@gaunt-sloth/core 2.0.0-beta.0 → 2.0.0-beta.2

package/dist/core/shell/approvalStop.js

@@ -1,94 +1,96 @@
+import { UNRESOLVED_MCP_SERVER } from '#src/core/approvals/mcpSubjects.js';
+import { renderApprovalEntryObject } from '#src/config/schema.js';
+import { frameUntrustedCommand, frameUntrustedText, frameWidthFor, narrowTerminalNotice, neutralizeToOneLine, neutralizeUntrustedText, } from '#src/core/shell/framing.js';
 /**
- * @module core/shell/approvalStop
+ * [[EXT-115]] — **the parts that name WHAT was gated**, branched on the {@link ApprovalSubject}
+ * kind the gate itself decided the call on.
  *
- * CFG-27 — the two ways the approvals gate **ends a run** rather than answering a tool call.
- * Both are thrown from `GthAgentRunner.decideToolApproval`, both carry the command and the reason
- * a person needs to see, and both are re-thrown UNCHANGED by `processMessages` (which otherwise
- * wraps failures as `Agent processing failed: …`) so the explanation reaches the user intact.
+ * Both stops carried the label `Command` unconditionally, so a gated `write_file` in CI read as
+ * `Command: write_file` and a gated MCP call read the same way — the framing [[TUI-C67]] removed
+ * from the two terminal prompts, surviving on the path with nobody to ask, where the message is the
+ * only thing anyone sees. It lives here rather than in either subclass because both stops make the
+ * identical claim about the identical subject, and a branch written twice is a branch that comes to
+ * disagree with itself.
  *
- * They are errors rather than {@link ../types.js ToolApprovalDecision}s on purpose. A decision is
- * something the model observes as a `ToolMessage` and can respond to; these two are precisely the
- * cases where the spec says the model gets no move at all:
+ * **The identifier stays in a `value`/`command` part and is NEVER interpolated into a sentence.**
+ * This is the one line the fix must not cross, and it is why the prose form
+ * `core/approvals/promptHeader` renders is deliberately not imported here: an `own` part is painted
+ * as-is *precisely because nothing can forge it*, everything else goes through the shared renderer,
+ * and the label sits on its own row for the reason {@link approvalStopRows} states. On the `mcpTool`
+ * arm the name comes from a third-party server's own tool listing, so a sentence carrying it would
+ * put attacker-supplied bytes into the gate's own voice — the forgery TUI-C26 closed.
  *
- * - **{@link AttackHaltError}** (§4.2) — an `attack` outcome *halts the run*. "A halt ends the
- *   agent loop. It is not a rejection the model can respond to, and no rung except `bypass` can
- *   turn it into anything else."
- * - **{@link NonInteractiveEscalationError}** (§6.2) — where no human can answer, *every*
- *   escalation is an immediate non-zero exit carrying the command, the rating and its reason.
- *   There is no prompt, no waiting, and never a timeout into approval. Teams that need specific
- *   commands to run unattended declare them in `approvals.allow` (§3), which is consulted before
- *   the rater and therefore never escalates.
+ * The arms:
  *
- * Exit code: neither class sets one. The single-shot runtime (`runSingleShot`) already reports a
- * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
- * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
- * exit path that could diverge from the existing one.
+ * - `shell` — `Command`, on a `command` part. Unchanged, and unchanged deliberately: that part kind
+ *   is what runs the site extraction, which is the framing a shell command's composition and
+ *   substitution boundaries are shown through.
+ * - `mcpTool` with a nameable server — `MCP tool`, plus a second `MCP server` part. Naming the
+ *   server is the point rather than a side effect: which server a call reaches is the load-bearing
+ *   fact the old label hid, and it is the user's own `mcpServers` key (§4.7.5).
+ * - everything else — `Tool`, on a `value` part.
  *
- * ## [[TUI-C71]] — a stop message is UNTRUSTED TEXT, and it is made safe in two places
+ * **A `mcpTool` call whose server would render blank falls to the `Tool` arm**, mirroring
+ * `approvalPromptHeader`'s own fallback so the two cannot describe one call two ways. The guard is
+ * on the **rendered** server, not the raw one: {@link UNRESOLVED_MCP_SERVER} is the empty string,
+ * but a server key of whitespace alone — which `z.string().min(1)` admits — is also empty once
+ * neutralised, and it would otherwise render an `MCP server` row promising an identity that is not
+ * there. `text` already carries the full registered name in that case, which still shows the
+ * `mcp__` namespace.
  *
- * Every string a stop carries except this module's own sentences is written by something other
- * than the user: the command the agent proposed, the rater's outcome and reason, the
- * `approvals.escalate` entry that matched, and the whole §5 negotiation. On an `attack` verdict
- * that is the *worst* text in the system by construction — the rater judged the command's own
- * structure to evidence deception or obfuscation — so a stop is the one message most likely to
- * carry a payload crafted to forge terminal output, and the last one that may be printed raw.
- *
- * The defence [[TUI-C26]] built has two halves, and they belong at different times:
- *
- * 1. **Neutralisation is done HERE, at construction, unconditionally.** It needs no width and no
- *    screen, it is idempotent, and it is the half every consumer needs — a thrown stop reaches the
- *    Ink transcript, `--no-tui` stderr, a session log, the approvals archive (`record.error`), an
- *    eval turn record, AG-UI and a CI job's output, and only some of those are terminals. Doing it
- *    at each render site would mean every present and future consumer had to remember; doing it
- *    once here means none of them can forget. After it, `{@link message}` contains no control or
- *    format character at all: a carriage return is the five printable characters `\x0d`, and —
- *    because LF is a control character too — untrusted text cannot even open a new line, let alone
- *    reach column 0 on one.
- * 2. **The gutter and the width bound are done at RENDER, by the surface** ({@link
- *    approvalStopRows} for the plain surfaces, `<ApprovalStopMessage>` for the Ink TUI). They
- *    cannot be done here: framing is arithmetic against a terminal width, an `Error.message` has
- *    no width, and a block wrapped for an 80-column terminal is wrong for every other one. What
- *    they buy over neutralisation alone is the last case it cannot close — one very long
- *    neutralised line that the *terminal* wraps, whose continuation starts at column 0 carrying
- *    whatever the attacker chose to put at that offset. That route is measured, not theorised: on
- *    a 120-column terminal the neutralised `Command:` line of a hostile command is ~164 columns.
- *
- * **Because half of it is the surface's job, the surfaces are enumerated rather than assumed.**
- * Every place that catches an `ApprovalStopError` and prints it calls {@link approvalStopRows} (or
- * the Ink component): `runtime/singleShot.ts`, `runtime/conversation.ts`,
- * `agent/modules/interactiveSessionModule.ts` (both its per-turn catch and its outermost one, which
- * is where the `-m` path lands), `review/modules/reviewModule.ts`, `app/commands/prCommand.ts`
- * (which catches what the PR-discovery agent throws) and `app/tui/components/App.tsx`.
- * **Adding a surface that catches a stop means adding it to that list.**
+ * **A stop built with no subject keeps the shell shape**, which is the opposite of
+ * `approvalPromptHeader`'s fail-to-vague and is chosen for a reason that does not apply there. That
+ * function picks between three sentences, so it picks the one true of every call; this one also
+ * picks the PART KIND, and falling back to `value` would silently drop the extracted-site notice
+ * from a shell stop — `framing.ts` calls that the most decision-relevant thing in a command. Every
+ * production throw site passes a subject (`GthAgentRunner.decideToolApprovalInner` and
+ * `haltOrRunAnyway` both have the decision's own subject in hand), so this fallback is reached only
+ * by a hand-built error, where showing more is better than labelling more cautiously.
+ */
+function subjectParts(text, subject) {
+    if (subject === undefined || subject.kind === 'shell') {
+        return [{ kind: 'command', label: 'Command', text }];
+    }
+    if (subject.kind === 'mcpTool' && neutralizeToOneLine(subject.server) !== UNRESOLVED_MCP_SERVER) {
+        return [
+            { kind: 'value', label: 'MCP tool', text },
+            { kind: 'value', label: 'MCP server', text: subject.server },
+        ];
+    }
+    return [{ kind: 'value', label: 'Tool', text }];
+}
+/**
+ * [[EXT-115]] — **the `approvals.allow` entry the general recovery offers as an example**, one per
+ * subject kind, rendered by the one renderer that spells an entry ({@link
+ * renderApprovalEntryObject}) so an example and a stored grant cannot come to disagree about the
+ * grammar.
  *
- * **That list is over the ERROR, and the error is not the only way a stop reaches a screen.** Some
- * consumers take {@link message} and hand the *string* onward, at which point no `instanceof` can
- * find it again: `runConversation` records it as a turn's `error`, and `evalRunner` folds that into
- * an eval case's `reasons`, which `batch/reporters/textReporter.ts` prints — a terminal, reached
- * without any of its code ever seeing this class. That one frames the text itself. So the honest
- * statement is not "every other consumer is a non-terminal" but: **a consumer that prints to a
- * terminal frames what it prints, whether it holds the error or only its text**, and the ones that
- * legitimately do neither are the file and protocol sinks (the approvals archive, the JUnit/JSON
- * reports, the AG-UI event) plus `reviewModule`'s `displayDebug` of the raw error, which is a debug
- * channel. All of them still inherit the neutralisation, which is what keeps the worst case a
- * wrapped line rather than a repainted screen.
+ * The kinds line up one for one with {@link ApprovalEntryType}, which is why this needs no mapping:
+ * a `tool` call's remedy is a `tool` entry, and a `shell` entry can never match one (`matchEntry`
+ * refuses a type mismatch outright), so the shell example this used to print unconditionally was a
+ * line the reader could paste and watch do nothing.
  *
- * **The structured fields stay RAW; only the message is neutralised.** That is what answers the
- * obvious objection to construction-time work — that it stops the error being a faithful record of
- * what was proposed. `{@link ApprovalStopError.command}`, `reason`, `outcome`, `escalatedBy` and
- * `negotiation` are the command as the agent wrote it, byte for byte, for any consumer that needs
- * the truth rather than a screen; the message is the *presentation*, and a presentation that can
- * repaint the terminal is not one. The render path frames from those raw fields, so its gutter
- * numbers the command's real lines rather than one escaped line.
+ * **Only the kind is interpolated — never a name, a server or a command.** These are the gate's own
+ * `own`-part sentences, the one part class a surface may paint raw, and a subject-derived
+ * identifier reaching one is exactly the forgery route the part tagging exists to close. The kind is
+ * a closed three-literal union, so nothing model-authored can ride in on it.
  *
- * **One parts list, two renderings** ({@link ApprovalStopPart}). The message string and the framed
- * block are both derived from {@link ApprovalStopError.parts}, so they cannot come to describe one
- * stop two ways — the same argument `renderNegotiationTranscript` makes for its own two surfaces.
- * A part is tagged with *who wrote it*, which is the only distinction any of this rests on: the
- * gate's own prose can be painted as it is because nothing can forge it, and everything else goes
- * through the shared renderer.
+ * **`*` on the `mcpTool` example, deliberately.** In production this general form is reached for an
+ * `mcpTool` subject only when the server could NOT be attributed — a specific entry is derived
+ * instead whenever one can be (`toolGrantEntry`) — and §4.7.5 makes `*` the reserved literal that is
+ * the only thing able to match such a call. Naming a plausible server there would hand the reader a
+ * line that cannot match the call they were just refused.
  */
-import { frameUntrustedCommand, frameUntrustedText, frameWidthFor, narrowTerminalNotice, neutralizeUntrustedText, } from '#src/core/shell/framing.js';
+const GENERAL_ALLOW_EXAMPLE = Object.freeze({
+    shell: renderApprovalEntryObject({ type: 'shell', matcher: 'exact', pattern: 'npm test' }),
+    tool: renderApprovalEntryObject({ type: 'tool', matcher: 'exact', pattern: 'gth_web_fetch' }),
+    mcpTool: renderApprovalEntryObject({
+        type: 'mcpTool',
+        server: '*',
+        matcher: 'exact',
+        pattern: 'search_issues',
+    }),
+});
 /**
  * The parts as the one string an `Error.message` has to be, with every untrusted part neutralised.
  *
@@ -154,7 +156,11 @@ export function approvalStopRows(parts, options) {
  * cannot shows {@link message}, which is already neutralised and is already the whole explanation.
  */
 export class ApprovalStopError extends Error {
-    /** The command that ended the run, exactly as the agent proposed it. */
+    /**
+     * What ended the run, exactly as the agent proposed it: the command for a shell subject, and the
+     * registered tool name for a gated tool or MCP call. The field name predates the gate widening
+     * past the shell; {@link subjectParts} is what decides the word the MESSAGE calls it.
+     */
     command;
     /** The message's pieces, tagged with who wrote each — see {@link ApprovalStopPart}. */
     parts;
@@ -167,6 +173,21 @@ export class ApprovalStopError extends Error {
         this.name = new.target.name;
     }
 }
+/**
+ * The **blunter** of the two recoveries a stop may name, and it is named second wherever both
+ * appear.
+ *
+ * §4.2 makes `approvals.allow` the supported way to run a specific command unattended: it is
+ * consulted before the rater and therefore before §4.6's deterministic preflight, so a command
+ * declared there never reaches a halt or an escalation at all. `bypass` also works and is far
+ * blunter — it turns off the rater, the prompts and the halt together, for every command, for the
+ * whole run. The ordering is the message: the answer first, the last resort after it, with what it
+ * costs stated rather than implied.
+ *
+ * One sentence, shared, so the two stops that offer it cannot come to describe it differently.
+ */
+const BYPASS_LAST_RESORT = `Dropping to approvals "bypass" also works, but it turns off the rater, ` +
+    `the prompts and the halt for every command in the run.`;
 /**
  * §4.2 — an `attack` outcome: the command's own **structure** evidenced compromise (§4.1.1 —
  * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
@@ -187,20 +208,19 @@ export class ApprovalStopError extends Error {
 export class AttackHaltError extends ApprovalStopError {
     /** The rater's explanation of what the command's structure showed. */
     reason;
-    constructor(command, reason) {
+    constructor(command, reason, subject) {
         super([
             {
                 kind: 'own',
                 text: 'Run halted: the auto-rater rated this command as an attack, which ends the run.',
             },
-            { kind: 'command', label: 'Command', text: command },
+            ...subjectParts(command, subject),
             { kind: 'value', label: 'Reason', text: reason },
             {
                 kind: 'own',
                 text: `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
                     `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
-                    `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
-                    `the prompts and the halt for every command in the run.`,
+                    `reaches a halt. ${BYPASS_LAST_RESORT}`,
             },
         ], command);
         this.reason = reason;
@@ -230,10 +250,35 @@ export class NonInteractiveEscalationError extends ApprovalStopError {
      * the last command and give no hint that the agent had already been told twice what to fix.
      */
     negotiation;
-    constructor(command, outcome, reason, escalatedBy, negotiation) {
+    /**
+     * [[EXT-106]] §4 — **the `approvals.allow` entry that would let THIS command run**, rendered in the
+     * object form a user writes in a config file, or `undefined` when none can soundly be derived.
+     *
+     * A refusal that stands has to say what would lift it, and a generic example leaves the reader to
+     * translate it — for a command the deterministic preflight floors, that translation is the entire
+     * remedy. `approvals.allow` is consulted before the rater and therefore before §4.6's preflight,
+     * so it is the one thing that lifts a floor the agent cannot argue past.
+     *
+     * **Derived by the caller, never here.** The caller holds what an entry has to be derived from —
+     * the normalized command for a shell subject (`shellApprovalEntryFor`), the tool's identity and
+     * host for a tool or MCP one (`toolGrantEntry`) — and it is the same derivation the escalation
+     * menu's *always approve* stores, so a message and a menu cannot promise different things about
+     * one call. `undefined` falls back to the general form, which is the right answer whenever a
+     * specific one would be wrong — an entry that is subtly too broad, or simply inert, is worse than
+     * none. That is what a call whose MCP server could not be attributed gets: `toolGrantEntry`
+     * returns `null` for it, because `server` cannot hold the unresolved sentinel.
+     *
+     * **It is untrusted text.** It embeds the command the model proposed, so it is carried as a
+     * labelled `value` part and neutralised with every other untrusted string; putting it in an `own`
+     * part would route model-authored bytes into the one part class a surface may paint raw.
+     */
+    allowEntry;
+    constructor(command, outcome, reason, escalatedBy, negotiation, allowEntry, subject) {
         const parts = [
+            // [[EXT-115]] — the lead sentence takes NO branch: it is already kind-neutral and true of a
+            // shell command, a tool call and an MCP call alike. Only the subject's own label moves.
             { kind: 'own', text: 'Approval required, but this session has no one to ask.' },
-            { kind: 'command', label: 'Command', text: command },
+            ...subjectParts(command, subject),
         ];
         if (outcome)
             parts.push({ kind: 'value', label: 'Rating', text: outcome });
@@ -250,13 +295,30 @@ export class NonInteractiveEscalationError extends ApprovalStopError {
                     `should run unattended.`,
             });
         }
+        else if (allowEntry) {
+            // [[EXT-106]] §4 — the same recovery `AttackHaltError` names, in the same order (the
+            // allow-list, then `bypass` as the blunter last resort), with the entry filled in for the
+            // command in hand. "Before the auto-rater" is stated as reaching further than the rater
+            // because that is the fact a floored command's reader needs: §4.6's preflight runs inside the
+            // rating decision, so an allow match is ahead of the floor as well as ahead of the model.
+            parts.push({
+                kind: 'own',
+                text: `Declare the commands this run is allowed to execute in approvals.allow — that list is ` +
+                    `consulted before the auto-rater, ahead of its deterministic preflights, and never ` +
+                    `escalates. For this command, add:`,
+            });
+            parts.push({ kind: 'value', label: 'approvals.allow entry', text: allowEntry });
+            parts.push({ kind: 'own', text: BYPASS_LAST_RESORT });
+        }
         else {
+            // [[EXT-115]] — the example is of the SUBJECT'S OWN KIND. `matchEntry` refuses a type
+            // mismatch outright, so the `shell` example this used to print unconditionally was, for a
+            // gated tool or MCP call, a line the reader could paste and watch match nothing.
             parts.push({
                 kind: 'own',
                 text: `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
-                    `one as an explicit entry, for example { "type": "shell", "matcher": "exact", ` +
-                    `"pattern": "npm test" }. That list is consulted before the auto-rater and never ` +
-                    `escalates.`,
+                    `one as an explicit entry, for example ${GENERAL_ALLOW_EXAMPLE[subject?.kind ?? 'shell']}` +
+                    `. That list is consulted before the auto-rater and never escalates.`,
             });
         }
         super(parts, command);
@@ -264,6 +326,7 @@ export class NonInteractiveEscalationError extends ApprovalStopError {
         this.reason = reason;
         this.escalatedBy = escalatedBy;
         this.negotiation = negotiation;
+        this.allowEntry = allowEntry;
     }
 }
 //# sourceMappingURL=approvalStop.js.map

package/dist/core/shell/approvalStop.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAsCpC;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,IAAsB;IAC5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE;YACE,OAAO,KAAK,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAkC,EAClC,OAA8B;IAE9B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,kEAAkE;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,wEAAwE;IAC/D,OAAO,CAAS;IAEzB,uFAAuF;IAC9E,KAAK,CAA8B;IAE5C,YAAsB,KAAkC,EAAE,OAAe;QACvE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,iFAAiF;aACxF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;YACpD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YAChD;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,wFAAwF;oBACxF,oFAAoF;oBACpF,yFAAyF;oBACzF,wDAAwD;aAC3D;SACF,EACD,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC;;;;;;OAMG;IACM,WAAW,CAAqB;IAEzC,YACE,OAAe,EACf,OAAgB,EAChB,MAAe,EACf,WAAoB,EACpB,WAAoB;QAEpB,MAAM,KAAK,GAAuB;YAChC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,wDAAwD,EAAE;YAC/E,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;SACrD,CAAC;QACF,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY;aACf,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AA2FA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAsCpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,OAAoC;IACtE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACtD,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,qBAAqB,EAAE,CAAC;QAChG,OAAO;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;YAC1C,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;SAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,qBAAqB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACvF,KAAK,EAAE,yBAAyB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1F,IAAI,EAAE,yBAAyB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7F,OAAO,EAAE,yBAAyB,CAAC;QACjC,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,eAAe;KACzB,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,IAAsB;IAC5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE;YACE,OAAO,KAAK,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAkC,EAClC,OAA8B;IAE9B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,kEAAkE;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD;;;;OAIG;IACM,OAAO,CAAS;IAEzB,uFAAuF;IAC9E,KAAK,CAA8B;IAE5C,YAAsB,KAAkC,EAAE,OAAe;QACvE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GACtB,yEAAyE;IACzE,wDAAwD,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc,EAAE,OAAyB;QACpE,KAAK,CACH;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,iFAAiF;aACxF;YACD,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;YACjC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YAChD;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,wFAAwF;oBACxF,oFAAoF;oBACpF,mBAAmB,kBAAkB,EAAE;aAC1C;SACF,EACD,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC;;;;;;OAMG;IACM,WAAW,CAAqB;IAEzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACM,UAAU,CAAqB;IAExC,YACE,OAAe,EACf,OAAgB,EAChB,MAAe,EACf,WAAoB,EACpB,WAAoB,EACpB,UAAmB,EACnB,OAAyB;QAEzB,MAAM,KAAK,GAAuB;YAChC,4FAA4F;YAC5F,wFAAwF;YACxF,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,wDAAwD,EAAE;YAC/E,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;SAClC,CAAC;QACF,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,UAAU,EAAE,CAAC;YACtB,qFAAqF;YACrF,0FAA0F;YAC1F,wFAAwF;YACxF,8FAA8F;YAC9F,0FAA0F;YAC1F,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,wFAAwF;oBACxF,oFAAoF;oBACpF,mCAAmC;aACtC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAChF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,sFAAsF;YACtF,0FAA0F;YAC1F,iFAAiF;YACjF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,sFAAsF;oBACtF,yCAAyC,qBAAqB,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,EAAE;oBAC1F,qEAAqE;aACxE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/core/shell/hardline.d.ts

@@ -19,9 +19,12 @@
  * asked for no gate. A false positive in this layer has no recovery at any rung; a miss still has
  * the layers above it. The floor stays narrow and accepts the misses.
  *
- * Two patterns are deliberately NOT anchored, because neither is a command-position construct: the
- * `>`-redirect-to-device arm (a redirection operator appears mid-command by definition) and the
- * fork-bomb literal (the string *is* the fork bomb).
+ * Two patterns carry no {@link CMD_POS} anchor, because neither is a command-position construct.
+ * The `>`-redirect-to-device arm is anchored differently instead — see
+ * {@link OUTSIDE_SINGLE_QUOTES} — because a redirection operator appears mid-command by definition,
+ * so the discrimination available to it is whether the `>` is QUOTED, not where it sits. The
+ * fork-bomb literal is anchored by nothing at all: the string *is* the fork bomb, so prose quoting
+ * it is refused, and that false positive is accepted rather than fixed.
  */
 export declare const HARDLINE_PATTERNS: ReadonlyArray<readonly [RegExp, string]>;
 /**
@@ -82,12 +85,31 @@ export interface HardlineMatch {
  * exfiltration test, which decides per pipeline rather than by one regex.
  */
 export declare const EXFILTRATION_ARM = "deterministic-exfiltration";
+/** Options for {@link checkHardline}. */
+export interface HardlineOptions {
+    /**
+     * The host platform to decide the {@link WINDOWS_HARDLINE_PATTERNS} arm against, in
+     * `process.platform`'s vocabulary. Defaults to `process.platform`, which is what every
+     * production caller wants.
+     *
+     * **It exists so the Windows arm is testable from any host, and that is not a convenience.**
+     * Without it the arm could only ever be exercised on a Windows CI cell: nobody could develop it
+     * on this repo's usual machines, and a regression would be invisible on four of the unit
+     * matrix's five cells — the majority of the signal, including every local run before a merge.
+     * With it, both arms run everywhere, and the Windows cells additionally prove that the real
+     * `process.platform` branch selects the arm the injected value stands in for.
+     */
+    platform?: NodeJS.Platform;
+}
 /**
  * Check a raw command against the hardline blocklist. Normalizes first so
  * obfuscated variants are caught. Returns the match (with a description) when the
  * command is catastrophic, or `null` when it is allowed to proceed.
+ *
+ * The shared patterns are tried on every host. The win32 arm is tried in addition on Windows —
+ * never instead of, because Git Bash, MSYS and WSL run the POSIX shapes on a Windows box too.
  */
-export declare function checkHardline(command: string): HardlineMatch | null;
+export declare function checkHardline(command: string, options?: HardlineOptions): HardlineMatch | null;
 /**
  * The refusal a floor match produces, shared by both call sites (§8, §4.2).
  *