@inhuman.tools/harness 0.1.0 → 0.3.0

package/dist/policy-processor/prep.js

@@ -1,690 +0,0 @@
-/**
- * Question prep: unbash AST → prepared questions + unparsed acts.
- * Hermetic — no PATH, no process.env, no execution. Word.parts is a lazy
- * getter; this file always reads it. Nested parse errors live on the nested
- * script, not the root.
- *
- * Partition builds I: a known value-flag attaches; an unknown flag followed
- * by a non-dash, non-`--` token forks attached and boolean readings.
- * `valueFlagsFor(argv0, suffix)` sees the leading positional spine — not
- * every descendant under argv0. `=value` and glued shorts stay one reading.
- * `--` never attaches as a value. Cap 16 is open ruling 5; overflow is ⊤I.
- * A nameless command still emits its redirects. `xargs -a FILE` is a read
- * of FILE as well as the inner command.
- */
-import { parse, } from "unbash";
-import { resolveKnown } from "./identity.js";
-const TRANSPARENT_FLAG_ARGS = {
-    xargs: ["-a", "-d", "-E", "-e", "-I", "-i", "-L", "-l", "-n", "-P", "-s"],
-    env: ["-C", "-S", "-u"],
-    timeout: ["-k", "--kill-after", "-s", "--signal"],
-    nice: ["-n"],
-    watch: ["-n", "-d", "-t", "-e"],
-    time: ["-p"],
-    stdbuf: ["-i", "-o", "-e"],
-    exec: ["-a"],
-    sudo: ["-C", "-D", "-g", "-l", "-p", "-r", "-U", "-u"],
-    doas: ["-C", "-u"],
-};
-/** Duration is the first positional; COMMAND follows. */
-const HOF_SKIP_POSITIONALS = { timeout: 1 };
-const PARTLESS_FORBIDDEN = /[*?[\\$`]/;
-export function prep(source, opts) {
-    const script = parse(source);
-    const errors = [...(script.errors ?? [])];
-    if (errors.length > 0) {
-        return { questions: [], unparsed: [{ via: "parse-error", source }], errors, redirects: [] };
-    }
-    const ctx = {
-        questions: [],
-        unparsed: [],
-        wrapChain: [],
-        elevated: false,
-        envDelta: {},
-        source,
-        valueFlags: opts?.valueFlags,
-        valueFlagsFor: opts?.valueFlagsFor,
-        which: opts?.which,
-        accessReads: [],
-        orphans: [],
-    };
-    walkScript(script, ctx, { background: false, stdinIsPipe: false, redirects: [] });
-    return { questions: ctx.questions, unparsed: ctx.unparsed, errors, redirects: ctx.orphans };
-}
-function walkScript(script, ctx, frame) {
-    if (script.errors !== undefined && script.errors.length > 0) {
-        ctx.unparsed.push({ via: "parse-error", source: ctx.source.slice(script.pos, script.end) });
-        return;
-    }
-    for (const statement of script.commands)
-        walkStatement(statement, ctx, frame);
-}
-function walkStatement(statement, ctx, frame) {
-    walkNode(statement.command, ctx, {
-        background: statement.background === true || frame.background,
-        stdinIsPipe: frame.stdinIsPipe,
-        redirects: [...frame.redirects, ...statement.redirects],
-    });
-}
-function walkNode(node, ctx, frame) {
-    switch (node.type) {
-        case "Statement":
-            walkStatement(node, ctx, frame);
-            return;
-        case "CompoundList":
-            for (const statement of node.commands)
-                walkStatement(statement, ctx, frame);
-            return;
-        case "Pipeline": {
-            const wrap = node.time === true ? withWrap(ctx, "time") : ctx;
-            for (const [i, child] of node.commands.entries()) {
-                walkNode(child, wrap, { ...frame, stdinIsPipe: frame.stdinIsPipe || i > 0 });
-            }
-            return;
-        }
-        case "AndOr":
-            for (const child of node.commands)
-                walkNode(child, ctx, frame);
-            return;
-        case "Subshell":
-        case "BraceGroup":
-            walkNode(node.body, ctx, frame);
-            return;
-        case "If":
-        case "For":
-        case "ArithmeticFor":
-        case "While":
-        case "Select":
-        case "Case":
-            ctx.unparsed.push({ via: "control-flow", source: slice(ctx, node) });
-            walkControlInner(node, ctx, frame);
-            return;
-        case "Function":
-            ctx.unparsed.push({ via: "function", source: slice(ctx, node) });
-            return;
-        case "Coproc":
-            ctx.unparsed.push({ via: "coproc", source: slice(ctx, node) });
-            walkNode(node.body, ctx, frame);
-            return;
-        case "TestCommand":
-            ctx.unparsed.push({ via: "test", source: slice(ctx, node) });
-            walkTestWords(node.expression, ctx, frame);
-            return;
-        case "ArithmeticCommand":
-            ctx.unparsed.push({ via: "arithmetic", source: slice(ctx, node) });
-            walkArith(node.expression, ctx, frame);
-            return;
-        case "Command":
-            walkCommand(node, ctx, frame);
-            return;
-    }
-}
-function walkControlInner(node, ctx, frame) {
-    switch (node.type) {
-        case "If":
-            walkNode(node.clause, ctx, frame);
-            walkNode(node.then, ctx, frame);
-            if (node.else !== undefined)
-                walkNode(node.else, ctx, frame);
-            return;
-        case "For":
-        case "Select":
-            walkWord(node.name, ctx, frame);
-            for (const word of node.wordlist)
-                walkWord(word, ctx, frame);
-            walkNode(node.body, ctx, frame);
-            return;
-        case "ArithmeticFor":
-            walkArith(node.initialize, ctx, frame);
-            walkArith(node.test, ctx, frame);
-            walkArith(node.update, ctx, frame);
-            walkNode(node.body, ctx, frame);
-            return;
-        case "While":
-            walkNode(node.clause, ctx, frame);
-            walkNode(node.body, ctx, frame);
-            return;
-        case "Case":
-            walkWord(node.word, ctx, frame);
-            for (const item of node.items) {
-                for (const pattern of item.pattern)
-                    walkWord(pattern, ctx, frame);
-                walkNode(item.body, ctx, frame);
-            }
-            return;
-        default:
-            return;
-    }
-}
-function walkCommand(command, ctx, frame) {
-    const envDelta = { ...ctx.envDelta };
-    for (const prefix of command.prefix) {
-        takeAssignment(prefix, envDelta);
-        walkAssignment(prefix, ctx, frame);
-    }
-    const redirects = [...frame.redirects, ...command.redirects];
-    for (const redirect of redirects)
-        walkRedirect(redirect, ctx, frame);
-    if (command.name === undefined) {
-        ctx.orphans.push(...redirects.flatMap(emitRedirect));
-        return;
-    }
-    const argv0Word = command.name;
-    walkWord(argv0Word, ctx, frame);
-    if (!isLiteralWord(argv0Word)) {
-        for (const word of command.suffix)
-            walkWord(word, ctx, frame);
-        ctx.unparsed.push({ via: "non-literal-argv0", source: slice(ctx, command) });
-        return;
-    }
-    const raw = argv0Word.value;
-    const argv0 = peelName(raw, ctx.which);
-    const suffix = command.suffix.map((word) => word.value);
-    const innerCtx = { ...ctx, envDelta };
-    switch (argv0) {
-        case undefined:
-            break;
-        case "sudo":
-        case "doas":
-            emitCommand(innerCtx, raw, suffix, { ...frame, redirects }, true);
-            peelInner(command, argv0, suffix, { ...innerCtx, elevated: true }, frame, redirects, true);
-            return;
-        case "source":
-        case ".":
-            for (const word of command.suffix)
-                walkWord(word, ctx, frame);
-            ctx.unparsed.push({ via: "source", source: slice(ctx, command) });
-            return;
-        case "find":
-            for (const word of command.suffix)
-                walkWord(word, ctx, frame);
-            ctx.unparsed.push({ via: "find-expression", source: slice(ctx, command) });
-            return;
-        case "python":
-        case "python3":
-        case "node":
-            if (hasScriptFlag(suffix)) {
-                for (const word of command.suffix)
-                    walkWord(word, ctx, frame);
-                ctx.unparsed.push({ via: "script-string", source: slice(ctx, command) });
-                emitCommand(innerCtx, raw, suffix, { ...frame, redirects }, false);
-                return;
-            }
-            break;
-        case "eval":
-            peelEval(command, innerCtx, frame, redirects);
-            return;
-        case "bash":
-        case "sh":
-        case "zsh":
-        case "dash":
-        case "ksh":
-            peelShellC(command, argv0, suffix, innerCtx, frame, redirects);
-            return;
-        case "env":
-            if (envHasDashFlags(suffix)) {
-                for (const word of command.suffix)
-                    walkWord(word, ctx, frame);
-                emitCommand(innerCtx, raw, suffix, { ...frame, redirects }, false);
-                return;
-            }
-            peelInner(command, argv0, suffix, innerCtx, frame, redirects, false);
-            return;
-        case "xargs":
-        case "timeout":
-        case "nice":
-        case "nohup":
-        case "stdbuf":
-        case "watch":
-        case "time":
-        case "command":
-        case "exec":
-        case "builtin":
-            peelInner(command, argv0, suffix, innerCtx, frame, redirects, false);
-            return;
-    }
-    for (const word of command.suffix)
-        walkWord(word, ctx, frame);
-    emitCommand(innerCtx, raw, suffix, { ...frame, redirects }, false);
-}
-function peelInner(command, argv0, suffix, ctx, frame, redirects, keepWrapper) {
-    const flagArgs = TRANSPARENT_FLAG_ARGS[argv0];
-    const skipAssign = argv0 === "env";
-    const boundary = scanPassthroughBoundary(suffix, flagArgs, skipAssign) + (HOF_SKIP_POSITIONALS[argv0] ?? 0);
-    const reads = wrapperFileReads(argv0, suffix);
-    const innerCtx = reads.length === 0 ? ctx : { ...ctx, accessReads: [...ctx.accessReads, ...reads] };
-    if (boundary >= suffix.length) {
-        if (keepWrapper) {
-            for (const word of command.suffix)
-                walkWord(word, innerCtx, frame);
-        }
-        else {
-            emitCommand(innerCtx, argv0, suffix, { ...frame, redirects }, false);
-        }
-        return;
-    }
-    for (const word of command.suffix.slice(0, boundary))
-        walkWord(word, innerCtx, frame);
-    const envDelta = { ...innerCtx.envDelta };
-    if (skipAssign) {
-        for (const word of suffix.slice(0, boundary)) {
-            if (isVarAssignment(word))
-                takeEnvText(word, envDelta);
-        }
-    }
-    const nameWord = command.suffix[boundary];
-    const wrapped = withWrap({ ...innerCtx, envDelta }, argv0);
-    const inner = {
-        type: "Command",
-        pos: nameWord.pos,
-        end: command.end,
-        name: nameWord,
-        prefix: [],
-        suffix: command.suffix.slice(boundary + 1),
-        redirects: [],
-    };
-    walkCommand(inner, wrapped, { ...frame, redirects });
-}
-function peelShellC(command, argv0, suffix, ctx, frame, redirects) {
-    for (const word of command.suffix)
-        walkWord(word, ctx, frame);
-    const body = scriptFlagBody(suffix, "-c");
-    if (body === undefined) {
-        emitCommand(ctx, argv0, suffix, { ...frame, redirects }, false);
-        return;
-    }
-    const inner = parse(body);
-    if (inner.errors !== undefined && inner.errors.length > 0) {
-        ctx.unparsed.push({ via: "script-string", source: body });
-        return;
-    }
-    walkScript(inner, withWrap(ctx, argv0), {
-        background: frame.background,
-        stdinIsPipe: frame.stdinIsPipe,
-        redirects,
-    });
-}
-function peelEval(command, ctx, frame, redirects) {
-    const suffix = command.suffix.map((word) => word.value);
-    emitCommand(ctx, "eval", suffix, { ...frame, redirects }, false);
-    if (suffix.length === 0)
-        return;
-    const body = suffix.join(" ");
-    const inner = parse(body);
-    if (inner.errors !== undefined && inner.errors.length > 0) {
-        ctx.unparsed.push({ via: "script-string", source: body });
-        return;
-    }
-    walkScript(inner, withWrap(ctx, "eval"), {
-        background: frame.background,
-        stdinIsPipe: frame.stdinIsPipe,
-        redirects,
-    });
-}
-function emitCommand(ctx, argv0, suffix, frame, elevated) {
-    const { readings, overflow } = partition(suffix, ctx.valueFlagsFor?.(argv0, suffix) ?? ctx.valueFlags);
-    ctx.questions.push({
-        argv0,
-        readings,
-        ...(overflow ? { overflow: true } : {}),
-        wrapChain: ctx.wrapChain,
-        elevated: elevated || ctx.elevated,
-        envDelta: ctx.envDelta,
-        redirects: [
-            ...frame.redirects.flatMap(emitRedirect),
-            ...ctx.accessReads.map((target) => ({ operator: "<", target })),
-        ],
-        background: frame.background,
-        stdinIsPipe: frame.stdinIsPipe,
-    });
-}
-function emitRedirect(redirect) {
-    if (redirect.target === undefined)
-        return [];
-    return [{ operator: redirect.operator, target: redirect.target.value }];
-}
-const READING_CAP = 16; // open ruling 5 (policy-algebra.md); overflow cannot prove deny/allow
-/**
- * Tokenize argv into positionals + flag bag.
- * `closed`: only those names are flags; other dash tokens are positionals.
- * Used when a `"--"` field reopens the suffix — undeclared `-file` stays a path.
- */
-export function partition(words, valueFlags, closed) {
-    const readings = [];
-    let overflow = false;
-    const rec = (i, cut, tokens, flags) => {
-        if (overflow)
-            return;
-        if (i >= words.length) {
-            if (readings.length >= READING_CAP) {
-                overflow = true;
-                return;
-            }
-            readings.push({ tokens, flags });
-            return;
-        }
-        const word = words[i];
-        if (cut || word === "--" || !word.startsWith("-") || word === "-" || !isDeclaredFlag(word, closed)) {
-            rec(i + 1, cut || word === "--", [...tokens, word], flags);
-            return;
-        }
-        if (word.startsWith("--")) {
-            const eq = word.indexOf("=");
-            if (eq !== -1) {
-                rec(i + 1, cut, tokens, withFlag(flags, word.slice(0, eq), word.slice(eq + 1)));
-                return;
-            }
-            takeFlag(words, i, cut, tokens, flags, word, true, valueFlags, rec);
-            return;
-        }
-        const eq = word.indexOf("=");
-        if (eq >= 2) {
-            rec(i + 1, cut, tokens, withFlag(flags, word.slice(0, eq), word.slice(eq + 1)));
-            return;
-        }
-        if (/^-[a-z]+$/i.test(word) && word.length > 2) {
-            let nextFlags = flags;
-            for (const ch of word.slice(1))
-                nextFlags = withFlag(nextFlags, `-${ch}`, "");
-            rec(i + 1, cut, tokens, nextFlags);
-            return;
-        }
-        takeFlag(words, i, cut, tokens, flags, word, word.length === 2, valueFlags, rec);
-    };
-    rec(0, false, [], {});
-    return { readings, overflow };
-}
-function takeFlag(words, i, cut, tokens, flags, name, mayAttach, valueFlags, rec) {
-    const next = words[i + 1];
-    const canAttach = mayAttach && i + 1 < words.length && next !== "--" && !next.startsWith("-");
-    if (canAttach && valueFlags?.has(name) === true) {
-        rec(i + 2, cut, tokens, withFlag(flags, name, next));
-        return;
-    }
-    if (canAttach) {
-        rec(i + 2, cut, tokens, withFlag(flags, name, next));
-        rec(i + 1, cut, tokens, withFlag(flags, name, ""));
-        return;
-    }
-    rec(i + 1, cut, tokens, withFlag(flags, name, ""));
-}
-function isDeclaredFlag(word, closed) {
-    if (closed === undefined)
-        return true;
-    if (word.startsWith("--")) {
-        const eq = word.indexOf("=");
-        return closed.has(eq === -1 ? word : word.slice(0, eq));
-    }
-    const eq = word.indexOf("=");
-    if (eq >= 2)
-        return closed.has(word.slice(0, eq));
-    if (/^-[a-z]+$/i.test(word) && word.length > 2) {
-        for (const ch of word.slice(1)) {
-            if (!closed.has(`-${ch}`))
-                return false;
-        }
-        return true;
-    }
-    return closed.has(word);
-}
-function withFlag(flags, name, val) {
-    return { ...flags, [name]: [...(flags[name] ?? []), val] };
-}
-function scanPassthroughBoundary(args, flagArgs, skipVarAssignments) {
-    let i = 0;
-    while (i < args.length) {
-        const arg = args[i];
-        if (skipVarAssignments && isVarAssignment(arg)) {
-            i++;
-            continue;
-        }
-        if (arg === "--")
-            return i + 1;
-        if (!arg.startsWith("-"))
-            break;
-        i += flagSpan(arg, i, args, flagArgs);
-    }
-    return i;
-}
-function flagSpan(arg, i, args, flagArgs) {
-    if (arg.includes("="))
-        return 1;
-    if (arg.length > 2 && !arg.startsWith("--") && takesValue(arg.slice(0, 2), flagArgs))
-        return 1;
-    if (takesValue(arg, flagArgs) && i + 1 < args.length && !args[i + 1].startsWith("-")) {
-        return 2;
-    }
-    return 1;
-}
-/** Wrapper-owned file reads that peeling must not drop. `xargs -a FILE` reads FILE. */
-function wrapperFileReads(argv0, suffix) {
-    if (argv0 !== "xargs")
-        return [];
-    const reads = [];
-    for (let i = 0; i < suffix.length; i++) {
-        const arg = suffix[i];
-        if (arg === "--")
-            break;
-        if (arg === "-a" || arg === "--arg-file") {
-            const next = suffix[i + 1];
-            if (next !== undefined && next !== "--" && !next.startsWith("-")) {
-                reads.push(next);
-                i += 1;
-            }
-            continue;
-        }
-        if (arg.startsWith("--arg-file=") && arg.length > 11)
-            reads.push(arg.slice(11));
-        if (arg.startsWith("-a=") && arg.length > 3)
-            reads.push(arg.slice(3));
-    }
-    return reads;
-}
-function takesValue(flag, flagArgs) {
-    if (flagArgs === undefined)
-        return false;
-    const stripped = flag.replace(/^-+/, "");
-    return flagArgs.some((name) => name.replace(/^-+/, "") === stripped);
-}
-function scriptFlagBody(suffix, flag) {
-    for (let i = 0; i < suffix.length; i++) {
-        const arg = suffix[i];
-        if (arg === flag)
-            return suffix[i + 1];
-        if (arg.startsWith(`${flag}=`) && arg.length > flag.length + 1)
-            return arg.slice(flag.length + 1);
-    }
-    return undefined;
-}
-function hasScriptFlag(suffix) {
-    return suffix.some((arg) => arg === "-c" || arg === "-e" || arg.startsWith("-c=") || arg.startsWith("-e="));
-}
-function isVarAssignment(arg) {
-    return /^[a-z_]\w*=/i.test(arg);
-}
-function takeAssignment(prefix, envDelta) {
-    if (prefix.name === undefined)
-        return;
-    envDelta[prefix.name] = prefix.value?.value ?? "";
-}
-function takeEnvText(text, envDelta) {
-    const eq = text.indexOf("=");
-    if (eq <= 0)
-        return;
-    envDelta[text.slice(0, eq)] = text.slice(eq + 1);
-}
-function isLiteralWord(word) {
-    if (word.parts === undefined) {
-        return !PARTLESS_FORBIDDEN.test(word.text) && !word.text.startsWith("~");
-    }
-    return word.parts.every(partIsLiteral);
-}
-function partIsLiteral(part) {
-    switch (part.type) {
-        case "Literal":
-        case "SingleQuoted":
-            return true;
-        case "AnsiCQuoted":
-            return !part.value.includes("\0");
-        case "DoubleQuoted":
-            return part.parts.every((child) => child.type === "Literal");
-        default:
-            return false;
-    }
-}
-const PEEL_NAMES = new Set([
-    "sudo",
-    "doas",
-    "source",
-    ".",
-    "find",
-    "python",
-    "python3",
-    "node",
-    "eval",
-    "bash",
-    "sh",
-    "zsh",
-    "dash",
-    "ksh",
-    "env",
-    "xargs",
-    "timeout",
-    "nice",
-    "nohup",
-    "stdbuf",
-    "watch",
-    "time",
-    "command",
-    "exec",
-    "builtin",
-]);
-/** Named peeler is itself. Path-form peels only when `which` agrees. */
-function peelName(raw, which) {
-    return resolveKnown(raw, PEEL_NAMES, which);
-}
-/** `env -C` / `-S` / `-u` change context this matcher does not apply. Do not peel. */
-function envHasDashFlags(suffix) {
-    for (const arg of suffix) {
-        if (arg === "--")
-            return false;
-        if (isVarAssignment(arg))
-            continue;
-        if (arg.startsWith("-"))
-            return true;
-    }
-    return false;
-}
-function withWrap(ctx, name) {
-    return { ...ctx, wrapChain: [...ctx.wrapChain, name] };
-}
-function slice(ctx, node) {
-    return ctx.source.slice(node.pos, node.end);
-}
-function walkWord(word, ctx, frame) {
-    if (word === undefined)
-        return;
-    walkParts(word.parts, ctx, frame);
-}
-function walkAssignment(prefix, ctx, frame) {
-    walkWord(prefix.value, ctx, frame);
-    if (prefix.array !== undefined) {
-        for (const word of prefix.array)
-            walkWord(word, ctx, frame);
-    }
-    walkParts(prefix.indexParts, ctx, frame);
-}
-function walkRedirect(redirect, ctx, frame) {
-    walkWord(redirect.target, ctx, frame);
-    walkWord(redirect.body, ctx, frame);
-}
-function walkParts(parts, ctx, frame) {
-    if (parts === undefined)
-        return;
-    for (const part of parts) {
-        switch (part.type) {
-            case "DoubleQuoted":
-            case "LocaleString":
-                walkParts(part.parts, ctx, frame);
-                break;
-            case "CommandExpansion":
-            case "ProcessSubstitution":
-                if (part.script !== undefined) {
-                    walkScript(part.script, ctx, { background: false, stdinIsPipe: false, redirects: [] });
-                }
-                break;
-            case "ParameterExpansion":
-                walkWord(part.operand, ctx, frame);
-                walkParts(part.indexParts, ctx, frame);
-                if (part.slice !== undefined) {
-                    walkWord(part.slice.offset, ctx, frame);
-                    walkWord(part.slice.length, ctx, frame);
-                }
-                if (part.replace !== undefined) {
-                    walkWord(part.replace.pattern, ctx, frame);
-                    walkWord(part.replace.replacement, ctx, frame);
-                }
-                break;
-            case "ArithmeticExpansion":
-                walkArith(part.expression, ctx, frame);
-                break;
-            case "BraceExpansion":
-            case "ExtendedGlob":
-                walkParts(part.parts, ctx, frame);
-                break;
-            default:
-                break;
-        }
-    }
-}
-function walkArith(expr, ctx, frame) {
-    if (expr === undefined)
-        return;
-    switch (expr.type) {
-        case "ArithmeticBinary":
-            walkArith(expr.left, ctx, frame);
-            walkArith(expr.right, ctx, frame);
-            return;
-        case "ArithmeticUnary":
-            walkArith(expr.operand, ctx, frame);
-            return;
-        case "ArithmeticTernary":
-            walkArith(expr.test, ctx, frame);
-            walkArith(expr.consequent, ctx, frame);
-            walkArith(expr.alternate, ctx, frame);
-            return;
-        case "ArithmeticGroup":
-            walkArith(expr.expression, ctx, frame);
-            return;
-        case "ArithmeticWord":
-            walkParts(expr.parts, ctx, frame);
-            return;
-        case "ArithmeticCommandExpansion":
-            if (expr.script !== undefined) {
-                walkScript(expr.script, ctx, { background: false, stdinIsPipe: false, redirects: [] });
-            }
-            return;
-    }
-}
-function walkTestWords(expr, ctx, frame) {
-    switch (expr.type) {
-        case "TestUnary":
-            walkWord(expr.operand, ctx, frame);
-            return;
-        case "TestBinary":
-            walkWord(expr.left, ctx, frame);
-            walkWord(expr.right, ctx, frame);
-            return;
-        case "TestLogical":
-            walkTestWords(expr.left, ctx, frame);
-            walkTestWords(expr.right, ctx, frame);
-            return;
-        case "TestNot":
-            walkTestWords(expr.operand, ctx, frame);
-            return;
-        case "TestGroup":
-            walkTestWords(expr.expression, ctx, frame);
-            return;
-    }
-}
-//# sourceMappingURL=prep.js.map