@koda-sl/baker-bridge 0.109.0-dev.9779e8b49 → 0.109.0-dev.d6e55699d

package/dist/review/shell-policy.js

@@ -16,6 +16,7 @@
  * top of it: the shell is the one surface where "everything except what I
  * thought of" is not a defensible default.
  */
+import { parse } from "unbash";
 /** Binaries the reviewer may invoke. Every one of them reads. */
 const ALLOWED_BINARIES = new Set([
     "cat",
@@ -60,109 +61,276 @@ const ALLOWED_GIT_VERBS = new Set([
     "reflog",
 ]);
 /**
- * Shell constructs that write, escape the allowlist, or reach the network —
- * checked against the whole command string rather than any one binary, because
- * a redirect or a `xargs` turns an allowed binary into an arbitrary one.
+ * Binaries worth naming when refused. The allowlist already refuses every one
+ * of them; the reason tells the reviewer what the command would have done, so
+ * it reports the refusal instead of trying a neighbour. Matched on the command
+ * that runs, never on a word anywhere in the line — a path such as
+ * `docs/tools/agent-browser.md` is something to read, not a browser.
  */
-const DENIED_PATTERNS = [
-    [/(^|[^0-9<>])>{1,2}[^&]/, "writes to a file"],
-    [/\btee\b/, "writes to a file"],
-    // `find` is on the allowlist because it reads, and these are a second command
-    // hidden inside the first: `-delete` removes, `-exec`/`-execdir`/`-ok` run
-    // anything at all, and `-fprintf`/`-fls`/`-fprint` write a file without a
-    // redirect for the rule above to see.
-    [/\s-(delete|exec|execdir|ok|okdir|fprintf|fprint|fls)\b/, "turns a read into a write"],
-    [/\bxargs\b/, "runs whatever it is piped"],
-    [/\bsudo\b/, "escalates"],
-    [/\b(rm|mv|cp|mkdir|touch|chmod|chown|ln|truncate|dd)\b/, "changes the workspace"],
-    [/\b(npm|pnpm|npx|yarn|node|tsx|bun|deno|python3?|bash|sh|zsh)\b/, "runs arbitrary code"],
-    [/\b(curl|wget|nc|ssh|scp|rsync)\b/, "reaches the network"],
-    [/\bnohup\b/, "outlives the turn"],
-    [/\bagent-browser\b/, "drives a browser"],
-    [/&\s*$/, "backgrounds the command"],
-    [/\$\(/, "substitutes a command the policy never saw"],
-    [/`/, "substitutes a command the policy never saw"],
-];
-/** `sed`/`awk` in place is an edit wearing a reader's name. */
-const IN_PLACE_EDIT = /\bsed\b[^|;]*\s-[a-zA-Z]*i\b|\bsed\b[^|;]*--in-place/;
+const DENIED_BINARIES = new Map([
+    ["tee", "writes to a file"],
+    ["xargs", "runs whatever it is piped"],
+    ["sudo", "escalates"],
+    ...["rm", "mv", "cp", "mkdir", "touch", "chmod", "chown", "ln", "truncate", "dd"].map((name) => [name, "changes the workspace"]),
+    ...["npm", "pnpm", "npx", "yarn", "node", "tsx", "bun", "deno", "python", "python3", "bash", "sh", "zsh"].map((name) => [name, "runs arbitrary code"]),
+    ...["curl", "wget", "nc", "ssh", "scp", "rsync"].map((name) => [name, "reaches the network"]),
+    ["nohup", "outlives the turn"],
+    ["agent-browser", "drives a browser"],
+]);
 /**
- * Every way one Bash call becomes a second command.
+ * Arguments that turn an allowed reader into a writer or a runner, checked per
+ * binary on the dequoted word so a quote cannot hide one and another command's
+ * pattern cannot trip one.
+ *
+ * `find` reads, and its action flags are a second command inside the first:
+ * `-delete` removes, `-exec`/`-execdir`/`-ok` run anything at all, and
+ * `-fprintf`/`-fls`/`-fprint` write a file without a redirect to see.
+ *
+ * awk and sed take a program rather than data, so their operands are read as
+ * code: awk runs a command with `system()` or a `|` and writes with `>`; sed
+ * writes with `w`/`W` (a command or an `s///` flag) and runs one with `e`.
+ * awk's own `||` and `>=` pass; the odd false refusal that is left is the
+ * right side to be wrong on. Their flags edit in place (`sed -i`, gawk's
+ * `-i inplace`), load code (`-l`), or read the program from a file (`-f`),
+ * where none of this can see it — and the workspace under review is the one
+ * whose agent could have written that file.
  *
- * A newline is in here because an agent writes a short script as readily as a
- * one-liner, and without it only the first line was ever checked — the whole
- * policy read `git log\ngit push` as a `git log`. A lone `&` is in here for the
- * same reason: the denial below catches a trailing one, which backgrounds, but
- * `ls & git push` backgrounds the *first* command and runs the second in front.
- * Its lookarounds spare `2>&1` and `&>`, where the `&` is part of a redirect
- * rather than a separator, and `&&` is consumed by the earlier alternative.
+ * `sort -o` and `git --output` write a file with no redirect in sight.
  */
-const COMMAND_SEPARATOR = /\|\||&&|[|;\n\r]|(?<![>&])&(?![>&])/;
-function splitPipeline(command) {
-    // Split on the operators that start a new command. Good enough precisely
-    // because every resulting segment is checked against the allowlist: a split
-    // that misses a boundary leaves a longer segment whose leading binary is still
-    // checked, and one that splits too eagerly only checks more.
-    return command
-        .split(COMMAND_SEPARATOR)
-        .map((part) => part.trim())
-        .filter((part) => part.length > 0);
-}
-function leadingBinary(segment) {
-    // Strip leading `VAR=value` assignments, which are not the command.
-    const tokens = segment.split(/\s+/).filter((token) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(token));
-    const first = tokens[0];
-    return first?.replace(/^.*\//, "");
+const ARGUMENT_RULES = new Map([
+    ["find", [{ flag: /^-(delete|exec|execdir|ok|okdir|fprintf|fprint0?|fls)$/, reason: "turns a read into a write" }]],
+    [
+        "sed",
+        [
+            { flag: /^-[^-]*i|^--in-place/, reason: "edits the file in place" },
+            { flag: /^-[^-]*f|^--file/, reason: "runs a program this review cannot read" },
+            { program: /(^|[\s;{}!\d$/=-])[gpiImM\d]*[wWe](\s|$|[;}])/, reason: "writes a file or runs a command" },
+        ],
+    ],
+    [
+        "awk",
+        [
+            { flag: /^-(i|l|-include|-load)/, reason: "loads code into the program" },
+            { flag: /^-(f|E|-file|-exec)/, reason: "runs a program this review cannot read" },
+            { program: /\bsystem\s*\(|(?<!\|)\|(?!\|)|>(?!=)|@load\b/, reason: "writes a file or runs a command" },
+        ],
+    ],
+    ["sort", [{ flag: /^-[^-]*o|^--output/, reason: "writes a file" }]],
+    ["git", [{ flag: /^--output(=|$)/, reason: "writes a file" }]],
+]);
+/**
+ * Options whose value is data, never the program: awk's field separator and
+ * variables. Read as code, `awk -F'|'` — the ordinary way to split a markdown
+ * table — was refused for its "pipe".
+ */
+const DATA_OPTIONS = new Map([["awk", /^(-[Fv]|--field-separator|--assign)/]]);
+/**
+ * The words a program rule reads: every operand except an option, and except
+ * the value an option carries as data, attached (`-F'|'`) or separate
+ * (`-F '|'`). Options that carry the program itself (`sed -e`) stay in.
+ */
+function programWords(binary, words) {
+    const data = DATA_OPTIONS.get(binary);
+    const out = [];
+    for (let index = 0; index < words.length; index += 1) {
+        const value = words[index]?.value ?? "";
+        if (data?.test(value)) {
+            // A bare `-F` / `-v` takes the next word as its value.
+            if (/^-[Fv]$|^--(field-separator|assign)$/.test(value)) {
+                index += 1;
+            }
+            continue;
+        }
+        if (!BARE_OPTION.test(value)) {
+            out.push(value);
+        }
+    }
+    return out;
 }
+/** A bare option such as `-n` or `--quiet`, which carries no program text. */
+const BARE_OPTION = /^-{1,2}[A-Za-z-]+$/;
 /**
- * Decide one `Bash` call.
+ * The only `VAR=value` prefixes a reader may carry: locale, time zone, colour
+ * and width, which change how output looks and nothing else. Any other name is
+ * a lever — `git diff` runs `GIT_EXTERNAL_DIFF`, a pager variable names a
+ * program — and a value is a second command wearing an assignment's name.
+ */
+const ALLOWED_ENVIRONMENT = /^(LC_[A-Z]+|LANG|LANGUAGE|TZ|NO_COLOR|COLUMNS)$/;
+const READ_ONLY = "this review is read-only and";
+const UNREADABLE = "could not tell what that command runs";
+/**
+ * Every simple command one Bash call runs, read the way the shell reads it.
  *
- * Returns the reason on a refusal so the bridge can tell the reviewer what it
- * tried and why, rather than a bare deny it will try to work around.
+ * A real parser rather than a split on `|`, `;` and newlines, because a split
+ * cannot tell an operator from the same character inside quotes: it read jq's
+ * own `|` and grep's `\|` alternation as pipes and refused the brief's own
+ * transcript projection. What the parser cannot read is refused rather than
+ * guessed at, and so is any shape other than commands joined by pipes, `&&`,
+ * `||`, `;` and newlines — a loop or a group is a second grammar to police.
  */
-/** The whole-string checks: constructs that write, escape, or reach the network. */
-function refuseDeniedConstruct(command) {
-    for (const [pattern, reason] of DENIED_PATTERNS) {
-        if (pattern.test(command)) {
-            return { allowed: false, reason: `this review is read-only and that command ${reason}` };
+function readScript(command) {
+    const script = parse(command);
+    if (script.errors && script.errors.length > 0) {
+        return { refused: UNREADABLE };
+    }
+    if (substitutesACommand(script)) {
+        return { refused: `${READ_ONLY} that command substitutes a command the policy never saw` };
+    }
+    const commands = [];
+    const redirects = [];
+    const pending = [...script.commands];
+    for (let node = pending.shift(); node; node = pending.shift()) {
+        switch (node.type) {
+            case "Statement":
+                if (node.background) {
+                    return { refused: `${READ_ONLY} that command backgrounds the command` };
+                }
+                pending.push(node.command);
+                redirects.push(...node.redirects);
+                break;
+            case "Pipeline":
+            case "AndOr":
+                pending.push(...node.commands);
+                break;
+            case "Command":
+                commands.push(node);
+                redirects.push(...node.redirects);
+                break;
+            default:
+                return { refused: UNREADABLE };
         }
     }
-    if (IN_PLACE_EDIT.test(command)) {
-        return { allowed: false, reason: "this review is read-only and an in-place sed edits the file" };
+    return { commands, redirects };
+}
+/** The parse nodes that run a nested script: `$(…)`, backticks, `<(…)`, `>(…)`. */
+const SUBSTITUTIONS = new Set(["CommandExpansion", "ProcessSubstitution", "ArithmeticCommandExpansion"]);
+/**
+ * Whether anything in the parse runs a command the policy never saw. Searched
+ * over the serialised tree because unbash computes word parts lazily and only
+ * `toJSON` materialises all of them — a walk over own keys finds no expansion
+ * at all, and says nothing while missing it. A substitution hides anywhere a
+ * word does: an argument, a heredoc body, a `${x:-…}` default, an array index.
+ */
+function substitutesACommand(script) {
+    let found = false;
+    JSON.stringify(script, (key, value) => {
+        if (key === "type" && typeof value === "string" && SUBSTITUTIONS.has(value)) {
+            found = true;
+        }
+        return value;
+    });
+    return found;
+}
+/**
+ * A redirect that only reads or discards. Input (`<`, heredocs) reads; `2>&1`
+ * duplicates a descriptor; `/dev/null` is the one file an output may name, so
+ * `2>/dev/null` keeps its place in a grep. Anything else — `>`, `>>`, `&>`,
+ * `>&file`, `<>` — opens a file for writing.
+ */
+function redirectReads(redirect) {
+    const target = redirect.target?.value;
+    switch (redirect.operator) {
+        case "<":
+        case "<<":
+        case "<<-":
+        case "<<<":
+            return true;
+        case ">&":
+        case "<&":
+            return target !== undefined && /^(\d+|-)$/.test(target);
+        case ">":
+        case ">>":
+        case ">|":
+        case "&>":
+        case "&>>":
+            return target === "/dev/null";
+        default:
+            return false;
+    }
+}
+function binaryOf(command) {
+    // The dequoted word, so `'rm'` or `$'\x72m'` is read as the `rm` it runs.
+    return command.name?.value.replace(/^.*\//, "") || undefined;
+}
+/** The per-binary argument rules: find's actions, awk's and sed's programs. */
+function refuseArguments(binary, command) {
+    const program = programWords(binary, command.suffix);
+    for (const rule of ARGUMENT_RULES.get(binary) ?? []) {
+        const hit = "flag" in rule
+            ? command.suffix.some(({ value }) => rule.flag.test(value))
+            : program.some((value) => rule.program.test(value));
+        if (hit) {
+            return { allowed: false, reason: `${READ_ONLY} that ${binary} ${rule.reason}` };
+        }
     }
     return undefined;
 }
-/** One segment of a pipeline: is the thing it runs one of the readers? */
-function refuseSegment(segment) {
-    const binary = leadingBinary(segment);
+/**
+ * The subcommand `git` will run. `-C <dir>` only says where, so it is skipped
+ * and the verb after it decides — `git -C repo log` reads, `git -C repo push`
+ * does not. Every other option before the verb is returned as the verb and so
+ * refused: `-c` sets config and `--exec-path` moves where git finds its own
+ * programs, and either can make a read run something else.
+ */
+function gitVerb(args) {
+    let index = 0;
+    while (args[index]?.value === "-C") {
+        index += 2;
+    }
+    return args[index]?.value;
+}
+/** One simple command: is the thing it runs one of the readers? */
+function refuseCommand(command) {
+    const binary = binaryOf(command);
     if (!binary) {
-        return { allowed: false, reason: "could not tell what that command runs" };
+        return { allowed: false, reason: UNREADABLE };
+    }
+    const assignment = command.prefix.find((prefix) => !prefix.name || !ALLOWED_ENVIRONMENT.test(prefix.name));
+    if (assignment) {
+        return {
+            allowed: false,
+            reason: `${READ_ONLY} \`${assignment.name ?? assignment.text}\` can hand a reader a program to run`,
+        };
+    }
+    const denied = DENIED_BINARIES.get(binary);
+    if (denied) {
+        return { allowed: false, reason: `${READ_ONLY} that command ${denied}` };
     }
     if (!ALLOWED_BINARIES.has(binary)) {
-        return { allowed: false, reason: `this review is read-only and \`${binary}\` is not one of the read commands` };
+        return { allowed: false, reason: `${READ_ONLY} \`${binary}\` is not one of the read commands` };
     }
     if (binary !== "git") {
-        return undefined;
+        return refuseArguments(binary, command);
     }
-    const verb = segment.split(/\s+/).filter((token) => token.length > 0)[1];
+    const verb = gitVerb(command.suffix);
     if (!verb || !ALLOWED_GIT_VERBS.has(verb)) {
         return {
             allowed: false,
-            reason: `this review is read-only and \`git ${verb ?? ""}\` is not one of the read subcommands`,
+            reason: `${READ_ONLY} \`git ${verb ?? ""}\` is not one of the read subcommands`,
         };
     }
-    return undefined;
+    return refuseArguments(binary, command);
 }
+/**
+ * Decide one `Bash` call.
+ *
+ * Returns the reason on a refusal so the bridge can tell the reviewer what it
+ * tried and why, rather than a bare deny it will try to work around.
+ */
 export function reviewBashPolicy(command) {
     const trimmed = command.trim();
     if (trimmed.length === 0) {
         return { allowed: false, reason: "empty command" };
     }
-    const construct = refuseDeniedConstruct(trimmed);
-    if (construct) {
-        return construct;
+    const script = readScript(trimmed);
+    if ("refused" in script) {
+        return { allowed: false, reason: script.refused };
+    }
+    if (!script.redirects.every(redirectReads)) {
+        return { allowed: false, reason: `${READ_ONLY} that command writes to a file` };
     }
-    for (const segment of splitPipeline(trimmed)) {
-        const refusal = refuseSegment(segment);
+    for (const simple of script.commands) {
+        const refusal = refuseCommand(simple);
         if (refusal) {
             return refusal;
         }

package/dist/review/shell-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-policy.js","sourceRoot":"","sources":["../../src/review/shell-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,UAAU;IACV,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,UAAU;IACV,4EAA4E;IAC5E,8CAA8C;IAC9C,cAAc;IACd,QAAQ;CACT,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,eAAe,GAA6C;IAChE,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;IAC9C,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAC/B,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,sCAAsC;IACtC,CAAC,wDAAwD,EAAE,2BAA2B,CAAC;IACvF,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAC1C,CAAC,UAAU,EAAE,WAAW,CAAC;IACzB,CAAC,uDAAuD,EAAE,uBAAuB,CAAC;IAClF,CAAC,gEAAgE,EAAE,qBAAqB,CAAC;IACzF,CAAC,kCAAkC,EAAE,qBAAqB,CAAC;IAC3D,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAClC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;IACzC,CAAC,OAAO,EAAE,yBAAyB,CAAC;IACpC,CAAC,MAAM,EAAE,4CAA4C,CAAC;IACtD,CAAC,GAAG,EAAE,4CAA4C,CAAC;CACpD,CAAC;AAEF,+DAA+D;AAC/D,MAAM,aAAa,GAAG,sDAAsD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAEhE,SAAS,aAAa,CAAC,OAAe;IACpC,yEAAyE;IACzE,4EAA4E;IAC5E,+EAA+E;IAC/E,6DAA6D;IAC7D,OAAO,OAAO;SACX,KAAK,CAAC,iBAAiB,CAAC;SACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,oEAAoE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,oFAAoF;AACpF,SAAS,qBAAqB,CAAC,OAAe;IAC5C,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,MAAM,EAAE,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,MAAM,oCAAoC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sCAAsC,IAAI,IAAI,EAAE,uCAAuC;SAChG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"shell-policy.js","sourceRoot":"","sources":["../../src/review/shell-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAA8C,KAAK,EAA4B,MAAM,QAAQ,CAAC;AAErG,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,UAAU;IACV,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,UAAU;IACV,4EAA4E;IAC5E,8CAA8C;IAC9C,cAAc;IACd,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAiB;IAC9C,CAAC,KAAK,EAAE,kBAAkB,CAAC;IAC3B,CAAC,OAAO,EAAE,2BAA2B,CAAC;IACtC,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,CACnF,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,uBAAuB,CAAU,CACnD;IACD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAC3G,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAU,CACjD;IACD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAU,CAAC;IACtG,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAC9B,CAAC,eAAe,EAAE,kBAAkB,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAsC;IAClE,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,wDAAwD,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACnH;QACE,KAAK;QACL;YACE,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,yBAAyB,EAAE;YACnE,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,wCAAwC,EAAE;YAC9E,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,iCAAiC,EAAE;SACxG;KACF;IACD;QACE,KAAK;QACL;YACE,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,6BAA6B,EAAE;YACzE,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,wCAAwC,EAAE;YACjF,EAAE,OAAO,EAAE,8CAA8C,EAAE,MAAM,EAAE,iCAAiC,EAAE;SACvG;KACF;IACD,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;CAC/D,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,YAAY,GAAgC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC;AAE5G;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,KAAsB;IAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACxC,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,uDAAuD;YACvD,IAAI,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,8EAA8E;AAC9E,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,iDAAiD,CAAC;AAE9E,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAM3D;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,GAAG,SAAS,0DAA0D,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAW,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,KAAK,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9D,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,WAAW;gBACd,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,OAAO,EAAE,OAAO,EAAE,GAAG,SAAS,uCAAuC,EAAE,CAAC;gBAC1E,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClC,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,OAAO;gBACV,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,SAAS;gBACZ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClC,MAAM;YACR;gBACE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,mFAAmF;AACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;AAEzG;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAc,EAAE,EAAE;QAC7C,IAAI,GAAG,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACtC,QAAQ,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC;QACT,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,IAAI;YACP,OAAO,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,KAAK,GAAG,CAAC;QACT,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,MAAM,KAAK,WAAW,CAAC;QAChC;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IAChC,0EAA0E;IAC1E,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,MAAc,EAAE,OAAgB;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,GAAG,GACP,MAAM,IAAI,IAAI;YACZ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,SAAS,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,IAAqB;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;AAC5B,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3G,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,GAAG,SAAS,MAAM,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,uCAAuC;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,iBAAiB,MAAM,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,MAAM,oCAAoC,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,GAAG,SAAS,UAAU,IAAI,IAAI,EAAE,uCAAuC;SAChF,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,gCAAgC,EAAE,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/review/shell-policy.test.js

@@ -84,6 +84,82 @@ describe("reviewBashPolicy", () => {
         expect(decision.allowed === false && decision.reason).toContain("read-only");
     });
 });
+describe("quoted arguments, which are data rather than shell", () => {
+    it("allows a jq program or a grep pattern whose own `|` sits inside quotes", () => {
+        // The brief prescribes the jq projection to read a transcript without its
+        // thinking blocks; a `|` inside quotes is jq's or grep's, not the shell's.
+        for (const command of [
+            `jq -c 'del(.message.content[]?.thinking) | select(.type=="assistant")' ~/.claude/projects/p/s.jsonl`,
+            "grep -n -i 'inspiration\\|scrape' src/content/brief.md",
+            `grep -E "experiment|execFile" src/lib/run.ts | head -20`,
+            "grep -n '[^]]*' src/pages/index.astro",
+        ]) {
+            expect(allows(command), command).toBe(true);
+        }
+    });
+    it("still starts a new command at a pipe, `;` or newline outside quotes", () => {
+        for (const command of ["cat f | sh", "ls; git push", "jq '.a | .b' f | xargs rm", "grep 'a;b' f\ngit push"]) {
+            expect(allows(command), command).toBe(false);
+        }
+    });
+    it("reads a quoted `>` as the argument's own, and an unquoted one as a write", () => {
+        expect(allows(`jq -c 'select(.costUsd > 1)' s.jsonl`)).toBe(true);
+        expect(allows("grep -n '=> ' src/lib/a.ts 2>/dev/null")).toBe(true);
+        expect(allows("grep -rn foo src 2>errors.txt")).toBe(false);
+        expect(allows("cat a.txt >> b.txt")).toBe(false);
+        expect(allows("jq . s.json >&copy.json")).toBe(false);
+    });
+    it("refuses every substitution the shell would run, and none it would not", () => {
+        for (const command of [
+            "cat <(rm -rf dist)",
+            `cat "$(which node)"`,
+            "grep x `echo f`",
+            "cat <<EOF\n$(rm -rf dist)\nEOF",
+            `ls \${HOME:-$(rm -rf dist)}`,
+        ]) {
+            expect(allows(command), command).toBe(false);
+        }
+        expect(allows("grep -n '$(' scripts/build.sh")).toBe(true);
+        expect(allows("grep -c '`' src/content/post.md")).toBe(true);
+    });
+    it("refuses an environment prefix that hands a reader a program to run", () => {
+        // `git diff` runs `GIT_EXTERNAL_DIFF`, and a pager variable names one too.
+        expect(allows("GIT_EXTERNAL_DIFF=sh git diff")).toBe(false);
+        expect(allows("PAGER=./x git log")).toBe(false);
+        expect(allows("LC_ALL=C sort names.txt")).toBe(true);
+    });
+    it("still polices the quoted text of awk and sed, which is a program rather than data", () => {
+        for (const command of [
+            `awk 'BEGIN { system("curl https://example.com") }' f`,
+            `awk '{ print | "sh" }' f`,
+            `awk '{ print > "copy.txt" }' f`,
+            "sed -n 'w copy.txt' f",
+            "sed 's/a/b/w copy.txt' f",
+            "sed '1e id' f",
+        ]) {
+            expect(allows(command), command).toBe(false);
+        }
+        expect(allows("sed -n '10,40p' src/pages/index.astro")).toBe(true);
+        expect(allows("awk -F, '{ print $1 }' data.csv")).toBe(true);
+    });
+    it("reads a denied name as a command only where it runs, not in a path", () => {
+        expect(allows("grep -n screenshot __tooling__/docs/tools/agent-browser.md")).toBe(true);
+        expect(reviewBashPolicy("agent-browser open https://example.com")).toEqual({
+            allowed: false,
+            reason: expect.stringContaining("drives a browser"),
+        });
+    });
+});
+describe("git, which reads or moves the branch depending on its verb", () => {
+    it("finds the verb after `-C <dir>`, so a read elsewhere is still a read", () => {
+        expect(allows("git -C /home/user/repo log --oneline -5")).toBe(true);
+        expect(allows("git -C repo push")).toBe(false);
+    });
+    it("refuses the other options before the verb, which can run a program", () => {
+        expect(allows("git -c core.pager=sh log")).toBe(false);
+        expect(allows("git --exec-path=/tmp log")).toBe(false);
+    });
+});
 describe("find, which is a reader with writers bolted onto it", () => {
     it("refuses the actions that delete or run something", () => {
         // `find` is allowlisted because it reads. Its action flags are a second
@@ -104,5 +180,43 @@ describe("find, which is a reader with writers bolted onto it", () => {
     it("still allows a plain find", () => {
         expect(allows("find src -name '*.astro' -type f")).toBe(true);
     });
+    it("reads those flags on find, not in another command's pattern", () => {
+        expect(allows("grep -rn -e ' -exec' __tooling__/checks")).toBe(true);
+        expect(allows("find . -name x '-delete'")).toBe(false);
+    });
+});
+describe("awk and sed programs the policy cannot read", () => {
+    it("refuses a program loaded from a file, whose code it never sees", () => {
+        // The workspace under review is the reviewed Session's own: a script file
+        // its agent wrote can call `system()` or `w` with nothing here to see it.
+        for (const command of [
+            "awk -f prog.awk data.txt",
+            "awk --file=prog.awk data.txt",
+            "awk -E prog.awk",
+            "sed -f script.sed file.md",
+            "sed --file=script.sed file.md",
+        ]) {
+            expect(allows(command), command).toBe(false);
+        }
+    });
+    it("reads an option's value as data, not as the program", () => {
+        // Splitting a markdown table on `|` is the ordinary way to read one.
+        expect(allows("awk -F'|' '{print $2}' digest/tools.md")).toBe(true);
+        expect(allows("awk -F '|' -v col=2 '{print $col}' digest/tools.md")).toBe(true);
+        expect(allows("awk -F'|' '{print $2 | \"sh\"}' digest/tools.md")).toBe(false);
+    });
+});
+describe("readers with an output flag", () => {
+    it("refuses the flags that write a file without a redirect", () => {
+        for (const command of [
+            "sort -o out.txt in.txt",
+            "sort --output=out.txt in.txt",
+            "git log --output=log.txt",
+            "git diff --output log.txt",
+        ]) {
+            expect(allows(command), command).toBe(false);
+        }
+        expect(allows("sort -u in.txt")).toBe(true);
+    });
 });
 //# sourceMappingURL=shell-policy.test.js.map

package/dist/review/shell-policy.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-policy.test.js","sourceRoot":"","sources":["../../src/review/shell-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,KAAK,MAAM,OAAO,IAAI;YACpB,uCAAuC;YACvC,qEAAqE;YACrE,iDAAiD;YACjD,2BAA2B;YAC3B,qCAAqC;YACrC,kCAAkC;YAClC,kCAAkC;YAClC,0DAA0D;YAC1D,wBAAwB;YACxB,mCAAmC;SACpC,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,4EAA4E;QAC5E,4DAA4D;QAC5D,KAAK,MAAM,OAAO,IAAI;YACpB,aAAa;YACb,qBAAqB;YACrB,+BAA+B;YAC/B,mCAAmC;YACnC,4BAA4B;YAC5B,sBAAsB;YACtB,mBAAmB;YACnB,UAAU;SACX,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,KAAK,MAAM,OAAO,IAAI;YACpB,gCAAgC;YAChC,mBAAmB;YACnB,eAAe;YACf,gBAAgB;YAChB,sBAAsB;SACvB,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,OAAO,IAAI;YACpB,2BAA2B;YAC3B,iBAAiB;YACjB,0BAA0B;YAC1B,cAAc;SACf,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,wEAAwE;QACxE,4EAA4E;QAC5E,uEAAuE;QACvE,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI;YACpB,8BAA8B;YAC9B,gCAAgC;YAChC,oCAAoC;YACpC,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"shell-policy.test.js","sourceRoot":"","sources":["../../src/review/shell-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,KAAK,MAAM,OAAO,IAAI;YACpB,uCAAuC;YACvC,qEAAqE;YACrE,iDAAiD;YACjD,2BAA2B;YAC3B,qCAAqC;YACrC,kCAAkC;YAClC,kCAAkC;YAClC,0DAA0D;YAC1D,wBAAwB;YACxB,mCAAmC;SACpC,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,4EAA4E;QAC5E,4DAA4D;QAC5D,KAAK,MAAM,OAAO,IAAI;YACpB,aAAa;YACb,qBAAqB;YACrB,+BAA+B;YAC/B,mCAAmC;YACnC,4BAA4B;YAC5B,sBAAsB;YACtB,mBAAmB;YACnB,UAAU;SACX,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,KAAK,MAAM,OAAO,IAAI;YACpB,gCAAgC;YAChC,mBAAmB;YACnB,eAAe;YACf,gBAAgB;YAChB,sBAAsB;SACvB,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,OAAO,IAAI;YACpB,2BAA2B;YAC3B,iBAAiB;YACjB,0BAA0B;YAC1B,cAAc;SACf,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,0EAA0E;QAC1E,2EAA2E;QAC3E,KAAK,MAAM,OAAO,IAAI;YACpB,qGAAqG;YACrG,wDAAwD;YACxD,yDAAyD;YACzD,uCAAuC;SACxC,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,2BAA2B,EAAE,wBAAwB,CAAC,EAAE,CAAC;YAC5G,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,KAAK,MAAM,OAAO,IAAI;YACpB,oBAAoB;YACpB,qBAAqB;YACrB,iBAAiB;YACjB,gCAAgC;YAChC,6BAA6B;SAC9B,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,KAAK,MAAM,OAAO,IAAI;YACpB,sDAAsD;YACtD,0BAA0B;YAC1B,gCAAgC;YAChC,uBAAuB;YACvB,0BAA0B;YAC1B,eAAe;SAChB,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,CAAC,CAAC,OAAO,CAAC;YACzE,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;IAC1E,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,wEAAwE;QACxE,4EAA4E;QAC5E,uEAAuE;QACvE,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI;YACpB,8BAA8B;YAC9B,gCAAgC;YAChC,oCAAoC;YACpC,4BAA4B;YAC5B,+BAA+B;YAC/B,0BAA0B;SAC3B,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,KAAK,MAAM,OAAO,IAAI;YACpB,0BAA0B;YAC1B,8BAA8B;YAC9B,iBAAiB;YACjB,2BAA2B;YAC3B,+BAA+B;SAChC,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,qEAAqE;QACrE,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,KAAK,MAAM,OAAO,IAAI;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,0BAA0B;YAC1B,2BAA2B;SAC5B,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@koda-sl/baker-bridge",
-  "version": "0.109.0-dev.9779e8b49",
+  "version": "0.109.0-dev.d6e55699d",
   "description": "HTTP server wrapping the Claude Agent SDK. Persists chat events to Convex; the dashboard subscribes via Convex realtime",
   "license": "MIT",
   "type": "module",
   "bin": {
-    "baker-bridge": "dist/cli.js"
+    "baker-bridge": "dist/cli.js",
+    "baker-credential-broker": "dist/broker/main.js",
+    "baker-credential-broker-supervisor": "dist/broker/supervisor-main.js"
   },
   "exports": {
     "./hono": {
@@ -39,20 +41,22 @@
     "unlink:local": "bash scripts/unlink-local.sh"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.280",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.295",
     "@hono/node-server": "^1.19.14",
-    "@latitude-data/claude-code-telemetry": "0.0.15",
     "@t3-oss/env-core": "^0.13.10",
     "hono": "^4.12.25",
     "image-size": "^2.0.2",
+    "mockttp": "4.6.3",
+    "unbash": "4.0.11",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/node": "25.3.0",
     "tsx": "^4.0.0",
     "typescript": "^7.0.2",
+    "undici": "7.29.0",
     "vite": "7.3.2",
-    "vitest": "^4.1.8"
+    "vitest": "^5.0.3"
   },
   "repository": {
     "type": "git",

package/dist/hono/latitude-telemetry.d.ts

@@ -1,17 +0,0 @@
-import type { Settings } from "@anthropic-ai/claude-agent-sdk";
-type LatitudeHook = {
-    readonly node: string;
-    readonly entry: string;
-};
-type LatitudeHooks = NonNullable<Settings["hooks"]>;
-/**
- * `Stop` reports each turn without delaying it; `SessionEnd` is synchronous
- * because it is the one that still fires when the CLI exits right after a turn,
- * which is how the bridge closes a query. The hook's own offset lock keeps the
- * two from reporting a turn twice.
- */
-export declare function latitudeTelemetryFor(env: Record<string, string | undefined>, hook: LatitudeHook | undefined): LatitudeHooks | undefined;
-/** Where the installed hook lives; undefined turns tracing off rather than failing the turn. */
-export declare function installedLatitudeHook(): LatitudeHook | undefined;
-export {};
-//# sourceMappingURL=latitude-telemetry.d.ts.map

package/dist/hono/latitude-telemetry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"latitude-telemetry.d.ts","sourceRoot":"","sources":["../../src/hono/latitude-telemetry.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/D,KAAK,YAAY,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,KAAK,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,YAAY,GAAG,SAAS,GAC7B,aAAa,GAAG,SAAS,CAS3B;AAED,gGAAgG;AAChG,wBAAgB,qBAAqB,IAAI,YAAY,GAAG,SAAS,CAOhE"}