@praxis.guard/auditor-cli 0.0.45 → 0.0.47

package/dist/policy/load.js

@@ -0,0 +1,52 @@
+import { existsSync } from "node:fs";
+import { copyFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { parsePoliciesV1Json } from "./schema.js";
+import { policiesV1MetaPathFor, resolveBundledPoliciesPath, resolvedPoliciesV1Path } from "./paths.js";
+export async function readPoliciesV1Revision(opts) {
+    const policyPath = resolvedPoliciesV1Path(opts);
+    const metaPath = policiesV1MetaPathFor(policyPath);
+    try {
+        const raw = await readFile(metaPath, "utf8");
+        const parsed = JSON.parse(raw);
+        const r = Number(parsed.revision);
+        return Number.isFinite(r) ? r : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function bootstrapPoliciesIfMissing(policyPath) {
+    if (existsSync(policyPath))
+        return;
+    const bundledPath = resolveBundledPoliciesPath();
+    const dir = path.dirname(policyPath);
+    await mkdir(dir, { recursive: true });
+    const tmpPolicy = `${policyPath}.tmp.${process.pid}`;
+    await copyFile(bundledPath, tmpPolicy);
+    await rename(tmpPolicy, policyPath);
+    const metaPath = policiesV1MetaPathFor(policyPath);
+    if (!existsSync(metaPath)) {
+        const bootstrapMeta = {
+            revision: 0,
+            syncedAt: new Date().toISOString(),
+            source: "bundled-bootstrap",
+        };
+        const tmpMeta = `${metaPath}.tmp.${process.pid}`;
+        await writeFile(tmpMeta, `${JSON.stringify(bootstrapMeta, null, 2)}\n`, "utf8");
+        await rename(tmpMeta, metaPath);
+    }
+}
+export async function loadPoliciesV1(opts) {
+    const policyPath = resolvedPoliciesV1Path(opts);
+    await bootstrapPoliciesIfMissing(policyPath);
+    const raw = await readFile(policyPath, "utf8");
+    try {
+        return parsePoliciesV1Json(JSON.parse(raw));
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Invalid policies file at ${policyPath}: ${msg}`);
+    }
+}
+//# sourceMappingURL=load.js.map

package/dist/policy/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/policy/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAmB,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEvG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAA8B;IACzE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,UAAkB;IAC1D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEnC,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACrD,MAAM,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,mBAAmB;SAC5B,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA8B;IACjE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/policy/paths.d.ts

@@ -0,0 +1,9 @@
+export declare function resolveBundledPoliciesPath(): string;
+export declare function defaultPoliciesV1Path(): string;
+/** Effective path when `opts.policyPath` is omitted (env override matches `auditor doctor` / help). */
+export declare function resolvedPoliciesV1Path(opts?: {
+    policyPath?: string;
+}): string;
+export declare function policiesV1MetaPathFor(policyFilePath: string): string;
+export declare function defaultPoliciesMetaPath(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/policy/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/policy/paths.ts"],"names":[],"mappings":"AAaA,wBAAgB,0BAA0B,IAAI,MAAM,CAOnD;AAMD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAK7E;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD"}

package/dist/policy/paths.js

@@ -0,0 +1,42 @@
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import os from "node:os";
+import path from "node:path";
+function bundledPoliciesCandidates() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return [
+        path.resolve(here, "../policies.v1.json"),
+        path.resolve(here, "../../../auditor/policies.v1.json"),
+    ];
+}
+export function resolveBundledPoliciesPath() {
+    for (const candidate of bundledPoliciesCandidates()) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    throw new Error(`No bundled policies.v1.json found. Tried:\n${bundledPoliciesCandidates().map((p) => `  - ${p}`).join("\n")}`);
+}
+function defaultPraxisDir() {
+    return path.join(os.homedir(), ".praxis");
+}
+export function defaultPoliciesV1Path() {
+    return path.join(defaultPraxisDir(), "policies.v1.json");
+}
+/** Effective path when `opts.policyPath` is omitted (env override matches `auditor doctor` / help). */
+export function resolvedPoliciesV1Path(opts) {
+    if (opts?.policyPath?.trim())
+        return opts.policyPath.trim();
+    const fromEnv = process.env.PRAXIS_POLICIES_V1_PATH?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return defaultPoliciesV1Path();
+}
+export function policiesV1MetaPathFor(policyFilePath) {
+    const dir = path.dirname(policyFilePath);
+    const base = path.basename(policyFilePath, ".json");
+    return path.join(dir, `${base}.meta.json`);
+}
+export function defaultPoliciesMetaPath() {
+    return policiesV1MetaPathFor(defaultPoliciesV1Path());
+}
+//# sourceMappingURL=paths.js.map

package/dist/policy/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/policy/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/policy/schema.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+export declare const TierSchema: z.ZodEnum<{
+    READ: "READ";
+    MUTATE: "MUTATE";
+    DESTRUCTIVE: "DESTRUCTIVE";
+}>;
+export type Tier = z.infer<typeof TierSchema>;
+export declare const PoliciesV1Schema: z.ZodObject<{
+    tiers: z.ZodArray<z.ZodEnum<{
+        READ: "READ";
+        MUTATE: "MUTATE";
+        DESTRUCTIVE: "DESTRUCTIVE";
+    }>>;
+    dangerous_flags: z.ZodArray<z.ZodString>;
+    policies: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodEnum<{
+        READ: "READ";
+        MUTATE: "MUTATE";
+        DESTRUCTIVE: "DESTRUCTIVE";
+    }>>>>;
+    shell: z.ZodOptional<z.ZodObject<{
+        prelude_verbs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        privilege_verbs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PoliciesV1 = z.infer<typeof PoliciesV1Schema>;
+export type Classification = {
+    tool: string | null;
+    command_path: string | null;
+    verb: string | null;
+    tier: Tier;
+    matched: boolean;
+};
+export declare function ensureTiersComplete(tiers: readonly Tier[]): void;
+export declare function parsePoliciesV1Json(raw: unknown): PoliciesV1;
+//# sourceMappingURL=schema.d.ts.map

package/dist/policy/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/policy/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU;;;;EAA4C,CAAC;AACpE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAU3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,QAOzD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAO5D"}

package/dist/policy/schema.js

@@ -0,0 +1,30 @@
+import { z } from "zod";
+export const TierSchema = z.enum(["READ", "MUTATE", "DESTRUCTIVE"]);
+export const PoliciesV1Schema = z.object({
+    tiers: z.array(TierSchema).nonempty(),
+    dangerous_flags: z.array(z.string()),
+    policies: z.record(z.string(), z.record(z.string(), z.record(z.string(), TierSchema))),
+    shell: z
+        .object({
+        prelude_verbs: z.array(z.string()).optional(),
+        privilege_verbs: z.array(z.string()).optional(),
+    })
+        .optional(),
+});
+export function ensureTiersComplete(tiers) {
+    const s = new Set(tiers);
+    for (const required of ["READ", "MUTATE", "DESTRUCTIVE"]) {
+        if (!s.has(required)) {
+            throw new Error(`policies.v1.json tiers missing: ${required}`);
+        }
+    }
+}
+export function parsePoliciesV1Json(raw) {
+    const parsed = PoliciesV1Schema.safeParse(raw);
+    if (!parsed.success) {
+        throw new Error(`Invalid policies: ${parsed.error.message}`);
+    }
+    ensureTiersComplete(parsed.data.tiers);
+    return parsed.data;
+}
+//# sourceMappingURL=schema.js.map

package/dist/policy/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/policy/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACtF,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAYH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAU,EAAE,CAAC;QAClE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxis.guard/auditor-cli",
-  "version": "0.0.45",
+  "version": "0.0.47",
   "private": false,
   "type": "module",
   "license": "MIT",