@lannguyensi/harness 0.42.0 → 0.43.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +27 -0
- package/dist/cli/approve/branch-protection.js +1 -1
- package/dist/cli/approve/branch-protection.js.map +1 -1
- package/dist/cli/dry-run.js +13 -1
- package/dist/cli/dry-run.js.map +1 -1
- package/dist/cli/init/composer.js +6 -6
- package/dist/cli/init/composer.js.map +1 -1
- package/dist/cli/init/profiles.d.ts +1 -1
- package/dist/cli/init/profiles.js +1 -1
- package/dist/cli/init/templates.d.ts +1 -1
- package/dist/cli/init/templates.js +47 -27
- package/dist/cli/init/templates.js.map +1 -1
- package/dist/cli/pack/hook-branch-protection.js +1 -1
- package/dist/cli/pack/hook-branch-protection.js.map +1 -1
- package/dist/cli/pack/hook-solution-acceptance-writeguard.js +1 -1
- package/dist/cli/pack/hook-solution-acceptance-writeguard.js.map +1 -1
- package/dist/cli/pack/hook-solution-acceptance.js +1 -1
- package/dist/cli/pack/hook-solution-acceptance.js.map +1 -1
- package/dist/cli/policy/intercept.js +77 -10
- package/dist/cli/policy/intercept.js.map +1 -1
- package/dist/cli/validate/checks.js +2 -2
- package/dist/cli/validate/checks.js.map +1 -1
- package/dist/policy-packs/builtin/branch-protection-runtime.d.ts +1 -1
- package/dist/policy-packs/builtin/branch-protection-runtime.js +1 -1
- package/dist/policy-packs/builtin/branch-protection.js +2 -2
- package/dist/policy-packs/builtin/branch-protection.js.map +1 -1
- package/dist/policy-packs/builtin/post-merge-gate.js +1 -1
- package/dist/policy-packs/builtin/solution-acceptance-runtime.js +1 -1
- package/dist/policy-packs/builtin/solution-acceptance-runtime.js.map +1 -1
- package/dist/policy-packs/builtin/solution-acceptance.js +1 -1
- package/dist/runtime/bash-match-facts.d.ts +58 -0
- package/dist/runtime/bash-match-facts.js +194 -0
- package/dist/runtime/bash-match-facts.js.map +1 -0
- package/dist/runtime/bash-match-registry.d.ts +75 -0
- package/dist/runtime/bash-match-registry.js +359 -0
- package/dist/runtime/bash-match-registry.js.map +1 -0
- package/dist/runtime/bash-prefix-parse.js +23 -0
- package/dist/runtime/bash-prefix-parse.js.map +1 -1
- package/dist/runtime/command-normalize.d.ts +92 -0
- package/dist/runtime/command-normalize.js +1182 -0
- package/dist/runtime/command-normalize.js.map +1 -0
- package/dist/runtime/intercept.d.ts +39 -1
- package/dist/runtime/intercept.js +33 -4
- package/dist/runtime/intercept.js.map +1 -1
- package/dist/runtime/read-only-bash.d.ts +43 -0
- package/dist/runtime/read-only-bash.js +15 -3
- package/dist/runtime/read-only-bash.js.map +1 -1
- package/dist/schema/policies.js +1 -1
- package/dist/schema/policies.js.map +1 -1
- package/package.json +2 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"bash-match-registry.js","sourceRoot":"","sources":["../../src/runtime/bash-match-registry.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,2DAA2D;AAC3D,4CAA4C;AAC5C,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,6EAA6E;AAC7E,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,kEAAkE;AAClE,+DAA+D;AAC/D,qEAAqE;AACrE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,wBAAwB;AACxB,0EAA0E;AAC1E,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,wBAAwB;AACxB,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,2CAA2C;AAC3C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,gEAAgE;AAChE,yEAAyE;AACzE,mEAAmE;AACnE,yEAAyE;AACzE,+CAA+C;AAC/C,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,4DAA4D;AAC5D,yEAAyE;AACzE,oEAAoE;AACpE,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,mEAAmE;AACnE,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,0DAA0D;AAC1D,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,qDAAqD;AACrD,2EAA2E;AAC3E,uEAAuE;AACvE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,mEAAmE;AACnE,8EAA8E;AAC9E,wEAAwE;AACxE,qCAAqC;AACrC,0EAA0E;AAC1E,2EAA2E;AAC3E,oEAAoE;AACpE,sEAAsE;AACtE,kEAAkE;AAClE,sEAAsE;AACtE,wDAAwD;AACxD,sEAAsE;AACtE,0EAA0E;AAC1E,wDAAwD;AACxD,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,kEAAkE;AAClE,gEAAgE;AAChE,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,4CAA4C;AAC5C,6EAA6E;AAC7E,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,iBAAiB;AACjB,EAAE;AACF,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,8DAA8D;AAC9D,0EAA0E;AAC1E,uEAAuE;AACvE,4DAA4D;AAC5D,kEAAkE;AAClE,4EAA4E;AAC5E,kEAAkE;AAClE,sEAAsE;AACtE,iBAAiB;AACjB,uEAAuE;AACvE,uEAAuE;AACvE,8CAA8C;AAC9C,uEAAuE;AACvE,gBAAgB;AAChB,uEAAuE;AACvE,iEAAiE;AACjE,0EAA0E;AAC1E,wEAAwE;AACxE,gDAAgD;AAChD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sDAAsD;AACtD,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,kEAAkE;AAClE,wEAAwE;AACxE,0EAA0E;AAC1E,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,0DAA0D;AAC1D,0EAA0E;AAC1E,2EAA2E;AAC3E,8BAA8B;AAC9B,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,wEAAwE;AACxE,kEAAkE;AAClE,mEAAmE;AACnE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAsD3F,MAAM,CAAC,MAAM,0BAA0B,GAAsC;IAC3E;QACE,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,kCAAkC;QAC1C,MAAM,EAAE,0BAA0B;QAClC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QACxC,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,WAAW,EACT,wHAAwH;KAC3H;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,MAAM,EAAE,kCAAkC;QAC1C,MAAM,EAAE,0BAA0B;QAClC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC9C,OAAO,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACjC,WAAW,EACT,+EAA+E;KAClF;CACF,CAAC;AAuBF;;;;;;;;;;GAUG;AACH,MAAM,+BAA+B,GAAsB;IACzD,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,KAAK;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IACN,KAAK;CACN,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA2D,EAC3D,gBAAmD,0BAA0B,EAC7E,sBAA2C,gCAAgC;IAE3E,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,sEAAsE;IACtE,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,mCAAmC;YAAE,SAAS;QACjE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK;oBACL,KAAK,EAAE,kBAAkB;oBACzB,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,WAAW,uEAAuE,KAAK,kDAAkD;iBACtL,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,qDAAqD;IACrD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAChC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,0BAA0B,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CACrE,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,0BAA0B;gBAClC,KAAK;gBACL,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,qBAAqB,KAAK,aAAa,GAAG,IAAI,SAAS,uHAAuH;aACvL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,qCAAqC;IACrC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,0BAA0B;YAAE,SAAS;QACxD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,WAAW,2DAA2D,MAAM,6BAA6B,MAAM,kRAAkR;iBAC9a,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,wDAAwD;IACxD,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,8CAA8C;IAC9C,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CACvC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,0BAA0B,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CACrE,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5E,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK;oBACL,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,WAAW,sEAAsE,KAAK,WAAW,KAAK,wBAAwB,MAAM,CAAC,MAAM,oCAAoC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mNAAmN;iBAChc,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,gDAAgD;IAChD,sEAAsE;IACtE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,+DAA+D;IAC/D,qEAAqE;IACrE,iBAAiB;IACjB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;QACtC,GAAG,KAAK,CAAC,eAAe;QACxB,GAAG,+BAA+B;KACnC,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,0BAA0B;YAAE,SAAS;QACxD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACtD,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK;oBACL,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,WAAW,0FAA0F,KAAK,WAAW,KAAK,uOAAuO;iBAC9Y,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}
|
|
@@ -30,6 +30,16 @@
|
|
|
30
30
|
// after `cd <path>`) the parser falls through cleanly: the malformed
|
|
31
31
|
// prefix is not consumed, the resolver-side fallback to process env /
|
|
32
32
|
// hook cwd holds. There are no thrown errors from this module.
|
|
33
|
+
//
|
|
34
|
+
// MEASUREMENT RULE (task 47297478): any claim about this parser's
|
|
35
|
+
// CD-TARGET extraction versus another build (lost or gained `cdTarget`
|
|
36
|
+
// values) must come from scripts/measure-bash-prefix-parse.mjs, the
|
|
37
|
+
// per-arm-gated corpus with real bash as referee. Three consecutive
|
|
38
|
+
// ad-hoc corpora in the b093911d run reported "0 lost" while being
|
|
39
|
+
// structurally unable to report a loss; that tool's self-test rebuilds
|
|
40
|
+
// exactly that failure and demands the gate catch it. The tool does NOT
|
|
41
|
+
// measure `inlineEnv` extraction — claims about inline-env behavior
|
|
42
|
+
// have no instrument yet and need their own measurement.
|
|
33
43
|
/**
|
|
34
44
|
* Parse leading inline-env and `cd <path>` idioms from a Bash command
|
|
35
45
|
* string. Returns an empty `inlineEnv` and `cdTarget:null` when neither
|
|
@@ -77,6 +87,19 @@ function skipWs(s, i) {
|
|
|
77
87
|
* On a syntactically broken token (e.g. unterminated quote) the broken
|
|
78
88
|
* token is NOT consumed and the function returns the cursor at the
|
|
79
89
|
* start of that token, preserving the rest of the command for fallback.
|
|
90
|
+
*
|
|
91
|
+
* QUOTE-MODEL DIVERGENCE, recorded so the next change here starts from
|
|
92
|
+
* the known state instead of rediscovering it (task 13e55484, review
|
|
93
|
+
* round 1): `command-normalize.ts`'s `consumeAssignment` is a SECOND
|
|
94
|
+
* quote model for the same leading-`VAR=value` construction, with
|
|
95
|
+
* different deliberate coverage — it handles backslash escapes (outside
|
|
96
|
+
* single quotes) and chained quote runs (`'a b'"c d"`), which this
|
|
97
|
+
* function does not, while this function extracts the VALUE (which the
|
|
98
|
+
* normaliser never needs). Neither model handles ANSI-C `$'...'`
|
|
99
|
+
* escapes; the normaliser side carries a one-directional guard so that
|
|
100
|
+
* divergence can only fall back to its pre-continuation behaviour,
|
|
101
|
+
* never swallow a gated head token. This function's own escape gaps are
|
|
102
|
+
* task `b093911d`.
|
|
80
103
|
*/
|
|
81
104
|
function consumeInlineEnv(s, start, into) {
|
|
82
105
|
let i = skipWs(s, start);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bash-prefix-parse.js","sourceRoot":"","sources":["../../src/runtime/bash-prefix-parse.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,2DAA2D;AAC3D,uEAAuE;AACvE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,6BAA6B;AAC7B,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oBAAoB;AACpB,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,+DAA+D;
|
|
1
|
+
{"version":3,"file":"bash-prefix-parse.js","sourceRoot":"","sources":["../../src/runtime/bash-prefix-parse.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,2DAA2D;AAC3D,uEAAuE;AACvE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,6BAA6B;AAC7B,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oBAAoB;AACpB,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,oEAAoE;AACpE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,yDAAyD;AAUzD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,oEAAoE;IACpE,sEAAsE;IACtE,WAAW;IACX,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC;QACtB,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,KAAK,MAAM;YAAE,MAAM;IAC/B,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,EAAE,GAAG,IAAI,CAAC;AAChB,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC;AAEhC,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gBAAgB,CAAC,CAAS,EAAE,KAAa,EAAE,IAA4B;IAC9E,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,MAAM;QAClC,CAAC,EAAE,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC,EAAE,CAAC;QACJ,mEAAmE;QACnE,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC7B,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC7B,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,CAAC,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC5C,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,CAAS,EAAE,KAAa;IAChD,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,mEAAmE;IACnE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,4BAA4B;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACd,CAAC;SAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACd,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
export interface NormalizedCommand {
|
|
2
|
+
/**
|
|
3
|
+
* The command with wrapper prefixes peeled and git invocations
|
|
4
|
+
* canonicalised to `git <subcommand>`. Shell boundary characters
|
|
5
|
+
* (`\n ; | && ( )`) are preserved verbatim so a boundary-anchored
|
|
6
|
+
* regex still matches. Byte-identical to the input when nothing
|
|
7
|
+
* recognisable was found anywhere in the command.
|
|
8
|
+
*/
|
|
9
|
+
normalized: string;
|
|
10
|
+
/**
|
|
11
|
+
* The effective target directory of the command's git invocation, or
|
|
12
|
+
* `null` when the command names none, the command names invocations
|
|
13
|
+
* that disagree, or the only named value is `~`-prefixed (see the
|
|
14
|
+
* module header's target-directory-extraction rules).
|
|
15
|
+
*
|
|
16
|
+
* NOT WIRED TO ANY GATE (see the module header's STATUS paragraph):
|
|
17
|
+
* extracted and fully tested, pending a redesign that attributes a
|
|
18
|
+
* target per-policy instead of per-event — follow-up task
|
|
19
|
+
* `98ad072f`.
|
|
20
|
+
*/
|
|
21
|
+
targetDir: string | null;
|
|
22
|
+
/**
|
|
23
|
+
* When `targetDir` is a RELATIVE path, the directory it should be
|
|
24
|
+
* resolved against instead of the caller's own cwd — the wrapping
|
|
25
|
+
* `env -C` on the same invocation, or a leading `cd` prefix (see the
|
|
26
|
+
* module header). `null` when `targetDir` is absolute, `null` itself,
|
|
27
|
+
* or no more specific base was found.
|
|
28
|
+
*
|
|
29
|
+
* Same unconsumed status as `targetDir` above — see the module
|
|
30
|
+
* header's STATUS paragraph.
|
|
31
|
+
*/
|
|
32
|
+
targetBase: string | null;
|
|
33
|
+
/**
|
|
34
|
+
* `true` when the input exceeded `MAX_NORMALIZE_LENGTH` and
|
|
35
|
+
* normalisation was skipped entirely (G4 fix, review round 2,
|
|
36
|
+
* 2026-07-27): the caller previously had no way to tell "nothing
|
|
37
|
+
* recognisable was found" apart from "normalisation never ran at all",
|
|
38
|
+
* so the skip carried no audit signal. `false` whenever the input WAS
|
|
39
|
+
* run through `normalizeCommandInner` (including when nothing
|
|
40
|
+
* recognisable was found there either — that case is still `false`,
|
|
41
|
+
* only the length-bound short-circuit sets this).
|
|
42
|
+
*/
|
|
43
|
+
truncated: boolean;
|
|
44
|
+
}
|
|
45
|
+
/**
|
|
46
|
+
* The `git` token itself, matched by BASENAME so a path-qualified
|
|
47
|
+
* invocation (`/usr/bin/git`, `./git`) is recognised too (F4 fix).
|
|
48
|
+
* Anchored to the WHOLE token (not a substring) so `mygit` / `git-foo`
|
|
49
|
+
* still correctly fail to match — `\S*` only ever contributes characters
|
|
50
|
+
* immediately before a literal `/`, never before `git` directly.
|
|
51
|
+
* Exported (fix round 2, finding F3) so
|
|
52
|
+
* `tests/runtime/bash-match-head-token-drift.test.ts` can couple this
|
|
53
|
+
* module's covered set to what FULL_TEMPLATE's shipped `bash_match`
|
|
54
|
+
* policies actually key on today, instead of a test-owned duplicate.
|
|
55
|
+
*/
|
|
56
|
+
export declare const GIT_TOKEN_RE: RegExp;
|
|
57
|
+
/**
|
|
58
|
+
* The three OTHER head tokens this module covers (D-001, run
|
|
59
|
+
* 2026-07-28-nongit-trigger-wrappers) — `gh` (`gh pr merge` / `gh pr
|
|
60
|
+
* create`), `npm` (`npm publish`), `harness` (the kill-switch verbs). A
|
|
61
|
+
* closed set, deliberately NOT a general "any head token" rule (see the
|
|
62
|
+
* module header): matched by EXACT literal equality, unlike `GIT_TOKEN_RE`'s
|
|
63
|
+
* basename match, so a path-qualified spelling of any of these three stays
|
|
64
|
+
* out of scope (named residual, module header NOT-SUPPORTED list). This is
|
|
65
|
+
* NOT the complete set of head tokens a shipped `bash_match` trigger keys
|
|
66
|
+
* on — see the module header's "SHIPPED BUT NOT COVERED" paragraph (fix
|
|
67
|
+
* round 2, finding F1) for the four that are NOT in this set (`env`,
|
|
68
|
+
* `unset`, `tee`, `cp`) and why. Exported (fix round 2, finding F3) for the
|
|
69
|
+
* same drift-guard reason as `GIT_TOKEN_RE` above.
|
|
70
|
+
*/
|
|
71
|
+
export declare const NON_GIT_HEAD_TOKENS: ReadonlySet<string>;
|
|
72
|
+
/**
|
|
73
|
+
* Above this length, normalisation is skipped entirely and the command
|
|
74
|
+
* is returned unchanged (F3 fix — see the module header for why command
|
|
75
|
+
* SIZE must be bounded even after `findNextBoundary` was made linear).
|
|
76
|
+
* 100k characters comfortably covers any command a human or agent would
|
|
77
|
+
* plausibly type, while keeping the worst case a small constant instead
|
|
78
|
+
* of scaling with whatever ends up pasted into a single Bash call.
|
|
79
|
+
* Exported (G4 fix, review round 2) so a caller reporting the skip (see
|
|
80
|
+
* `NormalizedCommand.truncated`) can reference the same number instead of
|
|
81
|
+
* hand-copying it into a diagnostic message.
|
|
82
|
+
*/
|
|
83
|
+
export declare const MAX_NORMALIZE_LENGTH = 100000;
|
|
84
|
+
/**
|
|
85
|
+
* Given a Bash command string, return its normalised form and the target
|
|
86
|
+
* directory (and base, if relative) of its git invocation. Never throws:
|
|
87
|
+
* any internal failure (there should be none — this is a defensive
|
|
88
|
+
* backstop matching the fail-safe shape used elsewhere in this codebase,
|
|
89
|
+
* e.g. `policyMatchesEvent`'s `try/catch` around `new RegExp`) falls back
|
|
90
|
+
* to the input unchanged.
|
|
91
|
+
*/
|
|
92
|
+
export declare function normalizeCommand(command: string): NormalizedCommand;
|