@guilz-dev/belay 0.9.3 → 0.10.0

package/dist/core/effect-ir/shell-lower/decoders/decode-package-exec.js

@@ -0,0 +1,68 @@
+import { classifyPackageAcquisitionSpec, resolveLocalBin, } from '../../package-exec.js';
+import { requirement } from '../requirement.js';
+export function decodePackageExec(peel, cwd, repoRoot, segment) {
+    if (peel.opaque) {
+        return [
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                peel.reason,
+                ...peel.signals,
+            ]),
+        ];
+    }
+    if (peel.reason === 'npx_wrapper_readonly') {
+        return [];
+    }
+    const binHead = peel.innerTokens[0] ?? '';
+    const metadataOnly = packageExecInnerIsMetadata(peel);
+    const local = !peel.forceAcquire ? resolveLocalBin(binHead, cwd, repoRoot) : null;
+    if (local) {
+        return metadataOnly
+            ? [
+                requirement('process.exec', 'process.exec', { kind: 'executable', command: local.path, operation: 'inspect' }, segment, ['package_exec.delegate', 'package_exec.local_bin_resolved']),
+            ]
+            : [];
+    }
+    const networkResources = peel.acquisitionSpecs
+        .map((spec) => classifyPackageAcquisitionSpec(spec))
+        .filter((source) => source.kind !== 'local')
+        .map((source) => source.kind === 'registry'
+        ? {
+            kind: 'network',
+            host: 'registry.npmjs.org',
+            protocol: 'registry',
+            mode: 'read',
+            payload: 'none',
+        }
+        : {
+            kind: 'network',
+            host: source.host,
+            ...(source.port ? { port: source.port } : {}),
+            protocol: source.protocol,
+            mode: 'read',
+            payload: 'none',
+        });
+    if (networkResources.length === 0) {
+        networkResources.push({
+            kind: 'network',
+            host: 'registry.npmjs.org',
+            protocol: 'registry',
+            mode: 'read',
+            payload: 'none',
+        });
+    }
+    return [
+        ...networkResources.map((resource) => requirement('network.acquire', 'network.connect', resource, segment, [
+            'package_acquire_possible',
+        ])),
+        requirement('fs.write', 'fs.write', { kind: 'package-cache', manager: peel.launcher === 'pnpm' ? 'pnpm' : 'npm' }, segment, ['package_cache_write']),
+        ...(metadataOnly
+            ? [
+                requirement('process.exec', 'process.exec', { kind: 'executable', command: binHead || peel.launcher, operation: 'inspect' }, segment, ['package_exec.delegate']),
+            ]
+            : []),
+    ];
+}
+export function packageExecInnerIsMetadata(peel) {
+    const args = peel.innerTokens.slice(1);
+    return (args.length > 0 && args.every((arg) => ['--help', '--version', '-V', '-h', '-v'].includes(arg)));
+}

package/dist/core/effect-ir/shell-lower/decoders/docker.d.ts

@@ -0,0 +1,3 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodeDockerComposeRun(head: string, args: string[], segment: string): ShellEffectRequirement[] | null;
+export declare function validDockerInfo(args: string[]): boolean;

package/dist/core/effect-ir/shell-lower/decoders/docker.js

@@ -0,0 +1,43 @@
+import { processRequirement, unsupportedProcess } from '../requirement.js';
+import { isOptionToken } from '../tokens.js';
+export function decodeDockerComposeRun(head, args, segment) {
+    let composeArgs = null;
+    let command = head;
+    if (head === 'docker-compose') {
+        composeArgs = args;
+    }
+    else if (head === 'docker' && args[0] === 'compose') {
+        composeArgs = args.slice(1);
+        command = 'docker';
+    }
+    if (!composeArgs) {
+        return null;
+    }
+    if (composeArgs.includes('run')) {
+        return [processRequirement(command, 'spawn', segment, ['process.docker_compose_run'])];
+    }
+    return unsupportedProcess(command, segment, 'process.docker_compose_grammar_incomplete');
+}
+export function validDockerInfo(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (arg === '--help') {
+            continue;
+        }
+        if (arg === '--format' || arg === '-f') {
+            if (!args[index + 1] || isOptionToken(args[index + 1] ?? '')) {
+                return false;
+            }
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--format=')) {
+            if (arg.slice('--format='.length).length === 0) {
+                return false;
+            }
+            continue;
+        }
+        return false;
+    }
+    return true;
+}

package/dist/core/effect-ir/shell-lower/decoders/filesystem.d.ts

@@ -0,0 +1,9 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodeCopyMove(head: 'cp' | 'mv', args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function decodeRm(args: string[], cwd: string, repoRoot: string, segment: string): ShellEffectRequirement[];
+export declare function canonicalRmOperand(targetPath: string, finalOperandIsSymlink: boolean): string;
+export declare function isSymbolicLink(targetPath: string): boolean;
+export declare function pathContains(ancestor: string, candidate: string): boolean;
+export declare function filesystemReadOperands(head: string, args: string[]): string[] | null;
+export declare function findReadOperands(args: string[]): string[] | null;
+export declare function filesystemWriteOperands(head: string, args: string[]): string[] | null;

package/dist/core/effect-ir/shell-lower/decoders/filesystem.js

@@ -0,0 +1,217 @@
+import { lstatSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { inspectGitResourceIdentity } from '../../../git-resource-identity.js';
+import { addSecretRead, addWriteEffects, processRequirement, requirement } from '../requirement.js';
+import { resolvePathOperand } from '../tokens.js';
+export function decodeCopyMove(head, args, cwd, segment) {
+    const requirements = [processRequirement(head, 'spawn', segment, ['process.filesystem_mutation'])];
+    const operands = [];
+    let targetDirectory = null;
+    let recursive = false;
+    let incomplete = false;
+    let optionsEnded = false;
+    const neutralFlags = new Set([
+        '-f',
+        '-i',
+        '-n',
+        '-p',
+        '-v',
+        '--force',
+        '--interactive',
+        '--no-clobber',
+    ]);
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (!optionsEnded && arg === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && (arg === '-r' || arg === '-R' || arg === '--recursive')) {
+            recursive = true;
+            continue;
+        }
+        if (!optionsEnded && (arg === '-t' || arg === '--target-directory')) {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                incomplete = true;
+            }
+            else {
+                targetDirectory = value;
+                index += 1;
+            }
+            continue;
+        }
+        if (!optionsEnded && arg.startsWith('--target-directory=')) {
+            targetDirectory = arg.slice('--target-directory='.length) || null;
+            incomplete ||= !targetDirectory;
+            continue;
+        }
+        if (!optionsEnded && arg.startsWith('-')) {
+            if (!neutralFlags.has(arg)) {
+                incomplete = true;
+            }
+            continue;
+        }
+        operands.push(arg);
+    }
+    const sources = targetDirectory ? operands : operands.slice(0, -1);
+    const destination = targetDirectory ?? (operands.length >= 2 ? (operands.at(-1) ?? null) : null);
+    if (sources.length === 0 || !destination) {
+        incomplete = true;
+    }
+    for (const source of sources) {
+        const resolved = resolvePathOperand(source, cwd);
+        requirements.push(requirement('fs.read', 'fs.read', { kind: 'path', path: resolved }, segment, [
+            `${head}.source_read`,
+        ]));
+        addSecretRead(requirements, resolved, segment);
+        if (head === 'mv') {
+            addWriteEffects(requirements, resolved, segment, ['mv.source_remove']);
+        }
+    }
+    if (destination) {
+        addWriteEffects(requirements, resolvePathOperand(destination, cwd), segment, [
+            `${head}.destination_write`,
+        ]);
+    }
+    if (recursive || incomplete) {
+        requirements.push(requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+            recursive ? `${head}.recursive_source` : `${head}.grammar_incomplete`,
+        ]));
+    }
+    return requirements;
+}
+export function decodeRm(args, cwd, repoRoot, segment) {
+    const requirements = [processRequirement('rm', 'spawn', segment, ['process.filesystem_mutation'])];
+    const recursive = args.some((arg) => arg === '-r' || arg === '-R' || arg === '--recursive' || /^-[^-]*[rR]/.test(arg));
+    const operands = args.filter((arg) => arg && !arg.startsWith('-'));
+    if (operands.length === 0) {
+        return [
+            ...requirements,
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'rm.operand_missing',
+            ]),
+        ];
+    }
+    const identity = inspectGitResourceIdentity(repoRoot);
+    for (const operand of operands) {
+        const resolved = resolvePathOperand(operand, cwd);
+        addWriteEffects(requirements, resolved, segment, ['filesystem.write', 'rm.remove']);
+        const finalOperandIsSymlink = isSymbolicLink(resolved);
+        const canonicalResolved = canonicalRmOperand(resolved, finalOperandIsSymlink);
+        const targetIdentity = recursive && !finalOperandIsSymlink
+            ? inspectGitResourceIdentity(resolved)
+            : { status: 'absent' };
+        const sameIdentityTargetRoot = identity.status === 'resolved' &&
+            targetIdentity.status === 'resolved' &&
+            identity.identity.commonDir === targetIdentity.identity.commonDir &&
+            pathContains(canonicalResolved, targetIdentity.identity.repositoryRoot);
+        if (recursive &&
+            identity.status === 'resolved' &&
+            (sameIdentityTargetRoot ||
+                [
+                    repoRoot,
+                    identity.identity.repositoryRoot,
+                    identity.identity.gitDir,
+                    identity.identity.commonDir,
+                    identity.identity.gitEntryPath,
+                ].some((metadataPath) => pathContains(canonicalResolved, metadataPath)))) {
+            const gitEntryPath = targetIdentity.status === 'resolved'
+                ? targetIdentity.identity.gitEntryPath
+                : identity.identity.gitEntryPath;
+            requirements.push(requirement('control_plane.write', 'control_plane.write', { kind: 'path', path: gitEntryPath }, segment, ['rm.recursive_git_boundary', 'tier1_catastrophic']));
+        }
+    }
+    return requirements;
+}
+export function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
+    try {
+        if (finalOperandIsSymlink) {
+            return path.join(realpathSync.native(path.dirname(targetPath)), path.basename(targetPath));
+        }
+        return realpathSync.native(targetPath);
+    }
+    catch {
+        return path.resolve(targetPath);
+    }
+}
+export function isSymbolicLink(targetPath) {
+    try {
+        return lstatSync(targetPath).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+export function pathContains(ancestor, candidate) {
+    const relative = path.relative(path.resolve(ancestor), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+export function filesystemReadOperands(head, args) {
+    switch (head) {
+        case 'ls': {
+            const operands = args.filter((arg) => arg && !arg.startsWith('-'));
+            return operands.length > 0 ? operands : ['.'];
+        }
+        case 'find':
+            return findReadOperands(args);
+        case 'cat':
+        case 'head':
+        case 'tail':
+        case 'less':
+        case 'stat':
+        case 'file':
+        case 'du':
+        case 'wc':
+            return args.filter((arg) => arg && !arg.startsWith('-'));
+        case 'grep':
+        case 'rg':
+            return args.slice(1).filter((arg) => arg && !arg.startsWith('-'));
+        case 'jq':
+            return args.slice(1).filter((arg) => arg && !arg.startsWith('-'));
+        default:
+            return null;
+    }
+}
+export function findReadOperands(args) {
+    const mutatingPrimaries = new Set([
+        '-delete',
+        '-exec',
+        '-execdir',
+        '-fls',
+        '-fprint',
+        '-fprintf',
+        '-ok',
+        '-okdir',
+    ]);
+    if (args.some((arg) => mutatingPrimaries.has(arg) ||
+        [...mutatingPrimaries].some((primary) => arg.startsWith(`${primary}=`)))) {
+        return null;
+    }
+    const paths = [];
+    for (const arg of args) {
+        if (arg.startsWith('-') || arg === '!' || arg === '(') {
+            break;
+        }
+        paths.push(arg);
+    }
+    return paths.length > 0 ? paths : ['.'];
+}
+export function filesystemWriteOperands(head, args) {
+    const positional = args.filter((arg) => arg && !arg.startsWith('-'));
+    switch (head) {
+        case 'touch':
+        case 'mkdir':
+        case 'rm':
+        case 'truncate':
+        case 'chmod':
+            return positional;
+        case 'cp':
+        case 'mv':
+            return positional.length > 0 ? [positional[positional.length - 1] ?? ''] : [];
+        case 'tee':
+            return positional;
+        default:
+            return null;
+    }
+}

package/dist/core/effect-ir/shell-lower/decoders/prisma.d.ts

@@ -0,0 +1,2 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodePrisma(args: string[], env: Readonly<Record<string, string | undefined>>, repoRoot: string, segment: string): ShellEffectRequirement[];

package/dist/core/effect-ir/shell-lower/decoders/prisma.js

@@ -0,0 +1,54 @@
+import { processRequirement, requirement } from '../requirement.js';
+import { databaseEndpoint, LOOPBACK_HOSTS } from '../tokens.js';
+export function decodePrisma(args, env, repoRoot, segment) {
+    const processEffect = processRequirement('prisma', 'spawn', segment, ['process.prisma']);
+    if (args[0] === 'generate') {
+        return [
+            processEffect,
+            requirement('fs.write', 'fs.write', { kind: 'path', path: repoRoot }, segment, [
+                'prisma.generate.repo_local',
+            ]),
+        ];
+    }
+    const databaseMutation = args[0] === 'migrate' || (args[0] === 'db' && args[1] === 'seed') || args[0] === 'seed';
+    if (!databaseMutation) {
+        return [
+            processEffect,
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'prisma.grammar_incomplete',
+            ]),
+        ];
+    }
+    const endpoint = databaseEndpoint(env.DATABASE_URL);
+    if (!endpoint) {
+        return [
+            processEffect,
+            requirement('network.connect', 'network.connect', {
+                kind: 'network',
+                host: 'unknown',
+                protocol: 'database',
+                mode: 'ambiguous',
+                payload: 'present',
+            }, segment, ['prisma.database_endpoint_unknown']),
+            requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+                'prisma.database_endpoint_unknown',
+            ]),
+        ];
+    }
+    const network = requirement('network.connect', 'network.connect', {
+        kind: 'network',
+        ...endpoint,
+        mode: 'mutate',
+        payload: 'present',
+    }, segment, [LOOPBACK_HOSTS.has(endpoint.host) ? 'prisma.database_local' : 'prisma.database_remote']);
+    if (LOOPBACK_HOSTS.has(endpoint.host)) {
+        return [processEffect, network];
+    }
+    return [
+        processEffect,
+        network,
+        requirement('indeterminate', 'indeterminate', { kind: 'unknown' }, segment, [
+            'prisma.remote_database_mutation',
+        ]),
+    ];
+}

package/dist/core/effect-ir/shell-lower/decoders/ruby.d.ts

@@ -0,0 +1,11 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function railsReadOnlySubcommand(args: string[]): boolean;
+export declare function isRubyTestScript(scriptPath: string): boolean;
+export declare function parseRubyTestInvocation(args: string[]): {
+    includePaths: string[];
+    scriptPath: string;
+} | null;
+export declare function isRubocopMutating(args: string[]): boolean;
+export declare function decodeBundleExecInner(innerHead: string, innerArgs: string[], segment: string): ShellEffectRequirement[] | null;
+export declare function decodeRuby(args: string[], cwd: string, repoRoot: string, segment: string): ShellEffectRequirement[];
+export declare function decodeRuntimeMetadataProcess(head: string, args: string[], segment: string): ShellEffectRequirement[] | null;

package/dist/core/effect-ir/shell-lower/decoders/ruby.js

@@ -0,0 +1,147 @@
+import path from 'node:path';
+import { canonicalPath, pathWithinRoot } from '../../../path-utils.js';
+import { processRequirement, requirement, unsupportedProcess } from '../requirement.js';
+import { executableBaseName, isMetadataOnlyArgv, resolvePathOperand } from '../tokens.js';
+const RAILS_READ_ONLY_SUBCOMMANDS = new Set(['routes', 'middleware', 'stats', 'about', 'version']);
+export function railsReadOnlySubcommand(args) {
+    const subcommand = args[0];
+    if (!subcommand || subcommand.startsWith('-')) {
+        return false;
+    }
+    return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
+}
+export function isRubyTestScript(scriptPath) {
+    const base = path.basename(scriptPath);
+    return base.endsWith('_test.rb') || base.endsWith('_spec.rb');
+}
+export function parseRubyTestInvocation(args) {
+    const includePaths = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (arg === '-e' || arg === '-r') {
+            return null;
+        }
+        if (arg === '-I') {
+            const includePath = args[index + 1];
+            if (!includePath) {
+                return null;
+            }
+            includePaths.push(includePath);
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('-I') && arg.length > 2) {
+            includePaths.push(arg.slice(2));
+            continue;
+        }
+        if (arg.startsWith('-')) {
+            if (arg === '-n') {
+                if (!args[index + 1]) {
+                    return null;
+                }
+                index += 1;
+                continue;
+            }
+            if (arg.startsWith('-n')) {
+                continue;
+            }
+            return null;
+        }
+        if (isRubyTestScript(arg)) {
+            return { includePaths, scriptPath: arg };
+        }
+        return null;
+    }
+    return null;
+}
+export function isRubocopMutating(args) {
+    return args.some((arg) => arg === '-A' ||
+        arg === '-a' ||
+        arg === '--auto-correct' ||
+        arg === '--autocorrect' ||
+        arg.startsWith('--auto-correct-all') ||
+        arg.startsWith('--autocorrect-all'));
+}
+export function decodeBundleExecInner(innerHead, innerArgs, segment) {
+    const innerBase = executableBaseName(innerHead);
+    if (innerBase === 'rubocop') {
+        const mutating = isRubocopMutating(innerArgs);
+        return [
+            processRequirement(innerHead, mutating ? 'spawn' : 'inspect', segment, mutating ? ['process.linter.mutating'] : ['process.inspect.linter']),
+        ];
+    }
+    if (innerBase === 'rspec') {
+        const targetArgs = innerArgs.filter((arg) => !arg.startsWith('-'));
+        if (targetArgs.length === 0) {
+            return null;
+        }
+        return [processRequirement(innerHead, 'spawn', segment, ['process.test_runner.rspec'])];
+    }
+    return null;
+}
+export function decodeRuby(args, cwd, repoRoot, segment) {
+    const parsed = parseRubyTestInvocation(args);
+    if (!parsed) {
+        return unsupportedProcess('ruby', segment, 'process.ruby_grammar_incomplete');
+    }
+    const scriptPath = resolvePathOperand(parsed.scriptPath, cwd);
+    if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(scriptPath))) {
+        return unsupportedProcess('ruby', segment, 'process.ruby_outside_repo');
+    }
+    for (const includePath of parsed.includePaths) {
+        const resolvedInclude = resolvePathOperand(includePath, cwd);
+        if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(resolvedInclude))) {
+            return unsupportedProcess('ruby', segment, 'process.ruby_outside_repo');
+        }
+    }
+    const lowered = [
+        processRequirement('ruby', 'spawn', segment, ['process.test_runner.minitest']),
+        requirement('fs.read', 'fs.read', { kind: 'path', path: scriptPath }, segment, [
+            'ruby.minitest_script_read',
+        ]),
+    ];
+    for (const includePath of parsed.includePaths) {
+        lowered.push(requirement('fs.read', 'fs.read', { kind: 'path', path: resolvePathOperand(includePath, cwd) }, segment, ['ruby.minitest_load_path_read']));
+    }
+    return lowered;
+}
+export function decodeRuntimeMetadataProcess(head, args, segment) {
+    if (head === 'bundle') {
+        if (args.length === 1 && isMetadataOnlyArgv(args)) {
+            return [processRequirement(head, 'inspect', segment, ['process.inspect.runtime_metadata'])];
+        }
+        if (args[0] === 'exec' && args.length >= 2) {
+            const innerHead = args[1] ?? '';
+            const innerArgs = args.slice(2);
+            const innerBase = executableBaseName(innerHead);
+            if ((innerBase === 'rails' || innerBase === 'rake') && railsReadOnlySubcommand(innerArgs)) {
+                return [
+                    processRequirement(innerHead, 'inspect', segment, ['process.inspect.rails_read_only']),
+                ];
+            }
+            if (isMetadataOnlyArgv(innerArgs)) {
+                return [
+                    processRequirement(innerHead, 'inspect', segment, [
+                        'process.inspect.bundle_exec_metadata',
+                    ]),
+                ];
+            }
+            const bundleExecInner = decodeBundleExecInner(innerHead, innerArgs, segment);
+            if (bundleExecInner) {
+                return bundleExecInner;
+            }
+        }
+        return null;
+    }
+    if ((head === 'ruby' || head === 'yarn') && args.length >= 1 && isMetadataOnlyArgv(args)) {
+        return [processRequirement(head, 'inspect', segment, ['process.inspect.runtime_metadata'])];
+    }
+    if (head === 'make' && args.includes('-n')) {
+        return [processRequirement(head, 'inspect', segment, ['process.inspect.make_dry_run'])];
+    }
+    const base = executableBaseName(head);
+    if ((base === 'rails' || base === 'rake') && railsReadOnlySubcommand(args)) {
+        return [processRequirement(head, 'inspect', segment, ['process.inspect.rails_read_only'])];
+    }
+    return null;
+}

package/dist/core/effect-ir/shell-lower/decoders/toolchain.d.ts

@@ -0,0 +1,7 @@
+import type { ShellEffectRequirement } from '../../shell-build.js';
+export declare function decodeTsc(args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function decodeGo(args: string[], segment: string): ShellEffectRequirement[];
+export declare function decodeRsync(args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function isRemoteRsyncOperand(operand: string): boolean;
+export declare function decodeSed(args: string[], cwd: string, segment: string): ShellEffectRequirement[];
+export declare function decodeNode(args: string[], cwd: string, segment: string): ShellEffectRequirement[];