -la\nrm -rf /` be read as the single command `ls`. A line break now reaches every
+ * consumer intact, exactly like `;`. Leading/trailing breaks are still trimmed, so the very
+ * common `"npm test\n"` tool argument remains ONE command and keeps matching the allow-list.
+ *
+ * A backslash before a line break (a shell line continuation) is deliberately NOT joined: folding
+ * it away would re-open the same hole for `ls \<newline>rm -rf /`. Keeping the boundary makes such
+ * a command categorically ambiguous, which costs a prompt, not a failure.
  *
  * This is intentionally lossy: the normalized form is ONLY used for detection,
  * never for execution (the original command is what runs).

package/dist/core/shell/normalize.js

@@ -19,6 +19,40 @@ const ANSI_OSC = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
 const ANSI_LONE = /\x1b[@-Z\\-_]?/g;
 // Null bytes.
 const NULL_BYTES = /\x00/g;
+// Any line ending — CRLF, a lone CR, or a lone LF. Canonicalized to `\n` by normalizeCommand.
+const LINE_ENDINGS = /\r\n?/g;
+// A run of HORIZONTAL whitespace: whitespace that is not a line break (spaces, tabs, NBSP, …).
+const HORIZONTAL_WS = /[^\S\n]+/g;
+// A run of line breaks together with any whitespace around it.
+const LINE_BREAK_RUN = /\s*\n\s*/g;
+/**
+ * SECURITY / EXT-55 — the single source of truth for **where a new command begins**.
+ *
+ * This is a regex character-class BODY (embed it as `` `[${COMMAND_SEPARATOR_CLASS}]` ``) listing
+ * every character at which the shell stops one command and starts the next: `;`, `&` (hence
+ * `&&`), `|` (hence `||`), and a LINE BREAK. Both consumers of the normalized form build their
+ * patterns from it — the allow-list classifier's fail-closed check
+ * ({@link import('./arity.js').classifyCommand}) and the agent hardline blocklist's pattern
+ * terminators (`@gaunt-sloth/agent` `tools/shell/hardline`) — so the two layers can never again
+ * disagree about what a separator is.
+ *
+ * The layers disagreed before EXT-55: `;`/`&&`/`|` made a command ambiguous (fail-closed) but a
+ * newline did not, because {@link normalizeCommand} folded it to a SPACE. `ls -la\nrm -rf /` was
+ * therefore classified as the single command `ls`, and an ordinary `ls` grant auto-approved it.
+ *
+ * `\r` is listed defensively: {@link normalizeCommand} canonicalizes CR/CRLF to LF, so a
+ * normalized string never contains one — but a pattern matched against a RAW command still fails
+ * closed.
+ */
+export const COMMAND_SEPARATOR_CLASS = ';&|\\n\\r';
+/** {@link COMMAND_SEPARATOR_CLASS} as a ready-made single-character matcher. */
+export const COMMAND_SEPARATOR_RE = new RegExp(`[${COMMAND_SEPARATOR_CLASS}]`);
+/**
+ * Matches any line break — the separator {@link normalizeCommand} used to destroy (EXT-55).
+ * Exported so a caller can ask "is this more than one command?" of a RAW string without
+ * depending on someone else's normalizer having preserved the boundary.
+ */
+export const LINE_BREAK_RE = /[\n\r]/;
 /**
  * Normalize a command string before dangerous-pattern matching.
  *
@@ -26,9 +60,21 @@ const NULL_BYTES = /\x00/g;
  * - strip ANSI escape sequences (CSI / OSC / lone-escape),
  * - drop null bytes,
  * - Unicode NFKC fold (fullwidth `ｒｍ` → `rm`, etc.),
+ * - canonicalize every line ending (CRLF / lone CR) to a bare `\n`,
  * - collapse shell backslash-escapes (`r\m` → `rm`, `\-rf` → `-rf`),
  * - drop empty-string literals that split tokens (`r''m` / `r""m` → `rm`),
- * - fold runs of whitespace (incl. tabs/newlines) to single spaces and trim.
+ * - fold runs of HORIZONTAL whitespace (spaces/tabs) to single spaces,
+ * - collapse each run of line breaks to a single `\n` — **which survives**, because a line break
+ *   is a command separator, not padding (EXT-55) — and trim the ends.
+ *
+ * EXT-55: the last two steps used to be one `\s+ → ' '` fold, which erased the command boundary
+ * and let `ls -la\nrm -rf /` be read as the single command `ls`. A line break now reaches every
+ * consumer intact, exactly like `;`. Leading/trailing breaks are still trimmed, so the very
+ * common `"npm test\n"` tool argument remains ONE command and keeps matching the allow-list.
+ *
+ * A backslash before a line break (a shell line continuation) is deliberately NOT joined: folding
+ * it away would re-open the same hole for `ls \<newline>rm -rf /`. Keeping the boundary makes such
+ * a command categorically ambiguous, which costs a prompt, not a failure.
  *
  * This is intentionally lossy: the normalized form is ONLY used for detection,
  * never for execution (the original command is what runs).
@@ -41,13 +87,21 @@ export function normalizeCommand(command) {
     c = c.replace(NULL_BYTES, '');
     // Unicode compatibility fold (fullwidth → ASCII, etc.).
     c = c.normalize('NFKC');
+    // EXT-55: canonicalize line endings FIRST so CR and CRLF are the same separator as LF for every
+    // step below (and for every consumer of the normalized form).
+    c = c.replace(LINE_ENDINGS, '\n');
     // Collapse backslash-escapes: `\x` → `x` (prevents `r\m -rf /` bypass).
     // Applied before empty-string stripping so `r\m` and `r''m` both fold.
+    // `[^\n]` keeps a backslash line-continuation intact — see the docblock.
     c = c.replace(/\\([^\n])/g, '$1');
     // Drop empty-string literals used to split a token: `r''m` / `r""m` → `rm`.
     c = c.replace(/''|""/g, '');
-    // Fold all whitespace runs (spaces, tabs, newlines) to a single space, trim.
-    c = c.replace(/\s+/g, ' ').trim();
-    return c;
+    // Fold runs of horizontal whitespace to a single space…
+    c = c.replace(HORIZONTAL_WS, ' ');
+    // …then collapse each run of line breaks (with the whitespace around it) to a single `\n`,
+    // which SURVIVES normalization as the command separator it is (EXT-55).
+    c = c.replace(LINE_BREAK_RUN, '\n');
+    // Trim the ends — including a leading/trailing break, which separates nothing.
+    return c.trim();
 }
 //# sourceMappingURL=normalize.js.map

package/dist/core/shell/normalize.js.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/core/shell/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,uEAAuE;AACvE,yCAAyC;AACzC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,kDAAkD;AAClD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,8DAA8D;AAC9D,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,cAAc;AACd,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9B,wDAAwD;IACxD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,wEAAwE;IACxE,uEAAuE;IACvE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAClC,4EAA4E;IAC5E,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,6EAA6E;IAC7E,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/core/shell/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,uEAAuE;AACvE,yCAAyC;AACzC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,kDAAkD;AAClD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,8DAA8D;AAC9D,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,cAAc;AACd,MAAM,UAAU,GAAG,OAAO,CAAC;AAC3B,8FAA8F;AAC9F,MAAM,YAAY,GAAG,QAAQ,CAAC;AAC9B,+FAA+F;AAC/F,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,+DAA+D;AAC/D,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9B,wDAAwD;IACxD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,gGAAgG;IAChG,8DAA8D;IAC9D,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAClC,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAClC,4EAA4E;IAC5E,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,wDAAwD;IACxD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAClC,2FAA2F;IAC3F,wEAAwE;IACxE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC"}