@namzu/cli 30.0.0 → 32.0.0

package/dist/schedule/fire/unattended-note.js.map

@@ -1 +1 @@
-{"version":3,"file":"unattended-note.js","sourceRoot":"","sources":["../../../src/schedule/fire/unattended-note.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAS,EAAE,EAAU;IAClD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC7C,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,YAAY;KAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACd,OAAO,GAAG,IAAI,KAAK,EAAE,GAAG,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAS,EAAE,EAAU;IACpD,OAAO,aAAa,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,iIAAiI,CAAA;AAC5K,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC7B,OAAe,EACf,UAKI,EAAE;IAEN,OAAO;QACN,4CAA4C,OAAO,2BAA2B;QAC9E,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,qIAAqI;QACrI,uKAAuK;QACvK,uGAAuG;QACvG,8LAA8L;QAC9L,GAAG,CAAC,OAAO,CAAC,OAAO;YAClB,CAAC,CAAC;gBACA,2QAA2Q;aAC3Q;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC"}
+{"version":3,"file":"unattended-note.js","sourceRoot":"","sources":["../../../src/schedule/fire/unattended-note.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAS,EAAE,EAAU;IAClD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC7C,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,YAAY;KAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACd,OAAO,GAAG,IAAI,KAAK,EAAE,GAAG,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAS,EAAE,EAAU;IACpD,OAAO,aAAa,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,iIAAiI,CAAA;AAC5K,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC7B,OAAe,EACf,UAaI,EAAE;IAEN,OAAO;QACN,4CAA4C,OAAO,2BAA2B;QAC9E,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,qIAAqI;QACrI,uKAAuK;QACvK,uGAAuG;QACvG,8LAA8L;QAC9L,GAAG,CAAC,OAAO,CAAC,OAAO;YAClB,CAAC,CAAC;gBACA,2QAA2Q;aAC3Q;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YACxC,CAAC,CAAC;gBACA,sOAAsO,OAAO,CAAC,eAAe,EAAE;aAC/P;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC"}

package/dist/schedule/fire/wake-gate.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The wake-gate output contract for a `script+agent` job: the gate script's
+ * stdout must be exactly one JSON line — its own last line, or its only
+ * line (trailing blank lines tolerated) — of the shape `{"wake": boolean,
+ * "context": string}`. Everything else the script writes is captured for
+ * the run record (`fire/run-script.ts`'s output, separately) but is never
+ * parsed as the contract.
+ *
+ * Parse failures are mechanical, not a judgement about whether the AGENT
+ * half would have succeeded: non-JSON stdout, a JSON value that is not an
+ * object, a missing/non-boolean `wake`, a non-string `context`, or more
+ * than one line of stdout that independently parses as JSON (ambiguous —
+ * which one is the answer?) are all refused the same way, by the caller,
+ * as `check-failed`.
+ *
+ * The gate script's stdout is UNTRUSTED — it is runtime output, not
+ * anything an operator confirmed — and a parse failure quotes a slice of
+ * it in the `reason` this module returns, which reaches the operator on
+ * `schedule show`/`history` and a desktop notification. `shown()` runs it
+ * through the same `sanitizeLine()` a notification already uses for the
+ * model's own text, so a gate script cannot put control characters or a
+ * terminal escape sequence on the operator's screen through a malformed
+ * contract line.
+ */
+export interface WakeGateResult {
+    readonly wake: boolean;
+    /** Cut to the job's `wakeGate.maxContextChars`, with an explicit marker — never silently. */
+    readonly context: string;
+}
+export type WakeGateOutcome = {
+    readonly ok: true;
+    readonly result: WakeGateResult;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** Parse a wake-gate's stdout against the contract, capping `context` at `maxContextChars`. */
+export declare function parseWakeGateOutput(stdout: string, maxContextChars: number): WakeGateOutcome;
+//# sourceMappingURL=wake-gate.d.ts.map

package/dist/schedule/fire/wake-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wake-gate.d.ts","sourceRoot":"","sources":["../../../src/schedule/fire/wake-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAiBlD,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,eAAe,CAkD5F"}

package/dist/schedule/fire/wake-gate.js

@@ -0,0 +1,90 @@
+/**
+ * The wake-gate output contract for a `script+agent` job: the gate script's
+ * stdout must be exactly one JSON line — its own last line, or its only
+ * line (trailing blank lines tolerated) — of the shape `{"wake": boolean,
+ * "context": string}`. Everything else the script writes is captured for
+ * the run record (`fire/run-script.ts`'s output, separately) but is never
+ * parsed as the contract.
+ *
+ * Parse failures are mechanical, not a judgement about whether the AGENT
+ * half would have succeeded: non-JSON stdout, a JSON value that is not an
+ * object, a missing/non-boolean `wake`, a non-string `context`, or more
+ * than one line of stdout that independently parses as JSON (ambiguous —
+ * which one is the answer?) are all refused the same way, by the caller,
+ * as `check-failed`.
+ *
+ * The gate script's stdout is UNTRUSTED — it is runtime output, not
+ * anything an operator confirmed — and a parse failure quotes a slice of
+ * it in the `reason` this module returns, which reaches the operator on
+ * `schedule show`/`history` and a desktop notification. `shown()` runs it
+ * through the same `sanitizeLine()` a notification already uses for the
+ * model's own text, so a gate script cannot put control characters or a
+ * terminal escape sequence on the operator's screen through a malformed
+ * contract line.
+ */
+import { sanitizeLine } from '../../integrations/notifications/desktop/sanitize.js';
+/** Untrusted text as a refusal quotes it: sanitized, one line, cut to fit, in backticks. */
+function shown(text, max = 200) {
+    const cut = sanitizeLine(text, max);
+    return cut.includes('`') ? `\`\` ${cut} \`\`` : `\`${cut}\``;
+}
+function isJson(line) {
+    try {
+        JSON.parse(line);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Parse a wake-gate's stdout against the contract, capping `context` at `maxContextChars`. */
+export function parseWakeGateOutput(stdout, maxContextChars) {
+    const lines = stdout.split(/\r?\n/);
+    while (lines.length > 0 && lines.at(-1).trim() === '')
+        lines.pop();
+    if (lines.length === 0) {
+        return {
+            ok: false,
+            reason: 'the wake-gate script produced no output; it must print exactly one JSON line, {"wake": boolean, "context": string}',
+        };
+    }
+    const last = lines.at(-1);
+    if (!isJson(last)) {
+        return {
+            ok: false,
+            reason: `the wake-gate script's stdout does not end with JSON: ${shown(last)}`,
+        };
+    }
+    const earlierJsonLines = lines.slice(0, -1).filter((line) => line.trim() !== '' && isJson(line));
+    if (earlierJsonLines.length > 0) {
+        return {
+            ok: false,
+            reason: 'the wake-gate script printed more than one line of JSON stdout; it must print exactly one, as its last line',
+        };
+    }
+    const value = JSON.parse(last);
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return {
+            ok: false,
+            reason: `the wake-gate script's JSON line is not an object: ${shown(last)}`,
+        };
+    }
+    const record = value;
+    if (typeof record.wake !== 'boolean') {
+        return {
+            ok: false,
+            reason: `the wake-gate script's JSON has no boolean "wake": ${shown(last)}`,
+        };
+    }
+    if (typeof record.context !== 'string') {
+        return {
+            ok: false,
+            reason: `the wake-gate script's JSON has no string "context": ${shown(last)}`,
+        };
+    }
+    const context = record.context.length > maxContextChars
+        ? `${record.context.slice(0, maxContextChars)}\n...(truncated)`
+        : record.context;
+    return { ok: true, result: { wake: record.wake, context } };
+}
+//# sourceMappingURL=wake-gate.js.map

package/dist/schedule/fire/wake-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wake-gate.js","sourceRoot":"","sources":["../../../src/schedule/fire/wake-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sDAAsD,CAAA;AAYnF,4FAA4F;AAC5F,SAAS,KAAK,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG;IACrC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAA;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC3B,IAAI,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAChB,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,eAAuB;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IAC9E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EACL,oHAAoH;SACrH,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yDAAyD,KAAK,CAAC,IAAI,CAAC,EAAE;SAC9E,CAAA;IACF,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAChG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EACL,6GAA6G;SAC9G,CAAA;IACF,CAAC;IACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sDAAsD,KAAK,CAAC,IAAI,CAAC,EAAE;SAC3E,CAAA;IACF,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sDAAsD,KAAK,CAAC,IAAI,CAAC,EAAE;SAC3E,CAAA;IACF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wDAAwD,KAAK,CAAC,IAAI,CAAC,EAAE;SAC7E,CAAA;IACF,CAAC;IACD,MAAM,OAAO,GACZ,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,eAAe;QACtC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,kBAAkB;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAA;IAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAA;AAC5D,CAAC"}

package/dist/schedule/floor.d.ts

@@ -106,7 +106,7 @@ export interface FloorOptions {
 /** What the floor keeps a run's paths out of. */
 export type FloorProtected = 'NAMZU_HOME' | 'the browser profiles';
 /** Why the floor denied a call: for tests and diagnostics. */
-export type FloorReason = `names ${FloorProtected}` | 'scheduler command' | `word names ${FloorProtected}` | `assigned value names ${FloorProtected}` | `redirection names ${FloorProtected}` | `loop or case word names ${FloorProtected}` | 'opaque line mentions a protected name' | 'unread text mentions a protected name' | 'too many spellings';
+export type FloorReason = `names ${FloorProtected}` | 'scheduler command' | `word names ${FloorProtected}` | `assigned value names ${FloorProtected}` | `redirection names ${FloorProtected}` | `loop or case word names ${FloorProtected}` | 'opaque line mentions a protected name' | 'unread text mentions a protected name' | 'encoded command cannot be read at all' | 'find -exec reaches a protected target' | 'runs a file the script wrote earlier' | 'too many spellings';
 /** Why the floor denied a call, and what in it matched. */
 export interface FloorFinding {
     readonly reason: FloorReason;

package/dist/schedule/floor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floor.d.ts","sourceRoot":"","sources":["../../src/schedule/floor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EACN,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EAStB,MAAM,YAAY,CAAA;AAEnB,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAkD,CAAA;AAE/F,MAAM,WAAW,YAAY;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,sBAAsB,CAAA;AAElE,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACpB,SAAS,cAAc,EAAE,GACzB,mBAAmB,GACnB,cAAc,cAAc,EAAE,GAC9B,wBAAwB,cAAc,EAAE,GACxC,qBAAqB,cAAc,EAAE,GACrC,2BAA2B,cAAc,EAAE,GAC3C,uCAAuC,GACvC,uCAAuC,GACvC,oBAAoB,CAAA;AAEvB,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,YAAY,GACnB,CAAC,IAAI,EAAE,0BAA0B,KAAK,WAAW,GAAG,IAAI,CAG1D;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,YAAY,GACnB,CAAC,IAAI,EAAE,0BAA0B,KAAK,YAAY,GAAG,IAAI,CAG3D;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAE1D;AAQD,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAE5D;AAED,kCAAkC;AAClC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,iBAAiB,CAe9E;AAimCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD"}
+{"version":3,"file":"floor.d.ts","sourceRoot":"","sources":["../../src/schedule/floor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EACN,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EAUtB,MAAM,YAAY,CAAA;AAEnB,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAkD,CAAA;AAE/F,MAAM,WAAW,YAAY;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,sBAAsB,CAAA;AAElE,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACpB,SAAS,cAAc,EAAE,GACzB,mBAAmB,GACnB,cAAc,cAAc,EAAE,GAC9B,wBAAwB,cAAc,EAAE,GACxC,qBAAqB,cAAc,EAAE,GACrC,2BAA2B,cAAc,EAAE,GAC3C,uCAAuC,GACvC,uCAAuC,GACvC,uCAAuC,GACvC,uCAAuC,GACvC,sCAAsC,GACtC,oBAAoB,CAAA;AAEvB,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,YAAY,GACnB,CAAC,IAAI,EAAE,0BAA0B,KAAK,WAAW,GAAG,IAAI,CAG1D;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,YAAY,GACnB,CAAC,IAAI,EAAE,0BAA0B,KAAK,YAAY,GAAG,IAAI,CAG3D;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAE1D;AAQD,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAE5D;AAED,kCAAkC;AAClC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,iBAAiB,CAe9E;AAy3CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD"}

package/dist/schedule/floor.js

@@ -83,7 +83,7 @@
  *
  * Everything here is linear in the input.
  */
-import { builtinCommandArguments, commandArgumentOf, lexShellCommandLine, nestedShellCommand, } from '@namzu/sdk';
+import { builtinCommandArguments, commandArgumentOf, lexShellCommandLine, nestedShellCommand, programPositions, } from '@namzu/sdk';
 /** Scheduler verbs a run may use: they read, they change nothing. */
 export const READ_ONLY_VERBS = ['list', 'show', 'status', 'history', 'logs'];
 /** The floor's reason for denying a call, or null: what the rule below decides on. */
@@ -185,6 +185,17 @@ const STRING_OPTIONS = {
     sudo: /^-(?:[a-z]*[si][a-z]*|-shell|-login)$/,
     env: /^-(?:[a-z]*s[a-z]*|-split-string(?:=.*)?)$/i,
 };
+/** PowerShell's two names, wherever the floor treats them as an unread shell. */
+const POWERSHELL_NAMES = new Set(['powershell', 'pwsh']);
+/**
+ * `-EncodedCommand` and every unambiguous prefix PowerShell itself accepts
+ * (`-e`, `-en`, `-enc`, …, up to the full name), case-insensitive. Unlike
+ * `-Command`/`-c`, whose literal text the tripwire can still read, the
+ * argument here is base64 of UTF-16LE: nothing in it can be read as text, so
+ * a line the tripwire finds nothing in front of proves nothing about what it
+ * runs.
+ */
+const ENCODED_COMMAND_FLAG = /^-e(?:n(?:c(?:o(?:d(?:e(?:d(?:c(?:o(?:m(?:m(?:a(?:n(?:d)?)?)?)?)?)?)?)?)?)?)?)?)?$/i;
 /** What a refusal says about a `schedule` verb that is not read-only. */
 const NOT_READ_ONLY = `a \`namzu schedule\` subcommand other than ${READ_ONLY_VERBS.join(', ')}`;
 const NAME_CHAR = /[a-z0-9._-]/;
@@ -235,15 +246,51 @@ function wordsOf(command, catalogue) {
  * before; for a question of "is there such a subsequence" that loses
  * nothing, and it is one pass.
  */
-function reachesScheduler(words, daemonCommandLine) {
+function reachesScheduler(command, words, daemonCommandLine, dialect) {
     const n = words.length;
     const find = (from, test) => {
         for (let i = from; i < n; i++)
-            if (test(words[i]))
+            if (test(words[i], i))
                 return i;
         return -1;
     };
-    const named = (name) => (w) => w.wild ? w.text.includes(name) : commandName(w.text) === name;
+    // Where a program name could stand: `programPositions` — the SDK's one
+    // answer to "where does this command actually exec a program" — unwraps
+    // a chain of re-exec wrappers (`sudo`, `env`, `nice`, `timeout`, …) with
+    // each one's own real option grammar, rather than assuming the program
+    // sits right after the wrapper's name (`timeout 5 prog`, `stdbuf -oL
+    // prog` and `ionice -c2 -n7 prog` all take at least one word of their
+    // own first). `words`/`command.words` share indices, so a resolved
+    // position's word maps straight back to one. A position `programPositions`
+    // could not resolve because that word ITSELF expands (`sudo
+    // $(echo systemctl) stop x`) still carries the word, so it becomes a
+    // head here too — same as before, just correctly placed after however
+    // many wrapper words came first. A literal `source`/`.` with a literal
+    // path, or a literal `eval` whose literal payload lexes cleanly, is read
+    // the same way and adds its own resolved position(s) here too. A
+    // position it could not resolve for a structural reason with no wild
+    // word of its own (an option a wrapper does not recognise, too many
+    // wrappers, an opaque `eval` payload) carries no word and adds nothing
+    // here; that gap is not this fix's scope — an interpreter or unread
+    // construct is the tripwire's and `runsUnreadText`'s job, not this one's.
+    const heads = new Set();
+    for (const position of programPositions(command, dialect)) {
+        if (position.word === undefined)
+            continue;
+        const idx = command.words.indexOf(position.word);
+        if (idx >= 0)
+            heads.add(idx);
+    }
+    // A wild (expanding) word in one of those positions cannot be read as
+    // NOT being the tool in question — a substring check on its raw,
+    // unevaluated text (`$(echo pk)ill`) is defeated by gluing a literal
+    // suffix onto the substitution, which never contains the tool's name as
+    // one contiguous run. Unknown never passes: such a word counts as being
+    // every name checked here, the same way `namesNamzu`/a verb check
+    // already treats a wild argument. A wild word elsewhere (an argument, a
+    // path — `find ~/.namzu -exec …`'s `~/.namzu`) is not a program name and
+    // is read as what it actually is, an argument, by the checks below.
+    const named = (name) => (w, i) => (w.wild && heads.has(i)) || commandName(w.text) === name;
     const namesNamzu = (w) => w.wild || w.text.includes('namzu');
     // systemctl <verb> <unit>
     const systemctl = find(0, named('systemctl'));
@@ -270,7 +317,7 @@ function reachesScheduler(words, daemonCommandLine) {
             return "deletes, changes or ends the scheduler's task";
     }
     // pkill / killall: a pattern that could match the daemon's process.
-    const killer = find(0, (w) => named('pkill')(w) || named('killall')(w));
+    const killer = find(0, (w, i) => named('pkill')(w, i) || named('killall')(w, i));
     if (killer >= 0) {
         const kills = "has a pattern that could match the scheduler's process";
         const full = words
@@ -291,7 +338,7 @@ function reachesScheduler(words, daemonCommandLine) {
         }
     }
     // A D-Bus call to systemd naming the unit.
-    const dbus = find(0, (w) => DBUS_TOOLS.has(commandName(w.text)));
+    const dbus = find(0, (w, i) => (w.wild && heads.has(i)) || DBUS_TOOLS.has(commandName(w.text)));
     if (dbus >= 0 && find(dbus + 1, namesNamzu) >= 0)
         return 'calls systemd about a namzu unit';
     // The CLI, by name (`namzu`, a path to it, `npx @namzu/cli`) or through
@@ -344,6 +391,17 @@ function runsUnreadText(command) {
             return `${program} runs text as code`;
         if (i === head && name === '.')
             return '`.` runs a file as commands';
+        if (i === head && name === 'trap') {
+            // `trap [-lp] [action] [sigspec...]`: the action, when given, runs as
+            // a command line when the signal fires — read the same way a nested
+            // shell's `-c` payload is, just later. `-l`/`-p`/`--` alone print or
+            // reset and run nothing.
+            const action = words
+                .slice(i + 1)
+                .find((w) => w.expands || (w.value !== '-l' && w.value !== '-p' && w.value !== '--'));
+            if (action !== undefined)
+                return `${program} runs its action as a command when the signal fires`;
+        }
         if (SHELLS.has(name) && !(i >= head && i <= readTo))
             return `${program} runs commands the floor does not read`;
     }
@@ -354,6 +412,22 @@ function runsUnreadText(command) {
     }
     return null;
 }
+/**
+ * `powershell`/`pwsh`, anywhere in the command, given `-EncodedCommand` (or
+ * an unambiguous prefix of it): the program word and the flag, or null.
+ */
+function encodedCommandCall(command) {
+    const words = command.words;
+    for (let i = command.assignments; i < words.length; i++) {
+        const word = words[i];
+        if (word.expands || !POWERSHELL_NAMES.has(commandName(word.value)))
+            continue;
+        const flag = words.slice(i + 1).find((w) => !w.expands && ENCODED_COMMAND_FLAG.test(w.value));
+        if (flag !== undefined)
+            return { program: word, flag };
+    }
+    return null;
+}
 // ---------------------------------------------------------------------------
 // Paths
 /**
@@ -649,17 +723,14 @@ class Floor {
     lineVerdict(line, dialect, depth = 0) {
         // A line for a shell that may be bash or a POSIX shell is read both
         // ways, and denied if either reading denies it.
-        const readings = dialect === 'bash'
-            ? [lexShellCommandLine(line, { dialect: 'bash' })]
-            : [
-                lexShellCommandLine(line, { dialect: 'sh' }),
-                lexShellCommandLine(line, { dialect: 'bash' }),
-            ];
+        const dialects = dialect === 'bash' ? ['bash'] : ['sh', 'bash'];
+        const readings = dialects.map((d) => lexShellCommandLine(line, { dialect: d }));
         const catalogue = /textdomain/i.test(line);
         const loops = /\b(?:while|until|for|select)\b/.test(line);
         let unaccounted = null;
-        for (const reading of readings) {
-            const finding = this.readingVerdict(reading, catalogue, loops);
+        for (let i = 0; i < readings.length; i += 1) {
+            const reading = readings[i];
+            const finding = this.readingVerdict(reading, catalogue, loops, dialects[i]);
             if (finding !== null)
                 return finding;
             if (reading.opaque) {
@@ -793,9 +864,17 @@ class Floor {
             }
         return null;
     }
-    readingVerdict(reading, catalogue, loops) {
+    readingVerdict(reading, catalogue, loops, dialect) {
+        for (const command of reading.commands) {
+            const encoded = encodedCommandCall(command);
+            if (encoded !== null)
+                return {
+                    reason: 'encoded command cannot be read at all',
+                    detail: `${shown(encoded.program.value)} ${shown(encoded.flag.value)} runs a base64-encoded script the floor cannot read at all, so it is refused outright whatever it decodes to; use -Command '<literal text>' instead`,
+                };
+        }
         for (const command of reading.commands) {
-            const does = reachesScheduler(wordsOf(command, catalogue), this.daemonCommandLine);
+            const does = reachesScheduler(command, wordsOf(command, catalogue), this.daemonCommandLine, dialect);
             if (does !== null)
                 return {
                     reason: 'scheduler command',
@@ -819,8 +898,32 @@ class Floor {
             for (const command of reading.commands)
                 cwd.after(command, (target) => this.spell(target, variables, cwd.current()), this.userHome);
         const seen = new Set();
+        /** Files an earlier command in this line wrote, resolved and normalized; content unverifiable. */
+        const written = new Set();
         for (const command of reading.commands) {
             const here = cwd.current();
+            const findExec = this.findExecFinding(command, variables, here, dialect);
+            if (findExec !== null)
+                return findExec;
+            const executed = executedPath(command);
+            if (executed !== null && !executed.expands) {
+                for (const base of isAbsolute(executed.value) ? [''] : here.dirs) {
+                    const path = base === '' ? normalize(executed.value) : join(base, executed.value);
+                    if (written.has(path)) {
+                        return {
+                            reason: 'runs a file the script wrote earlier',
+                            detail: `${shown(command.text)} runs ${shown(executed.text)}, which an earlier command in this script wrote; its content cannot be verified, so it is refused rather than run unattended`,
+                        };
+                    }
+                }
+            }
+            for (const target of writeTargets(command)) {
+                if (target.expands)
+                    continue;
+                for (const base of isAbsolute(target.value) ? [''] : here.dirs) {
+                    written.add(base === '' ? normalize(target.value) : join(base, target.value));
+                }
+            }
             const check = (word) => this.wordNames(word, variables, here, expands);
             const standalone = command.words.length === command.assignments && !exported;
             for (const [i, word] of command.words.entries()) {
@@ -1129,6 +1232,174 @@ class Floor {
         }
         return false;
     }
+    /**
+     * `find … -exec|-execdir|-ok|-okdir … ;|+`: the clause runs on every path
+     * `find` matches, substituted for `{}` — a placeholder no static reading
+     * can resolve. Refused when `{}` stands in that clause AND the search
+     * could plausibly reach a protected target: the root is unknown or is
+     * NAMZU_HOME itself or an ancestor of it (so `find` would recurse THROUGH
+     * it), a `-name`/`-iname`/`-path`/`-ipath` pattern could match NAMZU_HOME's
+     * own folder name, or the clause's own program is a tool that can stop or
+     * remove a service (`{}` there could name the scheduler's unit without
+     * ever spelling it in the line the floor can read).
+     */
+    findExecFinding(command, variables, cwd, dialect) {
+        const words = command.words;
+        const findAt = programPositions(command, dialect)
+            .map((position) => position.word && !position.word.expands && commandName(position.word.value) === 'find'
+            ? words.indexOf(position.word)
+            : -1)
+            .find((index) => index >= 0);
+        if (findAt === undefined)
+            return null;
+        const head = words[findAt];
+        const rootWords = [];
+        let i = findAt + 1;
+        while (i < words.length) {
+            const w = words[i];
+            if (!w.expands && (w.value.startsWith('-') || w.value === '(' || w.value === '!'))
+                break;
+            rootWords.push(w);
+            i++;
+        }
+        const roots = rootWords.length > 0
+            ? rootWords
+            : [{ text: '.', value: '.', expands: false, quoted: false, substitutes: false }];
+        const reachesHome = roots.some((root) => {
+            if (root.expands)
+                return true;
+            for (const spelling of this.spell(root, variables, cwd)) {
+                if (spelling.stop !== 'end')
+                    return true;
+                const bases = isAbsolute(spelling.known) ? [''] : cwd.dirs.length > 0 ? cwd.dirs : [''];
+                for (const base of bases) {
+                    const path = base === '' ? normalize(spelling.known) : join(base, spelling.known);
+                    if (this.inside(path) || this.belowAncestor(path) !== null)
+                        return true;
+                }
+            }
+            return false;
+        });
+        let filterMatchesHome = false;
+        for (let j = findAt; j < words.length; j++) {
+            const flag = words[j];
+            if (flag.expands || !/^-i?(?:name|path)$/.test(flag.value))
+                continue;
+            const pattern = words[j + 1];
+            if (!pattern || pattern.expands)
+                continue;
+            if (this.homeSegments.some((seg) => mayBe(lower(pattern.value), seg.name))) {
+                filterMatchesHome = true;
+                break;
+            }
+        }
+        for (let j = findAt + 1; j < words.length; j++) {
+            const flag = words[j];
+            if (flag.expands || !/^-(?:exec|execdir|ok|okdir)$/.test(flag.value))
+                continue;
+            let k = j + 1;
+            let hasPlaceholder = false;
+            const clauseStart = k;
+            while (k < words.length) {
+                const w = words[k];
+                if (!w.expands && (w.value === ';' || w.value === '+'))
+                    break;
+                if (!w.expands) {
+                    if (w.value.includes('{}'))
+                        hasPlaceholder = true;
+                }
+                k++;
+            }
+            // Ask the shared resolver what this clause actually runs. The
+            // first word may be `env`/`sudo`/another wrapper, and a shell -c
+            // payload can itself name a service tool. Reusing a one-clause
+            // find command keeps the answer tied to this clause.
+            const clauseCommand = {
+                ...command,
+                words: [head, flag, ...words.slice(clauseStart, k)],
+                assignments: 0,
+            };
+            const toolIsSchedulerTool = programPositions(clauseCommand, dialect)
+                .slice(1)
+                .some((position) => position.unknown !== undefined ||
+                (position.word !== undefined &&
+                    SCHEDULER_EXEC_TOOLS.has(commandName(position.word.value))));
+            if (hasPlaceholder && (reachesHome || filterMatchesHome || toolIsSchedulerTool)) {
+                const clauseText = words
+                    .slice(clauseStart, k)
+                    .map((w) => w.text)
+                    .join(' ');
+                const why = toolIsSchedulerTool
+                    ? "its clause's own program can stop or remove a service"
+                    : filterMatchesHome
+                        ? 'a -name/-iname/-path/-ipath pattern could match NAMZU_HOME’s own folder name'
+                        : 'its search root is unknown, is NAMZU_HOME, or is an ancestor of it';
+                return {
+                    reason: 'find -exec reaches a protected target',
+                    detail: `${shown(command.text)} runs \`${flag.value} ${clauseText}\` on whatever it finds, and ${why}; the floor cannot verify what {} will stand for`,
+                };
+            }
+            j = k;
+        }
+        return null;
+    }
+}
+/** Tools whose `find -exec`/`-execdir`/`-ok`/`-okdir` clause the floor refuses outright: each can stop or remove a service. */
+const SCHEDULER_EXEC_TOOLS = new Set([
+    'systemctl',
+    'launchctl',
+    'schtasks',
+    'pkill',
+    'killall',
+    'busctl',
+    'dbus-send',
+    'gdbus',
+]);
+/** A write target this command names: `>`/`>>` redirections, `tee`'s arguments, `cp`/`mv`'s destination. */
+function writeTargets(command) {
+    const targets = [];
+    for (const r of command.redirections) {
+        if (r.operator === '>' || r.operator === '>>')
+            targets.push(r.target);
+    }
+    const words = command.words;
+    const head = words[command.assignments];
+    if (!head || head.expands)
+        return targets;
+    const name = commandName(head.value);
+    const rest = words
+        .slice(command.assignments + 1)
+        .filter((w) => w.expands || !w.value.startsWith('-'));
+    if (name === 'tee')
+        targets.push(...rest);
+    else if (name === 'cp' || name === 'mv') {
+        const last = rest.at(-1);
+        if (last)
+            targets.push(last);
+    }
+    return targets;
+}
+/**
+ * The path this command executes as a FILE — `./x.sh`, `some/dir/x.sh`,
+ * `sh x.sh`, `bash x.sh`, `. x.sh`, `source x.sh` — or null. A bare name on
+ * `PATH` (`x.sh` alone, no `/`) is not: that resolves to whatever `PATH`
+ * finds, not a file this line can be shown to have written.
+ */
+function executedPath(command) {
+    const words = command.words;
+    const head = words[command.assignments];
+    if (!head || head.expands)
+        return null;
+    const name = commandName(head.value);
+    if (name === 'sh' || name === 'bash' || name === '.' || name === 'source') {
+        const rest = words
+            .slice(command.assignments + 1)
+            .filter((w) => w.expands || !w.value.startsWith('-'));
+        return rest[0] ?? null;
+    }
+    if (!head.expands && head.value.includes('/'))
+        return head;
+    return null;
 }
 /** `NAME=value`, `NAME+=value` or `--opt=value`: the value as a word of its own. */
 function assignedValue(word) {
@@ -1146,6 +1417,7 @@ function assignedValue(word) {
             value: word.value.slice(match[0].length),
             expands: word.expands,
             quoted: word.quoted,
+            substitutes: word.substitutes,
         },
     };
 }