@praxis.guard/auditor-cli 0.0.64 → 0.0.65
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/approval/mcp-flow-create.d.ts.map +1 -1
- package/dist/approval/mcp-flow-create.js +35 -9
- package/dist/approval/mcp-flow-create.js.map +1 -1
- package/dist/codex/evaluate-tool-audit.d.ts.map +1 -1
- package/dist/codex/evaluate-tool-audit.js +4 -1
- package/dist/codex/evaluate-tool-audit.js.map +1 -1
- package/dist/hooks/before-shell-evaluate.d.ts +32 -0
- package/dist/hooks/before-shell-evaluate.d.ts.map +1 -0
- package/dist/hooks/before-shell-evaluate.js +150 -0
- package/dist/hooks/before-shell-evaluate.js.map +1 -0
- package/dist/hooks/run-before-shell.d.ts.map +1 -1
- package/dist/hooks/run-before-shell.js +37 -130
- package/dist/hooks/run-before-shell.js.map +1 -1
- package/dist/mcp/server.d.ts.map +1 -1
- package/dist/mcp/server.js +12 -6
- package/dist/mcp/server.js.map +1 -1
- package/dist/shell/analyze-command-aggregate.d.ts +10 -1
- package/dist/shell/analyze-command-aggregate.d.ts.map +1 -1
- package/dist/shell/analyze-command-aggregate.js +25 -2
- package/dist/shell/analyze-command-aggregate.js.map +1 -1
- package/dist/shell/analyze-command.js +1 -1
- package/dist/shell/analyze-command.js.map +1 -1
- package/dist/shell/evaluate.d.ts.map +1 -1
- package/dist/shell/evaluate.js +4 -1
- package/dist/shell/evaluate.js.map +1 -1
- package/native/darwin-amd64/praxis-guard-daemon +0 -0
- package/native/darwin-amd64/praxis-guard-hook +0 -0
- package/native/darwin-arm64/praxis-guard-daemon +0 -0
- package/native/darwin-arm64/praxis-guard-hook +0 -0
- package/native/linux-amd64/praxis-guard-daemon +0 -0
- package/native/linux-amd64/praxis-guard-hook +0 -0
- package/native/linux-arm64/praxis-guard-daemon +0 -0
- package/native/linux-arm64/praxis-guard-hook +0 -0
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcp-flow-create.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-create.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"mcp-flow-create.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-create.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAiGzF,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAqB7B"}
|
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
import { isReliableWorkspaceRoot, resolveGuardStorageRoot, } from "../bridge/guard-storage-root.js";
|
|
2
2
|
import { recordRequestBinding } from "../bridge/request-binding-write.js";
|
|
3
|
-
import { writePendingApprovalIndex } from "../bridge/pending-approval-index.js";
|
|
3
|
+
import { readPendingApprovalIndex, writePendingApprovalIndex, } from "../bridge/pending-approval-index.js";
|
|
4
4
|
import { resolveShellApprovalHash } from "./argv-fingerprint.js";
|
|
5
5
|
import { createApprovalRequest } from "./client.js";
|
|
6
|
+
import { resolveExistingMutateApproval } from "./mcp-flow-existing.js";
|
|
6
7
|
import { redeemAfterApprovalWait } from "./mcp-flow-redeem.js";
|
|
7
8
|
async function stagePendingApproval(input, created, storageRoot) {
|
|
8
9
|
const hash = resolveShellApprovalHash({
|
|
@@ -29,14 +30,20 @@ async function stagePendingApproval(input, created, storageRoot) {
|
|
|
29
30
|
expires_at: created.expires_at,
|
|
30
31
|
};
|
|
31
32
|
}
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
33
|
+
function reusePendingMutateApproval(pending, input, storageRoot) {
|
|
34
|
+
return resolveExistingMutateApproval({
|
|
35
|
+
requestId: pending.request_id,
|
|
36
|
+
grant: null,
|
|
37
|
+
argv: input.argv,
|
|
38
|
+
proposalKind: input.proposalKind,
|
|
39
|
+
storageRoot,
|
|
40
|
+
sessionId: input.sessionId,
|
|
41
|
+
environment: input.environment,
|
|
42
|
+
waitMs: input.waitMs,
|
|
43
|
+
approval_fingerprint: input.approval_fingerprint,
|
|
44
|
+
});
|
|
45
|
+
}
|
|
46
|
+
async function createFreshMutateApproval(input, storageRoot) {
|
|
40
47
|
const created = await createApprovalRequest({
|
|
41
48
|
kind: input.proposalKind,
|
|
42
49
|
tier: "MUTATE",
|
|
@@ -73,4 +80,23 @@ export async function createMutateApproval(input) {
|
|
|
73
80
|
}
|
|
74
81
|
return stagePendingApproval(input, created, storageRoot);
|
|
75
82
|
}
|
|
83
|
+
export async function createMutateApproval(input) {
|
|
84
|
+
const storageRoot = resolveGuardStorageRoot(input.storageRoot);
|
|
85
|
+
if (!isReliableWorkspaceRoot(storageRoot)) {
|
|
86
|
+
return {
|
|
87
|
+
kind: "backend_unavailable",
|
|
88
|
+
message: "Cannot bind approval to a workspace root. Set proposal.cwd or context.workspace_root to the repo root where hooks run (must contain .git, .praxis, or .cursor/hooks.json).",
|
|
89
|
+
};
|
|
90
|
+
}
|
|
91
|
+
const approvalHash = resolveShellApprovalHash({
|
|
92
|
+
kind: input.proposalKind,
|
|
93
|
+
argv: input.argv,
|
|
94
|
+
approval_fingerprint: input.approval_fingerprint,
|
|
95
|
+
});
|
|
96
|
+
const pending = await readPendingApprovalIndex(approvalHash, { storageRoot });
|
|
97
|
+
if (pending) {
|
|
98
|
+
return reusePendingMutateApproval(pending, input, storageRoot);
|
|
99
|
+
}
|
|
100
|
+
return createFreshMutateApproval(input, storageRoot);
|
|
101
|
+
}
|
|
76
102
|
//# sourceMappingURL=mcp-flow-create.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcp-flow-create.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-create.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,
|
|
1
|
+
{"version":3,"file":"mcp-flow-create.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-create.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,KAAK,UAAU,oBAAoB,CACjC,KAAgC,EAChC,OAA0D,EAC1D,WAAmB;IAEnB,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,MAAM,yBAAyB,CAC7B;QACE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,EACD,EAAE,WAAW,EAAE,CAChB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAkC,EAClC,KAAgC,EAChC,WAAmB;IAEnB,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAgC,EAChC,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;IAEH,oBAAoB,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,uBAAuB,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/D,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EACL,4KAA4K;SAC/K,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,0BAA0B,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,yBAAyB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACvD,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate-tool-audit.d.ts","sourceRoot":"","sources":["../../src/codex/evaluate-tool-audit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;
|
|
1
|
+
{"version":3,"file":"evaluate-tool-audit.d.ts","sourceRoot":"","sources":["../../src/codex/evaluate-tool-audit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAExF,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAClE,GAAG,MAAM,CAUT;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAa9D"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { appendAuditJsonl } from "../audit/jsonl.js";
|
|
2
2
|
import { formatHookDenyMessages } from "../hooks/agent-message.js";
|
|
3
3
|
import { sendGuardEvent } from "../telemetry/guard-events.js";
|
|
4
|
+
import { shouldBumpReadChainToMutate } from "../shell/analyze-command-aggregate.js";
|
|
4
5
|
export function codexReason(input) {
|
|
5
6
|
const formatted = formatHookDenyMessages({
|
|
6
7
|
hook: input.kind === "shell" ? "beforeShellExecution" : "beforeMCPExecution",
|
|
@@ -45,8 +46,10 @@ export function shellReasons(analysis) {
|
|
|
45
46
|
const reasons = [];
|
|
46
47
|
if (!analysis.primary.evaluation.classification.matched)
|
|
47
48
|
reasons.push("unknown_command(default_deny)");
|
|
48
|
-
if (analysis.primary.evaluation.flags.metacharacters || analysis.raw_metacharacters)
|
|
49
|
+
if ((analysis.primary.evaluation.flags.metacharacters || analysis.raw_metacharacters) &&
|
|
50
|
+
shouldBumpReadChainToMutate(analysis.raw_command, analysis.operators)) {
|
|
49
51
|
reasons.push("metacharacters");
|
|
52
|
+
}
|
|
50
53
|
if (analysis.primary.evaluation.flags.dangerous_flags)
|
|
51
54
|
reasons.push("dangerous_flags");
|
|
52
55
|
if (analysis.fail_closed)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate-tool-audit.js","sourceRoot":"","sources":["../../src/codex/evaluate-tool-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"evaluate-tool-audit.js","sourceRoot":"","sources":["../../src/codex/evaluate-tool-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAGpF,MAAM,UAAU,WAAW,CAAC,KAO3B;IACC,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB;QAC5E,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,aAAa,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAalC;IACC,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QACxB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;QAC1B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,CAAC;QACnB,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;QAClE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAuB;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACvG,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QACjF,2BAA2B,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,EACrE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import type { Tier } from "../policy/index.js";
|
|
2
|
+
import type { ShellAnalysis } from "../shell/analyze-command.js";
|
|
3
|
+
import type { BeforeShellExecutionPayload, BeforeShellExecutionResponse } from "./before-shell-types.js";
|
|
4
|
+
export declare function collectShellHookReasons(analysis: ShellAnalysis): string[];
|
|
5
|
+
export type GovernedShellHookResolution = {
|
|
6
|
+
tier: Tier;
|
|
7
|
+
argv: string[];
|
|
8
|
+
evaluation: ShellAnalysis["primary"]["evaluation"];
|
|
9
|
+
permission: BeforeShellExecutionResponse["permission"];
|
|
10
|
+
ticketConsumed: boolean;
|
|
11
|
+
inlineApproval: {
|
|
12
|
+
request_id: string;
|
|
13
|
+
open_url: string;
|
|
14
|
+
} | null;
|
|
15
|
+
approvalFlowSignal: string | null;
|
|
16
|
+
reasons: string[];
|
|
17
|
+
};
|
|
18
|
+
export declare function resolveGovernedShellHook(input: {
|
|
19
|
+
payload: BeforeShellExecutionPayload;
|
|
20
|
+
analysis: ShellAnalysis;
|
|
21
|
+
storageRoot: string;
|
|
22
|
+
policyRevision: number | null;
|
|
23
|
+
}): Promise<GovernedShellHookResolution>;
|
|
24
|
+
export declare function emitGovernedShellHookResult(input: {
|
|
25
|
+
payload: BeforeShellExecutionPayload;
|
|
26
|
+
analysis: ShellAnalysis;
|
|
27
|
+
storageRoot: string;
|
|
28
|
+
policyRevision: number | null;
|
|
29
|
+
decisionStarted: number;
|
|
30
|
+
resolved: GovernedShellHookResolution;
|
|
31
|
+
}): Promise<void>;
|
|
32
|
+
//# sourceMappingURL=before-shell-evaluate.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"before-shell-evaluate.d.ts","sourceRoot":"","sources":["../../src/hooks/before-shell-evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAI/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAQjE,OAAO,KAAK,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAOzG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAgBzE;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;IACnD,UAAU,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACvD,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAwCvC;AA2GD,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,2BAA2B,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB"}
|
|
@@ -0,0 +1,150 @@
|
|
|
1
|
+
import { getInstallId } from "../cli/install-id.js";
|
|
2
|
+
import { shouldBumpReadChainToMutate } from "../shell/analyze-command-aggregate.js";
|
|
3
|
+
import { sendGuardEvent } from "../telemetry/guard-events.js";
|
|
4
|
+
import { resolveShellMutateHookPermission } from "./before-shell-mutate.js";
|
|
5
|
+
import { tryAppendAuditEvent } from "./before-shell-io.js";
|
|
6
|
+
import { formatHookAllowViaCredentialMessage, formatHookDenyMessages, } from "./agent-message.js";
|
|
7
|
+
function tierToPermission(tier) {
|
|
8
|
+
if (tier === "READ")
|
|
9
|
+
return "allow";
|
|
10
|
+
return "deny";
|
|
11
|
+
}
|
|
12
|
+
export function collectShellHookReasons(analysis) {
|
|
13
|
+
const evaluation = analysis.primary.evaluation;
|
|
14
|
+
const reasons = [];
|
|
15
|
+
if (!evaluation.classification.matched)
|
|
16
|
+
reasons.push("unknown_command(default_deny)");
|
|
17
|
+
if ((evaluation.flags.metacharacters || analysis.raw_metacharacters) &&
|
|
18
|
+
shouldBumpReadChainToMutate(analysis.raw_command, analysis.operators)) {
|
|
19
|
+
reasons.push("metacharacters");
|
|
20
|
+
}
|
|
21
|
+
if (evaluation.flags.dangerous_flags)
|
|
22
|
+
reasons.push("dangerous_flags");
|
|
23
|
+
if (analysis.fail_closed)
|
|
24
|
+
reasons.push("unparseable(fail_closed)");
|
|
25
|
+
if (analysis.invocations.length > 1) {
|
|
26
|
+
reasons.push(`multiple_governed_invocations(${analysis.invocations.length})`);
|
|
27
|
+
}
|
|
28
|
+
return reasons;
|
|
29
|
+
}
|
|
30
|
+
export async function resolveGovernedShellHook(input) {
|
|
31
|
+
const { payload, analysis, storageRoot, policyRevision } = input;
|
|
32
|
+
const argv = analysis.primary.canonical_argv;
|
|
33
|
+
const evaluation = analysis.primary.evaluation;
|
|
34
|
+
const tier = analysis.tier;
|
|
35
|
+
const reasons = collectShellHookReasons(analysis);
|
|
36
|
+
let permission = tierToPermission(tier);
|
|
37
|
+
let ticketConsumed = false;
|
|
38
|
+
let approvalFlowSignal = null;
|
|
39
|
+
let inlineApproval = null;
|
|
40
|
+
if (permission === "deny" && tier === "MUTATE") {
|
|
41
|
+
const mutate = await resolveShellMutateHookPermission({
|
|
42
|
+
tier,
|
|
43
|
+
argv,
|
|
44
|
+
analysis,
|
|
45
|
+
storageRoot,
|
|
46
|
+
rawDisplay: payload.command,
|
|
47
|
+
policyRevision,
|
|
48
|
+
initialReasons: reasons,
|
|
49
|
+
});
|
|
50
|
+
permission = mutate.permission;
|
|
51
|
+
ticketConsumed = mutate.ticketConsumed;
|
|
52
|
+
approvalFlowSignal = mutate.approvalFlowSignal;
|
|
53
|
+
inlineApproval = mutate.inlineApproval;
|
|
54
|
+
reasons.length = 0;
|
|
55
|
+
reasons.push(...mutate.reasons);
|
|
56
|
+
}
|
|
57
|
+
return {
|
|
58
|
+
tier,
|
|
59
|
+
argv,
|
|
60
|
+
evaluation,
|
|
61
|
+
permission,
|
|
62
|
+
ticketConsumed,
|
|
63
|
+
inlineApproval,
|
|
64
|
+
approvalFlowSignal,
|
|
65
|
+
reasons,
|
|
66
|
+
};
|
|
67
|
+
}
|
|
68
|
+
function buildGovernedShellHookResponse(resolved, storageRoot) {
|
|
69
|
+
const { tier, argv, permission, ticketConsumed, inlineApproval, reasons } = resolved;
|
|
70
|
+
if (permission === "allow") {
|
|
71
|
+
const allowMessage = formatHookAllowViaCredentialMessage({ ticketConsumed });
|
|
72
|
+
return {
|
|
73
|
+
permission,
|
|
74
|
+
...(allowMessage ? { agent_message: allowMessage } : {}),
|
|
75
|
+
};
|
|
76
|
+
}
|
|
77
|
+
const denyMessages = formatHookDenyMessages({
|
|
78
|
+
hook: "beforeShellExecution",
|
|
79
|
+
tier,
|
|
80
|
+
argv,
|
|
81
|
+
reasons,
|
|
82
|
+
inlineApproval,
|
|
83
|
+
storageRoot,
|
|
84
|
+
});
|
|
85
|
+
return {
|
|
86
|
+
permission,
|
|
87
|
+
user_message: denyMessages.user_message,
|
|
88
|
+
agent_message: denyMessages.agent_message,
|
|
89
|
+
};
|
|
90
|
+
}
|
|
91
|
+
async function appendGovernedShellHookAudit(input) {
|
|
92
|
+
const { payload, analysis, storageRoot, resolved, latency_ms } = input;
|
|
93
|
+
const { tier, argv, evaluation, permission, ticketConsumed, inlineApproval, approvalFlowSignal, reasons, } = resolved;
|
|
94
|
+
await tryAppendAuditEvent({
|
|
95
|
+
ts: new Date().toISOString(),
|
|
96
|
+
hook: "beforeShellExecution",
|
|
97
|
+
cwd: payload.cwd,
|
|
98
|
+
command: payload.command,
|
|
99
|
+
argv,
|
|
100
|
+
governed_argv: argv,
|
|
101
|
+
invocation_count: analysis.invocations.length,
|
|
102
|
+
segments: analysis.segments,
|
|
103
|
+
operators: analysis.operators,
|
|
104
|
+
classification: evaluation.classification,
|
|
105
|
+
flags: evaluation.flags,
|
|
106
|
+
tier,
|
|
107
|
+
permission,
|
|
108
|
+
ticketConsumed,
|
|
109
|
+
inline_request_id: inlineApproval?.request_id ?? null,
|
|
110
|
+
reasons,
|
|
111
|
+
approval_flow_signal: approvalFlowSignal,
|
|
112
|
+
latency_ms,
|
|
113
|
+
}, storageRoot);
|
|
114
|
+
}
|
|
115
|
+
async function sendGovernedShellHookTelemetry(input) {
|
|
116
|
+
const { payload, analysis, policyRevision, resolved, latency_ms } = input;
|
|
117
|
+
const { tier, argv, permission, ticketConsumed, inlineApproval, approvalFlowSignal, reasons } = resolved;
|
|
118
|
+
await sendGuardEvent({
|
|
119
|
+
ts: new Date().toISOString(),
|
|
120
|
+
status: permission === "allow" ? "passed" : "blocked",
|
|
121
|
+
tool: "auditor-hook",
|
|
122
|
+
command_path: argv[0] ?? null,
|
|
123
|
+
verb: argv[1] ?? null,
|
|
124
|
+
resource: argv.length > 2 ? argv.slice(2).join(" ") : null,
|
|
125
|
+
reason: reasons[0] ?? null,
|
|
126
|
+
cmd: payload.command,
|
|
127
|
+
tier,
|
|
128
|
+
decision: permission === "allow" ? "allow" : "block",
|
|
129
|
+
latency_ms,
|
|
130
|
+
installId: getInstallId(),
|
|
131
|
+
kind: "shell",
|
|
132
|
+
...(policyRevision !== null ? { policy_revision: policyRevision } : {}),
|
|
133
|
+
meta: {
|
|
134
|
+
hook: "beforeShellExecution",
|
|
135
|
+
ticketConsumed,
|
|
136
|
+
approval_request_id: inlineApproval?.request_id ?? null,
|
|
137
|
+
approval_flow_signal: approvalFlowSignal,
|
|
138
|
+
invocation_count: analysis.invocations.length,
|
|
139
|
+
},
|
|
140
|
+
});
|
|
141
|
+
}
|
|
142
|
+
export async function emitGovernedShellHookResult(input) {
|
|
143
|
+
const { payload, analysis, storageRoot, policyRevision, decisionStarted, resolved } = input;
|
|
144
|
+
const response = buildGovernedShellHookResponse(resolved, storageRoot);
|
|
145
|
+
const latency_ms = performance.now() - decisionStarted;
|
|
146
|
+
await appendGovernedShellHookAudit({ payload, analysis, storageRoot, resolved, latency_ms });
|
|
147
|
+
process.stdout.write(JSON.stringify(response, null, 2));
|
|
148
|
+
await sendGovernedShellHookTelemetry({ payload, analysis, policyRevision, resolved, latency_ms });
|
|
149
|
+
}
|
|
150
|
+
//# sourceMappingURL=before-shell-evaluate.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"before-shell-evaluate.js","sourceRoot":"","sources":["../../src/hooks/before-shell-evaluate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEpF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,mCAAmC,EACnC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAuB;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtF,IACE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QAChE,2BAA2B,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,EACrE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/C,MAAM,IAAI,GAAS,QAAQ,CAAC,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,cAAc,GAAoD,IAAI,CAAC;IAE3E,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC/C,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,UAAU;QACV,UAAU;QACV,cAAc;QACd,cAAc;QACd,kBAAkB;QAClB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,QAAqC,EACrC,WAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IACrF,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,mCAAmC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7E,OAAO;YACL,UAAU;YACV,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC1C,IAAI,EAAE,sBAAsB;QAC5B,IAAI;QACJ,IAAI;QACJ,OAAO;QACP,cAAc;QACd,WAAW;KACZ,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAM3C;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACvE,MAAM,EACJ,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,OAAO,GACR,GAAG,QAAQ,CAAC;IACb,MAAM,mBAAmB,CACvB;QACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;QACJ,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI;QACJ,UAAU;QACV,cAAc;QACd,iBAAiB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;QACrD,OAAO;QACP,oBAAoB,EAAE,kBAAkB;QACxC,UAAU;KACX,EACD,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAM7C;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAC3F,QAAQ,CAAC;IACX,MAAM,cAAc,CAAC;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACrD,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1B,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,IAAI;QACJ,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACpD,UAAU;QACV,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE;YACJ,IAAI,EAAE,sBAAsB;YAC5B,cAAc;YACd,mBAAmB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;YACvD,oBAAoB,EAAE,kBAAkB;YACxC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;SAC9C;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5F,MAAM,QAAQ,GAAG,8BAA8B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IACvD,MAAM,4BAA4B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,8BAA8B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AACpG,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-before-shell.d.ts","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"run-before-shell.d.ts","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEzG,YAAY,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AA+CzG;;GAEG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAqBjE;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,4BAA4B,CAMtF"}
|
|
@@ -1,38 +1,12 @@
|
|
|
1
1
|
import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
|
|
2
|
-
import { getInstallId } from "../cli/install-id.js";
|
|
3
2
|
import { analyzeShellCommand } from "../shell/analyze-command.js";
|
|
4
3
|
import { commandMayContainGovernedTool } from "../shell/governed-tools.js";
|
|
5
4
|
import { rememberActiveWorkspace, rememberResolvedWorkspaceRoot, resolveGuardStorageRoot, } from "../bridge/guard-storage-root.js";
|
|
6
|
-
import {
|
|
7
|
-
import {
|
|
8
|
-
import { readStdinJson, tryAppendAuditEvent } from "./before-shell-io.js";
|
|
5
|
+
import { emitGovernedShellHookResult, resolveGovernedShellHook, } from "./before-shell-evaluate.js";
|
|
6
|
+
import { readStdinJson } from "./before-shell-io.js";
|
|
9
7
|
import { handleSkippedShellHook } from "./before-shell-skipped.js";
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
if (tier === "READ")
|
|
13
|
-
return "allow";
|
|
14
|
-
return "deny";
|
|
15
|
-
}
|
|
16
|
-
/**
|
|
17
|
-
* Cursor `beforeShellExecution` contract: read one JSON object from stdin, write one JSON object to stdout.
|
|
18
|
-
*/
|
|
19
|
-
export async function runBeforeShellHookFromStdin() {
|
|
20
|
-
const payload = await readStdinJson();
|
|
21
|
-
const decisionStarted = performance.now();
|
|
22
|
-
const command = payload.command;
|
|
23
|
-
if (!commandMayContainGovernedTool(command)) {
|
|
24
|
-
const skipReason = command.trim() ? "no_governed_invocation" : "no_command";
|
|
25
|
-
const auditLogRoot = typeof payload.cwd === "string" && payload.cwd.trim() ? payload.cwd.trim() : undefined;
|
|
26
|
-
const policyRevision = await readPoliciesV1Revision();
|
|
27
|
-
await handleSkippedShellHook({
|
|
28
|
-
payload,
|
|
29
|
-
skipReason,
|
|
30
|
-
policyRevision,
|
|
31
|
-
auditLogRoot: auditLogRoot ?? "",
|
|
32
|
-
decisionStarted,
|
|
33
|
-
});
|
|
34
|
-
return;
|
|
35
|
-
}
|
|
8
|
+
async function runGovernedShellHook(input) {
|
|
9
|
+
const { payload, command, decisionStarted } = input;
|
|
36
10
|
const [policy, policyRevision] = await Promise.all([loadPoliciesV1(), readPoliciesV1Revision()]);
|
|
37
11
|
const analysis = analyzeShellCommand(command, policy);
|
|
38
12
|
rememberActiveWorkspace({
|
|
@@ -51,109 +25,42 @@ export async function runBeforeShellHookFromStdin() {
|
|
|
51
25
|
});
|
|
52
26
|
return;
|
|
53
27
|
}
|
|
54
|
-
const
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
28
|
+
const resolved = await resolveGovernedShellHook({
|
|
29
|
+
payload,
|
|
30
|
+
analysis,
|
|
31
|
+
storageRoot,
|
|
32
|
+
policyRevision,
|
|
33
|
+
});
|
|
34
|
+
await emitGovernedShellHookResult({
|
|
35
|
+
payload,
|
|
36
|
+
analysis,
|
|
37
|
+
storageRoot,
|
|
38
|
+
policyRevision,
|
|
39
|
+
decisionStarted,
|
|
40
|
+
resolved,
|
|
41
|
+
});
|
|
42
|
+
}
|
|
43
|
+
/**
|
|
44
|
+
* Cursor `beforeShellExecution` contract: read one JSON object from stdin, write one JSON object to stdout.
|
|
45
|
+
*/
|
|
46
|
+
export async function runBeforeShellHookFromStdin() {
|
|
47
|
+
const payload = await readStdinJson();
|
|
48
|
+
const decisionStarted = performance.now();
|
|
49
|
+
const command = payload.command;
|
|
50
|
+
if (!commandMayContainGovernedTool(command)) {
|
|
51
|
+
const skipReason = command.trim() ? "no_governed_invocation" : "no_command";
|
|
52
|
+
const auditLogRoot = typeof payload.cwd === "string" && payload.cwd.trim() ? payload.cwd.trim() : undefined;
|
|
53
|
+
const policyRevision = await readPoliciesV1Revision();
|
|
54
|
+
await handleSkippedShellHook({
|
|
55
|
+
payload,
|
|
56
|
+
skipReason,
|
|
80
57
|
policyRevision,
|
|
81
|
-
|
|
58
|
+
auditLogRoot: auditLogRoot ?? "",
|
|
59
|
+
decisionStarted,
|
|
82
60
|
});
|
|
83
|
-
|
|
84
|
-
ticketConsumed = mutate.ticketConsumed;
|
|
85
|
-
approvalFlowSignal = mutate.approvalFlowSignal;
|
|
86
|
-
inlineApproval = mutate.inlineApproval;
|
|
87
|
-
reasons.length = 0;
|
|
88
|
-
reasons.push(...mutate.reasons);
|
|
61
|
+
return;
|
|
89
62
|
}
|
|
90
|
-
|
|
91
|
-
const denyMessages = permission === "deny"
|
|
92
|
-
? formatHookDenyMessages({
|
|
93
|
-
hook: "beforeShellExecution",
|
|
94
|
-
tier,
|
|
95
|
-
argv,
|
|
96
|
-
reasons,
|
|
97
|
-
inlineApproval,
|
|
98
|
-
storageRoot,
|
|
99
|
-
})
|
|
100
|
-
: null;
|
|
101
|
-
const response = permission === "allow"
|
|
102
|
-
? {
|
|
103
|
-
permission,
|
|
104
|
-
...(allowMessage ? { agent_message: allowMessage } : {}),
|
|
105
|
-
}
|
|
106
|
-
: {
|
|
107
|
-
permission,
|
|
108
|
-
user_message: denyMessages.user_message,
|
|
109
|
-
agent_message: denyMessages.agent_message,
|
|
110
|
-
};
|
|
111
|
-
const latency_ms = performance.now() - decisionStarted;
|
|
112
|
-
await tryAppendAuditEvent({
|
|
113
|
-
ts: new Date().toISOString(),
|
|
114
|
-
hook: "beforeShellExecution",
|
|
115
|
-
cwd: payload.cwd,
|
|
116
|
-
command: payload.command,
|
|
117
|
-
argv,
|
|
118
|
-
governed_argv: argv,
|
|
119
|
-
invocation_count: analysis.invocations.length,
|
|
120
|
-
segments: analysis.segments,
|
|
121
|
-
operators: analysis.operators,
|
|
122
|
-
classification: evaluation.classification,
|
|
123
|
-
flags: evaluation.flags,
|
|
124
|
-
tier,
|
|
125
|
-
permission,
|
|
126
|
-
ticketConsumed,
|
|
127
|
-
inline_request_id: inlineApproval?.request_id ?? null,
|
|
128
|
-
reasons,
|
|
129
|
-
approval_flow_signal: approvalFlowSignal,
|
|
130
|
-
latency_ms,
|
|
131
|
-
}, storageRoot);
|
|
132
|
-
process.stdout.write(JSON.stringify(response, null, 2));
|
|
133
|
-
const status = permission === "allow" ? "passed" : "blocked";
|
|
134
|
-
await sendGuardEvent({
|
|
135
|
-
ts: new Date().toISOString(),
|
|
136
|
-
status,
|
|
137
|
-
tool: "auditor-hook",
|
|
138
|
-
command_path: argv[0] ?? null,
|
|
139
|
-
verb: argv[1] ?? null,
|
|
140
|
-
resource: argv.length > 2 ? argv.slice(2).join(" ") : null,
|
|
141
|
-
reason: reasons[0] ?? null,
|
|
142
|
-
cmd: payload.command,
|
|
143
|
-
tier,
|
|
144
|
-
decision: permission === "allow" ? "allow" : "block",
|
|
145
|
-
latency_ms,
|
|
146
|
-
installId: getInstallId(),
|
|
147
|
-
kind: "shell",
|
|
148
|
-
...(policyRevision !== null ? { policy_revision: policyRevision } : {}),
|
|
149
|
-
meta: {
|
|
150
|
-
hook: "beforeShellExecution",
|
|
151
|
-
ticketConsumed,
|
|
152
|
-
approval_request_id: inlineApproval?.request_id ?? null,
|
|
153
|
-
approval_flow_signal: approvalFlowSignal,
|
|
154
|
-
invocation_count: analysis.invocations.length,
|
|
155
|
-
},
|
|
156
|
-
});
|
|
63
|
+
await runGovernedShellHook({ payload, command, decisionStarted });
|
|
157
64
|
}
|
|
158
65
|
export function failClosedHookErrorResponse(err) {
|
|
159
66
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-before-shell.js","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,
|
|
1
|
+
{"version":3,"file":"run-before-shell.js","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAKnE,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtD,uBAAuB,CAAC;QACtB,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,uBAAuB,CACzC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;IACF,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,UAAU,EAAE,wBAAwB;YACpC,cAAc;YACd,YAAY,EAAE,WAAW;YACzB,eAAe;YACf,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,OAAO;QACP,QAAQ;QACR,WAAW;QACX,cAAc;KACf,CAAC,CAAC;IACH,MAAM,2BAA2B,CAAC;QAChC,OAAO;QACP,QAAQ;QACR,WAAW;QACX,cAAc;QACd,eAAe;QACf,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,OAAO,GAAG,MAAM,aAAa,EAA+B,CAAC;IACnE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5E,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACtD,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,UAAU;YACV,cAAc;YACd,YAAY,EAAE,YAAY,IAAI,EAAE;YAChC,eAAe;SAChB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,0DAA0D;QACxE,aAAa,EAAE,uBAAuB,MAAM,CAAC,GAAG,CAAC,EAAE;KACpD,CAAC;AACJ,CAAC"}
|
package/dist/mcp/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AA4DA,8EAA8E;AAC9E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CA8CvD"}
|
package/dist/mcp/server.js
CHANGED
|
@@ -5,6 +5,11 @@ import { AUDITOR_CLI_VERSION } from "../runtime/version.js";
|
|
|
5
5
|
import { evaluateGuard } from "./evaluate-guard.js";
|
|
6
6
|
import { startGuardHeartbeatLoop } from "./guard-heartbeat.js";
|
|
7
7
|
import { GuardInputSchema, GUARD_TOOL_DESCRIPTION, GUARD_WAIT_TOOL_DESCRIPTION, } from "./guard-schemas.js";
|
|
8
|
+
/** Zod v4 schema; MCP SDK typings target Zod v3 — runtime-compatible. */
|
|
9
|
+
const guardInputMcpSchema = GuardInputSchema;
|
|
10
|
+
function parseGuardInput(input) {
|
|
11
|
+
return GuardInputSchema.parse(input);
|
|
12
|
+
}
|
|
8
13
|
async function runGuardTool(input, policyState) {
|
|
9
14
|
let response;
|
|
10
15
|
try {
|
|
@@ -47,21 +52,22 @@ export async function runMcpStdioServer() {
|
|
|
47
52
|
name: "praxis-guard",
|
|
48
53
|
version: AUDITOR_CLI_VERSION,
|
|
49
54
|
});
|
|
50
|
-
const runTool = async (input) => await runGuardTool(input, policyState);
|
|
55
|
+
const runTool = async (input) => await runGuardTool(parseGuardInput(input), policyState);
|
|
51
56
|
server.registerTool("guard", {
|
|
52
57
|
description: GUARD_TOOL_DESCRIPTION,
|
|
53
|
-
inputSchema:
|
|
58
|
+
inputSchema: guardInputMcpSchema,
|
|
54
59
|
}, runTool);
|
|
55
60
|
server.registerTool("guard_wait", {
|
|
56
61
|
description: GUARD_WAIT_TOOL_DESCRIPTION,
|
|
57
|
-
inputSchema:
|
|
62
|
+
inputSchema: guardInputMcpSchema,
|
|
58
63
|
}, async (input) => {
|
|
59
|
-
const
|
|
64
|
+
const parsed = parseGuardInput(input);
|
|
65
|
+
const waitMs = parsed.context?.wait_ms ?? 120_000;
|
|
60
66
|
const withWait = {
|
|
61
|
-
...
|
|
67
|
+
...parsed,
|
|
62
68
|
mode: "enforce",
|
|
63
69
|
context: {
|
|
64
|
-
...
|
|
70
|
+
...parsed.context,
|
|
65
71
|
wait_ms: waitMs,
|
|
66
72
|
},
|
|
67
73
|
};
|
package/dist/mcp/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,GAE5B,MAAM,oBAAoB,CAAC;AAE5B,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,gBAAgD,CAAC;AAE7E,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAiB,EACjB,WAGC;IAED,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB,EAAE,KAAc;IAC9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACrD,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;QAClD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,EAAE;QAC/F,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,qDAAqD;YACnE,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,IAAI;SAClB;QACD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,MAAM,cAAc,EAAE;QAC9B,cAAc,EAAE,MAAM,sBAAsB,EAAE;KAC/C,CAAC;IACF,uBAAuB,EAAE,CAAC;IAE1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,mBAAmB;KAC7B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,EAAE,KAAc,EAAE,EAAE,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;IAElG,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,mBAAmB;KACjC,EACD,OAAO,CACR,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,mBAAmB;KACjC,EACD,KAAK,EAAE,KAAc,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC;QAClD,MAAM,QAAQ,GAAe;YAC3B,GAAG,MAAM;YACT,IAAI,EAAE,SAAS;YACf,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,OAAO;gBACjB,OAAO,EAAE,MAAM;aAChB;SACF,CAAC;QACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}
|
|
@@ -3,8 +3,17 @@ import type { ShellAnalysis, ShellApprovalFingerprintPayload, ShellInvocation }
|
|
|
3
3
|
import type { GuardEvaluation } from "./guard-eval.js";
|
|
4
4
|
import type { ShellOperator } from "./parse-segments.js";
|
|
5
5
|
export declare function rawMetacharactersInCommand(command: string): boolean;
|
|
6
|
+
/** Metacharacters that remain high-risk even when every governed invocation is READ. */
|
|
7
|
+
export declare function hasHighRiskMetacharacters(command: string): boolean;
|
|
8
|
+
/** True when a composed command uses only sequential `&&` between segments. */
|
|
9
|
+
export declare function isReadOnlyAndChainOperators(operators: ShellOperator[]): boolean;
|
|
10
|
+
/**
|
|
11
|
+
* Whether READ-tier composed commands should be promoted to MUTATE for metacharacters.
|
|
12
|
+
* `&&` chains of READ invocations stay READ; pipes, subshells, and `;` still bump.
|
|
13
|
+
*/
|
|
14
|
+
export declare function shouldBumpReadChainToMutate(command: string, operators: ShellOperator[]): boolean;
|
|
6
15
|
export declare function extractNestedShellScript(argv: readonly string[]): string | null;
|
|
7
|
-
export declare function aggregateTier(invocations: ShellInvocation[],
|
|
16
|
+
export declare function aggregateTier(invocations: ShellInvocation[], command: string, operators?: ShellOperator[]): Tier;
|
|
8
17
|
export declare function buildFingerprintPayload(segments: {
|
|
9
18
|
argv: string[];
|
|
10
19
|
}[], operators: ShellOperator[], invocations: ShellInvocation[]): ShellApprovalFingerprintPayload;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-command-aggregate.d.ts","sourceRoot":"","sources":["../../src/shell/analyze-command-aggregate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,KAAK,EACV,aAAa,EACb,+BAA+B,EAC/B,eAAe,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGnE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAM/E;AAED,wBAAgB,aAAa,
|
|
1
|
+
{"version":3,"file":"analyze-command-aggregate.d.ts","sourceRoot":"","sources":["../../src/shell/analyze-command-aggregate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,KAAK,EACV,aAAa,EACb,+BAA+B,EAC/B,eAAe,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGnE;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAE/E;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAKhG;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAM/E;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,eAAe,EAAE,EAC9B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,aAAa,EAAO,GAC9B,IAAI,CASN;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,EAC9B,SAAS,EAAE,aAAa,EAAE,EAC1B,WAAW,EAAE,eAAe,EAAE,GAC7B,+BAA+B,CAejC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG;IAC7D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;CAC7B,CAyBA;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAG,aAAa,CAqB7F"}
|
|
@@ -8,6 +8,28 @@ export function rawMetacharactersInCommand(command) {
|
|
|
8
8
|
const stripped = stripTrailingBenignShellRedirectsForMetacharCheck(command);
|
|
9
9
|
return /(;|&&|\|\||\||`|>|<|\$\()/.test(stripped);
|
|
10
10
|
}
|
|
11
|
+
/** Metacharacters that remain high-risk even when every governed invocation is READ. */
|
|
12
|
+
export function hasHighRiskMetacharacters(command) {
|
|
13
|
+
const stripped = stripTrailingBenignShellRedirectsForMetacharCheck(command);
|
|
14
|
+
return /(;|\|\||\||`|>|<|\$\()/.test(stripped);
|
|
15
|
+
}
|
|
16
|
+
/** True when a composed command uses only sequential `&&` between segments. */
|
|
17
|
+
export function isReadOnlyAndChainOperators(operators) {
|
|
18
|
+
return operators.length > 0 && operators.every((op) => op === "&&");
|
|
19
|
+
}
|
|
20
|
+
/**
|
|
21
|
+
* Whether READ-tier composed commands should be promoted to MUTATE for metacharacters.
|
|
22
|
+
* `&&` chains of READ invocations stay READ; pipes, subshells, and `;` still bump.
|
|
23
|
+
*/
|
|
24
|
+
export function shouldBumpReadChainToMutate(command, operators) {
|
|
25
|
+
if (!rawMetacharactersInCommand(command))
|
|
26
|
+
return false;
|
|
27
|
+
if (hasHighRiskMetacharacters(command))
|
|
28
|
+
return true;
|
|
29
|
+
if (operators.length === 0)
|
|
30
|
+
return true;
|
|
31
|
+
return !isReadOnlyAndChainOperators(operators);
|
|
32
|
+
}
|
|
11
33
|
export function extractNestedShellScript(argv) {
|
|
12
34
|
const tool = argv[0];
|
|
13
35
|
if (!tool || !SHELL_NAMES.has(tool))
|
|
@@ -17,13 +39,14 @@ export function extractNestedShellScript(argv) {
|
|
|
17
39
|
return null;
|
|
18
40
|
return argv[cIndex + 1] ?? null;
|
|
19
41
|
}
|
|
20
|
-
export function aggregateTier(invocations,
|
|
42
|
+
export function aggregateTier(invocations, command, operators = []) {
|
|
21
43
|
let tier = "READ";
|
|
22
44
|
for (const inv of invocations) {
|
|
23
45
|
tier = maxTier(tier, inv.evaluation.tier);
|
|
24
46
|
}
|
|
25
|
-
if (
|
|
47
|
+
if (tier === "READ" && shouldBumpReadChainToMutate(command, operators)) {
|
|
26
48
|
tier = "MUTATE";
|
|
49
|
+
}
|
|
27
50
|
return tier;
|
|
28
51
|
}
|
|
29
52
|
export function buildFingerprintPayload(segments, operators, invocations) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-command-aggregate.js","sourceRoot":"","sources":["../../src/shell/analyze-command-aggregate.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iDAAiD,EAAE,MAAM,yCAAyC,CAAC;AAE5G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,MAAM,SAAS,GAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAE/E,SAAS,OAAO,CAAC,CAAO,EAAE,CAAO;IAC/B,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,QAAQ,GAAG,iDAAiD,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,
|
|
1
|
+
{"version":3,"file":"analyze-command-aggregate.js","sourceRoot":"","sources":["../../src/shell/analyze-command-aggregate.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iDAAiD,EAAE,MAAM,yCAAyC,CAAC;AAE5G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,MAAM,SAAS,GAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAE/E,SAAS,OAAO,CAAC,CAAO,EAAE,CAAO;IAC/B,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,QAAQ,GAAG,iDAAiD,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,QAAQ,GAAG,iDAAiD,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAAC,SAA0B;IACpE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,SAA0B;IACrF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,WAA8B,EAC9B,OAAe,EACf,YAA6B,EAAE;IAE/B,IAAI,IAAI,GAAS,MAAM,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACvE,IAAI,GAAG,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAA8B,EAC9B,SAA0B,EAC1B,WAA8B;IAE9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsD,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5C,aAAa;YACb,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;SAChD,CAAC,CAAC;QACH,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAA8B;IAI1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC5F,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;aACzD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,iBAA0B;IAC5E,MAAM,UAAU,GAAoB;QAClC,IAAI,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;QAC/F,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC9F,KAAK,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,EAAE;KACrE,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;QAChD,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE;QACnE,4BAA4B,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QAClG,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,iBAAiB;QACrC,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}
|
|
@@ -29,7 +29,7 @@ export function analyzeShellCommand(command, policy, depth = 0) {
|
|
|
29
29
|
}
|
|
30
30
|
}
|
|
31
31
|
const skipped = invocations.length === 0;
|
|
32
|
-
const tier = skipped ? "READ" : aggregateTier(invocations,
|
|
32
|
+
const tier = skipped ? "READ" : aggregateTier(invocations, command, operators);
|
|
33
33
|
return {
|
|
34
34
|
raw_command: command,
|
|
35
35
|
segments,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-command.js","sourceRoot":"","sources":["../../src/shell/analyze-command.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,aAAa,GACd,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EACL,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAkB,EAAE,KAAK,GAAG,CAAC;IAChF,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CACd,GAAG,gCAAgC,CACjC,OAAO,CAAC,IAAI,EACZ,YAAY,EACZ,MAAM,EACN,aAAa,EACb,WAAW,CACZ,CACF,CAAC;QAEF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,OAAO,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACrF,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,
|
|
1
|
+
{"version":3,"file":"analyze-command.js","sourceRoot":"","sources":["../../src/shell/analyze-command.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,aAAa,GACd,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EACL,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAkB,EAAE,KAAK,GAAG,CAAC;IAChF,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CACd,GAAG,gCAAgC,CACjC,OAAO,CAAC,IAAI,EACZ,YAAY,EACZ,MAAM,EACN,aAAa,EACb,WAAW,CACZ,CACF,CAAC;QAEF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,OAAO,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACrF,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAE/E,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,QAAQ;QACR,SAAS;QACT,WAAW;QACX,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC;QACnC,4BAA4B,EAAE,uBAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;QACvF,OAAO;QACP,IAAI;QACJ,kBAAkB,EAAE,iBAAiB;QACrC,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/shell/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAa,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/shell/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAa,MAAM,oBAAoB,CAAC;AAG9E,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAgB,KAAK,eAAe,EAAoB,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,+BAA+B,EACpC,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,CAoBnD;AAmCD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAkC5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,iBAAiB,CAkBpB;AAED,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EAAE,GACb,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAE1C;AAED,OAAO,EAAE,kBAAkB,IAAI,wBAAwB,EAAE,CAAC"}
|
package/dist/shell/evaluate.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { classifyArgv } from "../policy/index.js";
|
|
2
|
+
import { shouldBumpReadChainToMutate } from "./analyze-command-aggregate.js";
|
|
2
3
|
import { analyzeShellCommand } from "./analyze-command.js";
|
|
3
4
|
import { evaluateArgv } from "./guard-eval.js";
|
|
4
5
|
import { parseCommandToArgv } from "./parse.js";
|
|
@@ -34,7 +35,9 @@ export function evaluateMcpProposal(policy, argv) {
|
|
|
34
35
|
function analysisToEvaluation(analysis) {
|
|
35
36
|
const { primary, tier, raw_metacharacters, invocations } = analysis;
|
|
36
37
|
const evaluation = { ...primary.evaluation, tier };
|
|
37
|
-
if (raw_metacharacters &&
|
|
38
|
+
if (raw_metacharacters &&
|
|
39
|
+
shouldBumpReadChainToMutate(analysis.raw_command, analysis.operators) &&
|
|
40
|
+
!evaluation.reasons.some((r) => r.code === "metacharacters")) {
|
|
38
41
|
evaluation.reasons = [
|
|
39
42
|
...evaluation.reasons,
|
|
40
43
|
{ code: "metacharacters", message: "Composition operators in raw command; treat as high-risk." },
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/shell/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAA0C,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIhD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAIvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAU7B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAkB,EAClB,IAAc;IAEd,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU,EAAE;gBACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,sDAAsD;qBAChE;iBACF;gBACD,cAAc,EAAE,EAAE,GAAG,cAAc,EAAE,IAAI,EAAE,MAAc,EAAE;gBAC3D,KAAK;aACN;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB;IACnD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IACpE,MAAM,UAAU,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAEnD,
|
|
1
|
+
{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/shell/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA8B,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAA0C,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIhD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAIvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAU7B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAkB,EAClB,IAAc;IAEd,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU,EAAE;gBACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,sDAAsD;qBAChE;iBACF;gBACD,cAAc,EAAE,EAAE,GAAG,cAAc,EAAE,IAAI,EAAE,MAAc,EAAE;gBAC3D,KAAK;aACN;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB;IACnD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IACpE,MAAM,UAAU,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAEnD,IACE,kBAAkB;QAClB,2BAA2B,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;QACrE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC5D,CAAC;QACD,UAAU,CAAC,OAAO,GAAG;YACnB,GAAG,UAAU,CAAC,OAAO;YACrB,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,2DAA2D,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,OAAO,GAAG;YACnB,GAAG,UAAU,CAAC,OAAO;YACrB;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,SAAS,WAAW,CAAC,MAAM,gDAAgD;gBACpF,OAAO,EAAE,EAAE,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE;aAClD;SACF,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,aAAgC;IAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACvF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ;YACR,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE;gBACtC,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,wDAAwD;qBAClE;iBACF;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,IAAI;oBACV,YAAY,EAAE,IAAI;oBAClB,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,KAAK;iBACf;gBACD,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;aACzD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ;QACR,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAGhC;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAEjE,OAAO;QACL,UAAU;QACV,YAAY,EAAE,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,wCAAwC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7G,aAAa,EACX,UAAU,KAAK,MAAM;YACnB,CAAC,CAAC,0BAA0B,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACtF,CAAC,CAAC,SAAS;QACf,UAAU;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B,CAC3C,MAAkB,EAClB,IAAc;IAEd,OAAO,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,OAAO,EAAE,kBAAkB,IAAI,wBAAwB,EAAE,CAAC"}
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@praxis.guard/auditor-cli",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.65",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -32,7 +32,7 @@
|
|
|
32
32
|
"lint": "eslint .",
|
|
33
33
|
"typecheck": "tsc -p tsconfig.json",
|
|
34
34
|
"pretest": "pnpm run build",
|
|
35
|
-
"test": "node --import tsx/esm --test src/**/*.test.ts",
|
|
35
|
+
"test": "node --experimental-test-module-mocks --import tsx/esm --test src/**/*.test.ts",
|
|
36
36
|
"mcp:dev": "tsx src/cli.ts mcp",
|
|
37
37
|
"prepack": "pnpm run build && pnpm run build:native && node scripts/prepare-package.cjs",
|
|
38
38
|
"e2e:pack-install": "bash scripts/e2e-pack-install.sh",
|