@lannguyensi/harness 0.53.0 → 0.54.0

package/dist/runtime/destructive-shell-floor.js

@@ -0,0 +1,597 @@
+// Built-in destructive-shell floor for the Risk Classifier (task 2929c5b7).
+//
+// WHY THIS IS CODE AND NOT ONLY A MANIFEST PATTERN. `when-eval.ts` no
+// longer lets an UNCLASSIFIED action satisfy `risk.severity_at_least:
+// critical` on its own. That change ships in the binary and takes effect
+// for every install on upgrade. Its compensating half, explicit
+// classification for the mutating heads that used to ride the blanket
+// fail-close (`dd`, `truncate`, `shred`, `mkfs`, `find -delete`, ...),
+// would take effect only for installs that ADOPT the new `dangerous-shell`
+// template patterns, because `harness init` writes the manifest once and
+// never rewrites it. An existing manifest carrying the original four
+// patterns would have kept the loosened fallback and lost the hard block
+// in the same upgrade. So the recognition ships HERE, composed into
+// `classifyRisk` like the existing built-in floors, and the template
+// patterns are its operator-visible, operator-editable mirror.
+//
+// FLOOR SEMANTICS, same as every other built-in floor: it composes under
+// highest-severity-wins. It can only RAISE an action's severity, never
+// lower one an operator classifier already assigned, and an operator
+// pattern can always raise above it.
+//
+// SCOPE, deliberately narrow. This is not a general "is this command
+// dangerous" oracle and must not grow into one: it recognises a closed set
+// of heads whose DESTRUCTIVE INVOCATION SHAPE is decidable from argv
+// tokens alone. Anything else stays unclassified and rides the "high" rung
+// fallback (approval-gated), which is the honest answer. A truncating
+// redirection (`cmd > file`) is NOT recognised here for the same reason it
+// is not a template pattern: this module has no redirection model, and a
+// text heuristic for a bare `>` over-matches `2>&1`, heredocs, and
+// comparison operators. See docs/risk-gate.md.
+//
+// TWO KNOWN OVER-BLOCKS, both in the raise-severity direction and both
+// accepted. (1) The boundary split is not quote-aware, so a floored head
+// name inside a torn-open quoted string is examined as if it were a real
+// invocation. (2) `shred` and `mkfs` are matched on their HEAD TOKEN
+// ALONE, with no argument shape to check, so any such fragment starting
+// with one of them classifies `critical`. The single exception carved out
+// of (2) is an invocation whose only argument is a help/version flag
+// (`isLoneVersionOrHelp`), which cannot destroy anything.
+//
+// HEAD-RESOLUTION SPELLINGS THIS FLOOR DOES NOT REACH, by design and
+// measured: a brace group (`{ dd of=y; }`), a backtick substitution
+// (`` `dd of=y` ``), `eval "dd of=y"`, an `-exec sh -c '<cmd>'` payload
+// (only a direct `-exec rm` is recognised), and `git -c k=v push --force`
+// (`-c` is deliberately absent from the git global-flag skip list because
+// config injection can execute code, so the subcommand walk stops there).
+// Each stays UNCLASSIFIED, which is approval-gated rather than silently
+// allowed, and each is pinned as such in
+// tests/runtime/destructive-shell-floor.test.ts so a future change to the
+// split or the wrapper peel cannot flip one without a test noticing.
+// Closing them would mean a real shell parser; see docs/risk-gate.md's
+// "Not recognized, by design".
+import { GIT_GLOBAL_NO_VALUE_FLAGS, GIT_GLOBAL_VALUE_TAKING_FLAGS, GIT_TOKEN_RE, peelWrapperPrefixes, } from "./command-normalize.js";
+import { decodeShellWord } from "./shell-word.js";
+// Shell boundary characters. The command text is split on these before any
+// head resolution, so a destructive invocation after `;`, `&&`, `||`, `|`,
+// `&`, a subshell paren, or a newline is still examined. Splitting is
+// deliberately NOT quote-aware: over-splitting inside a quoted string only
+// produces MORE candidate heads to examine, which is the safe direction
+// for a floor that raises severity. Under-splitting is what would hide a
+// destructive tail, and that cannot happen here.
+const BOUNDARY_SPLIT_RE = /[;&|()\n]+/;
+/** Multi-call binaries: `busybox dd if=... of=...` really runs `dd`. */
+const MULTICALL_HEADS = new Set(["busybox", "toybox"]);
+/** Shells whose `-c` argument is a nested command string. */
+const SHELL_HEADS = new Set([
+    "sh", "bash", "zsh", "dash", "ksh", "ash",
+]);
+/** Depth bound for `sh -c "sh -c ..."` nesting. */
+const MAX_NESTING_DEPTH = 4;
+/**
+ * Recognise every built-in destructive invocation in `command`.
+ *
+ * Pure and linear in the length of the command: whitespace tokenisation,
+ * set lookups, and a bounded wrapper peel. No regex with a backtracking
+ * risk runs over the command text (`BOUNDARY_SPLIT_RE` is a character
+ * class), so this may be called on the UNCAPPED command string, which it
+ * must be, so a destructive tail past the classifier's 16 KiB ReDoS cap
+ * cannot be laundered by a long benign head.
+ */
+export function classifyDestructiveShellFloor(command) {
+    const hits = [];
+    scanCommand(command, 0, hits);
+    return dedupe(hits);
+}
+function dedupe(hits) {
+    const seen = new Set();
+    const out = [];
+    for (const hit of hits) {
+        if (seen.has(hit.reason))
+            continue;
+        seen.add(hit.reason);
+        out.push(hit);
+    }
+    return out;
+}
+function scanCommand(command, depth, hits) {
+    if (depth > MAX_NESTING_DEPTH)
+        return;
+    // WHOLE-STRING pass first, and only for the `<shell> -c "<command>"`
+    // shape. The boundary split below is not quote-aware, so it would tear
+    // `sh -c "dd if=x of=y; rm -rf /"` apart mid-quote and leave the nested
+    // `dd` unrecognisable. Resolving the shell head before splitting keeps
+    // the nested command intact for the recursive scan.
+    const wholeTokens = tokenize(command);
+    const wholeHead = resolveHead(wholeTokens);
+    if (wholeHead !== null && SHELL_HEADS.has(wholeHead.name)) {
+        scanShellDashC(wholeTokens.slice(wholeHead.idx + 1), depth, hits);
+    }
+    for (const piece of command.split(BOUNDARY_SPLIT_RE)) {
+        const tokens = tokenize(piece);
+        if (tokens.length === 0)
+            continue;
+        scanInvocation(tokens, depth, hits);
+    }
+}
+function tokenize(s) {
+    return s.trim().split(/\s+/).filter((t) => t !== "");
+}
+/**
+ * Resolve the real head of one invocation: peel `VAR=x` assignments and
+ * the `sudo`/`env`/`command`/`timeout`/... wrapper chain, then any
+ * `busybox`/`toybox` multi-call prefix. Returns the head's literal name
+ * (decoded, path prefix stripped) and its token index, or `null` when no
+ * head token survives.
+ */
+function resolveHead(rawTokens) {
+    // Basename + decode every token that is not a flag and not a `NAME=value`
+    // assignment, so `/bin/dd`, `/usr/bin/env`, and `"sudo"` all resolve like
+    // their bare spellings. Assignments and `of=`-style operands keep their
+    // text (their `=` is load-bearing), and flags keep theirs (a flag has no
+    // path prefix to strip).
+    const peelTokens = rawTokens.map((t) => ({ text: headNameOf(t) }));
+    let idx = 0;
+    for (let guard = 0; guard <= MAX_NESTING_DEPTH; guard += 1) {
+        const before = idx;
+        // Shared wrapper vocabulary (`peelWrapperPrefixes`, command-normalize.ts)
+        // rather than a second hand-rolled copy of it: a wrapper added there
+        // benefits this floor automatically.
+        idx = peelWrapperPrefixes(peelTokens, idx).idx;
+        const peeled = peelTokens[idx]?.text;
+        if (peeled !== undefined && MULTICALL_HEADS.has(peeled)) {
+            idx += 1;
+            continue;
+        }
+        if (idx === before)
+            break;
+    }
+    const name = peelTokens[idx]?.text;
+    return name === undefined ? null : { name, idx };
+}
+/** Resolve one boundary-delimited invocation's head, then dispatch on it. */
+function scanInvocation(rawTokens, depth, hits) {
+    const resolved = resolveHead(rawTokens);
+    if (resolved === null)
+        return;
+    const head = resolved.name;
+    const args = rawTokens.slice(resolved.idx + 1);
+    if (SHELL_HEADS.has(head)) {
+        scanShellDashC(args, depth, hits);
+        return;
+    }
+    if (head === "dd")
+        return scanDd(args, hits);
+    if (head === "truncate")
+        return scanTruncate(args, hits);
+    if (head === "shred") {
+        if (isLoneVersionOrHelp(args))
+            return;
+        hits.push({
+            severity: "critical",
+            categories: ["destructive", "data_loss", "irreversible_action"],
+            reason: "built-in destructive floor: shred overwrites a file in place",
+        });
+        return;
+    }
+    if (head === "mkfs" || head.startsWith("mkfs.")) {
+        if (isLoneVersionOrHelp(args))
+            return;
+        hits.push({
+            severity: "critical",
+            categories: ["destructive", "data_loss", "infrastructure_change"],
+            reason: "built-in destructive floor: mkfs formats a filesystem",
+        });
+        return;
+    }
+    if (head === "find")
+        return scanFind(args, hits);
+    if (GIT_TOKEN_RE.test(head))
+        return scanGit(args, hits);
+    if (head === "chmod" || head === "chown")
+        return scanChmodChown(head, args, hits);
+    if (head === "sed")
+        return scanSed(args, hits);
+    if (head === "curl")
+        return scanCurl(args, hits);
+}
+/**
+ * `sh -c "<command>"` / `bash -lc '<command>'`: the nested command string
+ * is re-scanned from the top. The `-c` value is reconstructed by rejoining
+ * the tokens after the flag run (the whitespace tokenizer split the quoted
+ * string apart) and stripping one layer of surrounding quotes.
+ */
+function scanShellDashC(args, depth, hits) {
+    let i = 0;
+    let sawDashC = false;
+    for (; i < args.length; i += 1) {
+        const t = decodeShellWord(args[i]);
+        if (!t.startsWith("-"))
+            break;
+        if (t === "--") {
+            i += 1;
+            break;
+        }
+        if (!t.startsWith("--") && t.includes("c")) {
+            sawDashC = true;
+            i += 1;
+            break;
+        }
+        if (t === "--command") {
+            sawDashC = true;
+            i += 1;
+            break;
+        }
+    }
+    if (!sawDashC)
+        return;
+    const nested = stripOuterQuotes(args.slice(i).join(" "));
+    if (nested === "")
+        return;
+    scanCommand(nested, depth + 1, hits);
+}
+function stripOuterQuotes(s) {
+    const t = s.trim();
+    if (t.length >= 2) {
+        const first = t[0];
+        const last = t[t.length - 1];
+        if ((first === "'" || first === '"') && first === last)
+            return t.slice(1, -1);
+    }
+    return t;
+}
+/**
+ * The literal name a head token invokes: decoded, with any path prefix
+ * stripped. `NAME=value` assignment tokens and flags are returned
+ * unchanged (stripping a `/` out of an assignment's VALUE would corrupt
+ * the token `peelWrapperPrefixes` needs to recognise, and a flag has no
+ * path prefix).
+ */
+function headNameOf(token) {
+    const decoded = decodeShellWord(token);
+    if (decoded.startsWith("-"))
+        return decoded;
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(decoded))
+        return decoded;
+    const slash = decoded.lastIndexOf("/");
+    return slash === -1 ? decoded : decoded.slice(slash + 1);
+}
+/** `true` when `arg`, raw or decoded, satisfies `pred`. */
+function eitherForm(arg, pred) {
+    return pred(arg) || pred(decodeShellWord(arg));
+}
+/** `true` when `t` is a single-dash short-flag cluster containing `ch`. */
+function shortClusterHas(t, ch) {
+    return t.startsWith("-") && !t.startsWith("--") && t.slice(1).includes(ch);
+}
+/**
+ * Flags that mean "print and exit", never "act". Same set and same
+ * precedent as `VERSION_OR_HELP_FLAGS` in `read-only-bash.ts` (kept as a
+ * local copy rather than an import so this module stays free of that
+ * 2000-line predicate; the two sets are five literals and are pinned
+ * against each other in tests/runtime/destructive-shell-floor.test.ts).
+ */
+const VERSION_OR_HELP_FLAGS = new Set([
+    "--version", "-V", "-v", "--help", "-h",
+]);
+/**
+ * `true` for an invocation whose ONLY argument is a help/version flag.
+ *
+ * The argument-free heads below (`shred`, `mkfs`) are matched on the head
+ * token alone, because every real invocation of them destroys something.
+ * That over-blocks the one shape that destroys nothing: `shred --help`.
+ * The LONE requirement is what keeps this safe: `shred -v secret.txt` is
+ * a real shred with a verbose flag and keeps its `critical`, and a bare
+ * `shred -v` has no operand to destroy.
+ *
+ * NOTE, the same over-block in general: an argument-free head match fires
+ * on ANY boundary-split fragment whose first token resolves to that head,
+ * so a fragment like `echo mkfs` never reaches here (its head is `echo`)
+ * but `mkfs` inside a quoted string the non-quote-aware split tore open
+ * does. That is the deliberate direction for a floor that only RAISES
+ * severity, and is the same trade the split itself documents.
+ */
+function isLoneVersionOrHelp(args) {
+    return args.length === 1 && VERSION_OR_HELP_FLAGS.has(decodeShellWord(args[0]));
+}
+// `dd` writes only when it is given an output file. `dd if=/dev/sda | gzip`
+// (a read into a pipe) is deliberately NOT floored: it mutates nothing, and
+// flooring it would hard-block a backup on a production-resolved session,
+// the exact false positive this task exists to remove.
+function scanDd(args, hits) {
+    if (!args.some((a) => eitherForm(a, (t) => t.startsWith("of="))))
+        return;
+    hits.push({
+        severity: "critical",
+        categories: ["destructive", "data_loss"],
+        reason: "built-in destructive floor: dd with an of= write target",
+    });
+}
+// `truncate -s <size>` / `--size=<size>`, including the glued `-s0` form
+// and any cluster carrying `s` (`-cs 0`). Without a size there is nothing
+// to truncate to.
+function scanTruncate(args, hits) {
+    const sized = args.some((a) => eitherForm(a, (t) => t === "--size" || t.startsWith("--size=") || shortClusterHas(t, "s")));
+    if (!sized)
+        return;
+    hits.push({
+        severity: "critical",
+        categories: ["destructive", "data_loss"],
+        reason: "built-in destructive floor: truncate with a size argument",
+    });
+}
+// `find ... -delete` and `find ... -exec/-execdir rm`. Both spellings are
+// compared raw OR decoded, the measured bypass class from task fdee7d0f
+// (`-"delete"`, `-'delete'`, `-\delete` all reach find as `-delete`).
+function scanFind(args, hits) {
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (eitherForm(a, (t) => t === "-delete")) {
+            hits.push({
+                severity: "critical",
+                categories: ["destructive", "data_loss"],
+                reason: "built-in destructive floor: find -delete",
+            });
+            continue;
+        }
+        if (eitherForm(a, (t) => t === "-exec" || t === "-execdir")) {
+            const payload = args[i + 1];
+            if (payload !== undefined && headNameOf(payload) === "rm") {
+                hits.push({
+                    severity: "critical",
+                    categories: ["destructive", "data_loss"],
+                    reason: "built-in destructive floor: find -exec rm",
+                });
+            }
+        }
+    }
+}
+/**
+ * git's own global options sit BETWEEN the binary and the subcommand
+ * (`git -C /repo push -f`), so they are skipped before the subcommand is
+ * read, reusing command-normalize.ts's exported flag sets. `-c` is
+ * deliberately absent from `GIT_GLOBAL_VALUE_TAKING_FLAGS` (config
+ * injection can execute code); a command carrying it stops the walk and
+ * simply yields no subcommand here.
+ */
+function scanGit(args, hits) {
+    let i = 0;
+    while (i < args.length) {
+        const t = decodeShellWord(args[i]);
+        if (!t.startsWith("-"))
+            break;
+        if (GIT_GLOBAL_NO_VALUE_FLAGS.has(t)) {
+            i += 1;
+            continue;
+        }
+        const eq = t.indexOf("=");
+        const name = eq === -1 ? t : t.slice(0, eq);
+        if (GIT_GLOBAL_VALUE_TAKING_FLAGS.has(name)) {
+            i += eq === -1 ? 2 : 1;
+            continue;
+        }
+        break;
+    }
+    const sub = args[i] === undefined ? "" : decodeShellWord(args[i]);
+    const subArgs = args.slice(i + 1);
+    const push = (categories, reason) => {
+        hits.push({ severity: "high", categories, reason: `built-in destructive floor: ${reason}` });
+    };
+    if (sub === "reset" && subArgs.some((a) => eitherForm(a, (t) => t === "--hard"))) {
+        push(["destructive", "data_loss"], "git reset --hard");
+        return;
+    }
+    if (sub === "push") {
+        const forced = subArgs.some((a) => eitherForm(a, (t) => t === "--force" ||
+            t === "--force-with-lease" ||
+            t.startsWith("--force-with-lease=") ||
+            t.startsWith("+") ||
+            shortClusterHas(t, "f")));
+        if (forced)
+            push(["destructive", "production_mutation", "deployment_change"], "git push --force");
+        return;
+    }
+    if (sub === "clean") {
+        const forced = subArgs.some((a) => eitherForm(a, (t) => t === "--force" || shortClusterHas(t, "f")));
+        if (forced)
+            push(["destructive", "data_loss"], "git clean --force");
+        return;
+    }
+    if (sub === "checkout" || sub === "restore") {
+        const operands = subArgs.map((a) => decodeShellWord(a)).filter((t) => t !== "--");
+        if (operands.length === 1 && operands[0] === ".") {
+            push(["destructive", "data_loss"], `git ${sub} . discards every uncommitted change`);
+        }
+    }
+}
+// `chmod -R` / `chown -R` (and `--recursive`), cluster-aware so `-Rf` and
+// `-fR` are both caught. Categories: `mass_update` only, deliberately NOT
+// `destructive`/`data_loss`: a recursive mode or owner change rewrites
+// metadata across a tree (worth a `high` gate) but is reversible by the
+// inverse command, so the profile stays `reversible: true`.
+function scanChmodChown(head, args, hits) {
+    const recursive = args.some((a) => eitherForm(a, (t) => t === "--recursive" || shortClusterHas(t, "R")));
+    if (!recursive)
+        return;
+    hits.push({
+        severity: "high",
+        categories: ["mass_update"],
+        reason: `built-in destructive floor: ${head} -R rewrites a whole tree`,
+    });
+}
+// `sed -i` in every spelling: `-i`, `-i.bak`, the cluster `-ni`,
+// `--in-place`, `--in-place=SUFFIX`.
+function scanSed(args, hits) {
+    const inPlace = args.some((a) => eitherForm(a, (t) => t === "--in-place" || t.startsWith("--in-place=") || shortClusterHas(t, "i")));
+    if (!inPlace)
+        return;
+    hits.push({
+        severity: "high",
+        categories: ["destructive", "data_loss"],
+        reason: "built-in destructive floor: sed in-place edit",
+    });
+}
+/** curl flags that write a LOCAL file. */
+const CURL_LOCAL_WRITE_LONG_FLAGS = new Set([
+    "--output", "--remote-name", "--dump-header", "--cookie-jar", "--config",
+    "--create-dirs", "--output-dir", "--etag-save", "--trace", "--trace-ascii",
+    "--stderr", "--remote-header-name",
+]);
+const CURL_LOCAL_WRITE_SHORT_CHARS = ["o", "O", "D", "c", "K"];
+/** curl flags that send a REQUEST BODY (making the request a write). */
+const CURL_BODY_LONG_FLAGS = new Set([
+    "--data", "--data-raw", "--data-binary", "--data-urlencode", "--data-ascii",
+    "--json", "--form", "--form-string", "--form-escape", "--upload-file",
+]);
+const CURL_BODY_SHORT_CHARS = ["d", "F", "T"];
+/**
+ * `-H`/`--header`: curl reads the VALUE from a local file when it starts
+ * with `@` (`-H @/etc/passwd` sends that file's lines as request
+ * headers).
+ */
+const CURL_HEADER_FLAG = { long: "--header", short: "H" };
+/**
+ * `-b`/`--cookie` uses a DIFFERENT rule than `-H`, measured on curl 8.7.1:
+ * a value containing no `=` is read as a cookie-jar FILENAME, `@`-prefixed
+ * or not (`curl -b jar.txt` reads the jar; `curl -b @jar.txt` opens a file
+ * literally named `@jar.txt`, the `@` is not a file marker for this
+ * flag). A value containing `=` is sent as inline cookie data
+ * (`-b 'name=value'`) and stays inert.
+ */
+const CURL_COOKIE_FLAG = { long: "--cookie", short: "b" };
+/**
+ * The value curl reads for one flag, whichever of the three ways it is
+ * spelled: `=`-joined (`--header=@f`), glued into a short-flag cluster
+ * (`-H@f`, `-sH@f`), or the next argv token (`-H @f`, `--header @f`).
+ * `undefined` when this token does not carry the flag at all.
+ *
+ * Short-flag lookup is a plain cluster search, so a value character that
+ * happens to sit inside ANOTHER flag's glued value can be misread as this
+ * flag. That direction only ever adds a candidate value to inspect, which
+ * for a floor that exclusively RAISES severity is the safe one.
+ */
+function curlFlagValue(token, next, longName, shortChar) {
+    const nextValue = () => next === undefined ? undefined : decodeShellWord(next);
+    if (token.startsWith("--")) {
+        const eq = token.indexOf("=");
+        if ((eq === -1 ? token : token.slice(0, eq)) !== longName)
+            return undefined;
+        return eq === -1 ? nextValue() : token.slice(eq + 1);
+    }
+    if (!token.startsWith("-"))
+        return undefined;
+    const at = token.indexOf(shortChar, 1);
+    if (at === -1)
+        return undefined;
+    const glued = token.slice(at + 1);
+    return glued.length > 0 ? glued : nextValue();
+}
+/** `true` when `t` is `-w`/`--write-out` in any spelling. */
+function isCurlWriteOutFlag(t) {
+    return t === "--write-out" || t.startsWith("--write-out=") || shortClusterHas(t, "w");
+}
+// What the read-only side no longer tries to decide. Decision D-013 removed
+// the `curl` `low` floor entirely: a per-flag allowlist has to know every
+// curl flag's write capability across curl versions, and two rounds of it
+// leaked. This scan carries the opposite, tractable obligation: it names
+// only capability it CAN name, and everything it does not name stays
+// unclassified (approval-gated) rather than floored.
+function scanCurl(args, hits) {
+    let localWrite = false;
+    let body = false;
+    let atFile = false;
+    // `-w`/`--write-out`'s format string writes a LOCAL FILE when it carries
+    // curl 8.3.0's `%output{FILE}` directive (verified on curl 8.7.1), which
+    // is the hole review round 3 found in the removed read-only floor: it
+    // allowlisted `-w` as inert. The format string is operator text that this
+    // module's whitespace tokenizer may have split across several tokens
+    // (`-w 'code=%{http_code} %output{/etc/x}'`), so `%output` is looked for
+    // in EVERY token once a write-out flag is present, not only in the one
+    // token that follows the flag. That over-matches a URL or an unrelated
+    // argument carrying the literal `%output`, which is the safe direction.
+    const decoded = args.map((a) => decodeShellWord(a));
+    if (decoded.some(isCurlWriteOutFlag) && decoded.some((t) => t.includes("%output"))) {
+        localWrite = true;
+    }
+    // `-H @FILE`: a LOCAL file read into the outgoing request. The `@` sits
+    // at the very start of the value, so the first token of the value is
+    // always the right place to look and the precise per-flag extraction is
+    // hole-free here.
+    //
+    // `-b`/`--cookie` is checked separately, by its own rule (see
+    // CURL_COOKIE_FLAG above): a value with no `=` is a filename curl reads,
+    // regardless of an `@` prefix.
+    for (let i = 0; i < args.length; i += 1) {
+        const headerValue = curlFlagValue(decoded[i], args[i + 1], CURL_HEADER_FLAG.long, CURL_HEADER_FLAG.short);
+        if (headerValue !== undefined && headerValue.startsWith("@"))
+            atFile = true;
+        const cookieValue = curlFlagValue(decoded[i], args[i + 1], CURL_COOKIE_FLAG.long, CURL_COOKIE_FLAG.short);
+        // An empty value (-b '') only switches curl's cookie engine on without
+        // opening a file; it is raised anyway, an accepted over-block in the safe
+        // direction.
+        if (cookieValue !== undefined && !cookieValue.includes("="))
+            atFile = true;
+    }
+    for (let i = 0; i < args.length; i += 1) {
+        const t = decodeShellWord(args[i]);
+        if (!t.startsWith("-") || t === "-" || t === "--")
+            continue;
+        const eq = t.indexOf("=");
+        const name = eq === -1 ? t : t.slice(0, eq);
+        if (name === "--request" || (t.startsWith("-X") && !t.startsWith("--"))) {
+            let value;
+            if (name === "--request") {
+                value = eq === -1 ? (args[i + 1] === undefined ? undefined : decodeShellWord(args[i + 1])) : t.slice(eq + 1);
+            }
+            else {
+                const glued = t.slice(2);
+                value = glued.length > 0 ? glued : args[i + 1] === undefined ? undefined : decodeShellWord(args[i + 1]);
+            }
+            const method = (value ?? "").toUpperCase();
+            if (method !== "" && method !== "GET" && method !== "HEAD")
+                body = true;
+            continue;
+        }
+        if (CURL_LOCAL_WRITE_LONG_FLAGS.has(name)) {
+            localWrite = true;
+            continue;
+        }
+        if (CURL_BODY_LONG_FLAGS.has(name)) {
+            body = true;
+            continue;
+        }
+        if (t.startsWith("--"))
+            continue;
+        if (CURL_LOCAL_WRITE_SHORT_CHARS.some((c) => shortClusterHas(t, c)))
+            localWrite = true;
+        if (CURL_BODY_SHORT_CHARS.some((c) => shortClusterHas(t, c)))
+            body = true;
+    }
+    if (localWrite) {
+        hits.push({
+            severity: "high",
+            categories: ["destructive", "data_loss"],
+            reason: "built-in destructive floor: curl writes a local file",
+        });
+    }
+    if (body) {
+        hits.push({
+            severity: "high",
+            categories: ["production_mutation", "network_exfiltration"],
+            reason: "built-in destructive floor: curl sends a request body or a non-GET/HEAD method",
+        });
+    }
+    if (atFile) {
+        // `network_exfiltration` alone, not the request-body pair: reading a
+        // local file into a header or a cookie ships data OUT, but it does not
+        // by itself mutate the remote resource, so `production_mutation` would
+        // be a claim this scan cannot make. Without an irreversible category
+        // the profile stays `reversible: true`, which is honest for a read.
+        hits.push({
+            severity: "high",
+            categories: ["network_exfiltration"],
+            reason: "built-in destructive floor: curl reads a local file into the request (@ value on -H, or a no-= value on -b)",
+        });
+    }
+}
+//# sourceMappingURL=destructive-shell-floor.js.map

package/dist/runtime/destructive-shell-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive-shell-floor.js","sourceRoot":"","sources":["../../src/runtime/destructive-shell-floor.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,gEAAgE;AAChE,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qCAAqC;AACrC,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,mEAAmE;AACnE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,yCAAyC;AACzC,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,+BAA+B;AAG/B,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAUlD,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,iDAAiD;AACjD,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC,wEAAwE;AACxE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE5E,6DAA6D;AAC7D,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;CAC1C,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,IAAoC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,IAA2B;IAC9E,IAAI,KAAK,GAAG,iBAAiB;QAAE,OAAO;IAEtC,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,SAA4B;IAC/C,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,UAAU,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,0EAA0E;QAC1E,qEAAqE;QACrE,qCAAqC;QACrC,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,GAAG,IAAI,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,MAAM;YAAE,MAAM;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACnC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,SAA4B,EAAE,KAAa,EAAE,IAA2B;IAC9F,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,qBAAqB,CAAC;YAC/D,MAAM,EAAE,8DAA8D;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,uBAAuB,CAAC;YACjE,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAuB,EAAE,KAAa,EAAE,IAA2B;IACzF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO;IAC1B,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,GAAW,EAAE,IAA4B;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,CAAS,EAAE,EAAU;IAC5C,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;CACxC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,mBAAmB,CAAC,IAAuB;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,uDAAuD;AACvD,SAAS,MAAM,CAAC,IAAuB,EAAE,IAA2B;IAClE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO;IACzE,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QACxC,MAAM,EAAE,yDAAyD;KAClE,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,kBAAkB;AAClB,SAAS,YAAY,CAAC,IAAuB,EAAE,IAA2B;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC3F,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QACxC,MAAM,EAAE,2DAA2D;KACpE,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAA2B;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;gBACxC,MAAM,EAAE,0CAA0C;aACnD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1D,IAAI,CAAC,IAAI,CAAC;oBACR,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;oBACxC,MAAM,EAAE,2CAA2C;iBACpD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,IAAuB,EAAE,IAA2B;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAC9B,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,UAAmC,EAAE,MAAc,EAAQ,EAAE;QACzE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,+BAA+B,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC;IAEF,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,UAAU,CACR,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,SAAS;YACf,CAAC,KAAK,oBAAoB;YAC1B,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YACjB,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CACF,CAAC;QACF,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACjE,CAAC;QACF,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,sCAAsC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,4DAA4D;AAC5D,SAAS,cAAc,CAAC,IAAY,EAAE,IAAuB,EAAE,IAA2B;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACrE,CAAC;IACF,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,MAAM,EAAE,+BAA+B,IAAI,2BAA2B;KACvE,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,qCAAqC;AACrC,SAAS,OAAO,CAAC,IAAuB,EAAE,IAA2B;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,UAAU,CACR,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CACpF,CACF,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QACxC,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;AACL,CAAC;AAED,0CAA0C;AAC1C,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU;IACxE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe;IAC1E,UAAU,EAAE,sBAAsB;CACnC,CAAC,CAAC;AACH,MAAM,4BAA4B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAClF,wEAAwE;AACxE,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc;IAC3E,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe;CACtE,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,gBAAgB,GAAoC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAoC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CACpB,KAAa,EACb,IAAwB,EACxB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,SAAS,GAAG,GAAuB,EAAE,CACzC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,6DAA6D;AAC7D,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,qDAAqD;AACrD,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAA2B;IACpE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,kBAAkB;IAClB,EAAE;IACF,8DAA8D;IAC9D,yEAAyE;IACzE,+BAA+B;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,aAAa,CAC/B,OAAO,CAAC,CAAC,CAAE,EACX,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EACX,gBAAgB,CAAC,IAAI,EACrB,gBAAgB,CAAC,KAAK,CACvB,CAAC;QACF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;QAE5E,MAAM,WAAW,GAAG,aAAa,CAC/B,OAAO,CAAC,CAAC,CAAE,EACX,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EACX,gBAAgB,CAAC,IAAI,EACrB,gBAAgB,CAAC,KAAK,CACvB,CAAC;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,aAAa;QACb,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,KAAyB,CAAC;YAC9B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAAE,IAAI,GAAG,IAAI,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACvF,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;YACxC,MAAM,EAAE,sDAAsD;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;YAC3D,MAAM,EAAE,gFAAgF;SACzF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,CAAC,sBAAsB,CAAC;YACpC,MAAM,EACJ,6GAA6G;SAChH,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/runtime/intercept.d.ts

@@ -44,13 +44,16 @@ export interface PolicyDecision {
      */
     recordHint?: string;
     /**
-     * True when the policy's `when:` block matched ONLY because the action
-     * was unclassified (the "unknown is not safe" fail-close rule in
-     * `when-eval.ts`). Absent when the policy has no `when:` block, when
-     * the match was a genuine classification hit, or when `unclassifiedFallback`
-     * was false. Present in the audit record and the non-ux block-time deny
-     * message so an operator can distinguish a real critical-severity match
-     * from a fail-closed unclassified command at a glance.
+     * True when the policy's `when:` block matched because the action was
+     * unclassified (the fail-close rule in `when-eval.ts`: "unknown is not
+     * safe" for `risk.category_in` / `action.reversible`, the "treated as
+     * high" rung for `risk.severity_at_least`). Absent when the policy has
+     * no `when:` block, when the match was a genuine classification hit,
+     * or when `unclassifiedFallback` was false. Present in the audit
+     * record, the non-ux block-time deny message, AND (task 2929c5b7) the
+     * ux-declared `cannot:` deny message, so an operator — or the agent
+     * reading its own deny — can distinguish a real critical-severity
+     * match from a fail-closed unclassified command at a glance.
      */
     whenUnclassifiedFallback?: boolean;
     evaluatedAt: string;