@namzu/sdk 30.2.0 → 31.1.0

package/dist/authorization/command-line.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Break a command line into the commands it actually runs.
+ *
+ * ## The hole this closes
+ *
+ * A pattern rule tests a regular expression against an argument's value. When
+ * that value is a command line, the value and the command are not the same
+ * thing: `git push origin main` is one command, and
+ * `true; git push origin main` is two, of which the second is the one the rule
+ * was written about. An anchored pattern sees only the first.
+ *
+ * Measured against the gate, with the rule from this repository's own
+ * documentation (`^git push`, deny):
+ *
+ *     git push origin main               -> deny
+ *     echo hi && git push origin main    -> did not match
+ *     true; git push origin main         -> did not match
+ *     bash -c "git push origin main"     -> did not match
+ *
+ * A rule that fails to match reaches the permission mode, and a run with no
+ * terminal resolves that to `auto`. So an operator's prohibition was bypassed
+ * by typing four characters in front of it, in exactly the unattended case the
+ * prohibition exists for. The `bash` tool's own description tells the model to
+ * "use `&&` / `;` chaining for compound commands", so the evading form is not
+ * an exotic input — it is the documented one.
+ *
+ * ## Why splitting alone would make things worse
+ *
+ * Applied naively this widens `allow` in the same motion it fixes `deny`. An
+ * allow rule matching `^git status` would go on matching the first segment of
+ * `git status && rm -rf ~` and hand back `allow` for the whole line. So the
+ * caller must read the two decisions differently, and {@link evaluateRule}
+ * does:
+ *
+ * - **deny** matches when ANY segment matches. One prohibited command poisons
+ *   the line it rides on.
+ * - **allow** matches only when EVERY segment matches, and never when the line
+ *   is {@link CommandLineDecomposition.opaque}. Permission is a claim about the
+ *   whole line, and a claim that cannot be checked is not granted.
+ *
+ * That asymmetry is the same one `refuse-do-not-degrade` describes: when the
+ * analysis is uncertain, the uncertainty spends against the permissive answer.
+ *
+ * ## What `opaque` means
+ *
+ * Some lines contain text that is not the command that runs. Command
+ * substitution (`$(…)`, backticks, `<(…)`) executes something whose text is
+ * not in the line at all, and `eval` runs a string assembled at runtime. No
+ * decomposition of the source can be a decomposition of what ran, so the line
+ * is marked opaque and `allow` declines it. `deny` still tests what is visible,
+ * because a deny that matches too much costs a prompt and a deny that matches
+ * too little costs the thing it was written to prevent.
+ *
+ * ## What it deliberately does not do
+ *
+ * A value with no chain operator, no nested shell and nothing opaque comes back
+ * as itself, byte for byte. That keeps every rule about a non-command argument
+ * — a path, a number, a URL — behaving exactly as it did, and confines this
+ * machinery to the case that motivated it.
+ *
+ * It is a decomposition, not a shell. `xargs sh -c`, a command read from a
+ * file, and a shell invoked through an interpreter it does not recognise all
+ * pass through as ordinary text. Each of those either denies as before or, for
+ * an allow rule, fails to match every segment and so declines. The failure mode
+ * is a prompt, never a silent grant.
+ */
+/** The commands a line runs, and whether that list can be trusted as complete. */
+export interface CommandLineDecomposition {
+    /**
+     * The individual commands, in source order. Never empty: a line that
+     * decomposes to nothing yields the original.
+     */
+    readonly segments: readonly string[];
+    /**
+     * True when the line runs something this decomposition cannot see, so
+     * `segments` is a lower bound rather than the whole story.
+     */
+    readonly opaque: boolean;
+}
+export declare function decomposeCommandLine(command: string): CommandLineDecomposition;
+//# sourceMappingURL=command-line.d.ts.map

package/dist/authorization/command-line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-line.d.ts","sourceRoot":"","sources":["../../src/authorization/command-line.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACxB;AAwBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,wBAAwB,CAe9E"}

package/dist/authorization/command-line.js

@@ -0,0 +1,347 @@
+/**
+ * Break a command line into the commands it actually runs.
+ *
+ * ## The hole this closes
+ *
+ * A pattern rule tests a regular expression against an argument's value. When
+ * that value is a command line, the value and the command are not the same
+ * thing: `git push origin main` is one command, and
+ * `true; git push origin main` is two, of which the second is the one the rule
+ * was written about. An anchored pattern sees only the first.
+ *
+ * Measured against the gate, with the rule from this repository's own
+ * documentation (`^git push`, deny):
+ *
+ *     git push origin main               -> deny
+ *     echo hi && git push origin main    -> did not match
+ *     true; git push origin main         -> did not match
+ *     bash -c "git push origin main"     -> did not match
+ *
+ * A rule that fails to match reaches the permission mode, and a run with no
+ * terminal resolves that to `auto`. So an operator's prohibition was bypassed
+ * by typing four characters in front of it, in exactly the unattended case the
+ * prohibition exists for. The `bash` tool's own description tells the model to
+ * "use `&&` / `;` chaining for compound commands", so the evading form is not
+ * an exotic input — it is the documented one.
+ *
+ * ## Why splitting alone would make things worse
+ *
+ * Applied naively this widens `allow` in the same motion it fixes `deny`. An
+ * allow rule matching `^git status` would go on matching the first segment of
+ * `git status && rm -rf ~` and hand back `allow` for the whole line. So the
+ * caller must read the two decisions differently, and {@link evaluateRule}
+ * does:
+ *
+ * - **deny** matches when ANY segment matches. One prohibited command poisons
+ *   the line it rides on.
+ * - **allow** matches only when EVERY segment matches, and never when the line
+ *   is {@link CommandLineDecomposition.opaque}. Permission is a claim about the
+ *   whole line, and a claim that cannot be checked is not granted.
+ *
+ * That asymmetry is the same one `refuse-do-not-degrade` describes: when the
+ * analysis is uncertain, the uncertainty spends against the permissive answer.
+ *
+ * ## What `opaque` means
+ *
+ * Some lines contain text that is not the command that runs. Command
+ * substitution (`$(…)`, backticks, `<(…)`) executes something whose text is
+ * not in the line at all, and `eval` runs a string assembled at runtime. No
+ * decomposition of the source can be a decomposition of what ran, so the line
+ * is marked opaque and `allow` declines it. `deny` still tests what is visible,
+ * because a deny that matches too much costs a prompt and a deny that matches
+ * too little costs the thing it was written to prevent.
+ *
+ * ## What it deliberately does not do
+ *
+ * A value with no chain operator, no nested shell and nothing opaque comes back
+ * as itself, byte for byte. That keeps every rule about a non-command argument
+ * — a path, a number, a URL — behaving exactly as it did, and confines this
+ * machinery to the case that motivated it.
+ *
+ * It is a decomposition, not a shell. `xargs sh -c`, a command read from a
+ * file, and a shell invoked through an interpreter it does not recognise all
+ * pass through as ordinary text. Each of those either denies as before or, for
+ * an allow rule, fails to match every segment and so declines. The failure mode
+ * is a prompt, never a silent grant.
+ */
+/**
+ * Shells whose `-c` argument is another command line.
+ *
+ * Matched on the basename, so `/bin/bash` and `bash` are the same entry. An
+ * interpreter absent from this list is not a hole that grants anything: its
+ * payload stays inside one segment, where an allow rule fails to match it.
+ */
+const NESTED_SHELLS = new Set(['sh', 'bash', 'zsh', 'dash', 'ksh', 'ash', 'busybox']);
+/** Commands whose argument is code assembled at runtime. */
+const RUNTIME_EVALUATORS = new Set(['eval', 'source', '.']);
+/**
+ * Depth and width limits.
+ *
+ * A line that exceeds either is reported opaque rather than truncated: a
+ * shortened list of segments would read as complete to `allow`, which is the
+ * one reading that must never be wrong.
+ */
+const MAX_DEPTH = 4;
+const MAX_SEGMENTS = 64;
+export function decomposeCommandLine(command) {
+    const state = { opaque: false, structured: false };
+    const segments = split(command, state, 0);
+    // The untouched-value case, kept exact. Nothing was cut and nothing was
+    // unpacked, so there is no decomposition to report and the value goes back
+    // as it arrived — which is what keeps a rule about a path or a URL seeing
+    // the string it always saw, punctuation and surrounding space included.
+    if (!state.structured)
+        return { segments: [command], opaque: state.opaque };
+    if (segments.length === 0)
+        return { segments: [command], opaque: state.opaque };
+    if (segments.length > MAX_SEGMENTS) {
+        return { segments: segments.slice(0, MAX_SEGMENTS), opaque: true };
+    }
+    return { segments, opaque: state.opaque };
+}
+/**
+ * Walk the line once, quote-aware, cutting at every top-level separator.
+ *
+ * Quote tracking is the whole reason this is not a `String.split`: `echo "a &&
+ * b"` is one command that prints a literal, and a splitter that cannot tell
+ * would report a second command named `b"` — inventing a segment is as wrong as
+ * missing one, because `allow` requires every segment to match.
+ */
+function split(command, state, depth) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    const cut = () => {
+        const trimmed = trimSegment(current);
+        current = '';
+        if (trimmed === '')
+            return;
+        for (const piece of expand(trimmed, state, depth))
+            segments.push(piece);
+    };
+    for (let i = 0; i < command.length; i += 1) {
+        const char = command[i];
+        if (quote === "'") {
+            // Single quotes suspend everything, including the backslash. This is
+            // the branch that keeps `echo 'a && b'` one command.
+            if (char === "'")
+                quote = null;
+            current += char;
+            continue;
+        }
+        if (char === '\\') {
+            // An escaped separator is a literal, so both characters go through
+            // untouched and the next loop never sees the separator as one.
+            current += char + (command[i + 1] ?? '');
+            i += 1;
+            continue;
+        }
+        if (quote === '"') {
+            if (char === '"')
+                quote = null;
+            // Substitution is live inside double quotes, which is exactly where
+            // it hides best.
+            else if (isSubstitutionStart(command, i))
+                state.opaque = true;
+            current += char;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            current += char;
+            continue;
+        }
+        if (isSubstitutionStart(command, i)) {
+            state.opaque = true;
+            current += char;
+            continue;
+        }
+        const separator = separatorAt(command, i);
+        if (separator > 0) {
+            state.structured = true;
+            cut();
+            i += separator - 1;
+            continue;
+        }
+        current += char;
+    }
+    // An unterminated quote means the line does not parse. Whatever it runs is
+    // not what this walk saw, so the caller must not treat the result as a
+    // complete account.
+    if (quote !== null)
+        state.opaque = true;
+    cut();
+    return segments;
+}
+/**
+ * Length of the separator starting at `index`, or 0.
+ *
+ * The redirection cases are why this is a function. `2>&1` and `&>log` contain
+ * `&` and are not separators; splitting there would manufacture a segment named
+ * `1`, which no allow rule matches, and a command that redirects its output
+ * would stop being approvable for a reason nobody could see.
+ */
+function separatorAt(command, index) {
+    const char = command[index];
+    const next = command[index + 1];
+    if (char === '\n')
+        return 1;
+    if (char === ';')
+        return next === ';' ? 2 : 1;
+    if (char === '&') {
+        if (next === '&')
+            return 2;
+        if (next === '>')
+            return 0;
+        if (command[index - 1] === '>')
+            return 0;
+        return 1;
+    }
+    if (char === '|') {
+        if (next === '|')
+            return 2;
+        // `|&` pipes stderr as well; still a pipe, and both sides still run.
+        if (next === '&')
+            return 2;
+        return 1;
+    }
+    return 0;
+}
+/** Whether a command substitution opens here. */
+function isSubstitutionStart(command, index) {
+    const char = command[index];
+    if (char === '`')
+        return true;
+    if (char === '$' && command[index + 1] === '(')
+        return true;
+    // Process substitution: `diff <(a) <(b)` runs `a` and `b`.
+    if ((char === '<' || char === '>') && command[index + 1] === '(')
+        return true;
+    return false;
+}
+/**
+ * Strip the grouping punctuation a split leaves behind.
+ *
+ * `(cd build && make)` cuts into `(cd build` and `make)`. Leaving the bracket on
+ * would stop an allow rule matching a command it names, and — worse — stop a
+ * deny rule matching one, since `^make` does not match `make)`.
+ */
+function trimSegment(segment) {
+    return segment
+        .trim()
+        .replace(/^[({\s]+/, '')
+        .replace(/[)}\s]+$/, '');
+}
+/**
+ * Turn one segment into the commands it stands for.
+ *
+ * A shell invoked with `-c` carries a whole second command line in an argument,
+ * and that argument is where the smuggling this module exists for is easiest:
+ * `bash -c "git push"` contains no separator at all, so nothing above this
+ * function would have looked inside it.
+ *
+ * The outer segment is kept alongside the inner ones. A rule that denies the
+ * interpreter itself must still fire, and for `allow` the extra segment only
+ * makes the requirement stricter — which is the safe direction.
+ */
+function expand(segment, state, depth) {
+    const words = tokenize(segment);
+    const head = words[0];
+    if (head === undefined)
+        return [segment];
+    if (RUNTIME_EVALUATORS.has(basename(head.text))) {
+        // The argument is source text assembled elsewhere. Even when it is a
+        // visible literal, what runs is decided at runtime.
+        state.opaque = true;
+        return [segment];
+    }
+    if (!NESTED_SHELLS.has(basename(head.text)))
+        return [segment];
+    const flag = words.findIndex((word, index) => index > 0 && word.quoted === null && word.text === '-c');
+    if (flag < 0)
+        return [segment];
+    const payload = words[flag + 1];
+    if (payload === undefined) {
+        // `bash -c` with nothing after it is either a syntax error or an
+        // argument this tokenizer failed to read. Neither may be reported as
+        // "there is no nested command".
+        state.opaque = true;
+        return [segment];
+    }
+    if (depth + 1 >= MAX_DEPTH) {
+        state.opaque = true;
+        return [segment];
+    }
+    const nested = split(payload.text, state, depth + 1);
+    if (nested.length === 0)
+        return [segment];
+    state.structured = true;
+    return [segment, ...nested];
+}
+/**
+ * Split a segment into words, removing one layer of quoting.
+ *
+ * The quote is reported rather than discarded because `-c` must be the flag and
+ * not a literal: `echo "-c"` names no nested shell, and treating its next word
+ * as a command line would decompose a string that never runs.
+ */
+function tokenize(segment) {
+    const words = [];
+    let current = '';
+    let quote = null;
+    let sawQuote = null;
+    let open = false;
+    const push = () => {
+        if (open)
+            words.push({ text: current, quoted: sawQuote });
+        current = '';
+        sawQuote = null;
+        open = false;
+    };
+    for (let i = 0; i < segment.length; i += 1) {
+        const char = segment[i];
+        if (quote === "'") {
+            // Single quotes suspend the backslash too, so this branch precedes
+            // the escape below rather than sharing it.
+            if (char === "'")
+                quote = null;
+            else
+                current += char;
+            open = true;
+            continue;
+        }
+        if (char === '\\' && i + 1 < segment.length) {
+            current += segment[i + 1];
+            i += 1;
+            open = true;
+            continue;
+        }
+        if (quote === '"') {
+            if (char === '"')
+                quote = null;
+            else
+                current += char;
+            open = true;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            sawQuote = char;
+            open = true;
+            continue;
+        }
+        if (char === ' ' || char === '\t') {
+            push();
+            continue;
+        }
+        current += char;
+        open = true;
+    }
+    push();
+    return words;
+}
+function basename(word) {
+    const cut = word.lastIndexOf('/');
+    return cut < 0 ? word : word.slice(cut + 1);
+}
+//# sourceMappingURL=command-line.js.map

package/dist/authorization/command-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-line.js","sourceRoot":"","sources":["../../src/authorization/command-line.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAgBH;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAErF,4DAA4D;AAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,CAAC,CAAA;AACnB,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAc,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAEzC,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IAE3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IAC/E,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AAC1C,CAAC;AAWD;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,OAAe,EAAE,KAAgB,EAAE,KAAa;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAqB,IAAI,CAAA;IAElC,MAAM,GAAG,GAAG,GAAS,EAAE;QACtB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QACpC,OAAO,GAAG,EAAE,CAAA;QACZ,IAAI,OAAO,KAAK,EAAE;YAAE,OAAM;QAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxE,CAAC,CAAA;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAW,CAAA;QAEjC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,qEAAqE;YACrE,qDAAqD;YACrD,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAA;YAC9B,OAAO,IAAI,IAAI,CAAA;YACf,SAAQ;QACT,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,mEAAmE;YACnE,+DAA+D;YAC/D,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACxC,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACT,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAA;YAC9B,oEAAoE;YACpE,iBAAiB;iBACZ,IAAI,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC;gBAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YAC7D,OAAO,IAAI,IAAI,CAAA;YACf,SAAQ;QACT,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAA;YACZ,OAAO,IAAI,IAAI,CAAA;YACf,SAAQ;QACT,CAAC;QAED,IAAI,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YACnB,OAAO,IAAI,IAAI,CAAA;YACf,SAAQ;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACzC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;YACvB,GAAG,EAAE,CAAA;YACL,CAAC,IAAI,SAAS,GAAG,CAAC,CAAA;YAClB,SAAQ;QACT,CAAC;QAED,OAAO,IAAI,IAAI,CAAA;IAChB,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,KAAK,KAAK,IAAI;QAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;IAEvC,GAAG,EAAE,CAAA;IACL,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,KAAa;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAE/B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QAClB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,CAAA;QAC1B,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,CAAA;QAC1B,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAA;QACxC,OAAO,CAAC,CAAA;IACT,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QAClB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,CAAA;QAC1B,qEAAqE;QACrE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,CAAA;QAC1B,OAAO,CAAC,CAAA;IACT,CAAC;IACD,OAAO,CAAC,CAAA;AACT,CAAC;AAED,iDAAiD;AACjD,SAAS,mBAAmB,CAAC,OAAe,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC3D,2DAA2D;IAC3D,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC7E,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAAe;IACnC,OAAO,OAAO;SACZ,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,MAAM,CAAC,OAAe,EAAE,KAAgB,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAExC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjD,qEAAqE;QACrE,oDAAoD;QACpD,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;QACnB,OAAO,CAAC,OAAO,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAE7D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAC3B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CACxE,CAAA;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAE9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,iEAAiE;QACjE,qEAAqE;QACrE,gCAAgC;QAChC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;QACnB,OAAO,CAAC,OAAO,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;QACnB,OAAO,CAAC,OAAO,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACzC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAA;AAC5B,CAAC;AAQD;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,OAAe;IAChC,MAAM,KAAK,GAAW,EAAE,CAAA;IACxB,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAqB,IAAI,CAAA;IAClC,IAAI,QAAQ,GAAqB,IAAI,CAAA;IACrC,IAAI,IAAI,GAAG,KAAK,CAAA;IAEhB,MAAM,IAAI,GAAG,GAAS,EAAE;QACvB,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzD,OAAO,GAAG,EAAE,CAAA;QACZ,QAAQ,GAAG,IAAI,CAAA;QACf,IAAI,GAAG,KAAK,CAAA;IACb,CAAC,CAAA;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAW,CAAA;QAEjC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,mEAAmE;YACnE,2CAA2C;YAC3C,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAA;;gBACzB,OAAO,IAAI,IAAI,CAAA;YACpB,IAAI,GAAG,IAAI,CAAA;YACX,SAAQ;QACT,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,GAAG,IAAI,CAAA;YACX,SAAQ;QACT,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAA;;gBACzB,OAAO,IAAI,IAAI,CAAA;YACpB,IAAI,GAAG,IAAI,CAAA;YACX,SAAQ;QACT,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAA;YACZ,QAAQ,GAAG,IAAI,CAAA;YACf,IAAI,GAAG,IAAI,CAAA;YACX,SAAQ;QACT,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,EAAE,CAAA;YACN,SAAQ;QACT,CAAC;QAED,OAAO,IAAI,IAAI,CAAA;QACf,IAAI,GAAG,IAAI,CAAA;IACZ,CAAC;IAED,IAAI,EAAE,CAAA;IACN,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AAC5C,CAAC"}

package/dist/authorization/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/authorization/rules.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE5D,wBAAgB,YAAY,CAC3B,IAAI,EAAE,iBAAiB,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB,YAAY,GAAG,IAAI,CA8GrB"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/authorization/rules.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG5D,wBAAgB,YAAY,CAC3B,IAAI,EAAE,iBAAiB,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB,YAAY,GAAG,IAAI,CAkIrB"}

package/dist/authorization/rules.js

@@ -1,5 +1,6 @@
 import { DANGEROUS_PATTERNS } from '../constants/tools/index.js';
 import { isTrustedReadOnly } from '../tools/trusted-read-only.js';
+import { decomposeCommandLine } from './command-line.js';
 export function evaluateRule(rule, toolName, toolInput, toolDef, compiledPattern, nameSet) {
     switch (rule.type) {
         case 'allow_read_only': {
@@ -88,7 +89,27 @@ export function evaluateRule(rule, toolName, toolInput, toolDef, compiledPattern
                     : undefined;
             if (subject === undefined)
                 return null;
-            return compiledPattern.test(subject) ? rule.decision : null;
+            // A command line is not one string, and testing it as one is how a
+            // prohibition gets bypassed: `^git push` sees `git push origin main`
+            // and does not see `true; git push origin main`. See
+            // `decomposeCommandLine` for the measurement and for why the two
+            // decisions must read the result differently.
+            const { segments, opaque } = decomposeCommandLine(subject);
+            if (rule.decision === 'deny') {
+                // ANY segment. The whole subject is tested first so an
+                // unanchored deny keeps matching across a boundary, which
+                // splitting alone would have taken away.
+                if (compiledPattern.test(subject))
+                    return 'deny';
+                return segments.some((segment) => compiledPattern.test(segment)) ? 'deny' : null;
+            }
+            // EVERY segment, and nothing that hides one. Permission is a claim
+            // about the whole line; granting it from one matching part is what
+            // let `git status && rm -rf ~` through an allow rule for
+            // `^git status`.
+            if (opaque)
+                return null;
+            return segments.every((segment) => compiledPattern.test(segment)) ? 'allow' : null;
         }
         case 'allow_by_tier': {
             if (toolDef?.tier && rule.tiers.includes(toolDef.tier)) {

package/dist/authorization/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/authorization/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAIjE,MAAM,UAAU,YAAY,CAC3B,IAAuB,EACvB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB;IAErB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,sBAAsB;YACtB,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvD,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAA;YAClC,IAAI,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvE,OAAO,OAAO,CAAA;QACf,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5D,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/authorization/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAGjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,UAAU,YAAY,CAC3B,IAAuB,EACvB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB;IAErB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,sBAAsB;YACtB,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvD,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAA;YAClC,IAAI,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvE,OAAO,OAAO,CAAA;QACf,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,mEAAmE;YACnE,qEAAqE;YACrE,qDAAqD;YACrD,iEAAiE;YACjE,8CAA8C;YAC9C,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;YAE1D,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC9B,uDAAuD;gBACvD,0DAA0D;gBAC1D,yCAAyC;gBACzC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,MAAM,CAAA;gBAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;YACjF,CAAC;YAED,mEAAmE;YACnE,mEAAmE;YACnE,yDAAyD;YACzD,iBAAiB;YACjB,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACnF,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/bridge/a2a/client.d.ts

@@ -25,6 +25,13 @@ export type FetchLike = (input: string, init?: {
     json(): Promise<unknown>;
     text(): Promise<string>;
 }>;
+export interface FetchAgentCardOptions {
+    readonly fetch: FetchLike;
+    /** Cancels discovery; a pre-aborted signal starts no request. */
+    readonly signal?: AbortSignal;
+    /** Whole fetch-and-body deadline. Defaults to 30 seconds; `0` opts out. */
+    readonly timeoutMs?: number;
+}
 /** A peer that answered with something that is not an agent card. */
 export declare class InvalidAgentCardError extends Error {
     readonly details: {
@@ -76,10 +83,7 @@ export declare class A2ARequestError extends Error {
  * pre-1.0, where the minor carries breaking changes — matching on the full
  * string would refuse a peer over a patch bump that changes nothing.
  */
-export declare function fetchAgentCard(baseUrl: string, opts: {
-    readonly fetch: FetchLike;
-    readonly signal?: AbortSignal;
-}): Promise<A2AAgentCard>;
+export declare function fetchAgentCard(baseUrl: string, opts: FetchAgentCardOptions): Promise<A2AAgentCard>;
 export interface A2ADelegateConfig {
     /** The id the delegation tools name. See `Delegate.id`. */
     readonly id: string;
@@ -89,7 +93,7 @@ export interface A2ADelegateConfig {
     readonly headers?: Readonly<Record<string, string>>;
     /** How often to ask `tasks/get` while the peer is still working. */
     readonly pollIntervalMs?: number;
-    /** Give up on a delegation still running after this long. */
+    /** Give up on the whole delegation, including `message/send`, after this long. */
     readonly timeoutMs?: number;
 }
 export declare class A2ADelegate implements Delegate {
@@ -97,8 +101,22 @@ export declare class A2ADelegate implements Delegate {
     readonly id: string;
     readonly capabilities: DelegateCapabilities;
     private readonly endpoint;
+    private readonly pollIntervalMs;
+    private readonly timeoutMs;
     constructor(config: A2ADelegateConfig);
     private rpc;
+    /** Bounded best effort; cancellation is never allowed to create a second hang. */
+    private cancelPeer;
+    /** A client-terminal state may still be live on the peer. */
+    private settleKnownTask;
+    /**
+     * Give an in-flight `message/send` one short chance to reveal its task id.
+     *
+     * Aborting that first transport immediately can abandon remote work while
+     * claiming cancellation locally. A2A cannot address a task until the peer
+     * returns its id, so this bounded grace is the only honest cleanup attempt.
+     */
+    private recoverInitialTask;
     private parseTask;
     dispatch(request: DelegateRequest, opts: {
         readonly signal?: AbortSignal;

package/dist/bridge/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/bridge/a2a/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAkC,MAAM,0BAA0B,CAAA;AAC5F,OAAO,KAAK,EACX,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IACN,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,WAAW,CAAA;CACpB,KACG,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACvB,CAAC,CAAA;AAEF,qEAAqE;AACrE,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;gBAErC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAKpD;AAED,yEAAyE;AACzE,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;gBAEnD,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAOlE;AAED,sCAAsC;AACtC,qBAAa,eAAgB,SAAQ,KAAK;IACzC,QAAQ,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;gBAExD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;CAKxF;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAChE,OAAO,CAAC,YAAY,CAAC,CA4CvB;AAED,MAAM,WAAW,iBAAiB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAwED,qBAAa,WAAY,YAAW,QAAQ;IAM/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAA;IAE3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAEJ,MAAM,EAAE,iBAAiB;YA6BxC,GAAG;IA8BjB,OAAO,CAAC,SAAS;IAcX,QAAQ,CACb,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACrC,OAAO,CAAC,cAAc,CAAC;CAqD1B"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/bridge/a2a/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAkC,MAAM,0BAA0B,CAAA;AAC5F,OAAO,KAAK,EACX,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IACN,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,WAAW,CAAA;CACpB,KACG,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACvB,CAAC,CAAA;AAEF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,qEAAqE;AACrE,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;gBAErC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAKpD;AAED,yEAAyE;AACzE,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;gBAEnD,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAOlE;AAED,sCAAsC;AACtC,qBAAa,eAAgB,SAAQ,KAAK;IACzC,QAAQ,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;gBAExD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;CAKxF;AAmJD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,qBAAqB,GACzB,OAAO,CAAC,YAAY,CAAC,CAmEvB;AAED,MAAM,WAAW,iBAAiB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAqED,qBAAa,WAAY,YAAW,QAAQ;IAQ/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAA;IAE3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;gBAEL,MAAM,EAAE,iBAAiB;YAoCxC,GAAG;IA8BjB,kFAAkF;YACpE,UAAU;IAgBxB,6DAA6D;YAC/C,eAAe;IAK7B;;;;;;OAMG;YACW,kBAAkB;IA+BhC,OAAO,CAAC,SAAS;IAoBX,QAAQ,CACb,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACrC,OAAO,CAAC,cAAc,CAAC;CAgF1B"}