@guilz-dev/belay 0.9.2 → 0.9.4

package/dist/core/effect-ir/shell-lower/decoders/docker.js

@@ -0,0 +1,43 @@
+import { processRequirement, unsupportedProcess } from '../requirement.js';
+import { isOptionToken } from '../tokens.js';
+export function decodeDockerComposeRun(head, args, segment) {
+    let composeArgs = null;
+    let command = head;
+    if (head === 'docker-compose') {
+        composeArgs = args;
+    }
+    else if (head === 'docker' && args[0] === 'compose') {
+        composeArgs = args.slice(1);
+        command = 'docker';
+    }
+    if (!composeArgs) {
+        return null;
+    }
+    if (composeArgs.includes('run')) {
+        return [processRequirement(command, 'spawn', segment, ['process.docker_compose_run'])];
+    }
+    return unsupportedProcess(command, segment, 'process.docker_compose_grammar_incomplete');
+}
+export function validDockerInfo(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (arg === '--help') {
+            continue;
+        }
+        if (arg === '--format' || arg === '-f') {
+            if (!args[index + 1] || isOptionToken(args[index + 1] ?? '')) {
+                return false;
+            }
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--format=')) {
+            if (arg.slice('--format='.length).length === 0) {
+                return false;
+            }
+            continue;
+        }
+        return false;
+    }
+    return true;
+}

package/dist/core/effect-ir/shell-lower/decoders/filesystem.d.ts

@@ -0,0 +1,9 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodeCopyMove(head: 'cp' | 'mv', args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function decodeRm(args: string[], cwd: string, repoRoot: string, segment: string): ShellEffectRequirement[];
+export declare function canonicalRmOperand(targetPath: string, finalOperandIsSymlink: boolean): string;
+export declare function isSymbolicLink(targetPath: string): boolean;
+export declare function pathContains(ancestor: string, candidate: string): boolean;
+export declare function filesystemReadOperands(head: string, args: string[]): string[] | null;
+export declare function findReadOperands(args: string[]): string[] | null;
+export declare function filesystemWriteOperands(head: string, args: string[]): string[] | null;

package/dist/core/effect-ir/shell-lower/decoders/filesystem.js

@@ -0,0 +1,217 @@
+import { lstatSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { inspectGitResourceIdentity } from '../../../git-resource-identity.js';
+import { addSecretRead, addWriteEffects, processRequirement, requirement } from '../requirement.js';
+import { resolvePathOperand } from '../tokens.js';
+export function decodeCopyMove(head, args, cwd, segment) {
+    const requirements = [processRequirement(head, 'spawn', segment, ['process.filesystem_mutation'])];
+    const operands = [];
+    let targetDirectory = null;
+    let recursive = false;
+    let incomplete = false;
+    let optionsEnded = false;
+    const neutralFlags = new Set([
+        '-f',
+        '-i',
+        '-n',
+        '-p',
+        '-v',
+        '--force',
+        '--interactive',
+        '--no-clobber',
+    ]);
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (!optionsEnded && arg === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && (arg === '-r' || arg === '-R' || arg === '--recursive')) {
+            recursive = true;
+            continue;
+        }
+        if (!optionsEnded && (arg === '-t' || arg === '--target-directory')) {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                incomplete = true;
+            }
+            else {
+                targetDirectory = value;
+                index += 1;
+            }
+            continue;
+        }
+        if (!optionsEnded && arg.startsWith('--target-directory=')) {
+            targetDirectory = arg.slice('--target-directory='.length) || null;
+            incomplete ||= !targetDirectory;
+            continue;
+        }
+        if (!optionsEnded && arg.startsWith('-')) {
+            if (!neutralFlags.has(arg)) {
+                incomplete = true;
+            }
+            continue;
+        }
+        operands.push(arg);
+    }
+    const sources = targetDirectory ? operands : operands.slice(0, -1);
+    const destination = targetDirectory ?? (operands.length >= 2 ? (operands.at(-1) ?? null) : null);
+    if (sources.length === 0 || !destination) {
+        incomplete = true;
+    }
+    for (const source of sources) {
+        const resolved = resolvePathOperand(source, cwd);
+        requirements.push(requirement('fs.read', 'fs.read', { kind: 'path', path: resolved }, segment, [
+            `${head}.source_read`,
+        ]));
+        addSecretRead(requirements, resolved, segment);
+        if (head === 'mv') {
+            addWriteEffects(requirements, resolved, segment, ['mv.source_remove']);
+        }
+    }
+    if (destination) {
+        addWriteEffects(requirements, resolvePathOperand(destination, cwd), segment, [
+            `${head}.destination_write`,
+        ]);
+    }
+    if (recursive || incomplete) {
+        requirements.push(requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+            recursive ? `${head}.recursive_source` : `${head}.grammar_incomplete`,
+        ]));
+    }
+    return requirements;
+}
+export function decodeRm(args, cwd, repoRoot, segment) {
+    const requirements = [processRequirement('rm', 'spawn', segment, ['process.filesystem_mutation'])];
+    const recursive = args.some((arg) => arg === '-r' || arg === '-R' || arg === '--recursive' || /^-[^-]*[rR]/.test(arg));
+    const operands = args.filter((arg) => arg && !arg.startsWith('-'));
+    if (operands.length === 0) {
+        return [
+            ...requirements,
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'rm.operand_missing',
+            ]),
+        ];
+    }
+    const identity = inspectGitResourceIdentity(repoRoot);
+    for (const operand of operands) {
+        const resolved = resolvePathOperand(operand, cwd);
+        addWriteEffects(requirements, resolved, segment, ['filesystem.write', 'rm.remove']);
+        const finalOperandIsSymlink = isSymbolicLink(resolved);
+        const canonicalResolved = canonicalRmOperand(resolved, finalOperandIsSymlink);
+        const targetIdentity = recursive && !finalOperandIsSymlink
+            ? inspectGitResourceIdentity(resolved)
+            : { status: 'absent' };
+        const sameIdentityTargetRoot = identity.status === 'resolved' &&
+            targetIdentity.status === 'resolved' &&
+            identity.identity.commonDir === targetIdentity.identity.commonDir &&
+            pathContains(canonicalResolved, targetIdentity.identity.repositoryRoot);
+        if (recursive &&
+            identity.status === 'resolved' &&
+            (sameIdentityTargetRoot ||
+                [
+                    repoRoot,
+                    identity.identity.repositoryRoot,
+                    identity.identity.gitDir,
+                    identity.identity.commonDir,
+                    identity.identity.gitEntryPath,
+                ].some((metadataPath) => pathContains(canonicalResolved, metadataPath)))) {
+            const gitEntryPath = targetIdentity.status === 'resolved'
+                ? targetIdentity.identity.gitEntryPath
+                : identity.identity.gitEntryPath;
+            requirements.push(requirement('control_plane.write', 'control_plane.write', { kind: 'path', path: gitEntryPath }, segment, ['rm.recursive_git_boundary', 'tier1_catastrophic']));
+        }
+    }
+    return requirements;
+}
+export function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
+    try {
+        if (finalOperandIsSymlink) {
+            return path.join(realpathSync.native(path.dirname(targetPath)), path.basename(targetPath));
+        }
+        return realpathSync.native(targetPath);
+    }
+    catch {
+        return path.resolve(targetPath);
+    }
+}
+export function isSymbolicLink(targetPath) {
+    try {
+        return lstatSync(targetPath).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+export function pathContains(ancestor, candidate) {
+    const relative = path.relative(path.resolve(ancestor), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+export function filesystemReadOperands(head, args) {
+    switch (head) {
+        case 'ls': {
+            const operands = args.filter((arg) => arg && !arg.startsWith('-'));
+            return operands.length > 0 ? operands : ['.'];
+        }
+        case 'find':
+            return findReadOperands(args);
+        case 'cat':
+        case 'head':
+        case 'tail':
+        case 'less':
+        case 'stat':
+        case 'file':
+        case 'du':
+        case 'wc':
+            return args.filter((arg) => arg && !arg.startsWith('-'));
+        case 'grep':
+        case 'rg':
+            return args.slice(1).filter((arg) => arg && !arg.startsWith('-'));
+        case 'jq':
+            return args.slice(1).filter((arg) => arg && !arg.startsWith('-'));
+        default:
+            return null;
+    }
+}
+export function findReadOperands(args) {
+    const mutatingPrimaries = new Set([
+        '-delete',
+        '-exec',
+        '-execdir',
+        '-fls',
+        '-fprint',
+        '-fprintf',
+        '-ok',
+        '-okdir',
+    ]);
+    if (args.some((arg) => mutatingPrimaries.has(arg) ||
+        [...mutatingPrimaries].some((primary) => arg.startsWith(`${primary}=`)))) {
+        return null;
+    }
+    const paths = [];
+    for (const arg of args) {
+        if (arg.startsWith('-') || arg === '!' || arg === '(') {
+            break;
+        }
+        paths.push(arg);
+    }
+    return paths.length > 0 ? paths : ['.'];
+}
+export function filesystemWriteOperands(head, args) {
+    const positional = args.filter((arg) => arg && !arg.startsWith('-'));
+    switch (head) {
+        case 'touch':
+        case 'mkdir':
+        case 'rm':
+        case 'truncate':
+        case 'chmod':
+            return positional;
+        case 'cp':
+        case 'mv':
+            return positional.length > 0 ? [positional[positional.length - 1] ?? ''] : [];
+        case 'tee':
+            return positional;
+        default:
+            return null;
+    }
+}

package/dist/core/effect-ir/shell-lower/decoders/prisma.d.ts

@@ -0,0 +1,2 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodePrisma(args: string[], env: Readonly<Record<string, string | undefined>>, repoRoot: string, segment: string): ShellEffectRequirement[];

package/dist/core/effect-ir/shell-lower/decoders/prisma.js

@@ -0,0 +1,54 @@
+import { processRequirement, requirement } from '../requirement.js';
+import { databaseEndpoint, LOOPBACK_HOSTS } from '../tokens.js';
+export function decodePrisma(args, env, repoRoot, segment) {
+    const processEffect = processRequirement('prisma', 'spawn', segment, ['process.prisma']);
+    if (args[0] === 'generate') {
+        return [
+            processEffect,
+            requirement('fs.write', 'fs.write', { kind: 'path', path: repoRoot }, segment, [
+                'prisma.generate.repo_local',
+            ]),
+        ];
+    }
+    const databaseMutation = args[0] === 'migrate' || (args[0] === 'db' && args[1] === 'seed') || args[0] === 'seed';
+    if (!databaseMutation) {
+        return [
+            processEffect,
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'prisma.grammar_incomplete',
+            ]),
+        ];
+    }
+    const endpoint = databaseEndpoint(env.DATABASE_URL);
+    if (!endpoint) {
+        return [
+            processEffect,
+            requirement('network.connect', 'network.connect', {
+                kind: 'network',
+                host: 'unknown',
+                protocol: 'database',
+                mode: 'ambiguous',
+                payload: 'present',
+            }, segment, ['prisma.database_endpoint_unknown']),
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'prisma.database_endpoint_unknown',
+            ]),
+        ];
+    }
+    const network = requirement('network.connect', 'network.connect', {
+        kind: 'network',
+        ...endpoint,
+        mode: 'mutate',
+        payload: 'present',
+    }, segment, [LOOPBACK_HOSTS.has(endpoint.host) ? 'prisma.database_local' : 'prisma.database_remote']);
+    if (LOOPBACK_HOSTS.has(endpoint.host)) {
+        return [processEffect, network];
+    }
+    return [
+        processEffect,
+        network,
+        requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+            'prisma.remote_database_mutation',
+        ]),
+    ];
+}

package/dist/core/effect-ir/shell-lower/decoders/ruby.d.ts

@@ -0,0 +1,11 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function railsReadOnlySubcommand(args: string[]): boolean;
+export declare function isRubyTestScript(scriptPath: string): boolean;
+export declare function parseRubyTestInvocation(args: string[]): {
+    includePaths: string[];
+    scriptPath: string;
+} | null;
+export declare function isRubocopMutating(args: string[]): boolean;
+export declare function decodeBundleExecInner(innerHead: string, innerArgs: string[], segment: string): ShellEffectRequirement[] | null;
+export declare function decodeRuby(args: string[], cwd: string, repoRoot: string, segment: string): ShellEffectRequirement[];
+export declare function decodeRuntimeMetadataProcess(head: string, args: string[], segment: string): ShellEffectRequirement[] | null;

package/dist/core/effect-ir/shell-lower/decoders/ruby.js

@@ -0,0 +1,147 @@
+import path from 'node:path';
+import { canonicalPath, pathWithinRoot } from '../../../path-utils.js';
+import { processRequirement, requirement, unsupportedProcess } from '../requirement.js';
+import { executableBaseName, isMetadataOnlyArgv, resolvePathOperand } from '../tokens.js';
+const RAILS_READ_ONLY_SUBCOMMANDS = new Set(['routes', 'middleware', 'stats', 'about', 'version']);
+export function railsReadOnlySubcommand(args) {
+    const subcommand = args[0];
+    if (!subcommand || subcommand.startsWith('-')) {
+        return false;
+    }
+    return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
+}
+export function isRubyTestScript(scriptPath) {
+    const base = path.basename(scriptPath);
+    return base.endsWith('_test.rb') || base.endsWith('_spec.rb');
+}
+export function parseRubyTestInvocation(args) {
+    const includePaths = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (arg === '-e' || arg === '-r') {
+            return null;
+        }
+        if (arg === '-I') {
+            const includePath = args[index + 1];
+            if (!includePath) {
+                return null;
+            }
+            includePaths.push(includePath);
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('-I') && arg.length > 2) {
+            includePaths.push(arg.slice(2));
+            continue;
+        }
+        if (arg.startsWith('-')) {
+            if (arg === '-n') {
+                if (!args[index + 1]) {
+                    return null;
+                }
+                index += 1;
+                continue;
+            }
+            if (arg.startsWith('-n')) {
+                continue;
+            }
+            return null;
+        }
+        if (isRubyTestScript(arg)) {
+            return { includePaths, scriptPath: arg };
+        }
+        return null;
+    }
+    return null;
+}
+export function isRubocopMutating(args) {
+    return args.some((arg) => arg === '-A' ||
+        arg === '-a' ||
+        arg === '--auto-correct' ||
+        arg === '--autocorrect' ||
+        arg.startsWith('--auto-correct-all') ||
+        arg.startsWith('--autocorrect-all'));
+}
+export function decodeBundleExecInner(innerHead, innerArgs, segment) {
+    const innerBase = executableBaseName(innerHead);
+    if (innerBase === 'rubocop') {
+        const mutating = isRubocopMutating(innerArgs);
+        return [
+            processRequirement(innerHead, mutating ? 'spawn' : 'inspect', segment, mutating ? ['process.linter.mutating'] : ['process.inspect.linter']),
+        ];
+    }
+    if (innerBase === 'rspec') {
+        const targetArgs = innerArgs.filter((arg) => !arg.startsWith('-'));
+        if (targetArgs.length === 0) {
+            return null;
+        }
+        return [processRequirement(innerHead, 'spawn', segment, ['process.test_runner.rspec'])];
+    }
+    return null;
+}
+export function decodeRuby(args, cwd, repoRoot, segment) {
+    const parsed = parseRubyTestInvocation(args);
+    if (!parsed) {
+        return unsupportedProcess('ruby', segment, 'process.ruby_grammar_incomplete');
+    }
+    const scriptPath = resolvePathOperand(parsed.scriptPath, cwd);
+    if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(scriptPath))) {
+        return unsupportedProcess('ruby', segment, 'process.ruby_outside_repo');
+    }
+    for (const includePath of parsed.includePaths) {
+        const resolvedInclude = resolvePathOperand(includePath, cwd);
+        if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(resolvedInclude))) {
+            return unsupportedProcess('ruby', segment, 'process.ruby_outside_repo');
+        }
+    }
+    const lowered = [
+        processRequirement('ruby', 'spawn', segment, ['process.test_runner.minitest']),
+        requirement('fs.read', 'fs.read', { kind: 'path', path: scriptPath }, segment, [
+            'ruby.minitest_script_read',
+        ]),
+    ];
+    for (const includePath of parsed.includePaths) {
+        lowered.push(requirement('fs.read', 'fs.read', { kind: 'path', path: resolvePathOperand(includePath, cwd) }, segment, ['ruby.minitest_load_path_read']));
+    }
+    return lowered;
+}
+export function decodeRuntimeMetadataProcess(head, args, segment) {
+    if (head === 'bundle') {
+        if (args.length === 1 && isMetadataOnlyArgv(args)) {
+            return [processRequirement(head, 'inspect', segment, ['process.inspect.runtime_metadata'])];
+        }
+        if (args[0] === 'exec' && args.length >= 2) {
+            const innerHead = args[1] ?? '';
+            const innerArgs = args.slice(2);
+            const innerBase = executableBaseName(innerHead);
+            if ((innerBase === 'rails' || innerBase === 'rake') && railsReadOnlySubcommand(innerArgs)) {
+                return [
+                    processRequirement(innerHead, 'inspect', segment, ['process.inspect.rails_read_only']),
+                ];
+            }
+            if (isMetadataOnlyArgv(innerArgs)) {
+                return [
+                    processRequirement(innerHead, 'inspect', segment, [
+                        'process.inspect.bundle_exec_metadata',
+                    ]),
+                ];
+            }
+            const bundleExecInner = decodeBundleExecInner(innerHead, innerArgs, segment);
+            if (bundleExecInner) {
+                return bundleExecInner;
+            }
+        }
+        return null;
+    }
+    if ((head === 'ruby' || head === 'yarn') && args.length >= 1 && isMetadataOnlyArgv(args)) {
+        return [processRequirement(head, 'inspect', segment, ['process.inspect.runtime_metadata'])];
+    }
+    if (head === 'make' && args.includes('-n')) {
+        return [processRequirement(head, 'inspect', segment, ['process.inspect.make_dry_run'])];
+    }
+    const base = executableBaseName(head);
+    if ((base === 'rails' || base === 'rake') && railsReadOnlySubcommand(args)) {
+        return [processRequirement(head, 'inspect', segment, ['process.inspect.rails_read_only'])];
+    }
+    return null;
+}

package/dist/core/effect-ir/shell-lower/decoders/toolchain.d.ts

@@ -0,0 +1,7 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodeTsc(args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function decodeGo(args: string[], segment: string): ShellEffectRequirement[];
+export declare function decodeRsync(args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function isRemoteRsyncOperand(operand: string): boolean;
+export declare function decodeSed(args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function decodeNode(args: string[], cwd: string, segment: string): ShellEffectRequirement[];

package/dist/core/effect-ir/shell-lower/decoders/toolchain.js

@@ -0,0 +1,155 @@
+import { addWriteEffects, processRequirement, requirement, unsupportedProcess, } from '../requirement.js';
+import { resolvePathOperand } from '../tokens.js';
+export function decodeTsc(args, cwd, segment) {
+    const metadataOnly = args.length > 0 && args.every((arg) => ['--help', '--version', '-h', '-v'].includes(arg));
+    const requirements = [];
+    let hasOutput = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        const inline = arg.match(/^--(?:outDir|outFile)=(.+)$/)?.[1];
+        const separate = (arg === '--outDir' || arg === '--outFile') && args[index + 1] ? args[index + 1] : null;
+        const output = inline ?? separate;
+        if (!output) {
+            continue;
+        }
+        hasOutput = true;
+        addWriteEffects(requirements, resolvePathOperand(output, cwd), segment, ['tsc.output']);
+        if (separate) {
+            index += 1;
+        }
+    }
+    const typecheckOnly = args.includes('--noEmit') && !hasOutput;
+    const inspect = metadataOnly || typecheckOnly;
+    requirements.unshift(processRequirement('tsc', inspect ? 'inspect' : 'spawn', segment, [
+        metadataOnly
+            ? 'process.inspect.tsc_metadata'
+            : typecheckOnly
+                ? 'process.inspect.tsc_typecheck'
+                : 'process.known_local_spawn',
+    ]));
+    return requirements;
+}
+export function decodeGo(args, segment) {
+    if (['test', 'list', 'vet'].includes(args[0] ?? '')) {
+        return [processRequirement('go', 'spawn', segment, ['process.go_local_spawn'])];
+    }
+    if (args[0] === 'install' || (args[0] === 'mod' && args[1] === 'download')) {
+        return [
+            processRequirement('go', 'spawn', segment, ['process.go_acquire']),
+            requirement('network.acquire', 'network.connect', {
+                kind: 'network',
+                host: 'unknown',
+                protocol: 'go-module',
+                mode: 'ambiguous',
+                payload: 'none',
+            }, segment, ['go.network_acquisition_possible']),
+        ];
+    }
+    return unsupportedProcess('go', segment, 'process.go_grammar_incomplete');
+}
+export function decodeRsync(args, cwd, segment) {
+    const destructive = args.some((arg) => arg === '--delete' || arg === '--del' || arg.startsWith('--delete-'));
+    if (destructive) {
+        return [
+            processRequirement('rsync', 'spawn', segment, ['rsync_destructive']),
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'rsync_destructive',
+            ]),
+        ];
+    }
+    const allowedFlags = new Set([
+        '-a',
+        '-r',
+        '-v',
+        '-z',
+        '--archive',
+        '--delay-updates',
+        '--recursive',
+        '--verbose',
+    ]);
+    if (args.some((arg) => arg.startsWith('-') && !allowedFlags.has(arg))) {
+        return unsupportedProcess('rsync', segment, 'process.rsync_grammar_incomplete');
+    }
+    const operands = args.filter((arg) => !arg.startsWith('-'));
+    if (operands.length < 2) {
+        return unsupportedProcess('rsync', segment, 'process.rsync_operands_incomplete');
+    }
+    if (operands.some(isRemoteRsyncOperand)) {
+        return [
+            processRequirement('rsync', 'spawn', segment, ['rsync.remote']),
+            requirement('network.connect', 'network.connect', {
+                kind: 'network',
+                host: 'remote',
+                protocol: 'rsync',
+                mode: 'mutate',
+                payload: 'present',
+            }, segment, ['rsync.remote']),
+        ];
+    }
+    const destination = operands.at(-1) ?? '';
+    return [
+        processRequirement('rsync', 'spawn', segment, ['process.rsync_local']),
+        ...operands
+            .slice(0, -1)
+            .map((operand) => requirement('fs.read', 'fs.read', { kind: 'path', path: resolvePathOperand(operand, cwd) }, segment, ['rsync.local_source'])),
+        requirement('fs.write', 'fs.write', { kind: 'path', path: resolvePathOperand(destination, cwd) }, segment, ['rsync.local_destination']),
+    ];
+}
+export function isRemoteRsyncOperand(operand) {
+    return (/^rsync:\/\//i.test(operand) ||
+        /^[^/:\s]+::/.test(operand) ||
+        /^(?:[^@/:\s]+@)?[^/:\s]+:/.test(operand));
+}
+export function decodeSed(args, cwd, segment) {
+    let inline = false;
+    let scriptConsumed = false;
+    const files = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (arg === '-n' || arg === '--quiet' || arg === '--silent') {
+            continue;
+        }
+        if (arg === '-i' || arg === '--in-place' || arg.startsWith('-i')) {
+            inline = true;
+            continue;
+        }
+        if (arg === '-e' || arg === '--expression') {
+            if (!args[index + 1]) {
+                return unsupportedProcess('sed', segment, 'process.sed_expression_missing');
+            }
+            scriptConsumed = true;
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--expression=')) {
+            scriptConsumed = true;
+            continue;
+        }
+        if (arg.startsWith('-')) {
+            return unsupportedProcess('sed', segment, 'process.sed_grammar_incomplete');
+        }
+        if (!scriptConsumed) {
+            scriptConsumed = true;
+            continue;
+        }
+        files.push(arg);
+    }
+    const operation = inline ? 'spawn' : 'inspect';
+    const lowered = [processRequirement('sed', operation, segment, ['process.sed'])];
+    for (const file of files) {
+        lowered.push(requirement(inline ? 'fs.write' : 'fs.read', inline ? 'fs.write' : 'fs.read', { kind: 'path', path: resolvePathOperand(file, cwd) }, segment, [inline ? 'sed.in_place_write' : 'sed.file_read']));
+    }
+    return lowered;
+}
+export function decodeNode(args, cwd, segment) {
+    if (args.length > 0 && args.every((arg) => ['--help', '--version', '-h', '-v'].includes(arg))) {
+        return [processRequirement('node', 'inspect', segment, ['process.inspect.node_metadata'])];
+    }
+    if ((args[0] === '--check' || args[0] === '-c') && args.length === 2 && args[1]) {
+        return [
+            processRequirement('node', 'inspect', segment, ['process.inspect.node_syntax']),
+            requirement('fs.read', 'fs.read', { kind: 'path', path: resolvePathOperand(args[1], cwd) }, segment, ['node.syntax_source_read']),
+        ];
+    }
+    return unsupportedProcess('node', segment, 'process.node_grammar_incomplete');
+}

package/dist/core/effect-ir/shell-lower/requirement.d.ts

@@ -0,0 +1,12 @@
+import type { ShellEffectRequirement } from '../shell-build.js';
+import type { EffectProvenance } from '../types.js';
+export declare const SECRET_PATH_PATTERN: RegExp;
+export declare const CONTROL_PLANE_PATH_PATTERN: RegExp;
+export declare function requirement(tag: ShellEffectRequirement['tag'], action: ShellEffectRequirement['action'], resource: ShellEffectRequirement['resource'], segment: string, signals: string[]): ShellEffectRequirement;
+export declare function processRequirement(command: string, operation: 'inspect' | 'spawn', segment: string, signals: string[]): ShellEffectRequirement;
+export declare function unsupportedProcess(command: string, segment: string, signal: string): ShellEffectRequirement[];
+export declare function addWriteEffects(requirements: ShellEffectRequirement[], resolved: string, segment: string, signals: string[]): void;
+export declare function addSecretRead(requirements: ShellEffectRequirement[], resolved: string, segment: string): void;
+export declare function ensureRequirement(requirements: ShellEffectRequirement[], candidate: ShellEffectRequirement): void;
+export declare function withProvenances(requirementValue: ShellEffectRequirement, provenance: EffectProvenance, contributing: EffectProvenance): ShellEffectRequirement;
+export declare function withInnerProvenance(requirementValue: ShellEffectRequirement, innerCommand: string, launcher: string, outerSegment: string): ShellEffectRequirement;