@parel/security-basic 0.1.1 → 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Parall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,30 @@
+# @parel/security-basic
+
+> PAREL plugin for basic command and secret safety checks.
+
+A first-party runtime plugin for [PAREL](https://github.com/parall-hq/parel-opensource).
+
+## Install
+
+```bash
+npm install @parel/security-basic
+```
+
+## Usage
+
+```yaml
+plugins:
+  - security-basic
+```
+
+It enforces a command allowlist and redacts known secret patterns from tool
+output.
+
+> **Scope.** This is a best-effort policy layer, **not** an isolation boundary.
+> A program-name allowlist cannot see inside an allowlisted interpreter's
+> arguments (e.g. `python -c`, `awk`, `find -exec`), so treat it as a guard
+> rail, not a sandbox. For untrusted workloads, run inside a real sandbox.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/index.js

@@ -193,7 +193,10 @@ function tokenize(input) {
     }
     if (c === "$" && input[i + 1] === "(") {
       if (input[i + 2] === "(") {
-        const [, next2] = readBalanced(i + 3, "(", ")");
+        const [arith, next2] = readBalanced(i + 3, "(", ")");
+        for (const tok of tokenize(arith)) {
+          for (const sub of tok.nested) currentNested.push(sub);
+        }
         hasWord = true;
         i = input[next2] === ")" ? next2 + 1 : next2;
         continue;
@@ -313,7 +316,8 @@ function collectPrograms(tokens, out) {
     if (inWrapperArgs && (token.value.startsWith("-") || /^\d+$/.test(token.value))) {
       continue;
     }
-    if (token.value === "" && token.nested.length > 0) {
+    if (token.nested.length > 0) {
+      out.push("$(...)");
       expectProgram = false;
       inWrapperArgs = false;
       continue;
@@ -343,7 +347,6 @@ function extractAllPrograms(command) {
 }
 var index_default = definePlugin({
   name: "@parel/security-basic",
-  version: "0.0.2",
   async setup(ctx) {
     const mode = ctx.config.mode ?? "allowlist";
     const customExecTools = ctx.config.exec_tools;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parel/security-basic",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "PAREL plugin for basic command and secret safety checks.",
   "license": "MIT",
   "repository": {
@@ -20,10 +20,12 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "LICENSE",
+    "README.md"
   ],
   "dependencies": {
-    "@parel/plugin-sdk": "0.2.0"
+    "@parel/plugin-sdk": "0.2.2"
   },
   "devDependencies": {
     "tsup": "^8.0.0",