@praxis.guard/auditor-cli 0.0.32 → 0.0.34

package/dist/shell/guard-eval.js

@@ -0,0 +1,35 @@
+import { classifyArgv } from "../policy/index.js";
+export function evaluateArgv(policy, argv) {
+    const { classification, flags } = classifyArgv(policy, argv);
+    let tier = classification.tier;
+    const reasons = [];
+    if (!classification.matched) {
+        reasons.push({
+            code: "unknown_command",
+            message: "Command did not match any policy entry; default-deny applies.",
+            details: { tool: classification.tool, command_path: classification.command_path, verb: classification.verb },
+        });
+    }
+    else {
+        reasons.push({
+            code: "policy_match",
+            message: "Matched policy entry.",
+            details: { tool: classification.tool, command_path: classification.command_path, verb: classification.verb, tier },
+        });
+    }
+    if (flags.metacharacters) {
+        if (tier === "READ")
+            tier = "MUTATE";
+        reasons.push({ code: "metacharacters", message: "Metacharacters detected; treat as high-risk." });
+    }
+    if (flags.dangerous_flags && (tier === "MUTATE" || tier === "DESTRUCTIVE")) {
+        reasons.push({
+            code: "dangerous_flags",
+            message: "Dangerous flags detected for mutating/destructive action; rejected.",
+            details: { dangerous_flags: policy.dangerous_flags },
+        });
+        tier = "DESTRUCTIVE";
+    }
+    return { argv, tier, reasons, classification, flags };
+}
+//# sourceMappingURL=guard-eval.js.map

package/dist/shell/guard-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-eval.js","sourceRoot":"","sources":["../../src/shell/guard-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,MAAM,oBAAoB,CAAC;AAY9E,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,IAAc;IAC7D,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAS,cAAc,CAAC,IAAI,CAAC;IAErC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,+DAA+D;YACxE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE;SAC7G,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uBAAuB;YAChC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE;SACnH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,MAAM;YAAE,IAAI,GAAG,QAAQ,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,aAAa,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,qEAAqE;YAC9E,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;SACrD,CAAC,CAAC;QACH,IAAI,GAAG,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/shell/parse-segments.d.ts

@@ -0,0 +1,14 @@
+export type ShellOperator = "&&" | "||" | ";" | "|";
+export type ShellParseToken = string | {
+    op: string;
+};
+export declare function parseShellTokens(command: string): ShellParseToken[];
+export declare function isUnparseableTokens(tokens: ShellParseToken[]): boolean;
+export declare function parseShellSegments(command: string): {
+    tokens: ShellParseToken[];
+    segments: {
+        argv: string[];
+    }[];
+    operators: ShellOperator[];
+};
+//# sourceMappingURL=parse-segments.d.ts.map

package/dist/shell/parse-segments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-segments.d.ts","sourceRoot":"","sources":["../../src/shell/parse-segments.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC;AAIpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAInE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAEtE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACnD,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC/B,SAAS,EAAE,aAAa,EAAE,CAAC;CAC5B,CA+BA"}

package/dist/shell/parse-segments.js

@@ -0,0 +1,41 @@
+import { parse as shellParse } from "shell-quote";
+const SEGMENT_OPERATORS = new Set(["&&", "||", ";", "|"]);
+export function parseShellTokens(command) {
+    const parsed = shellParse(command);
+    if (parsed.length === 0)
+        return ["<unparseable>", command];
+    return parsed;
+}
+export function isUnparseableTokens(tokens) {
+    return tokens.length >= 1 && tokens[0] === "<unparseable>";
+}
+export function parseShellSegments(command) {
+    const tokens = parseShellTokens(command);
+    if (isUnparseableTokens(tokens)) {
+        return {
+            tokens,
+            segments: [{ argv: tokens }],
+            operators: [],
+        };
+    }
+    const segments = [];
+    const operators = [];
+    let current = [];
+    for (const token of tokens) {
+        if (typeof token === "object" && token !== null && "op" in token) {
+            const op = token.op;
+            if (SEGMENT_OPERATORS.has(op)) {
+                segments.push({ argv: current });
+                current = [];
+                operators.push(op);
+                continue;
+            }
+            current.push(op);
+            continue;
+        }
+        current.push(token);
+    }
+    segments.push({ argv: current });
+    return { tokens, segments, operators };
+}
+//# sourceMappingURL=parse-segments.js.map

package/dist/shell/parse-segments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-segments.js","sourceRoot":"","sources":["../../src/shell/parse-segments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAIlD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAIlE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAKhD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAkB,EAAE,CAAC;YACxC,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YACjE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,IAAI,CAAC,EAAmB,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEjC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxis.guard/auditor-cli",
-  "version": "0.0.32",
+  "version": "0.0.34",
   "private": false,
   "type": "module",
   "files": [