@goodandready/dsh-approval-gate 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.1.5
+
+- Security: block recursive `rm` with uppercase `-R` and `-Rf` flags in compliance with POSIX standard (Refs: #28).
+- Security: inspect `chmod` and `chown` in `inspectArgv`, blocking modifications to protected secret files and recursive changes to root/system paths (Refs: #29).
+- Security: inspect `source` and `.` shell built-in commands as script executions, requiring approval for external script files and process substitutions (Refs: #30).
+- Security: detect destructive SQL (`DROP`, `TRUNCATE`, `ALTER`) delivered via `heredoc` (`<< EOF`) and pipelines to database clients (Refs: #31).
+- Security: block `curl` and `wget` streaming pipelines into interpreter processes like `python`, `node`, `perl`, and `ruby` (Refs: #32).
+- Security: expand `isProtectedPath` to protect `/etc/shadow`, `/etc/sudoers`, `/etc/sudoers.d/`, and SSH `authorized_keys` from writes and redirects (Refs: #33).
+- Bugfix: support GNU sed `--in-place=<suffix>` prefix syntax when checking modifications to protected files (Refs: #34).
+- Refactor: decompose `lib/inspect.js` below the 600-line guideline by extracting bash tokenization into `lib/tokenizer.js` and message formatters into `lib/messages.js` (Refs: #35).
+- Localization: add complete built-in Russian (`ru`) dictionary covering all rules, syntax reasons, and approval prompts in `lib/messages.js` (Refs: #36).
+
+## 0.1.4
+
+- The gate no longer raises an ask it knows cannot be answered. It reads the effective
+  approval policy (`ctx.approval.config.policy`) and, when that policy is in
+  `unattendedPolicies` (default `["never"]`, i.e. the full-access preset), an allowed command
+  proceeds instead of dying as a rejection nobody could consent to. On 20.09.2026 exactly that
+  turned every agreed write in such a session into `the user rejected tool`.
+- Denials never depend on the policy: dangerous shell commands and writes to secret files are
+  still blocked unconditionally, and the uncertain-syntax case stays denied where no
+  pre-execute hook exists.
+- New settings: `unattendedPolicies` and an explicit `unattended` flag for deployments where
+  the policy is not visible. An unknown policy keeps the safe direction and still asks.
+- 8 tests for the new behaviour (23 in total).
+
+
 ## 0.1.3
 
 - First public npmjs release under the canonical @goodandready/dsh-approval-gate identity.

package/README.md

@@ -58,8 +58,9 @@ graph LR
 | Module | Responsibility |
 |---|---|
 | lib/index.js | Registers the monotonic tools.guard and pre-execution approval hook; wires the shell and file-write inspectors into DSH. |
-| lib/inspect.js | Tokenizes bounded Bash syntax, inspects command argv and expansions, applies destructive-command and protected-write rules, and returns pass, deny, or ask decisions. |
-| lib/messages.js | Provides English and Simplified Chinese rule names, explanations, and redacted-result labels. |
+| lib/tokenizer.js | Tokenizes bounded Bash syntax, tracks operators/heredocs, and extracts parameter/command substitutions. |
+| lib/inspect.js | Evaluates safety rules, inspects command argv and expansions, and returns pass, deny, or ask decisions. |
+| lib/messages.js | Provides English, Simplified Chinese, and Russian rule names, explanations, and formatted messages. |
 | cordis.patch.yml | Declares the host-side plugin bundle and optional tool configuration. |
 
 The guard runs before the tool body. A recognized dangerous action is denied even if a prompt could otherwise be shown. Uncertain syntax or targets are sent to DSH approval; DSH policy still decides whether a prompt is available.
@@ -68,7 +69,12 @@ The guard runs before the tool body. A recognized dangerous action is denied eve
 
 | Call | Result |
 |---|---|
-| `rm -rf /tmp/x`, `sudo rm -r ...` | block |
+| `rm -rf /tmp/x`, `rm -Rf /tmp/x`, `sudo rm -r ...` | block |
+| `chmod`/`chown` on `.env` / `id_rsa`, `chmod -R 777 /` | block |
+| `source script.sh`, `. script.sh`, `source <(...)` | request DSH approval |
+| `mysql << EOF DROP TABLE...`, `echo DROP \| mysql` | block |
+| `curl ... \| python3`, `wget ... \| node` | block |
+| writing to `/etc/shadow`, `/etc/sudoers`, `authorized_keys` | block |
 | `kill` / `pkill` / `killall` as the command | block |
 | `k''ill -9 1` (quoted fragments) | block |
 | `systemctl restart\|stop\|disable ...` | block |

package/README.ru.md

@@ -38,7 +38,7 @@
 Установка (публичный пакет npm):
 
 ```sh
-dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.3
+dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.5
 ```
 
 ## Изменения в v0.1.3
@@ -62,8 +62,9 @@ dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.3
 | Модуль | Назначение |
 |---|---|
 | lib/index.js | Регистрирует монотонный tools.guard и штатный pre-execution approval hook DSH, подключает проверки shell и файловых записей. |
-| lib/inspect.js | Разбирает ограниченный shell-синтаксис, проверяет argv и подстановки, применяет правила опасных команд и защищённых записей, возвращает pass, deny или ask. |
-| lib/messages.js | Содержит английские и китайские названия правил, пояснения и подписи для обезличенного фрагмента. |
+| lib/tokenizer.js | Разбирает ограниченный shell-синтаксис, выделяет операторы, heredoc и подстановки команд/параметров. |
+| lib/inspect.js | Применяет правила опасных команд и защищённых записей, проверяет argv и подстановки, возвращает pass, deny или ask. |
+| lib/messages.js | Содержит английские, китайские и русские словари правил, пояснений и форматирования сообщений. |
 | cordis.patch.yml | Объявляет host-пакет плагина и необязательную конфигурацию инструментов. |
 
 ```mermaid
@@ -80,7 +81,12 @@ graph LR
 
 | Пример вызова | Результат |
 |---|---|
-| rm -rf /tmp/x, sudo rm -r ... | Запрет |
+| rm -rf /tmp/x, rm -Rf /tmp/x, sudo rm -r ... | Запрет |
+| chmod/chown на секретах (.env, id_rsa) или chmod -R на корне | Запрет |
+| source script.sh, . script.sh, source <(...) | Запрос подтверждения DSH |
+| mysql << EOF DROP TABLE..., echo DROP \| mysql | Запрет |
+| curl ... \| python3, wget ... \| node | Запрет |
+| Запись в /etc/shadow, /etc/sudoers, authorized_keys | Запрет |
 | kill, pkill, killall | Запрет |
 | systemctl stop/restart/disable | Запрет; systemctl is-active проходит |
 | service name stop/restart | Запрет |
@@ -116,7 +122,7 @@ graph LR
 
 ### Установка и ограничения
 
-<pre><code>dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.3</code></pre>
+<pre><code>dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.5</code></pre>
 
 Плагин не добавляет HTTP-маршруты или отдельную CLI-команду и не читает содержимое файлов скриптов. Это не системная песочница: команды cron и systemd, запущенные отдельно от инструментов DSH, он не перехватывает.
 

package/README.zh.md

@@ -38,7 +38,7 @@
 从公开 npm registry 安装：
 
 ```sh
-dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.3
+dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.5
 ```
 
 ## v0.1.3 变更
@@ -62,8 +62,9 @@ shell 分析器现在支持命令替换、反引号、进程替换、常见重
 | 模块 | 职责 |
 |---|---|
 | lib/index.js | 注册单调的 tools.guard 和 DSH 原生预执行审批钩子，并连接 shell 与文件写入检查器。 |
-| lib/inspect.js | 对有界 shell 语法进行分词，检查 argv 和展开内容，应用危险命令与受保护写入规则，并返回通过、拒绝或请求审批的结果。 |
-| lib/messages.js | 提供英文和简体中文规则名称、说明及脱敏提示。 |
+| lib/tokenizer.js | 对有界 shell 语法进行分词，提取操作符、here-document 和命令/参数替换。 |
+| lib/inspect.js | 检查 argv 和展开内容，应用危险命令与受保护写入规则，并返回通过、拒绝或请求审批的结果。 |
+| lib/messages.js | 提供英文、简体中文及俄文规则名称、说明及格式化提示。 |
 | cordis.patch.yml | 声明 host 端插件包和可选工具配置。 |
 
 ```mermaid
@@ -116,7 +117,7 @@ graph LR
 
 ### 安装与限制
 
-<pre><code>dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.3</code></pre>
+<pre><code>dsh plugin --profile web add @goodandready/dsh-approval-gate@0.1.5</code></pre>
 
 本插件不添加 HTTP 路由或独立 CLI，也不读取脚本文件内容。它不是操作系统沙箱，不会检查 cron 或 systemd 自行执行的命令。
 

package/lib/index.js

@@ -4,7 +4,10 @@
 // commands and writes to secret files even when sandbox mode would allow
 // them. A guard return value (non-undefined) denies execution, so the
 // dangerous call never runs on its own - it needs an explicit owner
-// Approval is handled by DSH's native flow; no separate word is implemented.
+// Approval is handled by DSH's native flow; no separate word is implemented. When the
+// effective approval policy cannot be answered ("never", i.e. the full-access preset),
+// the gate does not raise an ask at all: an allowed command proceeds instead of dying as
+// a rejection nobody could consent to. Denials never depend on the policy.
 //
 // Only the agent tool calls pass through the guard (cron/systemd scripts
 // do not), so legitimate unattended operations are unaffected.
@@ -22,11 +25,50 @@ import { LOCALE_NS, MESSAGES } from "./messages.js";
 export const name = "dsh-approval-gate";
 export const inject = ["tools"];
 
+/** Policies under which a prompt cannot be answered, so raising one is a silent denial. */
+export const DEFAULT_UNATTENDED_POLICIES = ["never"];
+
+/**
+ * Whether a raised ask would be answerable in this session.
+ *
+ * `policy` comes from the approval service (`ctx.approval.config.policy`); an empty value
+ * means the knob is unknown and the gate keeps asking, which is the safe direction.
+ * @param {{policy?: string, unattendedPolicies?: string[]}} knobs
+ * @returns {boolean}
+ */
+export function isUnattended(knobs) {
+  const policy = knobs && knobs.policy;
+  const policies = (knobs && knobs.unattendedPolicies) || DEFAULT_UNATTENDED_POLICIES;
+  if (typeof policy !== "string" || policy === "") return false;
+  return policies.includes(policy);
+}
+
+/** Effective permission knobs, as the harness exposes them. */
+function readKnobs(ctx) {
+  const read = (name) => {
+    try {
+      return ctx && typeof ctx.get === "function" ? ctx.get(name) : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+  const approval = read("approval");
+  const shell = read("shell");
+  return {
+    policy: (approval && approval.config && approval.config.policy) || "",
+    sandbox: (shell && shell.sandboxMode) || "",
+  };
+}
+
 export const Config = Schema.object({
   /** Name of the tool whose `command` arg is inspected (the DSH bash tool). */
   toolName: Schema.string().default(DEFAULT_BASH_TOOL),
   /** Extra tool names treated as file writes; paths are matched against secret files. */
   fileWriteTools: Schema.array(Schema.string()).default(DEFAULT_FILE_WRITE_TOOLS.slice()),
+  /** Approval policies under which an ask could not be answered, so it is not raised. */
+  unattendedPolicies: Schema.array(Schema.string()).default(DEFAULT_UNATTENDED_POLICIES.slice()),
+  /** Force unattended behaviour where the approval policy is not visible. */
+  unattended: Schema.boolean().default(false),
 });
 
 function logBlocked(ctx, hit, who) {
@@ -54,12 +96,20 @@ export function apply(ctx, config) {
     if (locale && typeof locale.bind === "function") return locale.bind(LOCALE_NS)(key);
     return key;
   };
+  const unattendedPolicies = cfg.unattendedPolicies || DEFAULT_UNATTENDED_POLICIES.slice();
+  const forcedUnattended = cfg.unattended === true;
   const hasPreExecute = ctx && typeof ctx.on === "function";
   if (hasPreExecute) {
     ctx.on("tools/pre-execute", function (execution, next) {
       const hit = inspectExecution(execution, { toolName: toolName, fileWriteTools: fileWriteTools });
-      if (hit.ask) return { kind: "ask", reason: askMessage(hit, sessionTag(execution), translate, ctx && ctx.logger) };
-      return next();
+      if (!hit.ask) return next();
+      const knobs = readKnobs(ctx);
+      if (forcedUnattended || isUnattended({ policy: knobs.policy, unattendedPolicies })) {
+        // No one can answer here: an allowed command proceeds. Denials are the guard's job
+        // and do not depend on this decision.
+        return next();
+      }
+      return { kind: "ask", reason: askMessage(hit, sessionTag(execution), translate, ctx && ctx.logger) };
     });
   }
 

package/lib/inspect.js

@@ -1,4 +1,8 @@
-import { MESSAGES } from "./messages.js";
+import { DYNAMIC_MARKER, HEREDOC_OPS, REDIR_OPS, SPLIT_OPS, tokenize, readCommandSubstitution, readBacktick, readParameterExpansion } from "./tokenizer.js";
+import { askMessage, denyMessage, sessionTag } from "./messages.js";
+
+export { DYNAMIC_MARKER, tokenize } from "./tokenizer.js";
+export { askMessage, denyMessage, sessionTag } from "./messages.js";
 
 // Pure command/path inspector for dsh-approval-gate.
 // No Cordis imports: unit tests run this without the harness.
@@ -13,10 +17,6 @@ export const DEFAULT_FILE_WRITE_TOOLS = Object.freeze([
   "apply_patch",
 ]);
 
-const SPLIT_OPS = new Set(["|", "|&", "||", "&&", ";", "&"]);
-const REDIR_OPS = new Set([">", ">>", ">|", "<>", "2>", "2>>", "&>", "&>>"]);
-const HEREDOC_OPS = new Set(["<<", "<<-"]);
-const DYNAMIC_MARKER = "__shell_dynamic__";
 const PREFIXES = new Set(["then", "do"]);
 const SHELLS = new Set(["bash", "sh", "dash", "zsh", "ksh", "ash"]);
 const INTERPRETERS = new Set(["python", "python2", "python3", "node", "nodejs", "perl", "ruby", "php"]);
@@ -38,6 +38,8 @@ export function basename(path) {
 
 export function isProtectedPath(path) {
   if (typeof path !== "string" || path.trim() === "") return false;
+  const normalized = path.replace(/\\/g, "/");
+  if (normalized.includes("/etc/sudoers.d/")) return true;
   const base = basename(path);
   if (base === ".env" || base.startsWith(".env.")) return true;
   if (/^credentials\.ya?ml$/i.test(base)) return true;
@@ -45,326 +47,11 @@ export function isProtectedPath(path) {
   if (base === "cordis.patch.yml") return true;
   if (/\.(pem|key|crt|p12|pfx)$/i.test(base)) return true;
   if (/^(id_rsa|id_ed25519|id_ecdsa)$/.test(base)) return true;
+  if (/^(shadow|gshadow|shadow-|gshadow-|sudoers|authorized_keys2?)$/i.test(base)) return true;
   if (/(?:^|[._-])(?:secret|token|credential|passwd|api[_-]?key)(?:$|[._-])/i.test(base)) return true;
   return false;
 }
 
-function fail(reason, snippet) {
-  return { ok: false, reason: reason, snippet: snippet };
-}
-
-function opAt(s, i) {
-  const rest = s.slice(i);
-  if (rest.startsWith("<(") || rest.startsWith(">(")) return null;
-  const candidates = ["2>&", "2>>", "&>>", "<<<", "<<-", "2>", ">>", ">|", "|&", "&&", "||", "&>", ">&", "<&", "<>", "<<", ">", "<", "|", ";", "&"];
-  for (const op of candidates) {
-    if (rest.startsWith(op)) return op;
-  }
-  return null;
-}
-
-function readCommandSubstitution(src, start) {
-  let depth = 1;
-  let quote = "";
-  let escaped = false;
-  for (let i = start + 2; i < src.length; i += 1) {
-    const c = src[i];
-    if (escaped) { escaped = false; continue; }
-    if (c === "\\") { escaped = true; continue; }
-    if (quote) {
-      if (c === quote) quote = "";
-      continue;
-    }
-    if (c === "'" || c === '"') { quote = c; continue; }
-    if (c === String.fromCharCode(96)) {
-      const end = readBacktick(src, i);
-      if (!end) return null;
-      i = end.end;
-      continue;
-    }
-    if (src.startsWith("$(", i)) { depth += 1; i += 1; continue; }
-    if (c === "(") { depth += 1; continue; }
-    if (c === ")") {
-      depth -= 1;
-      if (depth === 0) return { script: src.slice(start + 2, i), end: i + 1 };
-    }
-  }
-  return null;
-}
-
-function readBacktick(src, start) {
-  let escaped = false;
-  for (let i = start + 1; i < src.length; i += 1) {
-    if (escaped) { escaped = false; continue; }
-    if (src[i] === "\\") { escaped = true; continue; }
-    if (src[i] === String.fromCharCode(96)) return { script: src.slice(start + 1, i), end: i + 1 };
-  }
-  return null;
-}
-
-function readParameterExpansion(src, start) {
-  if (src[start + 1] !== "{") {
-    let i = start + 1;
-    if (/[A-Za-z_]/.test(src[i] || "")) {
-      i += 1;
-      while (i < src.length && /[A-Za-z0-9_]/.test(src[i])) i += 1;
-    } else if (i < src.length) i += 1;
-    return { end: i };
-  }
-  let depth = 1;
-  let quote = "";
-  for (let i = start + 2; i < src.length; i += 1) {
-    const c = src[i];
-    if (c === "\\") { i += 1; continue; }
-    if (quote) {
-      if (c === quote) quote = "";
-      continue;
-    }
-    if (c === "'" || c === '"') { quote = c; continue; }
-    if (c === String.fromCharCode(96)) {
-      const nested = readBacktick(src, i);
-      if (!nested) return null;
-      i = nested.end - 1;
-      continue;
-    }
-    if (src.startsWith("$" + "(", i)) {
-      const nested = readCommandSubstitution(src, i);
-      if (!nested) return null;
-      i = nested.end - 1;
-      continue;
-    }
-    if (src.startsWith("$" + "{", i)) {
-      const nested = readParameterExpansion(src, i);
-      if (!nested) return null;
-      i = nested.end - 1;
-      continue;
-    }
-    if (c === "{") depth += 1;
-    if (c === "}") {
-      depth -= 1;
-      if (depth === 0) return { end: i + 1, body: src.slice(start + 2, i) };
-    }
-  }
-  return null;
-}
-
-function lexFail(src, index, reason, tokens) {
-  return { ok: false, reason: reason, snippet: src.slice(Math.max(0, index - 32), index + 96), tokens: tokens };
-}
-
-function readHeredocDelimiter(src, index) {
-  let i = index;
-  while (i < src.length && (src[i] === " " || src[i] === "\t")) i += 1;
-  if (i >= src.length || src[i] === "\n" || src[i] === "\r") return null;
-  let delimiter = "";
-  let quote = "";
-  let started = false;
-  let quoted = false;
-  while (i < src.length && !/\s/.test(src[i]) && !opAt(src, i)) {
-    const c = src[i];
-    if (c === "'" || c === '"') {
-      if (!quote) { quote = c; quoted = true; started = true; i += 1; continue; }
-      if (quote === c) { quote = ""; i += 1; continue; }
-    }
-    if (c === "\\") {
-      if (i + 1 >= src.length) return null;
-      quoted = true;
-      delimiter += src[i + 1];
-      started = true;
-      i += 2;
-      continue;
-    }
-    delimiter += c;
-    started = true;
-    i += 1;
-  }
-  if (quote || !started || !delimiter) return null;
-  return { delimiter: delimiter, end: i, quoted: quoted };
-}
-
-export function tokenize(src) {
-  if (typeof src !== "string") return { ok: false, reason: "not-a-string", snippet: "", tokens: [] };
-  const tokens = [];
-  const pendingHeredocs = [];
-  let i = 0;
-  const n = src.length;
-
-  function flushWord(value, started, dynamic, substitutions) {
-    if (started) tokens.push({ kind: "word", value: value, dynamic: dynamic, substitutions: substitutions });
-  }
-
-  while (i < n) {
-    if (src.startsWith("\\\n", i)) { i += 2; continue; }
-    if (src[i] === "\r" || src[i] === "\n") {
-      if (src[i] === "\r" && src[i + 1] === "\n") i += 2;
-      else i += 1;
-      if (pendingHeredocs.length) {
-        for (const heredoc of pendingHeredocs) {
-          let body = "";
-          let found = false;
-          while (i <= n) {
-            const lineEnd = src.indexOf("\n", i);
-            const hasNewline = lineEnd !== -1;
-            let line = src.slice(i, hasNewline ? lineEnd : n);
-            if (line.endsWith("\r")) line = line.slice(0, -1);
-            const compare = heredoc.stripTabs ? line.replace(/^\t+/, "") : line;
-            if (compare === heredoc.delimiter) {
-              i = hasNewline ? lineEnd + 1 : n;
-              found = true;
-              break;
-            }
-            body += (heredoc.stripTabs ? line.replace(/^\t+/, "") : line) + (hasNewline ? "\n" : "");
-            if (!hasNewline) { i = n; break; }
-            i = lineEnd + 1;
-          }
-          if (!found) return lexFail(src, i, "unterminated-heredoc", tokens);
-          tokens.push({ kind: "heredoc", body: body, quoted: heredoc.quoted });
-        }
-        pendingHeredocs.length = 0;
-        tokens.push({ kind: "op", value: ";" });
-      } else {
-        tokens.push({ kind: "op", value: ";" });
-      }
-      continue;
-    }
-    if (/\s/.test(src[i])) { i += 1; continue; }
-    if (src[i] === "#" && (tokens.length === 0 || tokens[tokens.length - 1].kind === "op")) {
-      while (i < n && src[i] !== "\n") i += 1;
-      continue;
-    }
-
-    const op = opAt(src, i);
-    if (op) {
-      tokens.push({ kind: "op", value: op });
-      i += op.length;
-      if (HEREDOC_OPS.has(op)) {
-        const parsed = readHeredocDelimiter(src, i);
-        if (!parsed) return lexFail(src, i, "invalid-heredoc-delimiter", tokens);
-        tokens.push({ kind: "heredoc-delimiter", value: parsed.delimiter });
-        pendingHeredocs.push({ delimiter: parsed.delimiter, stripTabs: op === "<<-", quoted: parsed.quoted });
-        i = parsed.end;
-      }
-      continue;
-    }
-
-    let word = "";
-    let started = false;
-    let dynamic = false;
-    const substitutions = [];
-    while (i < n && !/\s/.test(src[i]) && !opAt(src, i)) {
-      const c = src[i];
-      if (src.startsWith("<(", i) || src.startsWith(">(", i)) {
-        const sub = readCommandSubstitution(src, i);
-        if (!sub) return lexFail(src, i, "unclosed-process-substitution", tokens);
-        substitutions.push({ kind: "process-substitution", script: sub.script });
-        word += DYNAMIC_MARKER;
-        dynamic = true;
-        started = true;
-        i = sub.end;
-        continue;
-      }
-      if (c === "(" || c === ")") return lexFail(src, i, "unsupported-shell-grouping", tokens);
-      if (c === "\\") {
-        if (i + 1 >= n) return lexFail(src, i, "dangling-backslash", tokens);
-        word += src[i + 1];
-        started = true;
-        i += 2;
-        continue;
-      }
-      if (c === "'") {
-        const j = src.indexOf("'", i + 1);
-        if (j < 0) return lexFail(src, i, "unclosed-single-quote", tokens);
-        word += src.slice(i + 1, j);
-        started = true;
-        i = j + 1;
-        continue;
-      }
-      if (c === '"') {
-        started = true;
-        i += 1;
-        let closed = false;
-        while (i < n) {
-          if (src[i] === '"') { i += 1; closed = true; break; }
-          if (src[i] === "\\") {
-            if (i + 1 >= n) return lexFail(src, i, "dangling-backslash", tokens);
-            word += src[i + 1];
-            i += 2;
-            continue;
-          }
-          if (src.startsWith("$(", i)) {
-            const sub = readCommandSubstitution(src, i);
-            if (!sub) return lexFail(src, i, "unclosed-command-substitution", tokens);
-            substitutions.push({ kind: "command-substitution", script: sub.script });
-            word += DYNAMIC_MARKER;
-            dynamic = true;
-            i = sub.end;
-            continue;
-          }
-          if (src[i] === String.fromCharCode(96)) {
-            const sub = readBacktick(src, i);
-            if (!sub) return lexFail(src, i, "unclosed-backtick-substitution", tokens);
-            substitutions.push({ kind: "backtick-substitution", script: sub.script });
-            word += DYNAMIC_MARKER;
-            dynamic = true;
-            i = sub.end;
-            continue;
-          }
-          if (src[i] === "$") {
-            const expansion = readParameterExpansion(src, i);
-            if (!expansion) return lexFail(src, i, "unclosed-parameter-expansion", tokens);
-            word += DYNAMIC_MARKER;
-            dynamic = true;
-            if (expansion.body !== undefined) substitutions.push({ kind: "parameter-expansion", script: expansion.body });
-            i = expansion.end;
-            continue;
-          }
-          word += src[i];
-          i += 1;
-        }
-        if (!closed) return lexFail(src, i, "unclosed-double-quote", tokens);
-        continue;
-      }
-      if (src.startsWith("$(", i)) {
-        const sub = readCommandSubstitution(src, i);
-        if (!sub) return lexFail(src, i, "unclosed-command-substitution", tokens);
-        substitutions.push({ kind: "command-substitution", script: sub.script });
-        word += DYNAMIC_MARKER;
-        dynamic = true;
-        started = true;
-        i = sub.end;
-        continue;
-      }
-      if (c === String.fromCharCode(96)) {
-        const sub = readBacktick(src, i);
-        if (!sub) return lexFail(src, i, "unclosed-backtick-substitution", tokens);
-        substitutions.push({ kind: "backtick-substitution", script: sub.script });
-        word += DYNAMIC_MARKER;
-        dynamic = true;
-        started = true;
-        i = sub.end;
-        continue;
-      }
-      if (c === "$") {
-        const expansion = readParameterExpansion(src, i);
-        if (!expansion) return lexFail(src, i, "unclosed-parameter-expansion", tokens);
-        word += DYNAMIC_MARKER;
-        dynamic = true;
-        started = true;
-        if (expansion.body !== undefined) substitutions.push({ kind: "parameter-expansion", script: expansion.body });
-        i = expansion.end;
-        continue;
-      }
-      if (c === "*" || c === "?") dynamic = true;
-      word += c;
-      started = true;
-      i += 1;
-    }
-    flushWord(word, started, dynamic, substitutions);
-  }
-  if (pendingHeredocs.length) return lexFail(src, n, "unterminated-heredoc", tokens);
-  return { ok: true, tokens: tokens };
-}
-
 function wordsOf(seg) {
   return seg.filter(function (t) { return t.kind === "word"; }).map(function (t) { return t.value; });
 }
@@ -510,7 +197,7 @@ function inspectArgv(argv, depth, hasHeredoc) {
 
   if (cmd === "eval") return deny("eval", argv.join(" "));
   if (KILL_CMDS.has(cmd)) return deny("process-signal", argv.join(" "));
-  if (cmd === "rm" && (hasLetterFlag(argv, "r") || rest.indexOf("--recursive") !== -1)) {
+  if (cmd === "rm" && (hasLetterFlag(argv, "r") || hasLetterFlag(argv, "R") || rest.indexOf("--recursive") !== -1)) {
     return deny("recursive-rm", argv.join(" "));
   }
   if (cmd === "systemctl") {
@@ -543,17 +230,24 @@ function inspectArgv(argv, depth, hasHeredoc) {
       if (a.startsWith("of=") && (isDevicePath(a.slice(3)) || isProtectedPath(a.slice(3)))) return deny("device-write", a);
     }
   }
-  if (cmd === "tee" || cmd === "install" || cmd === "cp" || cmd === "mv" || cmd === "truncate") {
+  if (cmd === "tee" || cmd === "install" || cmd === "cp" || cmd === "mv" || cmd === "truncate" || cmd === "chmod" || cmd === "chown") {
     for (const a of rest) {
       if (a[0] !== "-" && isProtectedPath(a)) return deny("secret-write", argv.join(" "));
     }
+    if ((cmd === "chmod" || cmd === "chown") && (hasLetterFlag(argv, "R") || hasLetterFlag(argv, "r") || rest.indexOf("--recursive") !== -1)) {
+      for (const a of rest) {
+        if (a === "/" || a === "/etc" || a === "/var" || a === "/usr" || a === "/root" || a === "/boot") {
+          return deny("device-write", argv.join(" "));
+        }
+      }
+    }
   }
-  if (cmd === "sed" && (hasLetterFlag(argv, "i") || rest.indexOf("--in-place") !== -1)) {
+  if (cmd === "sed" && (hasLetterFlag(argv, "i") || rest.some(function (a) { return a === "--in-place" || a.startsWith("--in-place="); }))) {
     for (const a of rest) {
       if (a[0] !== "-" && isProtectedPath(a)) return deny("secret-write", argv.join(" "));
     }
   }
-  if (SHELLS.has(cmd)) {
+  if (SHELLS.has(cmd) || cmd === "source" || cmd === ".") {
     const script = scriptAfterDashC(rest);
     if (typeof script === "string") {
       if (depth > 4) return deny("nested-shell", script);
@@ -583,7 +277,7 @@ function hasDangerousPipeline(tokens) {
   for (const token of tokens) {
     if (token.kind === "op" && SPLIT_OPS.has(token.value)) {
       const cmd = inspectSegment();
-      if (inPipeline && SHELLS.has(cmd) && pipelineHasDownloader) return true;
+      if (inPipeline && (SHELLS.has(cmd) || INTERPRETERS.has(cmd)) && pipelineHasDownloader) return true;
       const continues = token.value === "|" || token.value === "|&";
       if (continues) {
         pipelineHasDownloader = pipelineHasDownloader || cmd === "curl" || cmd === "wget";
@@ -598,7 +292,33 @@ function hasDangerousPipeline(tokens) {
     segment.push(token);
   }
   const cmd = inspectSegment();
-  return inPipeline && pipelineHasDownloader && SHELLS.has(cmd);
+  return inPipeline && pipelineHasDownloader && (SHELLS.has(cmd) || INTERPRETERS.has(cmd));
+}
+
+function hasDestructiveSqlPipeline(tokens) {
+  let pipelineHasDestructiveSql = false;
+  let inPipeline = false;
+  let segment = [];
+  for (const token of tokens) {
+    if (token.kind === "op" && SPLIT_OPS.has(token.value)) {
+      const cmd = commandNameFromSegment(segment);
+      if (inPipeline && DB_CLIENTS.has(cmd) && pipelineHasDestructiveSql) return true;
+      const continues = token.value === "|" || token.value === "|&";
+      if (continues) {
+        const segText = wordsOf(segment).join(" ");
+        pipelineHasDestructiveSql = pipelineHasDestructiveSql || DESTRUCTIVE_SQL.test(segText);
+        inPipeline = true;
+      } else {
+        pipelineHasDestructiveSql = false;
+        inPipeline = false;
+      }
+      segment = [];
+      continue;
+    }
+    segment.push(token);
+  }
+  const cmd = commandNameFromSegment(segment);
+  return inPipeline && pipelineHasDestructiveSql && DB_CLIENTS.has(cmd);
 }
 
 function executableTokenOf(seg) {
@@ -727,6 +447,7 @@ export function inspectBashCommand(command, depth) {
     if (knownDanger) return knownDanger;
   }
   if (hasDangerousPipeline(tokens)) return deny("curl-pipe", command);
+  if (hasDestructiveSqlPipeline(tokens)) return deny("destructive-sql", command);
   const pipelineHeredocHit = inspectPipelineHeredocs(tokens, depth);
   if (pipelineHeredocHit.deny || pipelineHeredocHit.ask) return pipelineHeredocHit;
 
@@ -780,6 +501,12 @@ export function inspectBashCommand(command, depth) {
           const nested = inspectInterpreterPayload(commandName, heredoc.body);
           if (nested.deny || nested.ask) return nested;
         }
+      } else if (DB_CLIENTS.has(commandName)) {
+        for (const heredoc of heredocs) {
+          if (DESTRUCTIVE_SQL.test(heredoc.body)) {
+            return deny("destructive-sql", heredoc.body);
+          }
+        }
       }
     }
 
@@ -822,97 +549,3 @@ export function inspectExecution(execution, config) {
   return allow();
 }
 
-export function sessionTag(execution) {
-  const agent = execution && execution.agent;
-  if (typeof agent === "string") return " (session " + agent + ")";
-  if (agent && agent.session) return " (session " + String(agent.session) + ")";
-  return "";
-}
-
-function safeSnippet(value) {
-  return String(value || "")
-    .replace(/[\r\n\t\u0000-\u001f]+/g, " ")
-    .replace(/(authorization\s*:\s*(?:bearer|token)\s+)\S+/gi, "$1[redacted]")
-    .replace(/((?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*)[^\s,;]+/gi, "$1[redacted]")
-    .slice(0, 120);
-}
-
-function translated(translate, key, logger) {
-  if (typeof translate === "function") {
-    try {
-      const value = translate(key);
-      if (value && value !== key) return value;
-    } catch {
-      if (logger && typeof logger.warn === "function") {
-        logger.warn("[dsh-approval-gate] localization lookup failed; using English fallback");
-      }
-    }
-  }
-  return MESSAGES.en[key] || key;
-}
-
-const RULE_KEYS = Object.freeze({
-  "recursive-rm": "ruleRecursiveRm",
-  "process-signal": "ruleProcessSignal",
-  "service-control": "ruleServiceControl",
-  "git-clean": "ruleGitClean",
-  "git-reset-hard": "ruleGitResetHard",
-  "find-delete": "ruleFindDelete",
-  "destructive-sql": "ruleDestructiveSql",
-  "secret-write": "ruleSecretWrite",
-  "device-write": "ruleDeviceWrite",
-  "mkfs-device": "ruleMkfsDevice",
-  "curl-pipe": "ruleCurlPipe",
-  "eval": "ruleEval",
-  "nested-shell": "ruleNestedShell",
-  "interpreter-payload": "ruleInterpreterPayload",
-});
-
-const ASK_KEYS = Object.freeze({
-  unparseable: "askUnparseable",
-  "unknown-format": "askUnknownFormat",
-  "unknown-write-target": "askUnknownWriteTarget",
-  "dynamic-command": "askDynamicCommand",
-  "dynamic-arguments": "askDynamicArguments",
-  "dynamic-redirect": "askDynamicRedirect",
-  "script-file": "askScriptFile",
-  "shell-stdin": "askShellStdin",
-  "interpreter-payload": "askInterpreterPayload",
-  "credential-in-argv": "askCredentialInArgv",
-});
-
-const DETAIL_KEYS = Object.freeze({
-  "process-substitution": "detailProcessSubstitution",
-  "unclosed-process-substitution": "detailUnclosedProcessSubstitution",
-  "unclosed-command-substitution": "detailUnclosedCommandSubstitution",
-  "unclosed-backtick-substitution": "detailUnclosedBacktick",
-  "unclosed-parameter-expansion": "detailUnclosedParameterExpansion",
-  "unclosed-single-quote": "detailUnclosedSingleQuote",
-  "unclosed-double-quote": "detailUnclosedDoubleQuote",
-  "dangling-backslash": "detailDanglingEscape",
-  "invalid-heredoc-delimiter": "detailInvalidHeredoc",
-  "unterminated-heredoc": "detailUnterminatedHeredoc",
-  "unsupported-shell-grouping": "detailUnsupportedGrouping",
-});
-
-export function denyMessage(hit, who, translate, logger) {
-  const key = RULE_KEYS[hit && hit.reason] || "ruleUnknown";
-  const snippet = safeSnippet(hit && hit.snippet);
-  const parts = [translated(translate, "blockedPrefix", logger), translated(translate, key, logger)];
-  if (snippet) parts.push(translated(translate, "detectedLabel", logger) + ": " + snippet);
-  if (who) parts.push(who.trim());
-  return parts.join(" — ") + ".";
-}
-
-export function askMessage(hit, who, translate, logger) {
-  const key = ASK_KEYS[hit && hit.reason] || "askUnknown";
-  const snippet = safeSnippet(hit && hit.snippet);
-  const parts = [translated(translate, "approvalRequired", logger), translated(translate, key, logger)];
-  if (hit && hit.reason === "unparseable") {
-    const detailKey = DETAIL_KEYS[hit.detail] || "detailUnsupported";
-    parts.push(translated(translate, "parseReasonLabel", logger) + ": " + translated(translate, detailKey, logger));
-  }
-  if (snippet) parts.push(translated(translate, "commandLabel", logger) + ": " + snippet);
-  if (who) parts.push(who.trim());
-  return parts.join(" — ") + ".";
-}

package/lib/messages.js

@@ -91,4 +91,144 @@ export const MESSAGES = Object.freeze({
     ruleNestedShell: "嵌套 shell 超出检查深度",
     ruleInterpreterPayload: "不安全的解释器代码",
   },
+  ru: {
+    blockedPrefix: "Заблокировано правилом dsh-approval-gate",
+    detectedLabel: "Обнаружено",
+    commandLabel: "Команда",
+    parseReasonLabel: "Причина синтаксического анализа",
+    detailProcessSubstitution: "процессная подстановка требует подтверждения",
+    detailUnclosedProcessSubstitution: "незакрытая процессная подстановка",
+    detailUnclosedCommandSubstitution: "незакрытая подстановка команды",
+    detailUnclosedBacktick: "незакрытая подстановка команды в обратных кавычках",
+    detailUnclosedParameterExpansion: "незакрытое расширение параметров",
+    detailUnclosedSingleQuote: "незакрытая одинарная кавычка",
+    detailUnclosedDoubleQuote: "незакрытая двойная кавычка",
+    detailDanglingEscape: "незавершённое экранирование",
+    detailInvalidHeredoc: "неверный разделитель here-document",
+    detailUnterminatedHeredoc: "завершитель here-document не найден",
+    detailUnsupportedGrouping: "группировка шелла не поддерживается анализатором",
+    detailUnsupported: "неподдерживаемый синтаксис шелла",
+    approvalRequired: "Требуется подтверждение",
+    askUnknown: "Команда не может быть проверена полностью; проверьте её перед подтверждением",
+    askUnparseable: "Синтаксис шелла не может быть проверен полностью; проверьте его перед подтверждением",
+    askUnknownFormat: "Формат вызова инструмента не может быть проверен; проверьте его перед подтверждением",
+    askUnknownWriteTarget: "Целевой файл для записи не определён; проверьте его перед подтверждением",
+    askDynamicCommand: "Развёрнутое имя команды не может быть проверено; проверьте его перед подтверждением",
+    askDynamicArguments: "Развёрнутые аргументы чувствительной команды не могут быть проверены; проверьте их перед подтверждением",
+    askDynamicRedirect: "Развёрнутая цель перенаправления не может быть проверена; проверьте её перед подтверждением",
+    askScriptFile: "Содержимое файла скрипта недоступно для гейта; проверьте его перед подтверждением",
+    askShellStdin: "Ввод шелла недоступен для гейта в полном объёме; проверьте его перед подтверждением",
+    askInterpreterPayload: "Побочные эффекты интерпретатора не могут быть полностью проанализированы; проверьте их перед подтверждением",
+    askCredentialInArgv: "Развёрнутые учётные данные передаются как аргументы процесса; используйте безопасный API или проверьте перед подтверждением",
+    ruleUnknown: "Сработало защитное правило блокировки",
+    ruleRecursiveRm: "Рекурсивное удаление файлов",
+    ruleProcessSignal: "Завершение процесса",
+    ruleServiceControl: "Изменение состояния службы",
+    ruleGitClean: "Разрушительный git clean",
+    ruleGitResetHard: "Разрушительный git reset --hard",
+    ruleFindDelete: "find -delete",
+    ruleDestructiveSql: "Разрушительный SQL",
+    ruleSecretWrite: "Запись в защищённый файл с секретами",
+    ruleDeviceWrite: "Запись в системное устройство или защищённый файл",
+    ruleMkfsDevice: "Форматирование файловой системы",
+    ruleCurlPipe: "Передача скачанного содержимого в шелл",
+    ruleEval: "Динамическое выполнение шелла (eval)",
+    ruleNestedShell: "Превышен лимит вложенности шелла",
+    ruleInterpreterPayload: "Небезопасный исполняемый код интерпретатора",
+  },
+});
+
+export function sessionTag(execution) {
+  const agent = execution && execution.agent;
+  if (typeof agent === "string") return " (session " + agent + ")";
+  if (agent && agent.session) return " (session " + String(agent.session) + ")";
+  return "";
+}
+
+function safeSnippet(value) {
+  return String(value || "")
+    .replace(/[\r\n\t\u0000-\u001f]+/g, " ")
+    .replace(/(authorization\s*:\s*(?:bearer|token)\s+)\S+/gi, "$1[redacted]")
+    .replace(/((?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*)[^\s,;]+/gi, "$1[redacted]")
+    .slice(0, 120);
+}
+
+function translated(translate, key, logger) {
+  if (typeof translate === "function") {
+    try {
+      const value = translate(key);
+      if (value && value !== key) return value;
+    } catch {
+      if (logger && typeof logger.warn === "function") {
+        logger.warn("[dsh-approval-gate] localization lookup failed; using English fallback");
+      }
+    }
+  }
+  return MESSAGES.en[key] || key;
+}
+
+const RULE_KEYS = Object.freeze({
+  "recursive-rm": "ruleRecursiveRm",
+  "process-signal": "ruleProcessSignal",
+  "service-control": "ruleServiceControl",
+  "git-clean": "ruleGitClean",
+  "git-reset-hard": "ruleGitResetHard",
+  "find-delete": "ruleFindDelete",
+  "destructive-sql": "ruleDestructiveSql",
+  "secret-write": "ruleSecretWrite",
+  "device-write": "ruleDeviceWrite",
+  "mkfs-device": "ruleMkfsDevice",
+  "curl-pipe": "ruleCurlPipe",
+  "eval": "ruleEval",
+  "nested-shell": "ruleNestedShell",
+  "interpreter-payload": "ruleInterpreterPayload",
 });
+
+const ASK_KEYS = Object.freeze({
+  unparseable: "askUnparseable",
+  "unknown-format": "askUnknownFormat",
+  "unknown-write-target": "askUnknownWriteTarget",
+  "dynamic-command": "askDynamicCommand",
+  "dynamic-arguments": "askDynamicArguments",
+  "dynamic-redirect": "askDynamicRedirect",
+  "script-file": "askScriptFile",
+  "shell-stdin": "askShellStdin",
+  "interpreter-payload": "askInterpreterPayload",
+  "credential-in-argv": "askCredentialInArgv",
+});
+
+const DETAIL_KEYS = Object.freeze({
+  "process-substitution": "detailProcessSubstitution",
+  "unclosed-process-substitution": "detailUnclosedProcessSubstitution",
+  "unclosed-command-substitution": "detailUnclosedCommandSubstitution",
+  "unclosed-backtick-substitution": "detailUnclosedBacktick",
+  "unclosed-parameter-expansion": "detailUnclosedParameterExpansion",
+  "unclosed-single-quote": "detailUnclosedSingleQuote",
+  "unclosed-double-quote": "detailUnclosedDoubleQuote",
+  "dangling-backslash": "detailDanglingEscape",
+  "invalid-heredoc-delimiter": "detailInvalidHeredoc",
+  "unterminated-heredoc": "detailUnterminatedHeredoc",
+  "unsupported-shell-grouping": "detailUnsupportedGrouping",
+});
+
+export function denyMessage(hit, who, translate, logger) {
+  const key = RULE_KEYS[hit && hit.reason] || "ruleUnknown";
+  const snippet = safeSnippet(hit && hit.snippet);
+  const parts = [translated(translate, "blockedPrefix", logger), translated(translate, key, logger)];
+  if (snippet) parts.push(translated(translate, "detectedLabel", logger) + ": " + snippet);
+  if (who) parts.push(who.trim());
+  return parts.join(" — ") + ".";
+}
+
+export function askMessage(hit, who, translate, logger) {
+  const key = ASK_KEYS[hit && hit.reason] || "askUnknown";
+  const snippet = safeSnippet(hit && hit.snippet);
+  const parts = [translated(translate, "approvalRequired", logger), translated(translate, key, logger)];
+  if (hit && hit.reason === "unparseable") {
+    const detailKey = DETAIL_KEYS[hit.detail] || "detailUnsupported";
+    parts.push(translated(translate, "parseReasonLabel", logger) + ": " + translated(translate, detailKey, logger));
+  }
+  if (snippet) parts.push(translated(translate, "commandLabel", logger) + ": " + snippet);
+  if (who) parts.push(who.trim());
+  return parts.join(" — ") + ".";
+}

package/lib/tokenizer.js

@@ -0,0 +1,319 @@
+// Pure bash lexer and tokenizer for dsh-approval-gate.
+
+export const SPLIT_OPS = new Set(["|", "|&", "||", "&&", ";", "&"]);
+export const REDIR_OPS = new Set([">", ">>", ">|", "<>", "2>", "2>>", "&>", "&>>"]);
+export const HEREDOC_OPS = new Set(["<<", "<<-"]);
+export const DYNAMIC_MARKER = "__shell_dynamic__";
+
+function opAt(s, i) {
+  const rest = s.slice(i);
+  if (rest.startsWith("<(") || rest.startsWith(">(")) return null;
+  const candidates = ["2>&", "2>>", "&>>", "<<<", "<<-", "2>", ">>", ">|", "|&", "&&", "||", "&>", ">&", "<&", "<>", "<<", ">", "<", "|", ";", "&"];
+  for (const op of candidates) {
+    if (rest.startsWith(op)) return op;
+  }
+  return null;
+}
+
+export function readCommandSubstitution(src, start) {
+  let depth = 1;
+  let quote = "";
+  let escaped = false;
+  for (let i = start + 2; i < src.length; i += 1) {
+    const c = src[i];
+    if (escaped) { escaped = false; continue; }
+    if (c === "\\") { escaped = true; continue; }
+    if (quote) {
+      if (c === quote) quote = "";
+      continue;
+    }
+    if (c === "'" || c === '"') { quote = c; continue; }
+    if (c === String.fromCharCode(96)) {
+      const end = readBacktick(src, i);
+      if (!end) return null;
+      i = end.end;
+      continue;
+    }
+    if (src.startsWith("$(", i)) { depth += 1; i += 1; continue; }
+    if (c === "(") { depth += 1; continue; }
+    if (c === ")") {
+      depth -= 1;
+      if (depth === 0) return { script: src.slice(start + 2, i), end: i + 1 };
+    }
+  }
+  return null;
+}
+
+export function readBacktick(src, start) {
+  let escaped = false;
+  for (let i = start + 1; i < src.length; i += 1) {
+    if (escaped) { escaped = false; continue; }
+    if (src[i] === "\\") { escaped = true; continue; }
+    if (src[i] === String.fromCharCode(96)) return { script: src.slice(start + 1, i), end: i + 1 };
+  }
+  return null;
+}
+
+export function readParameterExpansion(src, start) {
+  if (src[start + 1] !== "{") {
+    let i = start + 1;
+    if (/[A-Za-z_]/.test(src[i] || "")) {
+      i += 1;
+      while (i < src.length && /[A-Za-z0-9_]/.test(src[i])) i += 1;
+    } else if (i < src.length) i += 1;
+    return { end: i };
+  }
+  let depth = 1;
+  let quote = "";
+  for (let i = start + 2; i < src.length; i += 1) {
+    const c = src[i];
+    if (c === "\\") { i += 1; continue; }
+    if (quote) {
+      if (c === quote) quote = "";
+      continue;
+    }
+    if (c === "'" || c === '"') { quote = c; continue; }
+    if (c === String.fromCharCode(96)) {
+      const nested = readBacktick(src, i);
+      if (!nested) return null;
+      i = nested.end - 1;
+      continue;
+    }
+    if (src.startsWith("$" + "(", i)) {
+      const nested = readCommandSubstitution(src, i);
+      if (!nested) return null;
+      i = nested.end - 1;
+      continue;
+    }
+    if (src.startsWith("$" + "{", i)) {
+      const nested = readParameterExpansion(src, i);
+      if (!nested) return null;
+      i = nested.end - 1;
+      continue;
+    }
+    if (c === "{") depth += 1;
+    if (c === "}") {
+      depth -= 1;
+      if (depth === 0) return { end: i + 1, body: src.slice(start + 2, i) };
+    }
+  }
+  return null;
+}
+
+function lexFail(src, index, reason, tokens) {
+  return { ok: false, reason: reason, snippet: src.slice(Math.max(0, index - 32), index + 96), tokens: tokens };
+}
+
+function readHeredocDelimiter(src, index) {
+  let i = index;
+  while (i < src.length && (src[i] === " " || src[i] === "\t")) i += 1;
+  if (i >= src.length || src[i] === "\n" || src[i] === "\r") return null;
+  let delimiter = "";
+  let quote = "";
+  let started = false;
+  let quoted = false;
+  while (i < src.length && !/\s/.test(src[i]) && !opAt(src, i)) {
+    const c = src[i];
+    if (c === "'" || c === '"') {
+      if (!quote) { quote = c; quoted = true; started = true; i += 1; continue; }
+      if (quote === c) { quote = ""; i += 1; continue; }
+    }
+    if (c === "\\") {
+      if (i + 1 >= src.length) return null;
+      quoted = true;
+      delimiter += src[i + 1];
+      started = true;
+      i += 2;
+      continue;
+    }
+    delimiter += c;
+    started = true;
+    i += 1;
+  }
+  if (quote || !started || !delimiter) return null;
+  return { delimiter: delimiter, end: i, quoted: quoted };
+}
+
+export function tokenize(src) {
+  if (typeof src !== "string") return { ok: false, reason: "not-a-string", snippet: "", tokens: [] };
+  const tokens = [];
+  const pendingHeredocs = [];
+  let i = 0;
+  const n = src.length;
+
+  function flushWord(value, started, dynamic, substitutions) {
+    if (started) tokens.push({ kind: "word", value: value, dynamic: dynamic, substitutions: substitutions });
+  }
+
+  while (i < n) {
+    if (src.startsWith("\\\n", i)) { i += 2; continue; }
+    if (src[i] === "\r" || src[i] === "\n") {
+      if (src[i] === "\r" && src[i + 1] === "\n") i += 2;
+      else i += 1;
+      if (pendingHeredocs.length) {
+        for (const heredoc of pendingHeredocs) {
+          let body = "";
+          let found = false;
+          while (i <= n) {
+            const lineEnd = src.indexOf("\n", i);
+            const hasNewline = lineEnd !== -1;
+            let line = src.slice(i, hasNewline ? lineEnd : n);
+            if (line.endsWith("\r")) line = line.slice(0, -1);
+            const compare = heredoc.stripTabs ? line.replace(/^\t+/, "") : line;
+            if (compare === heredoc.delimiter) {
+              i = hasNewline ? lineEnd + 1 : n;
+              found = true;
+              break;
+            }
+            body += (heredoc.stripTabs ? line.replace(/^\t+/, "") : line) + (hasNewline ? "\n" : "");
+            if (!hasNewline) { i = n; break; }
+            i = lineEnd + 1;
+          }
+          if (!found) return lexFail(src, i, "unterminated-heredoc", tokens);
+          tokens.push({ kind: "heredoc", body: body, quoted: heredoc.quoted });
+        }
+        pendingHeredocs.length = 0;
+        tokens.push({ kind: "op", value: ";" });
+      } else {
+        tokens.push({ kind: "op", value: ";" });
+      }
+      continue;
+    }
+    if (/\s/.test(src[i])) { i += 1; continue; }
+    if (src[i] === "#" && (tokens.length === 0 || tokens[tokens.length - 1].kind === "op")) {
+      while (i < n && src[i] !== "\n") i += 1;
+      continue;
+    }
+
+    const op = opAt(src, i);
+    if (op) {
+      tokens.push({ kind: "op", value: op });
+      i += op.length;
+      if (HEREDOC_OPS.has(op)) {
+        const parsed = readHeredocDelimiter(src, i);
+        if (!parsed) return lexFail(src, i, "invalid-heredoc-delimiter", tokens);
+        tokens.push({ kind: "heredoc-delimiter", value: parsed.delimiter });
+        pendingHeredocs.push({ delimiter: parsed.delimiter, stripTabs: op === "<<-", quoted: parsed.quoted });
+        i = parsed.end;
+      }
+      continue;
+    }
+
+    let word = "";
+    let started = false;
+    let dynamic = false;
+    const substitutions = [];
+    while (i < n && !/\s/.test(src[i]) && !opAt(src, i)) {
+      const c = src[i];
+      if (src.startsWith("<(", i) || src.startsWith(">(", i)) {
+        const sub = readCommandSubstitution(src, i);
+        if (!sub) return lexFail(src, i, "unclosed-process-substitution", tokens);
+        substitutions.push({ kind: "process-substitution", script: sub.script });
+        word += DYNAMIC_MARKER;
+        dynamic = true;
+        started = true;
+        i = sub.end;
+        continue;
+      }
+      if (c === "(" || c === ")") return lexFail(src, i, "unsupported-shell-grouping", tokens);
+      if (c === "\\") {
+        if (i + 1 >= n) return lexFail(src, i, "dangling-backslash", tokens);
+        word += src[i + 1];
+        started = true;
+        i += 2;
+        continue;
+      }
+      if (c === "'") {
+        const j = src.indexOf("'", i + 1);
+        if (j < 0) return lexFail(src, i, "unclosed-single-quote", tokens);
+        word += src.slice(i + 1, j);
+        started = true;
+        i = j + 1;
+        continue;
+      }
+      if (c === '"') {
+        started = true;
+        i += 1;
+        let closed = false;
+        while (i < n) {
+          if (src[i] === '"') { i += 1; closed = true; break; }
+          if (src[i] === "\\") {
+            if (i + 1 >= n) return lexFail(src, i, "dangling-backslash", tokens);
+            word += src[i + 1];
+            i += 2;
+            continue;
+          }
+          if (src.startsWith("$(", i)) {
+            const sub = readCommandSubstitution(src, i);
+            if (!sub) return lexFail(src, i, "unclosed-command-substitution", tokens);
+            substitutions.push({ kind: "command-substitution", script: sub.script });
+            word += DYNAMIC_MARKER;
+            dynamic = true;
+            i = sub.end;
+            continue;
+          }
+          if (src[i] === String.fromCharCode(96)) {
+            const sub = readBacktick(src, i);
+            if (!sub) return lexFail(src, i, "unclosed-backtick-substitution", tokens);
+            substitutions.push({ kind: "backtick-substitution", script: sub.script });
+            word += DYNAMIC_MARKER;
+            dynamic = true;
+            i = sub.end;
+            continue;
+          }
+          if (src[i] === "$") {
+            const expansion = readParameterExpansion(src, i);
+            if (!expansion) return lexFail(src, i, "unclosed-parameter-expansion", tokens);
+            word += DYNAMIC_MARKER;
+            dynamic = true;
+            if (expansion.body !== undefined) substitutions.push({ kind: "parameter-expansion", script: expansion.body });
+            i = expansion.end;
+            continue;
+          }
+          word += src[i];
+          i += 1;
+        }
+        if (!closed) return lexFail(src, i, "unclosed-double-quote", tokens);
+        continue;
+      }
+      if (src.startsWith("$(", i)) {
+        const sub = readCommandSubstitution(src, i);
+        if (!sub) return lexFail(src, i, "unclosed-command-substitution", tokens);
+        substitutions.push({ kind: "command-substitution", script: sub.script });
+        word += DYNAMIC_MARKER;
+        dynamic = true;
+        started = true;
+        i = sub.end;
+        continue;
+      }
+      if (c === String.fromCharCode(96)) {
+        const sub = readBacktick(src, i);
+        if (!sub) return lexFail(src, i, "unclosed-backtick-substitution", tokens);
+        substitutions.push({ kind: "backtick-substitution", script: sub.script });
+        word += DYNAMIC_MARKER;
+        dynamic = true;
+        started = true;
+        i = sub.end;
+        continue;
+      }
+      if (c === "$") {
+        const expansion = readParameterExpansion(src, i);
+        if (!expansion) return lexFail(src, i, "unclosed-parameter-expansion", tokens);
+        word += DYNAMIC_MARKER;
+        dynamic = true;
+        started = true;
+        if (expansion.body !== undefined) substitutions.push({ kind: "parameter-expansion", script: expansion.body });
+        i = expansion.end;
+        continue;
+      }
+      if (c === "*" || c === "?") dynamic = true;
+      word += c;
+      started = true;
+      i += 1;
+    }
+    flushWord(word, started, dynamic, substitutions);
+  }
+  if (pendingHeredocs.length) return lexFail(src, n, "unterminated-heredoc", tokens);
+  return { ok: true, tokens: tokens };
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-approval-gate",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
   "type": "module",
   "main": "lib/index.js",
@@ -42,5 +42,13 @@
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
-  }
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "security",
+    "approval-gate",
+    "safety"
+  ]
 }