@inhuman.tools/policy 0.0.0-stage → 0.1.0

package/dist/peel-cwd.js

@@ -0,0 +1,120 @@
+/**
+ * Peel a leading cwd-only `cd` off a shell command into the `cwd` arg.
+ * Unbash AST, not regex. Quoted `;` is not a splitter. Remainder stays
+ * one `/bin/sh -c` — this is not execute-split.
+ *
+ * Peel only the first top-level list element (`&&` or `;` / newline).
+ * `||`, pipes, subshells, brace groups, `cd` that is not first, and
+ * `cd` with flags/extra operands stay on the command string.
+ */
+import { parse } from "unbash";
+const PARTLESS_FORBIDDEN = /[*?[\\$`]/;
+export function peelLeadingCd(source) {
+    const script = parse(source);
+    if (script.errors !== undefined && script.errors.length > 0)
+        return null;
+    const statements = script.commands;
+    if (statements.length === 0)
+        return null;
+    const first = statements[0];
+    if (first === undefined || first.background === true || first.redirects.length > 0)
+        return null;
+    const node = first.command;
+    const simple = asSimpleCommand(node);
+    if (simple !== null) {
+        const cwd = cwdOnlyPath(simple);
+        if (cwd === null)
+            return null;
+        if (statements.length === 1)
+            return { cwd, command: "" };
+        return { cwd, command: source.slice(statements[1].pos).trim() };
+    }
+    if (node.type !== "AndOr" || node.operators[0] !== "&&")
+        return null;
+    const head = asSimpleCommand(node.commands[0]);
+    if (head === null)
+        return null;
+    const cwd = cwdOnlyPath(head);
+    if (cwd === null)
+        return null;
+    const rest = node.commands[1];
+    if (rest === undefined)
+        return { cwd, command: "" };
+    return { cwd, command: source.slice(rest.pos).trim() };
+}
+/** Keep an explicit `cwd` arg when it names the same leaf; never override a disagreement. */
+export function peelShellCwd(command, cwdArg) {
+    const peeled = peelLeadingCd(command);
+    if (peeled === null)
+        return null;
+    if (cwdArg !== undefined && cwdArg !== "" && normalizeCwdToken(cwdArg) !== normalizeCwdToken(peeled.cwd)) {
+        return null;
+    }
+    return {
+        cwd: cwdArg !== undefined && cwdArg !== "" ? cwdArg : peeled.cwd,
+        command: peeled.command,
+    };
+}
+function normalizeCwdToken(raw) {
+    let token = raw.replaceAll("\\", "/").replace(/\/+$/, "");
+    if (token.startsWith("./"))
+        token = token.slice(2);
+    return token === "" ? "." : token;
+}
+function asSimpleCommand(node) {
+    if (node === undefined)
+        return null;
+    if (node.type === "Command")
+        return node;
+    if (node.type !== "Pipeline")
+        return null;
+    if (node.commands.length !== 1 || (node.operators?.length ?? 0) > 0)
+        return null;
+    if (node.negated === true || node.time === true)
+        return null;
+    return asSimpleCommand(node.commands[0]);
+}
+function cwdOnlyPath(command) {
+    if (command.prefix.length > 0 || command.redirects.length > 0)
+        return null;
+    if (command.name === undefined || !isLiteralWord(command.name))
+        return null;
+    let argv0 = command.name.value;
+    let suffix = command.suffix;
+    if (argv0 === "builtin" || argv0 === "command") {
+        const inner = suffix[0];
+        if (inner === undefined || !isLiteralWord(inner) || inner.value !== "cd")
+            return null;
+        argv0 = "cd";
+        suffix = suffix.slice(1);
+    }
+    if (argv0 !== "cd" || suffix.length !== 1)
+        return null;
+    const dest = suffix[0];
+    if (dest === undefined || !isLiteralWord(dest))
+        return null;
+    const value = dest.value;
+    if (value === "" || value === "-" || value === "--" || value.startsWith("-"))
+        return null;
+    return value;
+}
+function isLiteralWord(word) {
+    if (word.parts === undefined) {
+        return !PARTLESS_FORBIDDEN.test(word.text) && !word.text.startsWith("~");
+    }
+    return word.parts.every(partIsLiteral);
+}
+function partIsLiteral(part) {
+    switch (part.type) {
+        case "Literal":
+        case "SingleQuoted":
+            return true;
+        case "AnsiCQuoted":
+            return !part.value.includes("\0");
+        case "DoubleQuoted":
+            return part.parts.every((child) => child.type === "Literal");
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=peel-cwd.js.map

package/dist/peel-cwd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peel-cwd.js","sourceRoot":"","sources":["../src/peel-cwd.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAqD,MAAM,QAAQ,CAAC;AAOlF,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;IAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAe;IAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;QAChE,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACtF,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC/D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/prep.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Question prep: unbash AST → prepared questions + unparsed acts.
+ * Hermetic — no PATH, no process.env, no execution. Word.parts is a lazy
+ * getter; this file always reads it. Nested parse errors live on the nested
+ * script, not the root.
+ *
+ * Partition builds I: a known value-flag attaches; an unknown flag followed
+ * by a non-dash, non-`--` token forks attached and boolean readings.
+ * `valueFlagsFor(argv0, suffix)` sees the leading positional spine — not
+ * every descendant under argv0. `=value` and glued shorts stay one reading.
+ * `--` never attaches as a value. Cap 16 is open ruling 5; overflow is ⊤I.
+ * A nameless command still emits its redirects. `xargs -a FILE` is a read
+ * of FILE as well as the inner command.
+ */
+import { type ParseError } from "unbash";
+import { type Which } from "./identity.js";
+import type { Question, Reading } from "./types.js";
+export type UnparsedVia = "parse-error" | "control-flow" | "function" | "source" | "test" | "arithmetic" | "coproc" | "find-expression" | "non-literal-argv0" | "script-string";
+export type UnparsedAct = {
+    readonly via: UnparsedVia;
+    readonly source: string;
+};
+export type RedirectEmit = {
+    readonly operator: string;
+    readonly target: string;
+};
+export type PreparedQuestion = Question & {
+    readonly wrapChain: readonly string[];
+    readonly elevated: boolean;
+    readonly envDelta: Readonly<Record<string, string>>;
+    readonly redirects: readonly RedirectEmit[];
+    readonly background: boolean;
+    readonly stdinIsPipe: boolean;
+};
+export type PrepResult = {
+    readonly questions: readonly PreparedQuestion[];
+    readonly unparsed: readonly UnparsedAct[];
+    readonly errors: readonly ParseError[];
+    /** File effects from commands that have no argv0 (`> .env`). */
+    readonly redirects: readonly RedirectEmit[];
+};
+export type PrepOpts = {
+    readonly valueFlags?: ReadonlySet<string>;
+    readonly valueFlagsFor?: (argv0: string, suffix: readonly string[]) => ReadonlySet<string> | undefined;
+    /** Path-form peelers are transparent only when this agrees. */
+    readonly which?: Which;
+};
+export declare function prep(source: string, opts?: PrepOpts): PrepResult;
+/**
+ * Tokenize argv into positionals + flag bag.
+ * `closed`: only those names are flags; other dash tokens are positionals.
+ * Used when a `"--"` field reopens the suffix — undeclared `-file` stays a path.
+ */
+export declare function partition(words: readonly string[], valueFlags: ReadonlySet<string> | undefined, closed?: ReadonlySet<string>): {
+    readings: Reading[];
+    overflow: boolean;
+};
+//# sourceMappingURL=prep.d.ts.map

package/dist/prep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prep.d.ts","sourceRoot":"","sources":["../src/prep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAML,KAAK,UAAU,EAOhB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,cAAc,GACd,UAAU,GACV,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,iBAAiB,GACjB,mBAAmB,GACnB,eAAe,CAAC;AAEpB,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;CAC7C,CAAC;AAoBF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACvG,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,UAAU,CAqBhE;AAsUD;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,EAC3C,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CA+C5C"}