@guilz-dev/belay 0.4.0 → 0.7.0

package/dist/core/verdict/shell-semantics.js

@@ -0,0 +1,225 @@
+import path from 'node:path';
+import { extractRedirectTargets } from '../shell-tokenizer.js';
+import { classifyGitCommand } from './git-classifier.js';
+const READ_ONLY_KEYS = new Set([
+    'cat',
+    'cd',
+    'echo',
+    'head',
+    'ls',
+    'pwd',
+    'rg',
+    'sort',
+    'tail',
+    'wc',
+    'which',
+    'find',
+    'grep',
+    'jq',
+    'stat',
+    'file',
+    'du',
+    'readlink',
+    'realpath',
+    'basename',
+    'dirname',
+    'uname',
+    'whoami',
+    'id',
+    'printenv',
+    'test',
+    'printf',
+    'cut',
+    'tr',
+    'uniq',
+    'cmp',
+    'comm',
+    'shasum',
+    'md5sum',
+]);
+const PURE_READ_ONLY_KEYS = new Set([
+    'echo',
+    'pwd',
+    'which',
+    'grep',
+    'jq',
+    'stat',
+    'file',
+    'du',
+    'readlink',
+    'realpath',
+    'basename',
+    'dirname',
+    'uname',
+    'whoami',
+    'id',
+    'printenv',
+    'test',
+    'printf',
+    'cut',
+    'tr',
+    'uniq',
+    'cmp',
+    'comm',
+    'shasum',
+    'md5sum',
+]);
+const LOCAL_MUTATION_KEYS = new Set([
+    'chmod',
+    'cp',
+    'mkdir',
+    'mv',
+    'rm',
+    'sed',
+    'tee',
+    'touch',
+    'truncate',
+]);
+export const LOCAL_ROUTINE_HEADS = new Set([
+    'tsc',
+    'vitest',
+    'vite',
+    'webpack',
+    'esbuild',
+    'rollup',
+    'jest',
+    'mocha',
+    'cargo',
+    'go',
+    'make',
+    'cmake',
+    'biome',
+    'eslint',
+]);
+function looksLikePathToken(token) {
+    if (!token || token.startsWith('-')) {
+        return false;
+    }
+    return (token.includes('/') || token.includes('\\') || token.startsWith('.') || token.includes('...'));
+}
+function filterRoutinePathTargets(head, targets) {
+    if (!LOCAL_ROUTINE_HEADS.has(head)) {
+        return targets;
+    }
+    return targets.filter((target) => looksLikePathToken(target));
+}
+function extractFilePathOperands(tokens) {
+    const redirects = extractRedirectTargets(tokens);
+    const args = [...redirects];
+    for (let index = 1; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (!token || token.startsWith('-')) {
+            continue;
+        }
+        if (redirects.includes(token)) {
+            continue;
+        }
+        args.push(token);
+    }
+    return args;
+}
+function isRsyncRemoteOperand(token) {
+    if (/^rsync:\/\/.+/.test(token)) {
+        return true;
+    }
+    if (/^(?:[^@\s/:]+@)?(?:\[[^\]]+\]|[^:/\s]+)::/.test(token)) {
+        return true;
+    }
+    if (!/^[A-Za-z]:[\\/]/.test(token) &&
+        /^(?:[^@\s/:]+@)?(?:\[[^\]]+\]|[^:/\s]+):[^:].*/.test(token)) {
+        return true;
+    }
+    if (/^\/\/.+\//.test(token)) {
+        return true;
+    }
+    return false;
+}
+function classifyRsync(tokens) {
+    const args = tokens.slice(1);
+    const pathTargets = args.filter((token) => token && !token.startsWith('-'));
+    const signals = ['rsync'];
+    const destructive = args.some((token) => token.startsWith('--delete') ||
+        token === '--del' ||
+        token === '--remove-source-files' ||
+        token.startsWith('--remove-source-files='));
+    if (destructive) {
+        return {
+            effect: 'local_mutation',
+            pathTargets,
+            signals: [...signals, 'rsync.destructive'],
+            requiresAsk: {
+                reason: 'rsync_destructive',
+                signals: ['rsync.destructive', 'rsync.delete'],
+            },
+        };
+    }
+    const remote = pathTargets.some((token) => isRsyncRemoteOperand(token));
+    if (remote) {
+        return {
+            effect: 'remote_mutation',
+            pathTargets,
+            signals: [...signals, 'rsync.remote'],
+            egressClass: 'ambiguous',
+        };
+    }
+    return {
+        effect: 'local_mutation',
+        pathTargets,
+        signals: [...signals, 'rsync.local'],
+    };
+}
+export function isPureReadOnlySemantics(segment, semantics) {
+    return (semantics.isReadOnly === true ||
+        PURE_READ_ONLY_KEYS.has(segment.head) ||
+        PURE_READ_ONLY_KEYS.has(segment.key) ||
+        PURE_READ_ONLY_KEYS.has(semantics.normalizedKey ?? ''));
+}
+export function analyzeShellCommandSemantics(tokens, segment, cwd) {
+    const head = segment.head;
+    const basename = path.basename(tokens[0] ?? head);
+    if (basename === 'git') {
+        const gitSemantics = classifyGitCommand(tokens, cwd);
+        if (gitSemantics) {
+            return {
+                effect: gitSemantics.effect,
+                pathTargets: gitSemantics.pathTargets,
+                scopeTargets: gitSemantics.scopeTargets,
+                signals: gitSemantics.signals,
+                egressClass: gitSemantics.egressClass,
+                requiresAsk: gitSemantics.requiresAsk,
+                effectiveCwd: gitSemantics.effectiveCwd,
+                gitWorkTree: gitSemantics.gitWorkTree,
+                normalizedKey: gitSemantics.normalizedKey,
+                isReadOnly: gitSemantics.isReadOnly,
+            };
+        }
+    }
+    if (head === 'rsync') {
+        return classifyRsync(tokens);
+    }
+    let effect = 'unknown';
+    let pathTargets = extractFilePathOperands(tokens);
+    pathTargets = filterRoutinePathTargets(head, pathTargets);
+    const signals = [];
+    if (READ_ONLY_KEYS.has(segment.key) || READ_ONLY_KEYS.has(head)) {
+        effect = 'read_only';
+    }
+    else if (LOCAL_MUTATION_KEYS.has(segment.key) || LOCAL_MUTATION_KEYS.has(head)) {
+        effect = 'local_mutation';
+    }
+    else if (LOCAL_ROUTINE_HEADS.has(head)) {
+        effect = 'local_mutation';
+        signals.push('routine_local');
+    }
+    if (extractRedirectTargets(tokens).length > 0 && effect === 'read_only') {
+        effect = 'local_mutation';
+    }
+    return {
+        effect,
+        pathTargets,
+        signals,
+        normalizedKey: segment.key,
+        isReadOnly: effect === 'read_only',
+    };
+}
+export { LOCAL_MUTATION_KEYS, PURE_READ_ONLY_KEYS, READ_ONLY_KEYS };

package/dist/core/verdict/types.d.ts

@@ -1,3 +1,7 @@
+import type { PolicyDecision } from '../capability/policy-types.js';
+import type { CapabilityRequestV1 } from '../capability/request.js';
+import type { BelayConfigV4 } from '../config.js';
+import type { EffectPlan } from '../effect-ir/types.js';
 export type VerdictPermission = 'allow' | 'ask';
 export type VerdictLocation = 'repo_local' | 'repo_outside' | 'external' | 'mixed' | 'unknown';
 export type VerdictOpacity = 'transparent' | 'recursive' | 'opaque' | 'unparseable';
@@ -14,6 +18,10 @@ export interface VerdictResult {
     fingerprint: string;
     signals: string[];
     judgeTrace?: JudgeTrace;
+    capabilityRequests?: CapabilityRequestV1[];
+    authorizationDecision?: PolicyDecision;
+    effectPlan?: EffectPlan;
+    effectPlanPolicyDecisions?: PolicyDecision[];
 }
 export interface Tier1Verdict {
     /** true = undoable via git/fs snapshot or trivial local revert (ADR-002 local-recoverable). */
@@ -33,6 +41,7 @@ export interface Tier1EvaluateInput {
     };
     innerCode?: string;
 }
+/** @deprecated Sync gate path no longer invokes Tier1 judge. Retained for shadow tooling. */
 export interface Tier1Judge {
     evaluate(input: Tier1EvaluateInput): Promise<Tier1Verdict>;
 }
@@ -41,6 +50,7 @@ export interface JudgeTrace {
     modelRequested: string;
     modelResolved: string;
     latencyMs: number;
+    transport?: 'http' | 'ollama-http' | 'codex-cli' | 'cursor-cli' | 'claude-cli' | 'codex-cli-session' | 'cursor-cli-session' | 'claude-cli-session' | 'cursor-acp' | 'unavailable';
     outboundRedacted?: boolean;
     fallbackReason?: string;
     judgeSessionUsed?: boolean;
@@ -60,17 +70,20 @@ export type VerdictMode = 'enforce' | 'audit';
 export interface VerdictContext {
     cwd: string;
     repoRoot: string;
+    config: BelayConfigV4;
     trustedCwd: boolean;
     trustedWorkspaceRoots?: string[];
     sensitivePaths: string[];
     protectedArtifactRoots?: string[];
     customAllowCommands?: string[];
     customExternalCommands?: string[];
-    judge: Tier1Judge;
     mode: VerdictMode;
     unknownLocalEffect: 'allow_flagged' | 'deny';
     unparseableShell: 'allow_flagged' | 'deny';
     maxRecursionDepth?: number;
+    grants?: import('../capability/grant.js').CapabilityGrantV1[];
+    attestation?: import('../capability/attestation.js').BoundaryAttestation | null;
+    egressProxyActive?: boolean;
 }
 export interface InternalSegmentVerdict {
     permission: VerdictPermission;
@@ -81,4 +94,8 @@ export interface InternalSegmentVerdict {
     reason: string;
     signals: string[];
     judgeTrace?: JudgeTrace;
+    capabilityRequests?: CapabilityRequestV1[];
+    authorizationDecision?: PolicyDecision;
+    effectPlan?: EffectPlan;
+    effectPlanPolicyDecisions?: PolicyDecision[];
 }