@intutic/sync-daemon 2.1.0 → 2.3.0

package/dist/harness/protectedPaths.d.ts

@@ -82,8 +82,40 @@ export declare const UNIVERSAL_PROTECTED_PATHS: readonly string[];
  */
 /** `action` is the space-padded action-token string the gate classifies a
  *  shell command to (`" action:deploy "`, from `ACTION_NEEDLES`) — the subject
- *  a `review_before: action:deploy` hold rule matches. */
-export type GuardSubject = 'tool' | 'command' | 'target' | 'content' | 'action' | 'any';
+ *  a `review_before: action:deploy` hold rule matches.
+ *
+ *  `phrase` is not a regex at all: the source is phrases joined by `|`, each
+ *  matched as words in the raw command by the phrase matcher
+ *  (`@intutic/shared-types` phrases.ts), with a word boundary before the first
+ *  word and after the last. It is for rules whose words may be split by a
+ *  comment, an escape or a line continuation — a gap a regex can only express
+ *  by backtracking, which runs for seconds on crafted text in the JS and
+ *  Python gates. A gate that predates the subject reads the source as a regex
+ *  over the command and target, which still matches the plain spellings. */
+export type GuardSubject = 'tool' | 'command' | 'target' | 'content' | 'action' | 'phrase' | 'any';
+/**
+ * The length every adversarial case is built to: the largest command a gate
+ * evaluates before refusing it as too large (`COMMAND_SIZE_LIMIT`). Content
+ * cases are built to it too; content may be four times longer, and every
+ * content rule is linear, so the bound scales with it.
+ */
+export declare const ADVERSARIAL_LENGTH: number;
+/**
+ * A text of at most {@link ADVERSARIAL_LENGTH} characters: `prefix`, then
+ * `unit` repeated as many whole times as fit, then `suffix`. It is the call's `command` for a
+ * command, phrase or `any` rule, its `file_path` for a target rule, and its
+ * `content` for a content rule or one with an argPattern (beside a
+ * `file_path` the rule's target matches).
+ */
+export interface AdversarialCase {
+    /** What the text is shaped to make a backtracking engine do. */
+    name: string;
+    prefix?: string;
+    unit: string;
+    suffix?: string;
+    /** Whether the rule matches the text. */
+    held: boolean;
+}
 export interface GuardPattern {
     /** Stable id. Appears in the block message and the audit line, so it is the
      *  thing a support conversation is conducted in. Never renumber one. */
@@ -99,6 +131,23 @@ export interface GuardPattern {
     subject?: GuardSubject;
     /** Matched case-insensitively (`grep -iE` / the JS `i` flag). */
     ignoreCase?: boolean;
+    /**
+     * Evaluate {@link source} as a sequence, in linear time, in the gates whose
+     * regex engine backtracks (JavaScript and Python).
+     *
+     * The source stays an ordinary regex — `grep -E`, which matches with an
+     * automaton, and a gate older than gate body v13 run it as written — but it
+     * must have the shape `A .* B | C .* D …`: alternatives at the top level,
+     * each a chain of steps joined by `.*`. A backtracking engine ran
+     * ` git .*(…)` from every ` git ` in the text and scanned to the end from
+     * each: 200 KB of `git -- ` took 9.5 s in the JS gates. Read as a sequence,
+     * each step is searched once, from where the previous one ended, so the text
+     * is read once per step. That is the regex's own meaning whenever an
+     * earlier match of a step never ends later than a later one, which holds for
+     * every step here (a word between spaces, or a fixed string); see
+     * {@link sequenceAlternatives}.
+     */
+    sequence?: boolean;
     /**
      * What the rule does when it matches.
      *
@@ -129,6 +178,14 @@ export interface GuardPattern {
      *  cheapest way to write a guard that never fires wrongly is to never think
      *  about the case where it would. */
     notMatches: readonly string[];
+    /**
+     * Texts built to stall a backtracking engine, and whether the rule matches
+     * each. Every table rule carries at least one; `gate-rule-vectors.json`
+     * (packages/shared-types/fixtures) takes them to every reader, which must
+     * agree with `held` and decide each in time linear in its length. See
+     * {@link AdversarialCase} for where the text goes.
+     */
+    adversarial?: readonly AdversarialCase[];
     /**
      * Argument-level condition from a ` WHERE ` SOP rule, as JS `RegExp` source.
      *
@@ -177,23 +234,10 @@ export declare const NORMALISE_CONTRACT: {
      * property this contract claims, and the next edit would not have been so lucky.
      *
      * Python's `\s` on a `str` covers Unicode whitespace (U+00A0, U+3000), matching
-     * JS. The shell fallback cannot, which is why SHELL_EXTRACT pre-passes.
+     * JS, as does `SHELL_EXTRACT`'s `split()` for the bash gates.
      */
     /** Requires `re` in scope — the emitted filter imports it. */
     readonly pySource: string;
-    /**
-     * Shell: pure parameter expansion — no subshell, no `tr`, no `python3`.
-     *
-     * **ASCII only, and deliberately second in line.** Bash cannot express a
-     * Unicode whitespace class, so this collapses only the C0 set; U+00A0 would
-     * survive it and a pattern written with a literal space would then miss. The
-     * bash gates are not exposed to that because `SHELL_EXTRACT` runs every field
-     * through Python's `" ".join(str(v).split())` *before* this ever sees it —
-     * which is Unicode-aware. This is the belt to that pair of braces, and saying
-     * so here is the point: an earlier version of this comment claimed the three
-     * normalisers were provably identical, and they were not.
-     */
-    readonly shell: string;
 };
 /**
  * Rejects any pattern that would not mean the same thing to `grep -E` and to
@@ -209,6 +253,28 @@ export declare const NORMALISE_CONTRACT: {
  * running us in an Alpine image would get a gate that silently matches nothing.
  */
 export declare function assertPortableEre(source: string, id: string): void;
+/**
+ * Refuses a rule a backtracking engine could run in super-linear time — the
+ * JavaScript and Python gates both backtrack, and a slow gate under a harness
+ * that allows on timeout is no gate. A `sequence` rule is checked step by
+ * step, the way those gates run it; a `phrase` rule is not a regex. Anything
+ * reported must be on BACKTRACKING_ALLOWLIST (regexLinearity.ts) by id.
+ */
+export declare function assertLinearRule(p: GuardPattern): void;
+/**
+ * A rule's flags column in a `.rules` line and the gates' tables: `i` for
+ * case-insensitive, `s` for a sequence rule, `-` for neither. A gate older
+ * than gate body v13 compares the column with `i`, so it runs a sequence rule
+ * as the plain regex it also is.
+ */
+export declare function ruleFlags(p: Pick<GuardPattern, 'ignoreCase' | 'sequence'>): string;
+/**
+ * Whether a rule fires on `text` the way every gate evaluates it: a `phrase`
+ * rule through the phrase matcher on the raw text, any other as a regex over
+ * the normalised text. For fixtures and tests; the gates carry their own copy
+ * of each half.
+ */
+export declare function guardMatches(p: GuardPattern, text: string): boolean;
 /**
  * Commands that disarm governance itself.
  *
@@ -217,6 +283,22 @@ export declare function assertPortableEre(source: string, id: string): void;
  * all, and every list guarded only its own harness's env kill-switch.
  */
 export declare const GOVERNANCE_BYPASS_PATTERNS: readonly GuardPattern[];
+/**
+ * The VS Code settings that can switch off the GitHub Copilot gate.
+ *
+ * VS Code loads hook files from `.github/hooks` (workspace) and
+ * `~/.copilot/hooks` (user) by default, so the Copilot gate needs no setting
+ * of its own, and no VS Code policy locks the setting that can drop one of
+ * those locations. Two keys are what an agent would reach for: `chat.useHooks`
+ * set to false turns every hook off, and `chat.hookFilesLocations` mapping a
+ * location to false drops it. Both are read from user, workspace, profile and
+ * `.code-workspace` settings, and no other file has reason to set them, so an
+ * edit that sets either key is refused whatever file it writes, and a shell
+ * command that names either key is refused too. The settings guard restores
+ * the keys if a change reaches the file another way (`settingsGuard.ts`), and
+ * the `ChatHooks` policy is the administrator's hard lock.
+ */
+export declare const HOOK_SETTING_PATTERNS: readonly GuardPattern[];
 /**
  * Credential VALUES in the content an agent is about to write.
  *
@@ -263,7 +345,7 @@ export declare const SECRET_CONTENT_PATTERNS: readonly GuardPattern[];
  * Writes and edits targeting the agent-skill surface — `.agents/skills/**`
  * and `.claude/skills/**`.
  *
- * TD-358 (updated 2026-08-18): these two entries stay `warn` and stay
+ * Updated 2026-08-18: these two entries stay `warn` and stay
  * compiled into {@link staticFloorPatterns} — that part of the original
  * decision is unchanged. What changed is what that tier assignment now
  * *means*: it is the DEGRADED-MODE baseline, not the intended steady state.
@@ -305,8 +387,8 @@ export declare const SECRET_CONTENT_PATTERNS: readonly GuardPattern[];
  * rule on purpose, since that rule blocks and this one only advises.
  *
  * Blocking on skill CONTENT (not path) is a separate table,
- * {@link SKILL_CONTENT_PATTERNS}, licensed by the benign-corpus measurement
- * TD-358 asked for and shipped only through the policy snapshot.
+ * {@link SKILL_CONTENT_PATTERNS}, licensed by a benign-corpus false-positive
+ * measurement and shipped only through the policy snapshot.
  */
 export declare const SKILL_SURFACE_PATTERNS: readonly GuardPattern[];
 /**
@@ -331,7 +413,7 @@ export declare const SKILL_SURFACE_PATTERNS: readonly GuardPattern[];
  */
 export declare function caseFoldedArgSource(source: string): string;
 /**
- * Skill-CONTENT block tier (TD-358): a write into a skill directory whose
+ * Skill-CONTENT block tier: a write into a skill directory whose
  * written text matches one of the `skillScan.ts` patterns measured at zero
  * false positives on the benign-skill corpus (`SKILL_CONTENT_BLOCK_PATTERN_IDS`;
  * `packages/shared-types/src/__tests__/corpus/skills/`, 350 real skills).
@@ -344,7 +426,7 @@ export declare function caseFoldedArgSource(source: string): string;
  * pattern inside the value of a {@link WRITTEN_CONTENT_KEYS} key of the
  * serialized tool input.
  *
- * **Snapshot-only, never in `staticFloorPatterns()`**, as TD-358 required: a
+ * **Snapshot-only, never in `staticFloorPatterns()`**, by design: a
  * content judgement ships where one sync cycle retracts it
  * (`SKILL_CONTENT_TIER_SEVERITY` in `lib/policySnapshot.ts`). The table's own
  * `warn` is a placeholder the snapshot builder always overrides.
@@ -373,9 +455,9 @@ export declare const SKILL_CONTENT_PATTERNS: readonly GuardPattern[];
 /**
  * Commands that destroy the machine or its data irrecoverably.
  *
- * TD-309: none of these were blocked by any harness. They are shipped through
- * the policy snapshot rather than compiled into the gate, and at `warn` before
- * `block` — see the note on `severity` below.
+ * None of these were blocked by any harness before this table. They are
+ * shipped through the policy snapshot rather than compiled into the gate, and
+ * at `warn` before `block` — see the note on `severity` below.
  *
  * ## What is deliberately allowed
  *
@@ -401,7 +483,7 @@ export declare function protectedPathShellPatterns(): readonly GuardPattern[];
  *  without a release. `SKILL_SURFACE_PATTERNS` IS here, deliberately, despite
  *  also being new: unlike the destructive tier it is a deterministic path
  *  match with no content judgement to get wrong, so there is no measurement
- *  risk to hold it back from — see its own doc comment. As of TD-358's
+ *  risk to hold it back from — see its own doc comment. As of the skill-surface
  *  block-tier promotion these two entries are the DEGRADED-MODE baseline
  *  only: the steady state is `block`, delivered through the policy snapshot
  *  (`SKILL_SURFACE_TIER_SEVERITY` in `lib/policySnapshot.ts`) and additive on

package/dist/harness/protectedPaths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protectedPaths.d.ts","sourceRoot":"","sources":["../../src/harness/protectedPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAIH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAuEtD,CAAA;AAMD;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH;;0DAE0D;AAC1D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEvF,MAAM,WAAW,YAAY;IAC3B;4EACwE;IACxE,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd;;;;;6BAKyB;IACzB,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC9C;wDACoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd;;2BAEuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,gCAAgC;IAChC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;;;yCAGqC;IACrC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAoCD,eAAO,MAAM,kBAAkB;IAC7B;;;;;;OAMG;iBACqD,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM;IAE9E,oEAAoE;;IAGpE;;;;;;;;;;;;;OAaG;IACH,8DAA8D;;IAM9D;;;;;;;;;;;OAWG;;CASK,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CA2BlE;AA0CD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,YAAY,EAyD5D,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EAyG1D,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,YAAY,EA+CxD,CAAA;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgC1D;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,YAAY,EAsBzD,CAAA;AAiCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,YAAY,EAoJ/D,CAAA;AA2CD,wBAAgB,0BAA0B,IAAI,SAAS,YAAY,EAAE,CAEpE;AAED;;;;;;;;;;kBAUkB;AAClB,wBAAgB,mBAAmB,IAAI,SAAS,YAAY,EAAE,CAO7D"}
+{"version":3,"file":"protectedPaths.d.ts","sourceRoot":"","sources":["../../src/harness/protectedPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAeH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAoHtD,CAAA;AAMD;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH;;;;;;;;;;;4EAW4E;AAC5E,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAA;AAElG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAqB,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yCAAyC;IACzC,IAAI,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B;4EACwE;IACxE,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd;;;;;6BAKyB;IACzB,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC9C;wDACoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd;;2BAEuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,gCAAgC;IAChC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;;;yCAGqC;IACrC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACxC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAsCD,eAAO,MAAM,kBAAkB;IAC7B;;;;;;OAMG;iBACqD,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM;IAE9E,oEAAoE;;IAGpE;;;;;;;;;;;;;OAaG;IACH,8DAA8D;;CAKtD,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CA4BlE;AA2CD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAsBtD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,UAAU,CAAC,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOnE;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,YAAY,EA6E5D,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,YAAY,EAqDvD,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EAgH1D,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,YAAY,EAuDxD,CAAA;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgC1D;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,YAAY,EA+BzD,CAAA;AAiCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,YAAY,EA6O/D,CAAA;AA+CD,wBAAgB,0BAA0B,IAAI,SAAS,YAAY,EAAE,CAEpE;AAED;;;;;;;;;;kBAUkB;AAClB,wBAAgB,mBAAmB,IAAI,SAAS,YAAY,EAAE,CAQ7D"}