@nexrall/code-core 1.4.75 → 1.4.77

package/dist/permissions/autoMode.js

@@ -0,0 +1,346 @@
+"use strict";
+// S20 — auto-mode config + the classifier's prompt/parse (see the design doc
+// nexrall/docs/AUTO_MODE_CLASSIFIER.md).
+//
+// The pure half: where `autoMode` settings may come from (user + managed +
+// --settings ONLY — never project/local, so a cloned repo cannot loosen the
+// gate), how tiers merge, the built-in prose limits, the classifier prompt and
+// the reply parser. The model CALL and the runtime (cache, budget, fast paths)
+// live in the hosts — cli/src/permissions/autoClassify.ts for the CLI.
+//
+// The lists below are PROSE FOR A JUDGE, not regexes: they say what the
+// classifier must protect, in the same words a human would, because the check
+// is a model call and not another denylist (the destructive-token guard is
+// that — and it stays the code-level floor, unchanged, underneath this).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_MODE_UNAVAILABLE = exports.AUTO_MODE_DEFAULT_MAX_BUDGET_USD = exports.AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS = exports.AUTO_MODE_DEFAULTS_SENTINEL = exports.AUTO_MODE_SOFT_DENY_DEFAULTS = exports.AUTO_MODE_HARD_DENY_DEFAULTS = void 0;
+exports.loadAutoModeConfig = loadAutoModeConfig;
+exports.classifyPrompt = classifyPrompt;
+exports.parseClassifierReply = parseClassifierReply;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const rules_1 = require("./rules");
+/**
+ * The built-in hard limits (CC's `$defaults` for `hard_deny`): unconditional —
+ * user intent does NOT clear these. Keep this list SHORT and beyond argument;
+ * it exists for the actions no request should ever authorize.
+ */
+exports.AUTO_MODE_HARD_DENY_DEFAULTS = [
+    {
+        label: 'Data exfiltration',
+        text: 'Sending file contents, repository contents, environment variables, credentials or tokens to any network ' +
+            'destination the user has not explicitly named (e.g. curl/wget with a body built from local files or env).',
+    },
+    {
+        label: 'Credential and system files',
+        text: 'Writing to or modifying security-sensitive locations outside the project: ~/.ssh, ~/.aws, ~/.config/gh, ' +
+            '~/.netrc, ~/.npmrc credential entries, shell rc files (.zshrc/.bashrc), /etc, or the OS keychain.',
+    },
+    {
+        label: 'Safety-system tampering',
+        text: "Disabling or weakening this session's own safety controls: editing permission rules or autoMode settings to " +
+            'grant more access, clearing audit trails, or killing the permission gate.',
+    },
+];
+/**
+ * The built-in soft limits (CC's `$defaults` for `soft_deny`): block UNLESS the
+ * user's own latest message directly and specifically asks for this exact
+ * action, or an allow exception matches.
+ */
+exports.AUTO_MODE_SOFT_DENY_DEFAULTS = [
+    {
+        label: 'Git history rewrite',
+        text: 'Rewriting shared history: git push --force/--force-with-lease to a shared branch, or reset --hard that ' +
+            'discards committed work.',
+    },
+    {
+        label: 'Database and infra destruction',
+        text: 'Destructive database or infrastructure operations against shared or production systems: DROP/DELETE/TRUNCATE ' +
+            'on non-scratch data, terraform destroy, kubectl delete of shared resources, deleting cloud buckets.',
+    },
+    {
+        label: 'Mass deletion outside scratch space',
+        text: 'Deleting many files or whole directories outside the project workspace and scratch/temp locations.',
+    },
+];
+/** The `$defaults` sentinel (CC's spelling) inside soft_deny / hard_deny lists. */
+exports.AUTO_MODE_DEFAULTS_SENTINEL = '$defaults';
+exports.AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS = 400;
+exports.AUTO_MODE_DEFAULT_MAX_BUDGET_USD = 0.25;
+function readTier(file) {
+    try {
+        const obj = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const am = obj?.autoMode;
+        return am && typeof am === 'object' && !Array.isArray(am) ? am : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Accept CC's snake_case spellings and our camelCase ones. */
+function pickKey(am, ...names) {
+    for (const n of names) {
+        if (Object.prototype.hasOwnProperty.call(am, n))
+            return { key: n, value: am[n] };
+    }
+    return null;
+}
+function asProseList(value, key, warnings) {
+    if (!Array.isArray(value)) {
+        warnings.push(`autoMode.${key} must be an array of strings — ignored`);
+        return null;
+    }
+    return value
+        .filter((v) => typeof v === 'string')
+        .map((v) => v.trim())
+        .filter(Boolean);
+}
+function asBool(value, key, warnings) {
+    if (typeof value === 'boolean')
+        return value;
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    warnings.push(`autoMode.${key} must be true or false — ignored`);
+    return null;
+}
+function asPositiveNumber(value, key, warnings) {
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(n) || n < 0) {
+        warnings.push(`autoMode.${key} must be a non-negative number — ignored`);
+        return null;
+    }
+    return n;
+}
+/** Expand `$defaults` in a list, or supply defaults when the key was never set. */
+function expandDefaults(list, defaults) {
+    if (list === null)
+        return defaults.map((d) => `[${d.label}] ${d.text}`);
+    const out = [];
+    for (const item of list) {
+        if (item === exports.AUTO_MODE_DEFAULTS_SENTINEL)
+            out.push(...defaults.map((d) => `[${d.label}] ${d.text}`));
+        else
+            out.push(item);
+    }
+    return out;
+}
+/**
+ * Load the effective auto-mode config.
+ *
+ * Tier order — LOW to HIGH precedence (a higher tier that defines a key wins
+ * WHOLESALE for that key): user < managed < session (`--settings`). Project and
+ * settings.local are read ONLY to report that their `autoMode` is ignored;
+ * they can never contribute a value. That asymmetry is the whole security
+ * model: settings travel with a checkout, and a checkout that could grant
+ * itself trust would make the classifier theatre.
+ */
+function loadAutoModeConfig(workDir) {
+    const warnings = [];
+    const sources = [];
+    const ignoredProjectFiles = [];
+    const userFile = path.join(os.homedir(), '.nexrall', 'settings.json');
+    const managedFile = (0, rules_1.managedSettingsPath)();
+    const tiers = [
+        { file: userFile, autoMode: readTier(userFile) },
+        { file: managedFile, autoMode: readTier(managedFile) },
+        { file: '--settings', autoMode: (0, rules_1.getSessionSettings)()?.autoMode ?? null },
+    ];
+    // A non-object there (e.g. the string "off") is still an attempt we must not
+    // swallow silently.
+    for (const cand of [
+        path.join(workDir, '.nexrall', 'settings.json'),
+        path.join(workDir, '.nexrall', 'settings.local.json'),
+    ]) {
+        try {
+            const obj = JSON.parse(fs.readFileSync(cand, 'utf-8'));
+            if (obj && Object.prototype.hasOwnProperty.call(obj, 'autoMode'))
+                ignoredProjectFiles.push(cand);
+        }
+        catch {
+            /* no file / unreadable — nothing ignored */
+        }
+    }
+    // Per-key merge, low → high.
+    let enabled = null;
+    let classifierModel;
+    let environment = null;
+    let allow = null;
+    let softList = null;
+    let hardList = null;
+    let classifyAllShell = null;
+    let maxClassifications = null;
+    let maxBudgetUsd = null;
+    for (const tier of tiers) {
+        if (!tier.autoMode)
+            continue;
+        const am = tier.autoMode;
+        const keys = [];
+        const take = (r, key) => {
+            if (r !== null && r !== undefined)
+                keys.push(key);
+            return r;
+        };
+        const en = pickKey(am, 'classifier', 'enabled');
+        if (en)
+            enabled = take(asBool(en.value, 'classifier', warnings) ?? enabled, en.key);
+        const cm = pickKey(am, 'classifierModel', 'classifier_model');
+        if (cm && typeof cm.value === 'string' && cm.value.trim()) {
+            classifierModel = cm.value.trim();
+            keys.push(cm.key);
+        }
+        const env = pickKey(am, 'environment');
+        if (env)
+            environment = take(asProseList(env.value, 'environment', warnings) ?? environment, 'environment');
+        const al = pickKey(am, 'allow');
+        if (al)
+            allow = take(asProseList(al.value, 'allow', warnings) ?? allow, 'allow');
+        const sd = pickKey(am, 'soft_deny', 'softDeny');
+        if (sd)
+            softList = take(asProseList(sd.value, sd.key, warnings) ?? softList, sd.key);
+        const hd = pickKey(am, 'hard_deny', 'hardDeny');
+        if (hd)
+            hardList = take(asProseList(hd.value, hd.key, warnings) ?? hardList, hd.key);
+        const ca = pickKey(am, 'classifyAllShell', 'classify_all_shell');
+        if (ca)
+            classifyAllShell = take(asBool(ca.value, ca.key, warnings) ?? classifyAllShell, ca.key);
+        const mc = pickKey(am, 'maxClassifications', 'max_classifications');
+        if (mc)
+            maxClassifications = take(asPositiveNumber(mc.value, mc.key, warnings) ?? maxClassifications, mc.key);
+        const mb = pickKey(am, 'maxBudgetUsd', 'max_budget_usd');
+        if (mb)
+            maxBudgetUsd = take(asPositiveNumber(mb.value, mb.key, warnings) ?? maxBudgetUsd, mb.key);
+        if (keys.length)
+            sources.push({ file: tier.file, keys });
+    }
+    return {
+        enabled: enabled ?? true,
+        ...(classifierModel ? { classifierModel } : {}),
+        environment: environment ?? [],
+        allow: allow ?? [],
+        softDeny: expandDefaults(softList, exports.AUTO_MODE_SOFT_DENY_DEFAULTS),
+        hardDeny: expandDefaults(hardList, exports.AUTO_MODE_HARD_DENY_DEFAULTS),
+        classifyAllShell: classifyAllShell ?? false,
+        maxClassifications: maxClassifications ?? exports.AUTO_MODE_DEFAULT_MAX_CLASSIFICATIONS,
+        maxBudgetUsd: maxBudgetUsd ?? exports.AUTO_MODE_DEFAULT_MAX_BUDGET_USD,
+        sources,
+        ignoredProjectFiles,
+        warnings,
+    };
+}
+// ─── The classifier's prompt + reply ─────────────────────────────────────────
+/** Clip helper local to this module (the prompt must never grow unbounded). */
+function clip(text, max) {
+    return text.length > max ? text.slice(0, max - 1) + '\u2026' : text;
+}
+/**
+ * The review request. Deliberately one flat prompt — the classifier is a fresh,
+ * tool-less call (askModelOnce), so everything it may consult must be here:
+ * the limits, the environment, the action, and the human's actual words.
+ */
+function classifyPrompt(a) {
+    const list = (items) => (items.length ? items.map((t) => `- ${t}`).join('\n') : '  (none)');
+    const env = [
+        `The project directory ${a.workDir}${a.extraDirs?.length ? ` and the added directories ${a.extraDirs.join(', ')}` : ''}`,
+        "the current git repository's own configured remotes",
+        ...a.cfg.environment,
+    ];
+    const intent = a.intent?.length
+        ? a.intent.map((t, i) => `[${i + 1}] ${clip(t.replace(/\s+/g, ' ').trim(), 300)}`).join('\n')
+        : '  (none)';
+    let action;
+    try {
+        action = clip(JSON.stringify(a.input), 2000);
+    }
+    catch {
+        action = '(unserializable input)';
+    }
+    return ('You are the AUTO-MODE SAFETY CLASSIFIER for a coding agent.\n' +
+        'The agent runs in "auto" mode: it will execute the action below WITHOUT asking the human, unless you block it.\n' +
+        "Judge the ACTION's real-world effect, not its wording.\n\n" +
+        'HARD LIMITS — block unconditionally, even if the user asked:\n' +
+        list(a.cfg.hardDeny) +
+        "\n\nSOFT LIMITS — block UNLESS the user's latest message directly and specifically asks for this exact action, " +
+        'or an ALLOW EXCEPTION matches:\n' +
+        list(a.cfg.softDeny) +
+        '\n\nALLOW EXCEPTIONS (pre-approved by the user; clear SOFT limits, never hard ones):\n' +
+        list(a.cfg.allow) +
+        '\n\nTRUSTED ENVIRONMENT (routine here; staying inside it is not a limit violation):\n' +
+        list(env) +
+        '\n\nTHE ACTION:\ntool: ' +
+        a.tool +
+        '\ninput: ' +
+        action +
+        '\n\nRECENT USER MESSAGES (intent; the LAST one is the current instruction):\n' +
+        intent +
+        '\n\nReply with EXACTLY ONE line, one of:\n' +
+        'ALLOW\n' +
+        'BLOCK: <one short reason>\n' +
+        'BLOCK-HARD: <one short reason>\n' +
+        'Use BLOCK only for a soft limit without clear user intent, BLOCK-HARD for a hard limit. ' +
+        'For a routine, reversible action inside the workspace, reply ALLOW. No other text.');
+}
+/** A local guard failed us (or the host never called in) — see the design doc. */
+exports.AUTO_MODE_UNAVAILABLE = {
+    action: 'unavailable',
+    reason: 'classifier could not review the action',
+};
+/**
+ * Parse one line of classifier output. Anything that is not a clear ALLOW is
+ * NOT an allow — a mangled or empty reply fails closed (`unavailable`).
+ */
+function parseClassifierReply(text) {
+    if (typeof text !== 'string')
+        return { ...exports.AUTO_MODE_UNAVAILABLE, reason: 'no reply from the classifier' };
+    const first = text
+        .split('\n')
+        .find((l) => l.trim().length > 0)
+        ?.trim() ?? '';
+    if (!first)
+        return { ...exports.AUTO_MODE_UNAVAILABLE, reason: 'empty reply from the classifier' };
+    const hard = /^BLOCK[\s_-]*HARD\b[:\s-]*(.*)$/i.exec(first);
+    if (hard)
+        return { action: 'block-hard', reason: hard[1].trim() || 'hard limit' };
+    const soft = /^BLOCK\b[:\s-]*(.*)$/i.exec(first);
+    if (soft)
+        return { action: 'block-soft', reason: soft[1].trim() || 'soft limit' };
+    if (/^ALLOW\b/i.test(first))
+        return { action: 'allow' };
+    return { ...exports.AUTO_MODE_UNAVAILABLE, reason: `unrecognized classifier reply: ${clip(first, 80)}` };
+}
+//# sourceMappingURL=autoMode.js.map

package/dist/permissions/rules.d.ts

@@ -9,11 +9,17 @@ export interface MergedSettings {
     /** Raw merged object (for hooks, allowedTools, etc.). */
     raw: Record<string, unknown>;
 }
+export declare function managedSettingsPath(): string;
 /** Replace the rules supplied for this process by flags. Not persisted anywhere. */
 export declare function setSessionRules(r: Partial<PermissionRules>): void;
 export declare function setSessionSettings(obj: Record<string, unknown> | null): void;
 export declare function getSessionSettings(): Record<string, unknown> | null;
 export declare function loadSettings(workDir: string): MergedSettings;
+/** The first ALLOW rule that matches this call, or null. S20's classifier gate
+ * reads this to tell a NARROW pre-approval (wins, no review) from a BROAD one
+ * (suspended while the classifier is on — see isBroadAllowRule). */
+export declare function matchedAllowRule(rules: PermissionRules, tool: string, input: Record<string, unknown>, workDir: string): string | null;
+export declare function isBroadAllowRule(rule: string): boolean;
 /**
  * Evaluate a tool call against merged rules. Returns the matching decision, or
  * null when no rule applies (caller decides the default, usually "ask").

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AA6BD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAE5E;AACD,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AAqJD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAsBD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAE5E;AACD,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AAqJD;;oEAEoE;AACpE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAEf;AAYD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}

package/dist/permissions/rules.js

@@ -33,15 +33,22 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.managedSettingsPath = managedSettingsPath;
 exports.setSessionRules = setSessionRules;
 exports.setSessionSettings = setSessionSettings;
 exports.getSessionSettings = getSessionSettings;
 exports.loadSettings = loadSettings;
+exports.matchedAllowRule = matchedAllowRule;
+exports.isBroadAllowRule = isBroadAllowRule;
 exports.evaluatePermission = evaluatePermission;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 function managedSettingsPath() {
+    // Tests (and a sandboxed doctor run) point this at a fixture. Checked first so it
+    // can never be shadowed by a real machine-level file.
+    if (process.env.NEXRALL_MANAGED_SETTINGS)
+        return process.env.NEXRALL_MANAGED_SETTINGS;
     if (process.platform === 'darwin')
         return '/Library/Application Support/Nexrall/managed-settings.json';
     if (process.platform === 'win32')
@@ -258,6 +265,32 @@ function ruleMatches(rule, tool, input, workDir, opts) {
         return true;
     return matchValues(tool, input, workDir).some((v) => matchPattern(pattern, v));
 }
+/** The first ALLOW rule that matches this call, or null. S20's classifier gate
+ * reads this to tell a NARROW pre-approval (wins, no review) from a BROAD one
+ * (suspended while the classifier is on — see isBroadAllowRule). */
+function matchedAllowRule(rules, tool, input, workDir) {
+    return rules.allow.find((r) => ruleMatches(r, tool, input, workDir, { forAllow: true })) ?? null;
+}
+/**
+ * Is this allow rule a BLANKET pre-approval ("anything this tool can do")?
+ * Those stop meaning anything once an auto-mode classifier exists: `Bash(*)`
+ * is exactly the rule a prompt-injected agent would wish for, and CC suspends
+ * the same set in their auto mode. Broad = bare tool name / `(*)`, or a bash
+ * rule that hands control to an interpreter (`Bash(python:*)`, `node -e`…).
+ * Narrow rules (`Bash(npm run test:*)`, `Read(src/**)`) keep resolving first.
+ */
+const INTERPRETER_HEADS = /^(?:\S*\/)?(python3?|node|bun|deno|ruby|perl|php|bash|sh|zsh|fish|pwsh|powershell|osascript|cmd)(\s|:|$)/i;
+function isBroadAllowRule(rule) {
+    const { tool, pattern } = parseRule(rule);
+    if (pattern === null || pattern === '' || pattern === '*')
+        return true;
+    const isBashRule = ['bash', 'run_command', 'execute_command', 'Bash'].includes(tool);
+    if (!isBashRule)
+        return false;
+    if (!/[*:]$/.test(pattern))
+        return false;
+    return INTERPRETER_HEADS.test(pattern.replace(/[:*]+$/, '').trim());
+}
 /**
  * Evaluate a tool call against merged rules. Returns the matching decision, or
  * null when no rule applies (caller decides the default, usually "ask").

package/dist/project/projectCommands.d.ts

@@ -0,0 +1,33 @@
+export interface ProjectCommand {
+    /** What the user types after `/run`: an npm script name, a make target, … */
+    name: string;
+    /** The full shell command. */
+    command: string;
+    /** The file it came from, shown in the picker and in errors. */
+    source: string;
+}
+/** The package manager whose scripts this project's lockfile asks for. */
+export declare function packageManager(workDir: string): 'npm' | 'pnpm' | 'yarn' | 'bun';
+/**
+ * Every command this folder can run, in a stable order (package.json first — the most
+ * common source — then the rest alphabetically). Missing files are simply absent: a
+ * project with no package.json is not an error, it is a Cargo project.
+ */
+export declare function detectProjectCommands(workDir: string): ProjectCommand[];
+/**
+ * The commands a shortcut should run: everything in the best tier it finds, best
+ * first. More than one means the caller asks which (a repo with `test` and
+ * `test:integration` should not silently pick one — running the wrong suite and
+ * calling it "the tests" is worse than one extra keystroke).
+ */
+export declare function resolveShortcut<T extends {
+    name: string;
+}>(cmds: T[], want: string): T[];
+/**
+ * Runs `git` with the user's arguments: `/git` alone means `git status`, `/git log -5`
+ * means exactly that. Not a list of allowed subcommands — the read-only gate in front
+ * of this (core's isReadOnlyBash) is what decides whether it may run unprompted, so
+ * `/git commit` works in a normal session and is refused under `--readonly`.
+ */
+export declare function gitCommand(arg: string): string;
+//# sourceMappingURL=projectCommands.d.ts.map

package/dist/project/projectCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectCommands.d.ts","sourceRoot":"","sources":["../../src/project/projectCommands.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAkCD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAM/E;AAsED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAiEvE;AAsBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,EAAE,CAKxF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C"}