@nexrall/code-core 1.3.0 → 1.4.0

package/dist/agent/testIntegrity.js

@@ -0,0 +1,199 @@
+"use strict";
+/**
+ * Test-Integrity Guard — deterministic reward-hacking detection.
+ *
+ * THE PROBLEM (unsolved by every frontier coding agent today):
+ *   A model asked to "make the tests pass" can satisfy that objective two ways:
+ *     (a) fix the code so the existing tests pass  ← what we want
+ *     (b) weaken the tests so they pass regardless ← reward hacking
+ *   (b) includes: deleting assertions, adding `.skip`/`.only`/`xit`, turning a
+ *   real assertion into a tautology (`assert True`, `expect(true).toBe(true)`),
+ *   or commenting out / deleting whole test cases. The agent then honestly
+ *   reports "tests pass" and the user believes the work is done. Frontier agents
+ *   mitigate this only with prompt instructions ("don't cheat") — there is no
+ *   deterministic detector. METR / Anthropic sabotage evals confirm every strong
+ *   model does this measurably under pressure.
+ *
+ * THE APPROACH:
+ *   Analyse the EDIT PAYLOAD of any write to a test file (old_string→new_string
+ *   for edit_file / multi_edit; content for write_file). Deterministically count
+ *   assertion / test-case / skip-marker deltas. When a test edit's NET effect is
+ *   "fewer or weaker tests" we flag it — with a concrete, human-readable reason.
+ *   No model output is trusted; this is pure structural analysis of the diff, so
+ *   it cannot itself be hallucinated or gamed.
+ *
+ * This is a heuristic signal, not a proof: legitimate refactors (renaming a test,
+ * splitting a file) can reduce counts. So the guard never BLOCKS — it surfaces a
+ * one-shot nudge asking the agent to justify the change, and records it in the
+ * progress ledger so it survives compaction. That converts a silent, invisible
+ * failure into an explicit, reviewable decision.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTestFile = isTestFile;
+exports.analyzeTestEdit = analyzeTestEdit;
+exports.analyzeWriteToolForTestIntegrity = analyzeWriteToolForTestIntegrity;
+// ── Is this a test file? ──────────────────────────────────────────────────────
+// Covers the common conventions across JS/TS, Python, Go, Java/Kotlin, Ruby,
+// Rust, PHP, C#. Path-based (fast, language-agnostic).
+const TEST_PATH_RE = /(?:^|[\/\\])(?:tests?|spec|__tests__|testing)[\/\\]|(?:\.|_|-)(?:test|spec|tests)\.[a-z]+$|(?:^|[\/\\])test_[^\/\\]+\.py$|(?:^|[\/\\])[^\/\\]+_test\.(?:go|py|rb)$|Test[^\/\\]*\.(?:java|kt|cs)$|(?:^|[\/\\])[^\/\\]*Tests?\.(?:java|kt|cs)$/i;
+function isTestFile(path) {
+    if (!path || typeof path !== 'string')
+        return false;
+    return TEST_PATH_RE.test(path);
+}
+// ── Token patterns ────────────────────────────────────────────────────────────
+// Assertion-bearing tokens across frameworks. We count occurrences, not parse.
+const ASSERTION_RES = [
+    /\bexpect\s*\(/g, // jest / chai / vitest / jasmine
+    /\bassert(?:Equals?|True|False|That|Null|NotNull|Same)?\b/g, // junit / python unittest / generic
+    /\bassert\s*[.(]/g, // node:assert (assert.equal / assert( ) )
+    /\.should\b/g, // chai should / rspec should
+    /\bshould\s*[.(]/g,
+    /\bEXPECT_[A-Z]+\s*\(/g, // gtest
+    /\bASSERT_[A-Z]+\s*\(/g, // gtest
+    /\brequire\.\w+\s*\(/g, // testify require
+    /\bassert\.\w+\s*\(/g, // testify assert
+    /\bt\.(?:Error|Fatal|Errorf|Fatalf)\b/g, // go testing
+    /\bassert!\s*\(|\bassert_eq!\s*\(|\bassert_ne!\s*\(/g, // rust
+];
+// Test-case declaration tokens (a "test" unit).
+const TESTCASE_RES = [
+    /\b(?:it|test)\s*\(/g, // jest / mocha / jasmine
+    /\bdef\s+test_\w+/g, // python
+    /\bfunc\s+Test\w+/g, // go
+    /@Test\b/g, // junit
+    /\bfn\s+\w*test\w*\s*\(/gi, // rust (best-effort)
+];
+// Skip / focus markers — presence in NEW but absence in OLD is a strong signal.
+const SKIP_RES = [
+    /\b(?:it|test|describe|context|suite)\s*\.\s*(?:skip|only)\b/g,
+    /\bx(?:it|describe|test|context)\s*\(/g, // xit / xdescribe
+    /\bf(?:it|describe)\s*\(/g, // fit / fdescribe (focus)
+    /@pytest\.mark\.skip\b|@pytest\.mark\.skipif\b|@unittest\.skip\b|@skip\b/g,
+    /\bpytest\.skip\s*\(/g,
+    /\bt\.Skip\s*\(|\bt\.SkipNow\s*\(/g, // go
+    /@Disabled\b|@Ignore\b/g, // junit / kotlin
+    /\.only\s*\(/g, // test.only leaks CI coverage
+];
+// Tautological assertions — always-true, structurally meaningless.
+const TAUTOLOGY_RES = [
+    /\bassert\s+True\b|\bassert\s+1\b|\bassert\s+not\s+False\b/g, // python
+    /\bassert\s*\(\s*true\s*\)|\bassert\.ok\s*\(\s*true\s*\)/gi, // node
+    /\bexpect\s*\(\s*true\s*\)\s*\.\s*to(?:Be|Equal|BeTruthy)\s*\(\s*true\s*\)?/gi, // jest
+    /\bexpect\s*\(\s*(\w+)\s*\)\s*\.\s*toBe\s*\(\s*\1\s*\)/g, // expect(x).toBe(x)
+    /\bassert_eq!\s*\(\s*true\s*,\s*true\s*\)/g, // rust
+    /\bassert!\s*\(\s*true\s*\)/g,
+];
+function countMatches(res, text) {
+    let n = 0;
+    for (const re of res) {
+        re.lastIndex = 0;
+        const m = text.match(re);
+        if (m)
+            n += m.length;
+    }
+    return n;
+}
+// Count lines that newly comment out something containing an assertion/test kw.
+function countCommentedOutTestLines(oldText, newText) {
+    const oldLines = new Set(oldText.split('\n').map((l) => l.trim()));
+    let n = 0;
+    for (const raw of newText.split('\n')) {
+        const line = raw.trim();
+        const isComment = /^(?:\/\/|#|\/\*|\*)/.test(line);
+        if (!isComment)
+            continue;
+        const body = line.replace(/^(?:\/\/+|#+|\/\*+|\*+)\s?/, '');
+        // Only count if the uncommented body looks like a test/assertion AND that
+        // exact code line existed (uncommented) in the old version.
+        const looksLikeTest = /\b(expect|assert|it\(|test\(|def test_|func Test|EXPECT_|ASSERT_)\b/.test(body);
+        if (looksLikeTest && oldLines.has(body))
+            n += 1;
+    }
+    return n;
+}
+/**
+ * Analyse a single test-file edit (old fragment → new fragment). For write_file
+ * pass ('', fullNewContent) — only additive signals (skips, tautologies) fire.
+ */
+function analyzeTestEdit(path, oldText, newText) {
+    if (!isTestFile(path)) {
+        return { isTestFile: false, suspicious: false, findings: [] };
+    }
+    const findings = [];
+    const skipsBefore = countMatches(SKIP_RES, oldText);
+    const skipsAfter = countMatches(SKIP_RES, newText);
+    if (skipsAfter > skipsBefore) {
+        findings.push({
+            kind: 'skip-added',
+            reason: `added ${skipsAfter - skipsBefore} skip/only/disabled marker(s) — tests are being skipped, not fixed`,
+        });
+    }
+    const tautoBefore = countMatches(TAUTOLOGY_RES, oldText);
+    const tautoAfter = countMatches(TAUTOLOGY_RES, newText);
+    if (tautoAfter > tautoBefore) {
+        findings.push({
+            kind: 'tautology-added',
+            reason: `added ${tautoAfter - tautoBefore} always-true assertion(s) (e.g. assert True / expect(x).toBe(x)) — the check no longer tests anything`,
+        });
+    }
+    const assertBefore = countMatches(ASSERTION_RES, oldText);
+    const assertAfter = countMatches(ASSERTION_RES, newText);
+    if (assertAfter < assertBefore) {
+        findings.push({
+            kind: 'assertion-removed',
+            reason: `removed ${assertBefore - assertAfter} assertion(s) — the test verifies less than before`,
+        });
+    }
+    const casesBefore = countMatches(TESTCASE_RES, oldText);
+    const casesAfter = countMatches(TESTCASE_RES, newText);
+    if (casesAfter < casesBefore) {
+        findings.push({
+            kind: 'testcase-removed',
+            reason: `removed ${casesBefore - casesAfter} test case(s)`,
+        });
+    }
+    const commented = countCommentedOutTestLines(oldText, newText);
+    if (commented > 0) {
+        findings.push({
+            kind: 'body-commented',
+            reason: `commented out ${commented} line(s) of previously-active test/assertion code`,
+        });
+    }
+    return { isTestFile: true, suspicious: findings.length > 0, findings };
+}
+/**
+ * Extract the (old, new) text fragments to analyse from a write-tool input.
+ * Returns null for non-test files or tools we can't inspect.
+ *
+ * - edit_file:  { old_string, new_string }
+ * - multi_edit: concatenate all edits' old / new
+ * - write_file: ('', content) — additive-only detection (no prior content here)
+ */
+function analyzeWriteToolForTestIntegrity(toolName, input) {
+    if (!input)
+        return null;
+    const path = typeof input.path === 'string' ? input.path
+        : typeof input.file_path === 'string' ? input.file_path
+            : '';
+    if (!isTestFile(path))
+        return null;
+    if (toolName === 'edit_file') {
+        const oldText = typeof input.old_string === 'string' ? input.old_string : '';
+        const newText = typeof input.new_string === 'string' ? input.new_string : '';
+        return analyzeTestEdit(path, oldText, newText);
+    }
+    if (toolName === 'multi_edit' && Array.isArray(input.edits)) {
+        const edits = input.edits;
+        const oldText = edits.map((e) => (typeof e.old_string === 'string' ? e.old_string : '')).join('\n');
+        const newText = edits.map((e) => (typeof e.new_string === 'string' ? e.new_string : '')).join('\n');
+        return analyzeTestEdit(path, oldText, newText);
+    }
+    if (toolName === 'write_file') {
+        const content = typeof input.content === 'string' ? input.content : '';
+        // No prior content available at this layer → additive-only ('' → content).
+        return analyzeTestEdit(path, '', content);
+    }
+    return null;
+}
+//# sourceMappingURL=testIntegrity.js.map

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKrH,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAiBlD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CA0WlB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAA8B,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKrH,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAiBlD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjG,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CA8WlB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAalD;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E;AAID,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBhF"}

package/dist/api/client.js

@@ -75,6 +75,10 @@ async function streamChat(messages, options, onEvent) {
                     await sleep(RETRY_BASE_MS * Math.pow(2, attempt));
                     continue;
                 }
+                // 4xx (incl. 413 Payload Too Large, 400 Bad Request, 402 Insufficient balance)
+                // are DETERMINISTIC given the same body — retrying resends the identical oversized
+                // conversation and can never succeed. Fall through to the non-retryable !response.ok
+                // handler below instead of burning retries (this was the 16-request "retry storm").
                 break; // success or non-retryable error
             }
             catch (err) {

package/dist/index.d.ts

@@ -3,6 +3,10 @@ export * from './auth/index';
 export * from './api/client';
 export * from './tools/executor';
 export * from './agent/loop';
+export * from './agent/testIntegrity';
+export * from './agent/editCompleteness';
+export * from './agent/crossFile';
+export * from './agent/flaky';
 export * from './mcp/client';
 export * from './mcp/httpClient';
 export * from './mcp/manager';
@@ -10,6 +14,7 @@ export * from './checkpoint/manager';
 export * from './commands/loader';
 export * from './agent/agentTypes';
 export * from './permissions/rules';
+export * from './permissions/destructive';
 export * from './plugins/index';
 export * from './plugins/installer';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -19,6 +19,10 @@ __exportStar(require("./auth/index"), exports);
 __exportStar(require("./api/client"), exports);
 __exportStar(require("./tools/executor"), exports);
 __exportStar(require("./agent/loop"), exports);
+__exportStar(require("./agent/testIntegrity"), exports);
+__exportStar(require("./agent/editCompleteness"), exports);
+__exportStar(require("./agent/crossFile"), exports);
+__exportStar(require("./agent/flaky"), exports);
 __exportStar(require("./mcp/client"), exports);
 __exportStar(require("./mcp/httpClient"), exports);
 __exportStar(require("./mcp/manager"), exports);
@@ -26,6 +30,7 @@ __exportStar(require("./checkpoint/manager"), exports);
 __exportStar(require("./commands/loader"), exports);
 __exportStar(require("./agent/agentTypes"), exports);
 __exportStar(require("./permissions/rules"), exports);
+__exportStar(require("./permissions/destructive"), exports);
 __exportStar(require("./plugins/index"), exports);
 __exportStar(require("./plugins/installer"), exports);
 //# sourceMappingURL=index.js.map

package/dist/permissions/destructive.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Destructive-command classifier.
+ *
+ * `rm -rf /`, `dd`, `mkfs` are DENIED outright by executor.ts BLOCKED_REGEXES —
+ * they are never legitimate. This module covers the OTHER class: commands that
+ * are perfectly legitimate but IRREVERSIBLE and high-blast-radius — dropping a
+ * database, force-pushing over history, `terraform destroy`, `kubectl delete`,
+ * `aws s3 rb`, `docker system prune`. These must never run silently.
+ *
+ * This is the class of action that has caused real production incidents (an
+ * agent in "auto-approve everything" mode wiping a prod database). So a positive
+ * classification here forces an EXPLICIT confirmation that CANNOT be bypassed by
+ * a blanket "approve all" / auto-approve session flag — the user must confirm
+ * THIS specific command.
+ *
+ * Matching runs against the command with heredoc bodies and quoted strings
+ * stripped (stripDataSections), so a commit message, README, or echo that merely
+ * MENTIONS "DROP TABLE" or "terraform destroy" does not trip the guard — only a
+ * real command position does. This mirrors the tier-2 approach in executor.ts
+ * that eliminated the false-positive storms.
+ */
+export interface DestructiveMatch {
+    /** Coarse category, e.g. 'database' | 'git-history' | 'infra' | 'cloud' | 'container'. */
+    category: string;
+    /** Short human-readable reason shown in the confirmation prompt. */
+    reason: string;
+}
+/**
+ * Classify a bash command. Returns the FIRST matching destructive category, or
+ * null when the command is not recognised as destructive.
+ *
+ * Two passes with different data-stripping:
+ *  - RAW_RULES run on the heredoc-stripped but quote-PRESERVING string, because
+ *    real SQL lives inside quotes (`psql -c "DROP TABLE"`); they are gated on a
+ *    DB-client token so a mention can't match.
+ *  - STRIPPED_RULES run on the fully stripped string (quotes + heredocs gone) so
+ *    mentions inside commit messages / echoes / grep patterns / heredoc'd docs
+ *    never trip the bare-command rules (git/infra/cloud/container/publish).
+ */
+export declare function classifyDestructiveCommand(command: string): DestructiveMatch | null;
+/** True when the given tool + input represents a destructive bash command. */
+export declare function isDestructiveBash(tool: string, input: Record<string, unknown>): DestructiveMatch | null;
+//# sourceMappingURL=destructive.d.ts.map

package/dist/permissions/destructive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AAsMD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAenF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}

package/dist/permissions/destructive.js

@@ -0,0 +1,244 @@
+"use strict";
+/**
+ * Destructive-command classifier.
+ *
+ * `rm -rf /`, `dd`, `mkfs` are DENIED outright by executor.ts BLOCKED_REGEXES —
+ * they are never legitimate. This module covers the OTHER class: commands that
+ * are perfectly legitimate but IRREVERSIBLE and high-blast-radius — dropping a
+ * database, force-pushing over history, `terraform destroy`, `kubectl delete`,
+ * `aws s3 rb`, `docker system prune`. These must never run silently.
+ *
+ * This is the class of action that has caused real production incidents (an
+ * agent in "auto-approve everything" mode wiping a prod database). So a positive
+ * classification here forces an EXPLICIT confirmation that CANNOT be bypassed by
+ * a blanket "approve all" / auto-approve session flag — the user must confirm
+ * THIS specific command.
+ *
+ * Matching runs against the command with heredoc bodies and quoted strings
+ * stripped (stripDataSections), so a commit message, README, or echo that merely
+ * MENTIONS "DROP TABLE" or "terraform destroy" does not trip the guard — only a
+ * real command position does. This mirrors the tier-2 approach in executor.ts
+ * that eliminated the false-positive storms.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyDestructiveCommand = classifyDestructiveCommand;
+exports.isDestructiveBash = isDestructiveBash;
+// ── Data-section stripping (naive; feeds a heuristic, not an executor) ────────
+function stripHeredocs(command) {
+    return command.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\2(?=\s|;|&|$)/g, ' ');
+}
+function stripDataSections(command) {
+    return stripHeredocs(command)
+        .replace(/"(?:[^"\\]|\\[\s\S])*"/g, '""')
+        .replace(/'[^']*'/g, "''");
+}
+// A command "position" is start-of-string/line or right after a shell separator
+// (; & | && || ` ( $( ) or a privilege / interpreter prefix. Reused as a prefix
+// so rules only fire on a real invocation, never on an argument or mention.
+const CMD_POS = '(?:^|[;&|`\\n(]|\\$\\(|\\bsudo\\s+|\\bdoas\\s+|\\bexec\\s+|\\bnohup\\s+|\\bxargs\\s+(?:-\\S+\\s+)*|\\btime\\s+|\\bnice\\s+(?:-\\S+\\s+)*)\\s*';
+// SQL/DB clients that indicate the surrounding text is EXECUTED SQL, not a
+// mention. Real SQL almost always lives inside quotes (`psql -c "DROP TABLE"`),
+// so DB rules run on the quote-PRESERVING string (RAW_RULES) — but they must be
+// gated on one of these client tokens at a command position, otherwise a
+// `git commit -m "drop table logic"` mention would trip them.
+const DB_CLIENT = '(?:psql|mysql|mariadb|mysqldump|mongo|mongosh|sqlite3|cockroach|clickhouse-client|pgcli|mycli|usql|sqlcmd)';
+// ── DB rules: matched on the heredoc-stripped (but quote-PRESERVING) string ──
+// Each is gated on a DB client so mentions in commit messages / echoes / grep
+// patterns (which get quote-stripped for the STRIPPED_RULES pass) don't match.
+const RAW_RULES = [
+    {
+        category: 'database',
+        reason: 'drops a database, table, or schema (irreversible data loss)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdrop\s+(?:database|schema|table)\b`, 'i'),
+    },
+    {
+        category: 'database',
+        reason: 'truncates a table (deletes all rows, irreversible)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\btruncate\s+(?:table\s+)?\w`, 'i'),
+    },
+    {
+        category: 'database',
+        reason: 'DELETE without a WHERE clause (deletes every row)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdelete\s+from\s+[\w.` + '`' + String.raw `"]+\s*(?:;|"|'|$)(?![\s\S]*\bwhere\b)`, 'i'),
+    },
+    {
+        category: 'database',
+        reason: 'drops a Postgres/MySQL role or user',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdrop\s+(?:role|user)\b`, 'i'),
+    },
+    {
+        category: 'database',
+        reason: 'drops a MongoDB database or collection',
+        re: /\b(?:mongo|mongosh)\b[\s\S]*?\.(?:drop|dropDatabase)\s*\(\s*\)/i,
+    },
+    {
+        category: 'database',
+        reason: 'flushes all Redis keys (wipes the datastore)',
+        re: new RegExp(CMD_POS + String.raw `redis-cli\b[\s\S]*?\bflush(?:all|db)\b`, 'i'),
+    },
+];
+// Each `re` is expected to be anchored with CMD_POS where relevant. Case-insensitive.
+const STRIPPED_RULES = [
+    // ── Migration reset verbs (bare commands, not quoted SQL) ───────────────────
+    {
+        category: 'database',
+        reason: 'reverses or resets database migrations (may drop columns/tables)',
+        re: new RegExp(CMD_POS + String.raw `(?:rails\s+db:(?:drop|reset)|rake\s+db:(?:drop|reset)|(?:npx\s+)?prisma\s+migrate\s+reset|(?:npx\s+)?sequelize(?:-cli)?\s+db:drop|python\s+manage\.py\s+flush|knex\s+migrate:rollback\s+--all|alembic\s+downgrade\s+base)`, 'i'),
+    },
+    // ── Git history / remotes ───────────────────────────────────────────────────
+    {
+        category: 'git-history',
+        reason: 'force-pushes (can overwrite/destroy remote history)',
+        re: /\bgit\s+push\b[^\n]*\s(?:--force\b(?!-with-lease)|-f\b)/i,
+    },
+    {
+        category: 'git-history',
+        reason: 'deletes a remote branch',
+        re: /\bgit\s+push\b[^\n]*\s:(?:refs\/heads\/)?\S/i,
+    },
+    {
+        category: 'git-history',
+        reason: 'hard-resets the working tree (discards uncommitted work)',
+        re: /\bgit\s+reset\s+(?:--hard|--keep)\b/i,
+    },
+    {
+        category: 'git-history',
+        reason: 'deletes untracked files (git clean)',
+        re: /\bgit\s+clean\s+-[a-z]*f/i,
+    },
+    {
+        category: 'git-history',
+        reason: 'force-deletes a git branch',
+        re: /\bgit\s+branch\s+-[a-z]*D/i,
+    },
+    {
+        category: 'git-history',
+        reason: 'rewrites git history (filter-branch/filter-repo)',
+        re: /\bgit\s+(?:filter-branch|filter-repo)\b/i,
+    },
+    {
+        category: 'git-history',
+        reason: 'reflog expire / gc prune (permanently drops recoverable commits)',
+        re: /\bgit\s+(?:reflog\s+expire|gc\s+[^\n]*--prune=(?:now|all))\b/i,
+    },
+    // ── Infrastructure as code ──────────────────────────────────────────────────
+    {
+        category: 'infra',
+        reason: 'destroys Terraform-managed infrastructure',
+        re: /\bterraform\s+(?:destroy|apply)\b[^\n]*(?:-auto-approve|destroy)/i,
+    },
+    {
+        category: 'infra',
+        reason: 'terraform destroy',
+        re: /\bterraform\s+destroy\b/i,
+    },
+    {
+        category: 'infra',
+        reason: 'destroys Pulumi-managed infrastructure',
+        re: /\bpulumi\s+destroy\b/i,
+    },
+    {
+        category: 'infra',
+        reason: 'deletes Kubernetes resources',
+        re: /\bkubectl\s+delete\b/i,
+    },
+    {
+        category: 'infra',
+        reason: 'helm uninstall / delete (removes a release)',
+        re: /\bhelm\s+(?:uninstall|delete)\b/i,
+    },
+    // ── Cloud CLIs ──────────────────────────────────────────────────────────────
+    {
+        category: 'cloud',
+        reason: 'removes an S3 bucket or recursively deletes objects',
+        re: /\baws\s+s3\s+(?:rb\b|rm\b[^\n]*--recursive)/i,
+    },
+    {
+        category: 'cloud',
+        reason: 'deletes/terminates an AWS resource',
+        re: /\baws\s+\w[\w-]*\s+(?:delete-\w+|terminate-instances|delete\b|remove-\w+)/i,
+    },
+    {
+        category: 'cloud',
+        reason: 'deletes a GCP resource',
+        re: /\bgcloud\s+[\w-]+(?:\s+[\w-]+)*\s+delete\b/i,
+    },
+    {
+        category: 'cloud',
+        reason: 'deletes an Azure resource',
+        re: /\baz\s+[\w-]+(?:\s+[\w-]+)*\s+delete\b/i,
+    },
+    {
+        category: 'cloud',
+        reason: 'gsutil recursive remove (deletes cloud objects/buckets)',
+        re: /\bgsutil\s+(?:-m\s+)?rm\b[^\n]*-[a-z]*r/i,
+    },
+    {
+        category: 'cloud',
+        reason: 'wrangler delete (removes a Cloudflare Worker/resource)',
+        re: /\bwrangler\s+(?:delete|d1\s+delete|r2\s+bucket\s+delete|kv:namespace\s+delete)\b/i,
+    },
+    // ── Containers / volumes ────────────────────────────────────────────────────
+    {
+        category: 'container',
+        reason: 'docker system/volume prune (removes volumes & data)',
+        re: /\bdocker\s+(?:system|volume|image|container)\s+prune\b/i,
+    },
+    {
+        category: 'container',
+        reason: 'removes docker volumes (data loss)',
+        re: /\bdocker\s+volume\s+rm\b/i,
+    },
+    {
+        category: 'container',
+        reason: 'docker-compose down with -v (deletes named volumes)',
+        re: /\bdocker[\s-]compose\s+down\b[^\n]*\s-v\b|--volumes\b/i,
+    },
+    // ── Irreversible publishes ──────────────────────────────────────────────────
+    {
+        category: 'publish',
+        reason: 'publishes a package to a public registry (cannot be unpublished)',
+        re: new RegExp(CMD_POS + String.raw `(?:npm\s+publish|yarn\s+publish|pnpm\s+publish|cargo\s+publish|twine\s+upload|gem\s+push)\b`, 'i'),
+    },
+];
+/**
+ * Classify a bash command. Returns the FIRST matching destructive category, or
+ * null when the command is not recognised as destructive.
+ *
+ * Two passes with different data-stripping:
+ *  - RAW_RULES run on the heredoc-stripped but quote-PRESERVING string, because
+ *    real SQL lives inside quotes (`psql -c "DROP TABLE"`); they are gated on a
+ *    DB-client token so a mention can't match.
+ *  - STRIPPED_RULES run on the fully stripped string (quotes + heredocs gone) so
+ *    mentions inside commit messages / echoes / grep patterns / heredoc'd docs
+ *    never trip the bare-command rules (git/infra/cloud/container/publish).
+ */
+function classifyDestructiveCommand(command) {
+    if (!command || typeof command !== 'string')
+        return null;
+    const raw = stripHeredocs(command);
+    for (const rule of RAW_RULES) {
+        if (rule.re.test(raw)) {
+            return { category: rule.category, reason: rule.reason };
+        }
+    }
+    const stripped = stripDataSections(command);
+    for (const rule of STRIPPED_RULES) {
+        if (rule.re.test(stripped)) {
+            return { category: rule.category, reason: rule.reason };
+        }
+    }
+    return null;
+}
+/** True when the given tool + input represents a destructive bash command. */
+function isDestructiveBash(tool, input) {
+    if (tool !== 'bash' && tool !== 'run_command' && tool !== 'execute_command')
+        return null;
+    const command = typeof input.command === 'string'
+        ? input.command
+        : typeof input.cmd === 'string'
+            ? input.cmd
+            : '';
+    return classifyDestructiveCommand(command);
+}
+//# sourceMappingURL=destructive.js.map

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AA6qDtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAy8DtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}