@praxis.guard/auditor-cli 0.0.32 → 0.0.34

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AA+WA,8EAA8E;AAC9E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmDvD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAcA,8EAA8E;AAC9E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkDvD"}

package/dist/mcp/server.js

@@ -1,340 +1,17 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import { v4 as uuidv4 } from "uuid";
 import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
-import { resolveGuardToken } from "../cli/credentials.js";
-import { getInstallId } from "../cli/install-id.js";
-import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
-import { resolveMutateApproval } from "../approval/mcp-flow.js";
-import { evaluateMcpProposal, evaluateShellProposal, parseCommandToArgv, } from "../shell/evaluate.js";
-import { sendGuardEvent } from "../telemetry/guard-events.js";
-import { resolveGuardAuditStatus } from "./guard-audit-status.js";
-import { applyGuardMode, tierToPolicyDecision } from "./guard-mode.js";
 import { AUDITOR_CLI_VERSION } from "../runtime/version.js";
-import { prodFunctionUrl } from "../cli/function-url.js";
-const GuardModeSchema = z.enum(["shadow", "enforce"]);
-const ProposalKindSchema = z.enum(["shell", "mcp"]);
-const ApprovalContextSchema = z
-    .object({
-    request_id: z.string().nullable().optional(),
-    grant: z.string().nullable().optional(),
-})
-    .optional();
-const GuardInputSchema = z.object({
-    mode: GuardModeSchema,
-    proposal: z.object({
-        kind: ProposalKindSchema,
-        argv: z.array(z.string()).min(1),
-        cwd: z.string().optional(),
-        raw_command: z.string().optional(),
-    }),
-    context: z
-        .object({
-        provider: z.string().optional(),
-        session_id: z.string().optional(),
-        trace_id: z.string().optional(),
-        agent_id: z.string().optional(),
-        user_id: z.string().optional(),
-        environment: z.string().optional(),
-        approval: ApprovalContextSchema,
-        wait_ms: z.number().int().nonnegative().optional(),
-        tool_input_sha256: z.string().nullable().optional(),
-    })
-        .optional(),
-});
-const GUARD_TOOL_DESCRIPTION = "Policy gatekeeper for agent actions. Evaluates a proposal argv against policies.v1.json. " +
-    "Required `mode`: `shadow` (dry-run — response `decision` is always `allow`; see `shadow` for the policy verdict) " +
-    "or `enforce` (coordination — real `allow` / `require_approval` / `block`; runs human approval for MUTATE). " +
-    "For MUTATE after approval, pass `context.approval.request_id` (and optional `grant`) from the app or dev CLI.";
-const GUARD_WAIT_TOOL_DESCRIPTION = "Poll until a MUTATE approval request is approved, redeem grant, and record a signed execution ticket for hooks. " +
-    "Uses enforce semantics (approval backend). Prefer this over a separate `guard` + retry. " +
-    "Set `context.wait_ms` (e.g. 120000) and `context.approval.request_id` from hook deny or a prior `guard` call.";
-const DEFAULT_HEARTBEAT_URL = prodFunctionUrl("guardHeartbeat");
-const HEARTBEAT_BASE_INTERVAL_MS = 5 * 60 * 1000;
-const HEARTBEAT_MAX_INTERVAL_MS = 30 * 60 * 1000;
-let heartbeatTimer = null;
-let consecutiveIdleHeartbeats = 0;
-function getNextHeartbeatInterval() {
-    if (consecutiveIdleHeartbeats < 3)
-        return HEARTBEAT_BASE_INTERVAL_MS;
-    return Math.min(HEARTBEAT_BASE_INTERVAL_MS * Math.pow(1.5, consecutiveIdleHeartbeats - 2), HEARTBEAT_MAX_INTERVAL_MS);
-}
-function scheduleNextHeartbeat() {
-    if (heartbeatTimer)
-        clearTimeout(heartbeatTimer);
-    heartbeatTimer = setTimeout(async () => {
-        consecutiveIdleHeartbeats++;
-        await sendGuardHeartbeat();
-        scheduleNextHeartbeat();
-    }, getNextHeartbeatInterval());
-}
-function resetHeartbeatIdle() {
-    consecutiveIdleHeartbeats = 0;
-}
-async function sendGuardHeartbeat() {
-    const heartbeatUrl = process.env.PRAXIS_GUARD_HEARTBEAT_URL || DEFAULT_HEARTBEAT_URL;
-    const token = resolveGuardToken();
-    if (!token)
-        return;
-    const payload = {
-        installId: getInstallId(),
-        kind: "auditor-mcp",
-        version: AUDITOR_CLI_VERSION,
-        status: "running",
-        client: {
-            os: process.platform,
-            arch: process.arch,
-            node: process.version,
-        },
-    };
-    try {
-        const res = await fetch(heartbeatUrl, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify(payload),
-            signal: AbortSignal.timeout(3000),
-        });
-        if (!res.ok) {
-            process.stderr.write(`[auditor:mcp] heartbeat failed (${res.status}).\n`);
-        }
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`[auditor:mcp] heartbeat error: ${msg}\n`);
-    }
-}
-async function evaluateGuard(input, policyState) {
-    const startedAt = performance.now();
-    const event_id = uuidv4();
-    resetHeartbeatIdle();
-    policyState.policy = await loadPoliciesV1();
-    policyState.policyRevision = await readPoliciesV1Revision();
-    const storageRoot = resolveGuardStorageRoot(input.proposal.cwd);
-    const argv = input.proposal.raw_command
-        ? parseCommandToArgv(input.proposal.raw_command)
-        : input.proposal.argv;
-    const { skipped, evaluation } = input.proposal.kind === "shell"
-        ? evaluateShellProposal(policyState.policy, argv)
-        : evaluateMcpProposal(policyState.policy, argv);
-    const tier = evaluation.tier;
-    const reasons = [...evaluation.reasons];
-    const policyReasons = [...evaluation.reasons];
-    let enforceDecision = tierToPolicyDecision(tier, skipped);
-    let approvalBlock = {
-        required: false,
-        request_id: null,
-        expires_at: null,
-        open_url: null,
-        instructions: null,
-        redeemed: false,
-        approved_by: null,
-    };
-    let approvalRequestId = null;
-    if (skipped) {
-        enforceDecision = "allow";
-    }
-    else if (tier === "DESTRUCTIVE") {
-        enforceDecision = "block";
-        approvalBlock.instructions =
-            "DESTRUCTIVE actions cannot be approved via guard. Escalate outside the agent loop.";
-    }
-    else if (tier === "READ") {
-        enforceDecision = "allow";
-    }
-    else if (input.mode === "shadow") {
-        enforceDecision = "require_approval";
-        approvalBlock.instructions =
-            "Shadow mode: no approval request created. Re-call with mode enforce to coordinate human approval.";
-    }
-    else {
-        const hasToken = Boolean(resolveGuardToken());
-        if (!hasToken) {
-            enforceDecision = "require_approval";
-            approvalBlock = {
-                required: true,
-                request_id: null,
-                expires_at: null,
-                open_url: null,
-                instructions: "MUTATE requires human approval. Run `auditor login` (or set PRAXIS_GUARD_TOKEN), then call guard again.",
-                redeemed: false,
-                approved_by: null,
-            };
-            reasons.push({
-                code: "approval_backend_unavailable",
-                message: "No guard token; cannot create approval request.",
-            });
-        }
-        else {
-            const outcome = await resolveMutateApproval({
-                argv,
-                proposalKind: input.proposal.kind,
-                storageRoot,
-                rawDisplay: input.proposal.raw_command ?? argv.join(" "),
-                eventId: event_id,
-                policyRevision: policyState.policyRevision,
-                reasons,
-                sessionId: input.context?.session_id ?? null,
-                environment: input.context?.environment ?? null,
-                approval: input.context?.approval ?? null,
-                waitMs: input.context?.wait_ms ?? null,
-                tool_input_sha256: input.context?.tool_input_sha256 ?? null,
-            });
-            if (outcome.kind === "allow") {
-                if (!outcome.ticketRecorded) {
-                    enforceDecision = "require_approval";
-                    approvalRequestId = outcome.request_id;
-                    approvalBlock = {
-                        required: true,
-                        request_id: outcome.request_id,
-                        expires_at: null,
-                        open_url: null,
-                        instructions: "Approval redeemed but execution ticket was not written under .cursor/guard/tickets. Fix permissions and call guard_wait again.",
-                        redeemed: false,
-                        approved_by: outcome.approved_by,
-                    };
-                    reasons.push({
-                        code: "hook_credential_not_recorded",
-                        message: "Execution ticket file was not recorded for hooks.",
-                    });
-                }
-                else {
-                    enforceDecision = "allow";
-                    approvalRequestId = outcome.request_id;
-                    approvalBlock = {
-                        required: false,
-                        request_id: outcome.request_id,
-                        expires_at: null,
-                        open_url: null,
-                        instructions: "Approval redeemed; retry the same shell/MCP invocation (hook consumes execution ticket).",
-                        redeemed: outcome.redeemed,
-                        approved_by: outcome.approved_by,
-                    };
-                    reasons.push({
-                        code: "execution_ticket_recorded",
-                        message: "Recorded signed execution ticket for hooks (same argv within TTL).",
-                    });
-                }
-            }
-            else if (outcome.kind === "credential_not_recorded") {
-                enforceDecision = "require_approval";
-                approvalRequestId = outcome.request_id;
-                approvalBlock = {
-                    required: true,
-                    request_id: outcome.request_id,
-                    expires_at: null,
-                    open_url: null,
-                    instructions: `${outcome.message} Hooks will deny until a credential is recorded; retry guard after fixing local write permissions.`,
-                    redeemed: false,
-                    approved_by: null,
-                };
-                reasons.push({
-                    code: "hook_credential_not_recorded",
-                    message: outcome.message,
-                });
-            }
-            else if (outcome.kind === "require_approval") {
-                enforceDecision = "require_approval";
-                approvalRequestId = outcome.request_id;
-                approvalBlock = {
-                    required: true,
-                    request_id: outcome.request_id,
-                    expires_at: outcome.expires_at,
-                    open_url: outcome.open_url,
-                    instructions: "Human must approve in the Praxis app (or dev: `auditor approvals approve <id>`). Prefer guard_wait with context.approval.request_id and context.wait_ms, then retry once.",
-                    redeemed: false,
-                    approved_by: null,
-                };
-            }
-            else {
-                enforceDecision = "require_approval";
-                approvalBlock = {
-                    required: true,
-                    request_id: input.context?.approval?.request_id ?? null,
-                    expires_at: null,
-                    open_url: null,
-                    instructions: `Approval backend error: ${outcome.message}. Hooks will deny MUTATE until resolved.`,
-                    redeemed: false,
-                    approved_by: null,
-                };
-                reasons.push({
-                    code: "approval_backend_unavailable",
-                    message: outcome.message,
-                });
-            }
-        }
-    }
-    const { decision, shadow } = applyGuardMode({
-        mode: input.mode,
-        skipped,
-        tier,
-        policyReasons,
-        enforceDecision,
-    });
-    const response = {
-        mode: input.mode,
-        decision,
-        skipped,
-        tier,
-        risk_score: skipped ? 0 : tier === "READ" ? 0 : tier === "MUTATE" ? 60 : 95,
-        reasons,
-        shadow,
-        approval: approvalBlock,
-        audit: {
-            event_id,
-            timestamp: new Date().toISOString(),
-            latency_ms: performance.now() - startedAt,
-        },
-        execution: {
-            attempted: false,
-            result: null,
-        },
-    };
-    const firstReason = reasons.find((r) => typeof r?.message === "string")?.message ??
-        reasons.find((r) => typeof r?.code === "string")?.code ??
-        null;
-    const actionVerb = argv[1] ?? null;
-    const actionResource = argv.length > 2 ? argv.slice(2).join(" ") : null;
-    const status = resolveGuardAuditStatus({ skipped, decision });
-    void sendGuardEvent({
-        ts: new Date().toISOString(),
-        status,
-        skipped,
-        ...(skipped
-            ? {
-                skip_reason: input.proposal.kind === "shell" ? "ungoverned_shell_tool" : "mcp_policy_unmatched",
-            }
-            : {}),
-        tool: "auditor-mcp",
-        command_path: argv[0] ?? null,
-        verb: actionVerb,
-        resource: actionResource,
-        reason: firstReason,
-        cmd: argv.join(" "),
-        tier,
-        decision,
-        latency_ms: performance.now() - startedAt,
-        event_id,
-        installId: getInstallId(),
-        kind: input.proposal.kind,
-        ...(policyState.policyRevision !== null
-            ? { policy_revision: policyState.policyRevision }
-            : {}),
-        ...(approvalRequestId ? { approval_request_id: approvalRequestId } : {}),
-    });
-    return { response, startedAt };
-}
+import { evaluateGuard } from "./evaluate-guard.js";
+import { startGuardHeartbeatLoop } from "./guard-heartbeat.js";
+import { GuardInputSchema, GUARD_TOOL_DESCRIPTION, GUARD_WAIT_TOOL_DESCRIPTION, } from "./guard-schemas.js";
 /** Start the Praxis `guard` MCP server on stdio (blocks until disconnect). */
 export async function runMcpStdioServer() {
     const policyState = {
         policy: await loadPoliciesV1(),
         policyRevision: await readPoliciesV1Revision(),
     };
-    await sendGuardHeartbeat();
-    scheduleNextHeartbeat();
+    startGuardHeartbeatLoop();
     const server = new McpServer({
         name: "praxis-guard",
         version: AUDITOR_CLI_VERSION,

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACtD,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAEpD,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACE,OAAO,EAAE,CAAC;SACX,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAC1B,2FAA2F;IAC3F,mHAAmH;IACnH,6GAA6G;IAC7G,+GAA+G,CAAC;AAElH,MAAM,2BAA2B,GAC/B,kHAAkH;IAClH,0FAA0F;IAC1F,+GAA+G,CAAC;AAElH,MAAM,qBAAqB,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAEhE,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,IAAI,cAAc,GAAyC,IAAI,CAAC;AAChE,IAAI,yBAAyB,GAAG,CAAC,CAAC;AAElC,SAAS,wBAAwB;IAC/B,IAAI,yBAAyB,GAAG,CAAC;QAAE,OAAO,0BAA0B,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,CACb,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,GAAG,CAAC,CAAC,EACzE,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,cAAc;QAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACjD,cAAc,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACrC,yBAAyB,EAAE,CAAC;QAC5B,MAAM,kBAAkB,EAAE,CAAC;QAC3B,qBAAqB,EAAE,CAAC;IAC1B,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,kBAAkB;IACzB,yBAAyB,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,qBAAqB,CAAC;IACrF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE;YACN,EAAE,EAAE,OAAO,CAAC,QAAQ;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,OAAO;SACtB;KACF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAuC,EACvC,WAAkG;IAElG,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,CAAC;IAErB,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAE5D,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEhE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW;QACrC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IAExB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAC3B,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAS,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,eAAe,GAAkB,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,aAAa,GAA4B;QAC3C,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,IAAI,OAAO,EAAE,CAAC;QACZ,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,eAAe,GAAG,OAAO,CAAC;QAC1B,aAAa,CAAC,YAAY;YACxB,oFAAoF,CAAC;IACzF,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,eAAe,GAAG,kBAAkB,CAAC;QACrC,aAAa,CAAC,YAAY;YACxB,mGAAmG,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,eAAe,GAAG,kBAAkB,CAAC;YACrC,aAAa,GAAG;gBACd,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;gBACd,YAAY,EACV,yGAAyG;gBAC3G,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,IAAI;aAClB,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;gBAC1C,IAAI;gBACJ,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;gBACjC,WAAW;gBACX,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxD,OAAO,EAAE,QAAQ;gBACjB,cAAc,EAAE,WAAW,CAAC,cAAc;gBAC1C,OAAO;gBACP,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;gBAC5C,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI;gBAC/C,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI;gBACzC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI;gBACtC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,iBAAiB,IAAI,IAAI;aAC5D,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC5B,eAAe,GAAG,kBAAkB,CAAC;oBACrC,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;oBACvC,aAAa,GAAG;wBACd,QAAQ,EAAE,IAAI;wBACd,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,UAAU,EAAE,IAAI;wBAChB,QAAQ,EAAE,IAAI;wBACd,YAAY,EACV,gIAAgI;wBAClI,QAAQ,EAAE,KAAK;wBACf,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,8BAA8B;wBACpC,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,eAAe,GAAG,OAAO,CAAC;oBAC1B,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;oBACvC,aAAa,GAAG;wBACd,QAAQ,EAAE,KAAK;wBACf,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,UAAU,EAAE,IAAI;wBAChB,QAAQ,EAAE,IAAI;wBACd,YAAY,EACV,0FAA0F;wBAC5F,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EACL,oEAAoE;qBACvE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACtD,eAAe,GAAG,kBAAkB,CAAC;gBACrC,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;gBACvC,aAAa,GAAG;oBACd,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,GAAG,OAAO,CAAC,OAAO,oGAAoG;oBACpI,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,IAAI;iBAClB,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,8BAA8B;oBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC/C,eAAe,GAAG,kBAAkB,CAAC;gBACrC,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;gBACvC,aAAa,GAAG;oBACd,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,YAAY,EACV,2KAA2K;oBAC7K,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,IAAI;iBAClB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,eAAe,GAAG,kBAAkB,CAAC;gBACrC,aAAa,GAAG;oBACd,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI;oBACvD,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,2BAA2B,OAAO,CAAC,OAAO,0CAA0C;oBAClG,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,IAAI;iBAClB,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,8BAA8B;oBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;QACJ,aAAa;QACb,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC3E,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;SAC1C;QACD,SAAS,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IAEF,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CAAC;IACP,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO;QACP,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,WAAW,EACT,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,sBAAsB;aACrF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnB,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,QAAQ;QACR,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,GAAG,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,cAAc,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,MAAM,cAAc,EAAE;QAC9B,cAAc,EAAE,MAAM,sBAAsB,EAAE;KAC/C,CAAC;IACF,MAAM,kBAAkB,EAAE,CAAC;IAC3B,qBAAqB,EAAE,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,mBAAmB;KAC7B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,EAAE,KAAuC,EAAE,EAAE;QAChE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,gBAAgB;KAC9B,EACD,OAAO,CACR,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,gBAAgB;KAC9B,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC;QACjD,MAAM,QAAQ,GAAG;YACf,GAAG,KAAK;YACR,IAAI,EAAE,SAAkB;YACxB,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,OAAO;gBAChB,OAAO,EAAE,MAAM;aAChB;SACF,CAAC;QACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,GAE5B,MAAM,oBAAoB,CAAC;AAE5B,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,MAAM,cAAc,EAAE;QAC9B,cAAc,EAAE,MAAM,sBAAsB,EAAE;KAC/C,CAAC;IACF,uBAAuB,EAAE,CAAC;IAE1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,mBAAmB;KAC7B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,EAAE,KAAiB,EAAE,EAAE;QAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,gBAAgB;KAC9B,EACD,OAAO,CACR,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,gBAAgB;KAC9B,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC;QACjD,MAAM,QAAQ,GAAe;YAC3B,GAAG,KAAK;YACR,IAAI,EAAE,SAAS;YACf,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,OAAO;gBAChB,OAAO,EAAE,MAAM;aAChB;SACF,CAAC;QACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/policies.v1.json

@@ -543,5 +543,9 @@
         "*": "READ"
       }
     }
+  },
+  "shell": {
+    "prelude_verbs": ["cd", "pushd", "popd"],
+    "privilege_verbs": ["sudo", "doas"]
   }
 }

package/dist/policy/index.d.ts

@@ -17,6 +17,10 @@ export declare const PoliciesV1Schema: z.ZodObject<{
         MUTATE: "MUTATE";
         DESTRUCTIVE: "DESTRUCTIVE";
     }>>>>;
+    shell: z.ZodOptional<z.ZodObject<{
+        prelude_verbs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        privilege_verbs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type PoliciesV1 = z.infer<typeof PoliciesV1Schema>;
 export type Classification = {

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU;;;;EAA4C,CAAC;AACpE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;iBAI3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,QAOzD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAO5D;AAuBD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAK7E;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWnG;AA0BD,wBAAsB,cAAc,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAUxF;AA0BD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE;QAAE,cAAc,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAoFlG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU;;;;EAA4C,CAAC;AACpE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAU3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,QAOzD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAO5D;AAuBD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAK7E;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWnG;AA0BD,wBAAsB,cAAc,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAUxF;AA0BD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE;QAAE,cAAc,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAoFlG"}

package/dist/policy/index.js

@@ -9,6 +9,12 @@ export const PoliciesV1Schema = z.object({
     tiers: z.array(TierSchema).nonempty(),
     dangerous_flags: z.array(z.string()),
     policies: z.record(z.string(), z.record(z.string(), z.record(z.string(), TierSchema))),
+    shell: z
+        .object({
+        prelude_verbs: z.array(z.string()).optional(),
+        privilege_verbs: z.array(z.string()).optional(),
+    })
+        .optional(),
 });
 export function ensureTiersComplete(tiers) {
     const s = new Set(tiers);

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;CACvF,CAAC,CAAC;AAYH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAU,EAAE,CAAC;QAClE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAA8B;IACzE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,UAAkB;IAC1D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEnC,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACrD,MAAM,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,mBAAmB;SAC5B,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA8B;IACjE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB,EAAE,cAAiC;IACnF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAkC,EAClC,IAAuB,EACvB,SAAiB,EACjB,KAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;YACxF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAyC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAG3E,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBACnF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAClG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAK,EAA2B,CAAC;QACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC9G,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACtF,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAYH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAU,EAAE,CAAC;QAClE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAA8B;IACzE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,UAAkB;IAC1D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEnC,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACrD,MAAM,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,mBAAmB;SAC5B,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA8B;IACjE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB,EAAE,cAAiC;IACnF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAkC,EAClC,IAAuB,EACvB,SAAiB,EACjB,KAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;YACxF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAyC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAG3E,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBACnF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAClG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAK,EAA2B,CAAC;QACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC9G,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;KAC3C,CAAC;AACJ,CAAC"}

package/dist/shell/analyze-command-aggregate.d.ts

@@ -0,0 +1,16 @@
+import type { Tier } from "../policy/index.js";
+import type { ShellAnalysis, ShellApprovalFingerprintPayload, ShellInvocation } from "./analyze-command.types.js";
+import type { GuardEvaluation } from "./guard-eval.js";
+import type { ShellOperator } from "./parse-segments.js";
+export declare function rawMetacharactersInCommand(command: string): boolean;
+export declare function extractNestedShellScript(argv: readonly string[]): string | null;
+export declare function aggregateTier(invocations: ShellInvocation[], rawMetacharacters: boolean): Tier;
+export declare function buildFingerprintPayload(segments: {
+    argv: string[];
+}[], operators: ShellOperator[], invocations: ShellInvocation[]): ShellApprovalFingerprintPayload;
+export declare function selectPrimary(invocations: ShellInvocation[]): {
+    canonical_argv: string[];
+    evaluation: GuardEvaluation;
+};
+export declare function failClosedAnalysis(command: string, rawMetacharacters: boolean): ShellAnalysis;
+//# sourceMappingURL=analyze-command-aggregate.d.ts.map

package/dist/shell/analyze-command-aggregate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-command-aggregate.d.ts","sourceRoot":"","sources":["../../src/shell/analyze-command-aggregate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,KAAK,EACV,aAAa,EACb,+BAA+B,EAC/B,eAAe,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGnE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAM/E;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,eAAe,EAAE,EAAE,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAO9F;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,EAC9B,SAAS,EAAE,aAAa,EAAE,EAC1B,WAAW,EAAE,eAAe,EAAE,GAC7B,+BAA+B,CAejC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG;IAC7D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;CAC7B,CAyBA;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAG,aAAa,CAqB7F"}

package/dist/shell/analyze-command-aggregate.js

@@ -0,0 +1,89 @@
+import { stripTrailingBenignShellRedirectsForMetacharCheck } from "./strip-trailing-benign-shell-redirs.js";
+const SHELL_NAMES = new Set(["bash", "sh", "zsh"]);
+const TIER_RANK = { READ: 0, MUTATE: 1, DESTRUCTIVE: 2 };
+function maxTier(a, b) {
+    return TIER_RANK[a] >= TIER_RANK[b] ? a : b;
+}
+export function rawMetacharactersInCommand(command) {
+    const stripped = stripTrailingBenignShellRedirectsForMetacharCheck(command);
+    return /(;|&&|\|\||\||`|>|<|\$\()/.test(stripped);
+}
+export function extractNestedShellScript(argv) {
+    const tool = argv[0];
+    if (!tool || !SHELL_NAMES.has(tool))
+        return null;
+    const cIndex = argv.indexOf("-c");
+    if (cIndex < 0 || cIndex + 1 >= argv.length)
+        return null;
+    return argv[cIndex + 1] ?? null;
+}
+export function aggregateTier(invocations, rawMetacharacters) {
+    let tier = "READ";
+    for (const inv of invocations) {
+        tier = maxTier(tier, inv.evaluation.tier);
+    }
+    if (rawMetacharacters && tier === "READ")
+        tier = "MUTATE";
+    return tier;
+}
+export function buildFingerprintPayload(segments, operators, invocations) {
+    const bySegment = new Map();
+    for (const inv of invocations) {
+        const list = bySegment.get(inv.segment_index) ?? [];
+        list.push({ canonical_argv: inv.canonical_argv, tier: inv.evaluation.tier });
+        bySegment.set(inv.segment_index, list);
+    }
+    return {
+        segments: segments.map((_, segment_index) => ({
+            segment_index,
+            invocations: bySegment.get(segment_index) ?? [],
+        })),
+        operators: [...operators],
+    };
+}
+export function selectPrimary(invocations) {
+    if (invocations.length === 0) {
+        return {
+            canonical_argv: [],
+            evaluation: {
+                argv: [],
+                tier: "READ",
+                reasons: [],
+                classification: { tool: null, command_path: null, verb: null, tier: "READ", matched: false },
+                flags: { metacharacters: false, dangerous_flags: false },
+            },
+        };
+    }
+    let primary = invocations[0];
+    for (const inv of invocations.slice(1)) {
+        if (TIER_RANK[inv.evaluation.tier] > TIER_RANK[primary.evaluation.tier]) {
+            primary = inv;
+        }
+    }
+    return {
+        canonical_argv: primary.canonical_argv,
+        evaluation: primary.evaluation,
+    };
+}
+export function failClosedAnalysis(command, rawMetacharacters) {
+    const evaluation = {
+        argv: ["<unparseable>", command],
+        tier: "MUTATE",
+        reasons: [{ code: "unparseable", message: "Command could not be parsed safely; fail closed." }],
+        classification: { tool: null, command_path: null, verb: null, tier: "MUTATE", matched: false },
+        flags: { metacharacters: rawMetacharacters, dangerous_flags: false },
+    };
+    return {
+        raw_command: command,
+        segments: [{ argv: ["<unparseable>", command] }],
+        operators: [],
+        invocations: [],
+        primary: { canonical_argv: ["<unparseable>", command], evaluation },
+        approval_fingerprint_payload: { segments: [{ segment_index: 0, invocations: [] }], operators: [] },
+        skipped: false,
+        tier: "MUTATE",
+        raw_metacharacters: rawMetacharacters,
+        fail_closed: true,
+    };
+}
+//# sourceMappingURL=analyze-command-aggregate.js.map

package/dist/shell/analyze-command-aggregate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-command-aggregate.js","sourceRoot":"","sources":["../../src/shell/analyze-command-aggregate.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iDAAiD,EAAE,MAAM,yCAAyC,CAAC;AAE5G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,MAAM,SAAS,GAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAE/E,SAAS,OAAO,CAAC,CAAO,EAAE,CAAO;IAC/B,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,QAAQ,GAAG,iDAAiD,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,iBAA0B;IACtF,IAAI,IAAI,GAAS,MAAM,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,iBAAiB,IAAI,IAAI,KAAK,MAAM;QAAE,IAAI,GAAG,QAAQ,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAA8B,EAC9B,SAA0B,EAC1B,WAA8B;IAE9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsD,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5C,aAAa;YACb,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;SAChD,CAAC,CAAC;QACH,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAA8B;IAI1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC5F,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;aACzD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,iBAA0B;IAC5E,MAAM,UAAU,GAAoB;QAClC,IAAI,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;QAC/F,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC9F,KAAK,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,EAAE;KACrE,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;QAChD,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE;QACnE,4BAA4B,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QAClG,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,iBAAiB;QACrC,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}

package/dist/shell/analyze-command-invocations.d.ts

@@ -0,0 +1,11 @@
+import type { PoliciesV1 } from "../policy/index.js";
+import type { ShellInvocation } from "./analyze-command.types.js";
+import { type ShellPolicyConfig } from "./governed-tools.js";
+/** Strip trailing fd redirects from argv before policy classification (e.g. `2>&1` from shell-quote). */
+export declare function stripTrailingBenignRedirectArgv(argv: readonly string[]): string[];
+export declare function findGovernedInvocationsInSegment(segmentArgv: readonly string[], segmentIndex: number, policy: PoliciesV1, governedTools: readonly string[], shellConfig: ShellPolicyConfig): ShellInvocation[];
+export declare function resolveInvocationScanContext(policy: PoliciesV1): {
+    governedTools: readonly string[];
+    shellConfig: ShellPolicyConfig;
+};
+//# sourceMappingURL=analyze-command-invocations.d.ts.map

package/dist/shell/analyze-command-invocations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-command-invocations.d.ts","sourceRoot":"","sources":["../../src/shell/analyze-command-invocations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAI7B,yGAAyG;AACzG,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAoBjF;AA8DD,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,WAAW,EAAE,iBAAiB,GAC7B,eAAe,EAAE,CA4BnB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,UAAU;;;EAK9D"}