@namzu/sdk 51.1.0 → 52.1.0

package/dist/authorization/protected-paths.js

@@ -0,0 +1,107 @@
+/**
+ * Paths a write is always asked about, in every mode.
+ *
+ * A repository carries files that are not data but triggers: a git hook runs
+ * on the next commit, a shell rc file on the next terminal, `.vscode/tasks.json`
+ * when a folder opens, `.envrc` on the next `cd`. A model that can write them
+ * does not need to run anything now; it plants code that runs later, outside
+ * the turn, with the operator's own rights. So a write to one of them is a
+ * question for a person, whatever the mode and whatever a rule or an earlier
+ * "approve all" said. That is what a mode is, an answer given before the call
+ * existed, and none of them saw this path.
+ *
+ * The lists are the reference terminal's protected-directory and
+ * protected-file tables (version 2.1.302), with its own configuration
+ * directory and file mapped to Namzu's: the project directory is `.namzu` and
+ * the project file is `namzu.config.json`.
+ *
+ * Matching is by name, on every segment of the path. `.git` anywhere above a
+ * file protects it, and `.config/git` counts as one two-segment unit. Names
+ * are case-folded, including the dotless `ı` and long `ſ` that fold to `i`
+ * and `s`, so `.GIT` and `.gıt` on a case-insensitive file system are the
+ * same directory.
+ */
+/** Directory names; a path with one of these as any segment is protected. */
+export const PROTECTED_DIRECTORIES = [
+    '.git',
+    '.vscode',
+    '.idea',
+    '.namzu',
+    '.husky',
+    '.cargo',
+    '.devcontainer',
+    '.yarn',
+    '.mvn',
+];
+/** Directory sequences; the segments must be adjacent. */
+export const PROTECTED_NESTED_DIRECTORIES = [['.config', 'git']];
+/** File names; a path whose last segment is one of these is protected. */
+export const PROTECTED_FILE_NAMES = [
+    '.gitconfig',
+    '.gitmodules',
+    '.bashrc',
+    '.bash_profile',
+    '.zshrc',
+    '.zprofile',
+    '.profile',
+    '.zshenv',
+    '.zlogin',
+    '.zlogout',
+    '.bash_login',
+    '.bash_aliases',
+    '.bash_logout',
+    '.envrc',
+    '.ripgreprc',
+    '.mcp.json',
+    'namzu.config.json',
+    // The project's local config, where "don't ask again" answers are written.
+    'namzu.config.local.json',
+    '.npmrc',
+    '.yarnrc',
+    '.yarnrc.yml',
+    '.pnp.cjs',
+    '.pnp.loader.mjs',
+    '.pnpmfile.cjs',
+    'bunfig.toml',
+    '.bunfig.toml',
+    '.bazelrc',
+    '.bazelversion',
+    '.bazeliskrc',
+    '.pre-commit-config.yaml',
+    'lefthook.yml',
+    '.lefthook.yml',
+    'lefthook.yaml',
+    '.lefthook.yaml',
+    'gradle-wrapper.properties',
+    'maven-wrapper.properties',
+    '.devcontainer.json',
+    'pyrightconfig.json',
+];
+/** Lower case, with the two letters that fold into ASCII on some file systems. */
+function fold(name) {
+    return name.toLowerCase().replace(/ı/g, 'i').replace(/ſ/g, 's');
+}
+const DIRECTORIES = new Set(PROTECTED_DIRECTORIES.map(fold));
+const FILE_NAMES = new Set(PROTECTED_FILE_NAMES.map(fold));
+const NESTED = PROTECTED_NESTED_DIRECTORIES.map((sequence) => sequence.map(fold));
+/**
+ * Whether a write to `path` is one of the protected kinds. Pure: it reads the
+ * spelling it is given, so a caller that wants a symlink's target covered
+ * passes the canonical path as well.
+ */
+export function isProtectedPath(path) {
+    const segments = path.split(/[\\/]+/).map(fold);
+    for (const segment of segments) {
+        if (DIRECTORIES.has(segment))
+            return true;
+    }
+    for (const sequence of NESTED) {
+        for (let start = 0; start + sequence.length <= segments.length; start += 1) {
+            if (sequence.every((name, offset) => segments[start + offset] === name))
+                return true;
+        }
+    }
+    const last = segments[segments.length - 1];
+    return last !== undefined && last !== '' && FILE_NAMES.has(last);
+}
+//# sourceMappingURL=protected-paths.js.map

package/dist/authorization/protected-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths.js","sourceRoot":"","sources":["../../src/authorization/protected-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACvD,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,OAAO;IACP,MAAM;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,4BAA4B,GAAmC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;AAEhG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACtD,YAAY;IACZ,aAAa;IACb,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,aAAa;IACb,eAAe;IACf,cAAc;IACd,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,mBAAmB;IACnB,2EAA2E;IAC3E,yBAAyB;IACzB,QAAQ;IACR,SAAS;IACT,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,eAAe;IACf,aAAa;IACb,cAAc;IACd,UAAU;IACV,eAAe;IACf,aAAa;IACb,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,0BAA0B;IAC1B,oBAAoB;IACpB,oBAAoB;CACpB,CAAA;AAED,kFAAkF;AAClF,SAAS,IAAI,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC1D,MAAM,MAAM,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAEjF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;IAC1C,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;QACrF,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACjE,CAAC"}

package/dist/authorization/readonly-commands.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Which shell lines only read, so that they run without a prompt.
+ *
+ * The reference terminal runs `ls`, `cat`, `git status` and `git diff` without
+ * asking, because each is on a vetted list and nothing in the line is decided
+ * at run time. This is that list and those conditions (version 2.1.302):
+ *
+ * - every command of the line is on the list, the line parses completely, and
+ *   nothing in it is read at run time: no `$var` outside single quotes, no
+ *   substitution, no subshell or group, no background `&`, no here-document,
+ *   no unquoted glob except for a short set of commands that only list or show;
+ * - a redirection is allowed only to `/dev/null`, as a descriptor copy, or as
+ *   an input from a plain file; a `~user` path and a UNC path are refused;
+ * - a leading assignment is allowed only for a variable that cannot change
+ *   what a command does (`LANG`, `TZ`, `NO_COLOR`, ...);
+ * - `git` must match a vetted subcommand and every flag must be one the table
+ *   names, with the kind of value it takes. `git diff --output=f`, `git -c`,
+ *   `--exec-path` and `--config-env` are in no table, so they are refused;
+ *   `git fetch` is deliberately absent. A `cd` in the same line as `git`
+ *   refuses the line, because the directory it enters may hold a repository
+ *   the person never looked at.
+ *
+ * Not ported, and so never read-only here: `sed`, `ps`, `lsof`, `ss`, `date`,
+ * `man`, `xargs`, `fd`, `gh`, `docker logs|inspect`, `printf`, `[[`, `test`
+ * and the shell builtins other than `cd`. The reference's check of the working
+ * directory for a planted bare repository needs the directory, which the tool
+ * predicate does not get; the trusted-project gate is what stands in for it.
+ *
+ * This decides only "does not need a prompt for being a command". The path
+ * floor still applies: a read-only command that reads outside the roots is
+ * asked about, and so is anything the protected-path and removal floors see.
+ */
+import type { ShellDialect } from '../types/tool/index.js';
+/**
+ * Whether `line` only reads: every command in it is vetted and nothing in it
+ * is decided at run time. False for anything this module cannot vouch for.
+ */
+export declare function isReadOnlyCommandLine(line: string, dialect?: ShellDialect): boolean;
+//# sourceMappingURL=readonly-commands.d.ts.map

package/dist/authorization/readonly-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readonly-commands.d.ts","sourceRoot":"","sources":["../../src/authorization/readonly-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAkrB1D;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,YAAqB,GAAG,OAAO,CA2C3F"}