@pellux/goodvibes-sdk 0.18.3 → 0.18.12

package/dist/_internal/platform/runtime/permissions/normalization/canonicalizer.js

@@ -0,0 +1,61 @@
+/** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
+/**
+ * Canonicalizer — resolves raw command tokens to their canonical command names.
+ *
+ * Strips:
+ *  - Absolute and relative path prefixes (e.g. /usr/bin/rm → rm)
+ *  - Environment variable assignments that prefix the command
+ *    (e.g. FOO=bar git → git)
+ *  - Quoted wrappers around the command name
+ *
+ * Returns the lowercase bare command name, or an empty string if the
+ * input cannot be resolved.
+ */
+/** Pattern for an environment variable assignment (KEY=value). */
+const ENV_VAR_PREFIX = /^[A-Z_][A-Z0-9_]*=/i;
+/**
+ * Strips shell quoting (single or double) from a string.
+ *
+ * @param value - The raw token value, potentially quoted.
+ * @returns The unquoted string value.
+ */
+function stripQuotes(value) {
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+/**
+ * Resolves a raw command token to its canonical bare command name.
+ *
+ * Processing order:
+ *  1. Strip quotes.
+ *  2. Strip leading environment variable assignments.
+ *  3. Extract the basename (strip directory path).
+ *  4. Lowercase the result.
+ *
+ * @param raw - The raw command token value.
+ * @returns The canonical command name (e.g. "rm", "git", "npm").
+ */
+export function canonicalize(raw) {
+    if (!raw)
+        return '';
+    let value = stripQuotes(raw);
+    // Strip env var prefixes (e.g. "FOO=bar command" — take the last space-separated part)
+    const parts = value.split(/\s+/);
+    // Walk forward past any KEY=value segments
+    let commandPart = parts[0] ?? '';
+    for (const part of parts) {
+        if (!ENV_VAR_PREFIX.test(part)) {
+            commandPart = part;
+            break;
+        }
+    }
+    // Extract basename from path (e.g. /usr/bin/git → git, ./scripts/deploy.sh → deploy.sh)
+    const lastSlash = commandPart.lastIndexOf('/');
+    if (lastSlash !== -1) {
+        commandPart = commandPart.slice(lastSlash + 1);
+    }
+    return commandPart.toLowerCase();
+}

package/dist/_internal/platform/runtime/permissions/normalization/classifier.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Classifier — assigns a CommandClassification to each command segment
+ * and computes the highest-risk classification for a full command.
+ *
+ * Classification priority (highest → lowest):
+ *   destructive > escalation > network > write > read
+ *
+ * Also detects dangerous shell patterns such as rm -rf, force-push, etc.
+ */
+import type { CommandClassification, CommandSegment, NormalizedCommand } from './types.js';
+/**
+ * Returns the higher-priority classification of two.
+ *
+ * @param a - First classification.
+ * @param b - Second classification.
+ * @returns The classification with higher risk priority.
+ */
+export declare function higherPriority(a: CommandClassification, b: CommandClassification): CommandClassification;
+/**
+ * Classifies a single CommandSegment into a CommandClassification tier.
+ *
+ * For compound tools (git, npm, npx, yarn, pnpm, bun), the first positional
+ * argument (sub-command) determines the sub-classification.
+ *
+ * @param seg - The command segment to classify.
+ * @returns The CommandClassification for this segment.
+ */
+export declare function classifySegment(seg: CommandSegment): CommandClassification;
+/**
+ * Classifies a full normalized command, computing the union of classifications
+ * across all segments and the highest-risk tier.
+ *
+ * @param original - The original command string.
+ * @param segments - The command segments to classify.
+ * @returns A partial NormalizedCommand (without the original field, for composability).
+ */
+export declare function classifyCommand(original: string, segments: CommandSegment[]): Omit<NormalizedCommand, 'original' | 'segments'>;
+//# sourceMappingURL=classifier.d.ts.map

package/dist/_internal/platform/runtime/permissions/normalization/classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/normalization/classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAmKpB;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,qBAAqB,EACxB,CAAC,EAAE,qBAAqB,GACvB,qBAAqB,CAIvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,qBAAqB,CAyE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,EAAE,GACzB,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,UAAU,CAAC,CAoClD"}

package/dist/_internal/platform/runtime/permissions/normalization/classifier.js

@@ -0,0 +1,277 @@
+/**
+ * Classifier — assigns a CommandClassification to each command segment
+ * and computes the highest-risk classification for a full command.
+ *
+ * Classification priority (highest → lowest):
+ *   destructive > escalation > network > write > read
+ *
+ * Also detects dangerous shell patterns such as rm -rf, force-push, etc.
+ */
+// ── Classification sets ────────────────────────────────────────────────────────
+/** Commands classified as read-only operations. */
+const READ_COMMANDS = new Set([
+    'cat', 'head', 'tail', 'less', 'more', 'bat',
+    'grep', 'egrep', 'fgrep', 'rg', 'ag',
+    'find', 'locate', 'which', 'whereis', 'type',
+    'ls', 'dir', 'tree', 'du', 'df', 'stat', 'file',
+    'wc', 'sort', 'uniq', 'cut',
+    'diff', 'cmp', 'md5sum', 'sha256sum', 'shasum',
+    'ps', 'top', 'htop', 'env', 'printenv', 'pwd', 'id', 'whoami',
+    'date', 'uname', 'uptime',
+]);
+/** Git sub-commands that are read-only. */
+const GIT_READ_SUBCOMMANDS = new Set([
+    'log', 'status', 'diff', 'show', 'branch', 'tag',
+    'describe', 'shortlog', 'reflog', 'blame', 'grep',
+    'ls-files', 'ls-tree', 'rev-parse', 'cat-file',
+]);
+/** Commands classified as write operations. */
+const WRITE_COMMANDS = new Set([
+    'cp', 'mv', 'mkdir', 'touch', 'ln', 'chmod', 'chown', 'chgrp',
+    'tee', 'install',
+    'zip', 'unzip', 'tar', 'gzip', 'gunzip',
+    'patch', 'sed', 'awk',
+]);
+/** Git sub-commands that are write operations. */
+const GIT_WRITE_SUBCOMMANDS = new Set([
+    'add', 'commit', 'merge', 'rebase', 'cherry-pick',
+    'stash', 'apply', 'am', 'checkout', 'switch', 'restore',
+    'init',
+]);
+/** npm / package manager sub-commands that are write operations. */
+const NPM_WRITE_SUBCOMMANDS = new Set(['install', 'i', 'ci', 'update', 'uninstall', 'link', 'pack']);
+/** Commands classified as network operations. */
+const NETWORK_COMMANDS = new Set([
+    'curl', 'wget', 'http', 'httpie', 'nc', 'netcat',
+    'ssh', 'scp', 'sftp', 'rsync',
+    'ftp', 'ftps', 'telnet',
+    'ping', 'traceroute', 'nslookup', 'dig', 'host',
+]);
+/** Git sub-commands that involve network I/O. */
+const GIT_NETWORK_SUBCOMMANDS = new Set(['push', 'fetch', 'pull', 'clone', 'remote']);
+/** npm / package manager sub-commands that involve network I/O. */
+const NPM_NETWORK_SUBCOMMANDS = new Set(['publish', 'deprecate']);
+/** Commands classified as destructive operations. */
+const DESTRUCTIVE_COMMANDS = new Set([
+    'rm', 'rmdir', 'shred', 'wipe', 'wipefs',
+    'mkfs', 'fdisk', 'parted', 'dd',
+    'kill', 'killall', 'pkill',
+    'truncate',
+]);
+/** SQL keywords indicating destructive database operations (used in pattern detection). */
+const DESTRUCTIVE_SQL_PATTERNS = ['DROP ', 'DELETE ', 'TRUNCATE '];
+/** Git sub-commands that are destructive when combined with certain flags. */
+const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set([
+    'reset', 'clean', 'gc', 'prune', 'reflog',
+]);
+/** Commands that escalate privileges. */
+const ESCALATION_COMMANDS = new Set([
+    'sudo', 'su', 'doas', 'pkexec', 'runas',
+    'docker', 'kubectl', 'helm', 'oc',
+    'nsenter', 'unshare', 'chroot',
+    'setuid', 'setgid',
+]);
+const DANGEROUS_PATTERNS = [
+    {
+        description: 'rm -rf: recursive forced deletion',
+        match: (seg) => seg.command === 'rm' &&
+            seg.flags.some((f) => f.includes('r') || f === '-r' || f === '--recursive') &&
+            seg.flags.some((f) => f.includes('f') || f === '-f' || f === '--force'),
+    },
+    {
+        description: 'rm -rf /: attempted root filesystem deletion',
+        match: (seg) => seg.command === 'rm' &&
+            seg.flags.some((f) => f.includes('r')) &&
+            seg.flags.some((f) => f.includes('f')) &&
+            seg.args.some((a) => a === '/' || a === '/*'),
+    },
+    {
+        description: 'git reset --hard: irreversible history rewrite',
+        match: (seg) => seg.command === 'git' &&
+            seg.args[0] === 'reset' &&
+            seg.flags.includes('--hard'),
+    },
+    {
+        description: 'git clean -fd: removes untracked files and directories',
+        match: (seg) => seg.command === 'git' &&
+            seg.args[0] === 'clean' &&
+            seg.flags.some((f) => f.includes('f')),
+    },
+    {
+        description: 'git push --force: force-pushes, may rewrite remote history',
+        match: (seg) => seg.command === 'git' &&
+            seg.args[0] === 'push' &&
+            (seg.flags.includes('--force') || seg.flags.includes('-f')),
+    },
+    {
+        description: 'SQL DROP/DELETE/TRUNCATE: destructive database operation',
+        match: (seg) => DESTRUCTIVE_SQL_PATTERNS.some((pattern) => seg.raw.toUpperCase().includes(pattern)),
+    },
+    {
+        description: 'sudo: command run with elevated privileges',
+        match: (seg) => seg.command === 'sudo',
+    },
+    {
+        description: 'docker exec: executing inside a container',
+        match: (seg) => seg.command === 'docker' && seg.args[0] === 'exec',
+    },
+    {
+        description: 'kubectl exec: executing inside a Kubernetes pod',
+        match: (seg) => seg.command === 'kubectl' && seg.args[0] === 'exec',
+    },
+    {
+        description: 'dd: raw disk write (potentially destructive)',
+        match: (seg) => seg.command === 'dd',
+    },
+];
+// ── Classification priority ────────────────────────────────────────────────────
+/** Ordered priority: index 0 = highest risk. */
+const CLASSIFICATION_PRIORITY = [
+    'destructive',
+    'escalation',
+    'network',
+    'write',
+    'read',
+];
+/**
+ * Returns the higher-priority classification of two.
+ *
+ * @param a - First classification.
+ * @param b - Second classification.
+ * @returns The classification with higher risk priority.
+ */
+export function higherPriority(a, b) {
+    const ai = CLASSIFICATION_PRIORITY.indexOf(a);
+    const bi = CLASSIFICATION_PRIORITY.indexOf(b);
+    return ai <= bi ? a : b;
+}
+/**
+ * Classifies a single CommandSegment into a CommandClassification tier.
+ *
+ * For compound tools (git, npm, npx, yarn, pnpm, bun), the first positional
+ * argument (sub-command) determines the sub-classification.
+ *
+ * @param seg - The command segment to classify.
+ * @returns The CommandClassification for this segment.
+ */
+export function classifySegment(seg) {
+    const { command, args, flags } = seg;
+    // ── Escalation check (highest priority) ─────────────────────────────────────
+    // For sudo/doas/su, unwrap the inner command and take the higher-priority classification.
+    const SUDO_LIKE = new Set(['sudo', 'doas', 'su']);
+    if (SUDO_LIKE.has(command)) {
+        const innerArgs = [...args];
+        if (innerArgs.length > 0) {
+            const innerCommand = innerArgs[0];
+            const innerSeg = {
+                ...seg,
+                command: innerCommand,
+                args: innerArgs.slice(1),
+            };
+            const innerCls = classifySegment(innerSeg);
+            return higherPriority(innerCls, 'escalation');
+        }
+        return 'escalation';
+    }
+    if (ESCALATION_COMMANDS.has(command))
+        return 'escalation';
+    // ── git sub-command routing ─────────────────────────────────────────────────
+    if (command === 'git') {
+        const sub = args[0] ?? '';
+        if (GIT_DESTRUCTIVE_SUBCOMMANDS.has(sub)) {
+            // git reset --hard is always destructive; other git destructive cmds need flags
+            if (sub === 'reset' && flags.includes('--hard'))
+                return 'destructive';
+            if (sub === 'clean')
+                return 'destructive';
+            // git reflog delete etc — treat as destructive
+            if (sub === 'gc' || sub === 'prune')
+                return 'destructive';
+            // fallthrough to write for other cases (e.g. git reflog alone = read)
+            if (sub === 'reflog' && args.length === 1)
+                return 'read';
+        }
+        if (GIT_NETWORK_SUBCOMMANDS.has(sub))
+            return 'network';
+        if (GIT_WRITE_SUBCOMMANDS.has(sub))
+            return 'write';
+        if (GIT_READ_SUBCOMMANDS.has(sub))
+            return 'read';
+        // Unknown git sub-command: treat as write (conservative)
+        return 'write';
+    }
+    // ── npm / npx / yarn / pnpm / bun routing ───────────────────────────────────
+    const isPackageManager = ['npm', 'npx', 'yarn', 'pnpm', 'bun'].includes(command);
+    if (isPackageManager) {
+        const sub = args[0] ?? '';
+        if (NPM_NETWORK_SUBCOMMANDS.has(sub))
+            return 'network';
+        if (NPM_WRITE_SUBCOMMANDS.has(sub))
+            return 'write';
+        // run, exec, x, dlx — treat as write (executes code)
+        if (sub === 'run' || sub === 'exec' || sub === 'x' || sub === 'dlx')
+            return 'write';
+        // info, view, list, ls, audit, outdated — read
+        if (['info', 'view', 'list', 'ls', 'audit', 'outdated'].includes(sub))
+            return 'read';
+        return 'write'; // conservative default
+    }
+    // ── Destructive commands ─────────────────────────────────────────────────────
+    if (DESTRUCTIVE_COMMANDS.has(command))
+        return 'destructive';
+    // ── Network commands ─────────────────────────────────────────────────────────
+    if (NETWORK_COMMANDS.has(command))
+        return 'network';
+    // ── Write commands ───────────────────────────────────────────────────────────
+    if (WRITE_COMMANDS.has(command))
+        return 'write';
+    // ── Read commands ────────────────────────────────────────────────────────────
+    if (READ_COMMANDS.has(command))
+        return 'read';
+    // ── echo/printf: redirect makes it a write, otherwise read ─────────────────────
+    if (command === 'echo' || command === 'printf') {
+        return seg.tokens.some((t) => t.type === 'redirect') ? 'write' : 'read';
+    }
+    // Unknown command: conservative default — write
+    return 'write';
+}
+/**
+ * Classifies a full normalized command, computing the union of classifications
+ * across all segments and the highest-risk tier.
+ *
+ * @param original - The original command string.
+ * @param segments - The command segments to classify.
+ * @returns A partial NormalizedCommand (without the original field, for composability).
+ */
+export function classifyCommand(original, segments) {
+    if (segments.length === 0) {
+        return {
+            classifications: ['read'],
+            highestClassification: 'read',
+            hasDangerousPatterns: false,
+        };
+    }
+    const classificationSet = new Set();
+    let highest = 'read';
+    for (const seg of segments) {
+        const cls = classifySegment(seg);
+        classificationSet.add(cls);
+        highest = higherPriority(highest, cls);
+    }
+    // ── Dangerous pattern detection ──────────────────────────────────────────────
+    const matched = [];
+    for (const seg of segments) {
+        for (const pattern of DANGEROUS_PATTERNS) {
+            if (pattern.match(seg)) {
+                matched.push(pattern.description);
+            }
+        }
+    }
+    const hasDangerousPatterns = matched.length > 0;
+    return {
+        classifications: Array.from(classificationSet),
+        highestClassification: highest,
+        hasDangerousPatterns,
+        ...(hasDangerousPatterns ? { dangerousPatterns: matched } : {}),
+    };
+}

package/dist/_internal/platform/runtime/permissions/normalization/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Command normalization pipeline — barrel export and primary entry point.
+ *
+ * Exposes the normalizeCommand() function and all supporting types.
+ * Pipeline: tokenize → segment → classify → NormalizedCommand
+ */
+export type { CommandToken, CommandSegment, CommandClassification, NormalizedCommand, } from './types.js';
+export type { ShellNode, CommandNode, PipeNode, SequenceNode, SubshellNode, } from './ast.js';
+export type { SegmentVerdict, CompoundVerdict, } from './verdict.js';
+export { tokenize } from './tokenizer.js';
+export { segment } from './segmenter.js';
+export { canonicalize } from './canonicalizer.js';
+export { classifySegment, classifyCommand, higherPriority } from './classifier.js';
+export { collectCommandNodes, describeNode } from './ast.js';
+export { parseAST, parseCommandAST } from './parser.js';
+export { evaluateSegmentNode, evaluateCommandAST, buildDenialExplanation, DEFAULT_ALLOWED_CLASSES } from './verdict.js';
+import type { NormalizedCommand, CommandClassification } from './types.js';
+import type { CompoundVerdict } from './verdict.js';
+/**
+ * Normalizes a raw shell command string and evaluates per-segment verdicts.
+ *
+ * Uses the Shell AST parser to produce a CompoundVerdict with
+ * per-segment classification and denial reasons. Requires the
+ * `shell-ast-normalization` feature flag to be enabled; falls back to
+ * `normalizeCommand` when the flag is disabled.
+ *
+ * @param command        - The raw shell command string to evaluate.
+ * @param allowedClasses - Classification tiers to allow (default: read+write+network).
+ * @returns A CompoundVerdict with per-segment breakdown.
+ */
+export declare function normalizeCommandWithVerdicts(command: string, allowedClasses?: ReadonlySet<CommandClassification>): CompoundVerdict;
+export declare function normalizeCommand(command: string): NormalizedCommand;
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/platform/runtime/permissions/normalization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/normalization/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAKxH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAG3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,cAAc,GAAE,WAAW,CAAC,qBAAqB,CAA2B,GAC3E,eAAe,CAGjB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAWnE"}

package/dist/_internal/platform/runtime/permissions/normalization/index.js

@@ -0,0 +1,45 @@
+/**
+ * Command normalization pipeline — barrel export and primary entry point.
+ *
+ * Exposes the normalizeCommand() function and all supporting types.
+ * Pipeline: tokenize → segment → classify → NormalizedCommand
+ */
+export { tokenize } from './tokenizer.js';
+export { segment } from './segmenter.js';
+export { canonicalize } from './canonicalizer.js';
+export { classifySegment, classifyCommand, higherPriority } from './classifier.js';
+export { collectCommandNodes, describeNode } from './ast.js';
+export { parseAST, parseCommandAST } from './parser.js';
+export { evaluateSegmentNode, evaluateCommandAST, buildDenialExplanation, DEFAULT_ALLOWED_CLASSES } from './verdict.js';
+import { tokenize } from './tokenizer.js';
+import { segment } from './segmenter.js';
+import { classifyCommand } from './classifier.js';
+import { parseCommandAST } from './parser.js';
+import { evaluateCommandAST, DEFAULT_ALLOWED_CLASSES } from './verdict.js';
+/**
+ * Normalizes a raw shell command string and evaluates per-segment verdicts.
+ *
+ * Uses the Shell AST parser to produce a CompoundVerdict with
+ * per-segment classification and denial reasons. Requires the
+ * `shell-ast-normalization` feature flag to be enabled; falls back to
+ * `normalizeCommand` when the flag is disabled.
+ *
+ * @param command        - The raw shell command string to evaluate.
+ * @param allowedClasses - Classification tiers to allow (default: read+write+network).
+ * @returns A CompoundVerdict with per-segment breakdown.
+ */
+export function normalizeCommandWithVerdicts(command, allowedClasses = DEFAULT_ALLOWED_CLASSES) {
+    const ast = parseCommandAST(command);
+    return evaluateCommandAST(command, ast, allowedClasses);
+}
+export function normalizeCommand(command) {
+    const trimmed = command.trim();
+    const tokens = tokenize(trimmed);
+    const segments = segment(tokens);
+    const analysis = classifyCommand(trimmed, segments);
+    return {
+        original: command,
+        segments,
+        ...analysis,
+    };
+}

package/dist/_internal/platform/runtime/permissions/normalization/parser.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shell AST parser.
+ *
+ * Converts a flat CommandToken list into a ShellNode AST, preserving
+ * operator relationships between segments (&&, ||, ;, |, subshells).
+ *
+ * Grammar (simplified, right-associative for simplicity):
+ *
+ *   compound := sequence
+ *   sequence := pipe (('&&' | '||' | ';') pipe)*
+ *   pipe     := atom ('|' atom)*
+ *   atom     := subshell | command
+ *
+ * Obfuscation handling:
+ *   - Backtick subshells (`cmd`) are extracted and recursively parsed.
+ *   - $(...) subshells are extracted and recursively parsed.
+ *   - Base64-like argument tokens are flagged for upper-layer analysis.
+ *
+ * @module normalization/parser
+ */
+import type { CommandToken } from './types.js';
+import type { ShellNode } from './ast.js';
+/**
+ * Parses a flat CommandToken list into a ShellNode AST.
+ *
+ * Handles compound commands (pipes, &&, ||, ;) and subshell expressions.
+ * Falls back to a single CommandNode if parsing encounters errors.
+ *
+ * @param tokens - The flat token list from the tokenizer.
+ * @returns The root ShellNode of the parsed AST.
+ */
+export declare function parseAST(tokens: CommandToken[]): ShellNode;
+/**
+ * Parses a raw shell command string into a ShellNode AST.
+ *
+ * Convenience wrapper: tokenizes and parses in one step.
+ *
+ * @param command - The raw shell command string.
+ * @returns The root ShellNode of the parsed AST.
+ */
+export declare function parseCommandAST(command: string): ShellNode;
+//# sourceMappingURL=parser.d.ts.map

package/dist/_internal/platform/runtime/permissions/normalization/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/normalization/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,SAAS,EAKV,MAAM,UAAU,CAAC;AA+JlB;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAc1D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAG1D"}