@qduc/term2 0.9.4 → 0.10.0

package/dist/utils/command-safety/index.js

@@ -1,227 +0,0 @@
-import { parse } from 'unbash';
-import { SafetyStatus, ALLOWED_COMMANDS, BLOCKED_COMMANDS } from './constants.js';
-import { extractWordText } from './utils.js';
-import { hasFindDangerousExecution, hasFindSuspiciousFlags } from './find-helpers.js';
-import { analyzePathRisk } from './path-analysis.js';
-import { getCommandHandler } from './handlers/index.js';
-const nullLoggingService = {
-    info: () => { },
-    warn: () => { },
-    error: () => { },
-    debug: () => { },
-    security: () => { },
-    setCorrelationId: () => { },
-    getCorrelationId: () => undefined,
-    clearCorrelationId: () => { },
-};
-function getLogger(loggingService) {
-    return loggingService ?? nullLoggingService;
-}
-function hasUnparsedTrailingInput(commandString, ast) {
-    if (!Array.isArray(ast.commands) || ast.commands.length === 0)
-        return false;
-    const lastCommandEnd = ast.commands.reduce((end, node) => Math.max(end, node?.end ?? 0), 0);
-    const tail = commandString.slice(lastCommandEnd);
-    return !/^\s*;?\s*(#.*)?$/.test(tail);
-}
-/**
- * Classify command into a SafetyStatus (GREEN/YELLOW/RED)
- */
-export function classifyCommand(commandString, loggingService) {
-    return classifyCommandDetailed(commandString, loggingService).status;
-}
-/**
- * Classify command and return both the status and the list of reasons
- * that contributed to the final status.
- */
-export function classifyCommandDetailed(commandString, loggingService) {
-    const reasons = [];
-    const truncatedCommand = commandString.substring(0, 200);
-    const logger = getLogger(loggingService);
-    logger.security('Classifying command safety', {
-        command: truncatedCommand,
-    });
-    let ast;
-    try {
-        ast = parse(commandString);
-    }
-    catch (e) {
-        logger.warn('Failed to parse command, classifying as YELLOW', {
-            command: commandString.substring(0, 200),
-            error: e instanceof Error ? e.message : String(e),
-        });
-        return {
-            status: SafetyStatus.YELLOW,
-            reasons: [`YELLOW: failed to parse command (${e instanceof Error ? e.message : String(e)})`],
-        };
-    }
-    if (ast.errors && ast.errors.length > 0) {
-        logger.warn('Failed to parse command, classifying as YELLOW', {
-            command: commandString.substring(0, 200),
-            error: ast.errors.map((e) => e.message).join('; '),
-        });
-        return {
-            status: SafetyStatus.YELLOW,
-            reasons: [`YELLOW: failed to parse command (${ast.errors.map((e) => e.message).join('; ')})`],
-        };
-    }
-    if (hasUnparsedTrailingInput(commandString, ast)) {
-        return {
-            status: SafetyStatus.YELLOW,
-            reasons: ['YELLOW: failed to parse complete command'],
-        };
-    }
-    let worstStatus = SafetyStatus.GREEN;
-    const analyzePathRiskWithLogger = (p) => analyzePathRisk(p, logger);
-    function upgradeStatus(s, reason) {
-        if (worstStatus === SafetyStatus.RED)
-            return;
-        if (s === SafetyStatus.RED)
-            worstStatus = SafetyStatus.RED;
-        else if (s === SafetyStatus.YELLOW && worstStatus === SafetyStatus.GREEN)
-            worstStatus = SafetyStatus.YELLOW;
-        if (reason)
-            reasons.push(`${s}: ${reason}`);
-    }
-    function traverse(node) {
-        if (!node)
-            return;
-        if (Array.isArray(node))
-            return node.forEach(traverse);
-        if (Array.isArray(node.parts))
-            traverse(node.parts);
-        if (node.type === 'CommandExpansion') {
-            traverse(node.script);
-            return;
-        }
-        if (node.type === 'Command') {
-            const name = node.name?.text || (node.name && node.name.parts && node.name.parts.map((p) => p.text).join(''));
-            if (typeof name === 'string') {
-                if (BLOCKED_COMMANDS.has(name)) {
-                    upgradeStatus(SafetyStatus.RED, `blocked command: ${name}`);
-                    return;
-                }
-                if (!ALLOWED_COMMANDS.has(name)) {
-                    upgradeStatus(SafetyStatus.YELLOW, `unknown or unlisted command: ${name}`);
-                }
-            }
-            const cmdName = typeof name === 'string' ? name : undefined;
-            // Check if there's a specialized handler for this command
-            if (cmdName) {
-                const handler = getCommandHandler(cmdName);
-                if (handler) {
-                    const helpers = {
-                        extractWordText,
-                        analyzePathRisk: analyzePathRiskWithLogger,
-                        hasFindDangerousExecution,
-                        hasFindSuspiciousFlags,
-                    };
-                    const result = handler.handle(node, helpers);
-                    upgradeStatus(result.status, result.reasons.join('; '));
-                    traverse(node.name);
-                    traverse(node.prefix);
-                    traverse(node.suffix);
-                    traverse(node.redirects);
-                    return;
-                }
-            }
-            // Handle redirects
-            if (node.redirects) {
-                for (const redirect of node.redirects) {
-                    const fileText = extractWordText(redirect.target ?? redirect);
-                    const pathStatus = analyzePathRiskWithLogger(fileText);
-                    upgradeStatus(pathStatus, `redirect to ${fileText ?? '<unknown>'}`);
-                }
-            }
-            // Generic argument processing for commands without specialized handlers
-            if (node.suffix) {
-                for (const arg of node.suffix) {
-                    const argText = extractWordText(arg);
-                    // Skip flags (generic commands don't have special flag handling)
-                    if (argText && argText.startsWith('-')) {
-                        continue;
-                    }
-                    // Analyze path arguments
-                    const pathStatus = analyzePathRiskWithLogger(argText);
-                    // Unknown/opaque args fall back to YELLOW
-                    if (!argText)
-                        upgradeStatus(SafetyStatus.YELLOW, 'opaque or unparseable argument');
-                    else
-                        upgradeStatus(pathStatus, `argument ${argText}`);
-                }
-            }
-        }
-        // recurse common shapes
-        if (node.type === 'Statement') {
-            if (node.redirects) {
-                for (const redirect of node.redirects) {
-                    const fileText = extractWordText(redirect.target ?? redirect);
-                    const pathStatus = analyzePathRiskWithLogger(fileText);
-                    upgradeStatus(pathStatus, `redirect to ${fileText ?? '<unknown>'}`);
-                }
-            }
-            traverse(node.command);
-            return;
-        }
-        if (node.type === 'AndOr') {
-            (node.commands || []).forEach(traverse);
-            return;
-        }
-        if (node.type === 'Pipeline') {
-            (node.commands || []).forEach(traverse);
-            return;
-        }
-        if (node.type === 'Subshell') {
-            traverse(node.body);
-            return;
-        }
-        if (node.type === 'Script' || node.type === 'Program') {
-            (node.commands || []).forEach(traverse);
-            return;
-        }
-        for (const k of Object.keys(node)) {
-            const v = node[k];
-            if (v && typeof v === 'object')
-                traverse(v);
-        }
-    }
-    if (ast && ast.commands) {
-        ast.commands.forEach(traverse);
-    }
-    logger.security('Command classification result', {
-        command: truncatedCommand,
-        status: worstStatus,
-        reasons,
-    });
-    return { status: worstStatus, reasons };
-}
-/**
- * Validate command safety using an AST parser.
- * Returns true when a command requires user approval (YELLOW or RED).
- * Throws for invalid/empty inputs.
- */
-export function validateCommandSafety(command, loggingService) {
-    if (!command || typeof command !== 'string' || command.trim().length === 0) {
-        throw new Error('Command cannot be empty');
-    }
-    const logger = getLogger(loggingService);
-    logger.security('Validating command safety', {
-        command: command.substring(0, 200),
-    });
-    const status = classifyCommand(command, logger);
-    if (status === SafetyStatus.RED || status === SafetyStatus.YELLOW) {
-        logger.security('Command validation: needs approval', {
-            command: command.substring(0, 200),
-            status,
-        });
-        return true;
-    }
-    logger.security('Validation result', {
-        command: command.substring(0, 200),
-        status,
-    });
-    return false;
-}
-// Re-export types and constants for convenience
-export { SafetyStatus } from './constants.js';
-//# sourceMappingURL=index.js.map

package/dist/utils/command-safety/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/utils/command-safety/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,MAAM,kBAAkB,GAAoB;IAC1C,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;IAClB,gBAAgB,EAAE,GAAG,EAAE,GAAE,CAAC;IAC1B,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS;IACjC,kBAAkB,EAAE,GAAG,EAAE,GAAE,CAAC;CAC7B,CAAC;AAEF,SAAS,SAAS,CAAC,cAAgC;IACjD,OAAO,cAAc,IAAI,kBAAkB,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB,CAAC,aAAqB,EAAE,GAA6B;IACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,IAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjD,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,cAAgC;IACrF,OAAO,uBAAuB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,cAAgC;IAEhC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAEzC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE;QAC5C,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,IAAI,GAA6D,CAAC;IAClE,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,aAAa,CAA6D,CAAC;IACzF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAC5D,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACxC,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,CAAC,oCAAoC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAC5D,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACxC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACnD,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,CAAC,oCAAoC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9F,CAAC;IACJ,CAAC;IACD,IAAI,wBAAwB,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,CAAC,0CAA0C,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,GAAiB,YAAY,CAAC,KAAK,CAAC;IAEnD,MAAM,yBAAyB,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAExF,SAAS,aAAa,CAAC,CAAe,EAAE,MAAe;QACrD,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG;YAAE,OAAO;QAC7C,IAAI,CAAC,KAAK,YAAY,CAAC,GAAG;YAAE,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC;aACtD,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,IAAI,WAAW,KAAK,YAAY,CAAC,KAAK;YAAE,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC;QAC5G,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,QAAQ,CAAC,IAAS;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxG,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;oBAC5D,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,aAAa,CAAC,YAAY,CAAC,MAAM,EAAE,gCAAgC,IAAI,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAE5D,0DAA0D;YAC1D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,OAAO,GAA0B;wBACrC,eAAe;wBACf,eAAe,EAAE,yBAAyB;wBAC1C,yBAAyB;wBACzB,sBAAsB;qBACvB,CAAC;oBACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC7C,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACtB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACtB,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACzB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,mBAAmB;YACnB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAC9D,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;oBACvD,aAAa,CAAC,UAAU,EAAE,eAAe,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;oBACrC,iEAAiE;oBACjE,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,SAAS;oBACX,CAAC;oBAED,yBAAyB;oBACzB,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;oBACtD,0CAA0C;oBAC1C,IAAI,CAAC,OAAO;wBAAE,aAAa,CAAC,YAAY,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;;wBAC9E,aAAa,CAAC,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;oBAC9D,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;oBACvD,aAAa,CAAC,UAAU,EAAE,eAAe,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtD,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvB,GAAG,CAAC,QAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE;QAC/C,OAAO,EAAE,gBAAgB;QACzB,MAAM,EAAE,WAAW;QACnB,OAAO;KACR,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,cAAgC;IACrF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE;QAC3C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEhD,IAAI,MAAM,KAAK,YAAY,CAAC,GAAG,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,oCAAoC,EAAE;YACpD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YAClC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACnC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,MAAM;KACP,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gDAAgD;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/utils/command-safety/path-analysis.d.ts

@@ -1,4 +0,0 @@
-import type { ILoggingService } from '../../services/service-interfaces.js';
-import { SafetyStatus } from './constants.js';
-export declare function analyzePathRisk(inputPath: string | undefined, loggingService?: ILoggingService): SafetyStatus;
-//# sourceMappingURL=path-analysis.d.ts.map

package/dist/utils/command-safety/path-analysis.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-analysis.d.ts","sourceRoot":"","sources":["../../../source/utils/command-safety/path-analysis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,YAAY,EAOb,MAAM,gBAAgB,CAAC;AAgHxB,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,cAAc,CAAC,EAAE,eAAe,GAAG,YAAY,CAkM7G"}

package/dist/utils/command-safety/path-analysis.js

@@ -1,269 +0,0 @@
-import path from 'path';
-import { SafetyStatus, SYSTEM_PATHS, SENSITIVE_EXTENSIONS, HOME_PATTERNS, SENSITIVE_PATHS, SAFE_JSON_FILES, SUSPICIOUS_JSON_PATTERNS, } from './constants.js';
-const nullLoggingService = {
-    info: () => { },
-    warn: () => { },
-    error: () => { },
-    debug: () => { },
-    security: () => { },
-    setCorrelationId: () => { },
-    getCorrelationId: () => undefined,
-    clearCorrelationId: () => { },
-};
-// Dot-directories that almost always contain credentials, private keys, or secrets.
-// Access to these should be blocked (RED) regardless of the specific file inside.
-const HIGHLY_SENSITIVE_HOME_DIRS = new Set([
-    '.ssh',
-    '.gnupg',
-    '.gpg',
-    '.aws',
-    '.azure',
-    '.gcloud',
-    '.config/gcloud',
-    '.kube',
-    '.docker',
-    '.netrc',
-    '.pgpass',
-    '.password-store',
-    '.cert',
-    '.certs',
-    '.keys',
-    '.secrets',
-]);
-// Sensitive dotfiles at the root of the home directory (RED).
-const HIGHLY_SENSITIVE_HOME_FILES = new Set([
-    '.netrc',
-    '.pgpass',
-    '.npmrc', // can contain auth tokens
-    '.pypirc', // can contain auth tokens
-    '.gitconfig', // may contain credentials / signing keys
-    '.git-credentials',
-    '.bash_history',
-    '.zsh_history',
-    '.python_history',
-    '.node_repl_history',
-    '.mysql_history',
-    '.psql_history',
-    '.lesshst',
-]);
-// Dot-directories that are commonly used as working/cache/data directories.
-// These should NOT be RED — they're YELLOW at worst, often GREEN-ish.
-// Users frequently work in these (installing tools, inspecting caches, etc.).
-const COMMON_WORKING_DOT_DIRS = new Set([
-    '.local',
-    '.cache',
-    '.config', // root .config is broad; specific sensitive subdirs handled above
-    '.npm',
-    '.yarn',
-    '.pnpm',
-    '.nvm',
-    '.node_modules',
-    '.vscode',
-    '.idea',
-    '.cursor',
-    '.vim',
-    '.emacs.d',
-    '.mozilla',
-    '.themes',
-    '.icons',
-    '.fonts',
-    '.gradle',
-    '.m2',
-    '.cargo',
-    '.rustup',
-    '.pyenv',
-    '.rbenv',
-    '.virtualenvs',
-    '.docker-desktop',
-]);
-const SENSITIVE_LOCAL_PATH_SEGMENTS = new Set(['.ssh', '.gnupg', '.aws', '.kube', '.git', '.env']);
-function getLogger(loggingService) {
-    return loggingService ?? nullLoggingService;
-}
-/**
- * Given a sliced home-relative path (e.g. "/.ssh/id_rsa" or "/.local/bin/foo"),
- * return the first dot-segment (e.g. ".ssh", ".local") or undefined.
- */
-function firstDotSegment(sliced) {
-    const segments = sliced.split('/').filter(Boolean);
-    const first = segments[0];
-    return first && first.startsWith('.') ? first : undefined;
-}
-/**
- * Check whether a sliced home path falls within a highly sensitive directory.
- * Handles nested keys like ".config/gcloud".
- */
-function isInHighlySensitiveDir(sliced) {
-    const trimmed = sliced.replace(/^\/+/, '');
-    for (const dir of HIGHLY_SENSITIVE_HOME_DIRS) {
-        if (trimmed === dir || trimmed.startsWith(dir + '/')) {
-            return true;
-        }
-    }
-    return false;
-}
-export function analyzePathRisk(inputPath, loggingService) {
-    const logger = getLogger(loggingService);
-    const candidate = inputPath?.trim();
-    if (!candidate)
-        return SafetyStatus.GREEN;
-    // GREEN: Safe pseudo-devices
-    const safeDevices = new Set(['/dev/null', '/dev/stdout', '/dev/stderr', '/dev/zero', '/dev/random', '/dev/urandom']);
-    if (safeDevices.has(candidate)) {
-        return SafetyStatus.GREEN;
-    }
-    // GREEN: the current directory itself ("." / "./"). Without this, the later
-    // "hidden file" check fires because path.basename('.') === '.' (starts with a dot),
-    // wrongly flagging read-only commands like `rg "x" .` or `grep -r "x" .` as YELLOW.
-    if (candidate === '.' || candidate === './') {
-        return SafetyStatus.GREEN;
-    }
-    const cwd = process.cwd();
-    // Pre-calculate project membership for absolute paths
-    const isAbsolute = path.isAbsolute(candidate);
-    const normalizedCandidate = path.normalize(candidate);
-    const normalizedCwd = path.normalize(cwd);
-    const isWithinProject = isAbsolute && (normalizedCandidate.startsWith(normalizedCwd + path.sep) || normalizedCandidate === normalizedCwd);
-    // RED: Home directory and sensitive paths
-    // Check for various home directory representations
-    const isHomeRelated = HOME_PATTERNS.some((pattern) => pattern.test(candidate));
-    if (isHomeRelated && !isWithinProject) {
-        // Extract the path after home prefix for further analysis
-        const sliced = candidate
-            .replace(/^~/, '')
-            .replace(/^\$\{?HOME\}?/, '')
-            .replace(/^\$\{?USER\}?/, '')
-            .replace(/^\$\{?LOGNAME\}?/, '')
-            .replace(/^\/home\/[^/]+/, '')
-            .replace(/^\/Users\/[^/]+/, '')
-            .replace(/^\/root/, '');
-        // Plain home directory access without any suffix is broad and privacy-sensitive,
-        // but not inherently destructive. Let the model judge the task context.
-        if (sliced === '' || sliced === '/') {
-            logger.security('Path risk: home directory access', { path: candidate });
-            return SafetyStatus.YELLOW;
-        }
-        const filename = path.basename(candidate);
-        const topDot = firstDotSegment(sliced);
-        // RED: highly sensitive credential directories (anywhere inside)
-        if (isInHighlySensitiveDir(sliced)) {
-            logger.security('Path risk: sensitive credential directory', { path: candidate });
-            return SafetyStatus.RED;
-        }
-        // RED: highly sensitive dotfiles at home root
-        // (only when the file sits directly under home, not deep inside another dir)
-        const slicedSegments = sliced.split('/').filter(Boolean);
-        if (slicedSegments.length === 1 && HIGHLY_SENSITIVE_HOME_FILES.has(slicedSegments[0])) {
-            logger.security('Path risk: sensitive home dotfile', { path: candidate });
-            return SafetyStatus.RED;
-        }
-        // Legacy explicit sensitive-path substring match (kept for back-compat with constants.ts)
-        if (SENSITIVE_PATHS.some((sensitive) => sliced.includes(sensitive))) {
-            logger.security('Path risk: known sensitive path', { path: candidate });
-            return SafetyStatus.RED;
-        }
-        // Suspicious filename patterns (credentials.json, *_token.json, etc.) anywhere in home -> RED
-        if (/\.json$/i.test(filename) && SUSPICIOUS_JSON_PATTERNS.some((pattern) => pattern.test(filename))) {
-            logger.security('Path risk: suspicious JSON file in home directory', { path: candidate });
-            return SafetyStatus.RED;
-        }
-        // Sensitive extensions (private keys, pem, etc.) anywhere in home -> RED
-        if (SENSITIVE_EXTENSIONS.some((ext) => filename.endsWith(ext))) {
-            logger.security('Path risk: sensitive file in home directory', { path: candidate });
-            return SafetyStatus.RED;
-        }
-        // YELLOW: common working dot-directories (~/.local, ~/.cache, ~/.config/..., etc.)
-        // Users legitimately operate here often — flag as cautious, not blocked.
-        if (topDot && COMMON_WORKING_DOT_DIRS.has(topDot)) {
-            logger.security('Path risk: home working dot-directory', { path: candidate, segment: topDot });
-            return SafetyStatus.YELLOW;
-        }
-        // YELLOW: any other unknown dotfile/dotdir directly under home — be cautious
-        // but don't block, since many tools create custom dot-directories.
-        if (topDot) {
-            logger.security('Path risk: unknown home dot-entry', { path: candidate, segment: topDot });
-            return SafetyStatus.YELLOW;
-        }
-        // Non-dot files/folders inside home -> YELLOW (privacy-sensitive but not destructive)
-        logger.security('Path risk: home directory file', { path: candidate });
-        return SafetyStatus.YELLOW;
-    }
-    // YELLOW: Absolute System Paths
-    if (path.isAbsolute(candidate)) {
-        if (SYSTEM_PATHS.some((sys) => candidate.startsWith(sys))) {
-            logger.security('Path risk: absolute system path', { path: candidate });
-            return SafetyStatus.YELLOW;
-        }
-        // Absolute paths into highly sensitive home dirs are still RED
-        const absHomeMatch = candidate.match(/^\/(?:home|Users)\/[^/]+(\/.*)?$/) ||
-            (candidate.startsWith('/root') ? [candidate, candidate.slice(5)] : null);
-        if (absHomeMatch) {
-            const tail = absHomeMatch[1] ?? '';
-            if (isInHighlySensitiveDir(tail)) {
-                logger.security('Path risk: absolute sensitive home dir', { path: candidate });
-                return SafetyStatus.RED;
-            }
-            const tailSegments = tail.split('/').filter(Boolean);
-            if (tailSegments.length === 1 && HIGHLY_SENSITIVE_HOME_FILES.has(tailSegments[0])) {
-                logger.security('Path risk: absolute sensitive home file', { path: candidate });
-                return SafetyStatus.RED;
-            }
-        }
-        // Check if absolute path is within current project directory or in a safe temporary directory
-        const isTempDir = normalizedCandidate === '/tmp' ||
-            normalizedCandidate.startsWith('/tmp' + path.sep) ||
-            normalizedCandidate === '/private/tmp' ||
-            normalizedCandidate.startsWith('/private/tmp' + path.sep);
-        if (!isWithinProject && !isTempDir) {
-            // Absolute paths outside project are suspicious -> audit
-            logger.security('Path risk: absolute non-system path', { path: candidate });
-            return SafetyStatus.YELLOW;
-        }
-        // If within project, continue with normal flow (treat like relative path)
-        // Fall through to continue checking for sensitive files, hidden files, etc.
-    }
-    // YELLOW: Directory Traversal
-    if (candidate.includes('..')) {
-        logger.security('Path risk: directory traversal detected', { path: candidate });
-        return SafetyStatus.YELLOW;
-    }
-    const pathSegments = normalizedCandidate.split(/[\\/]+/).filter(Boolean);
-    if (pathSegments.some((segment) => SENSITIVE_LOCAL_PATH_SEGMENTS.has(segment))) {
-        logger.security('Path risk: sensitive local dot-directory', { path: candidate });
-        return SafetyStatus.YELLOW;
-    }
-    const filename = path.basename(candidate);
-    // JSON files: check allowlist and suspicious patterns BEFORE hidden file check
-    // This ensures safe JSON files like .eslintrc.json are GREEN
-    // Use case-insensitive check for .json extension
-    if (/\.json$/i.test(filename)) {
-        // Safe project config files are always GREEN
-        // Check case-insensitively by converting to lowercase
-        if (SAFE_JSON_FILES.has(filename.toLowerCase())) {
-            return SafetyStatus.GREEN;
-        }
-        // Check for suspicious credential/token patterns
-        if (SUSPICIOUS_JSON_PATTERNS.some((pattern) => pattern.test(filename))) {
-            logger.security('Path risk: suspicious JSON filename', {
-                path: candidate,
-            });
-            return SafetyStatus.YELLOW;
-        }
-        // Other JSON files are GREEN by default (permissive)
-        return SafetyStatus.GREEN;
-    }
-    // Hidden files -> YELLOW
-    if (filename.startsWith('.')) {
-        logger.security('Path risk: hidden file', { path: candidate });
-        return SafetyStatus.YELLOW;
-    }
-    // Sensitive extensions
-    if (SENSITIVE_EXTENSIONS.some((ext) => filename.endsWith(ext))) {
-        logger.security('Path risk: sensitive extension', {
-            path: candidate,
-        });
-        return SafetyStatus.YELLOW;
-    }
-    return SafetyStatus.GREEN;
-}
-//# sourceMappingURL=path-analysis.js.map

package/dist/utils/command-safety/path-analysis.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-analysis.js","sourceRoot":"","sources":["../../../source/utils/command-safety/path-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,eAAe,EACf,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,MAAM,kBAAkB,GAAoB;IAC1C,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;IAClB,gBAAgB,EAAE,GAAG,EAAE,GAAE,CAAC;IAC1B,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS;IACjC,kBAAkB,EAAE,GAAG,EAAE,GAAE,CAAC;CAC7B,CAAC;AAEF,oFAAoF;AACpF,kFAAkF;AAClF,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,iBAAiB;IACjB,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,QAAQ;IACR,SAAS;IACT,QAAQ,EAAE,0BAA0B;IACpC,SAAS,EAAE,0BAA0B;IACrC,YAAY,EAAE,yCAAyC;IACvD,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH,4EAA4E;AAC5E,sEAAsE;AACtE,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,SAAS,EAAE,kEAAkE;IAC7E,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,eAAe;IACf,SAAS;IACT,OAAO;IACP,SAAS;IACT,MAAM;IACN,UAAU;IACV,UAAU;IACV,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,KAAK;IACL,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnG,SAAS,SAAS,CAAC,cAAgC;IACjD,OAAO,cAAc,IAAI,kBAAkB,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAA6B,EAAE,cAAgC;IAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC;IAE1C,6BAA6B;IAC7B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IACrH,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IAED,4EAA4E;IAC5E,oFAAoF;IACpF,oFAAoF;IACpF,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1B,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,eAAe,GACnB,UAAU,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,mBAAmB,KAAK,aAAa,CAAC,CAAC;IAEpH,0CAA0C;IAC1C,mDAAmD;IACnD,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAE/E,IAAI,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,0DAA0D;QAC1D,MAAM,MAAM,GAAG,SAAS;aACrB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;aAC/B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;aAC7B,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE1B,iFAAiF;QACjF,wEAAwE;QACxE,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,OAAO,YAAY,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,iEAAiE;QACjE,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAClF,OAAO,YAAY,CAAC,GAAG,CAAC;QAC1B,CAAC;QAED,8CAA8C;QAC9C,6EAA6E;QAC7E,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1E,OAAO,YAAY,CAAC,GAAG,CAAC;QAC1B,CAAC;QAED,0FAA0F;QAC1F,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO,YAAY,CAAC,GAAG,CAAC;QAC1B,CAAC;QAED,8FAA8F;QAC9F,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,QAAQ,CAAC,mDAAmD,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1F,OAAO,YAAY,CAAC,GAAG,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,OAAO,YAAY,CAAC,GAAG,CAAC;QAC1B,CAAC;QAED,mFAAmF;QACnF,yEAAyE;QACzE,IAAI,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/F,OAAO,YAAY,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3F,OAAO,YAAY,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,sFAAsF;QACtF,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO,YAAY,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,+DAA+D;QAC/D,MAAM,YAAY,GAChB,SAAS,CAAC,KAAK,CAAC,kCAAkC,CAAC;YACnD,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/E,OAAO,YAAY,CAAC,GAAG,CAAC;YAC1B,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChF,OAAO,YAAY,CAAC,GAAG,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,8FAA8F;QAC9F,MAAM,SAAS,GACb,mBAAmB,KAAK,MAAM;YAC9B,mBAAmB,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;YACjD,mBAAmB,KAAK,cAAc;YACtC,mBAAmB,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5D,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,yDAAyD;YACzD,MAAM,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5E,OAAO,YAAY,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;IAC9E,CAAC;IAED,8BAA8B;IAC9B,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChF,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,0CAA0C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACjF,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE1C,+EAA+E;IAC/E,6DAA6D;IAC7D,iDAAiD;IACjD,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,6CAA6C;QAC7C,sDAAsD;QACtD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,OAAO,YAAY,CAAC,KAAK,CAAC;QAC5B,CAAC;QAED,iDAAiD;QACjD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,QAAQ,CAAC,qCAAqC,EAAE;gBACrD,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,qDAAqD;QACrD,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,uBAAuB;IACvB,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YAChD,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC;AAC5B,CAAC"}

package/dist/utils/command-safety/scratch-classify.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=scratch-classify.test.d.ts.map

package/dist/utils/command-safety/scratch-classify.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scratch-classify.test.d.ts","sourceRoot":"","sources":["../../../source/utils/command-safety/scratch-classify.test.ts"],"names":[],"mappings":""}

package/dist/utils/command-safety/scratch-classify.test.js

@@ -1,22 +0,0 @@
-import test from 'ava';
-import { classifyCommandDetailed } from './index.js';
-const cases = [
-    `awk '1' source/prompts/plan-mode-info.md`,
-    `awk --version`,
-    `rg -n "actualPromptTokens" source/`,
-    `git status --short && rg -n "actualPromptTokens" source/`,
-    `rg -n "x" .`,
-    `rg --files . | rg 'testfrontend_public\\.h$'`,
-    `rg -n "y" ~/Library/Logs/term2-nodejs/logs/provider-traffic/2026-05-25`,
-    `printf 'a'; rg -n '^#' source/prompts/codex.md`,
-    `rg -n "z" src test docs -g '*.cpp'`,
-];
-test('classify scratch', (t) => {
-    for (const c of cases) {
-        const r = classifyCommandDetailed(c);
-        // eslint-disable-next-line no-console
-        console.log(`[${r.status}] ${c.slice(0, 60)}  :: ${r.reasons.join(' | ')}`);
-    }
-    t.pass();
-});
-//# sourceMappingURL=scratch-classify.test.js.map

package/dist/utils/command-safety/scratch-classify.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scratch-classify.test.js","sourceRoot":"","sources":["../../../source/utils/command-safety/scratch-classify.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,KAAK,GAAG;IACZ,0CAA0C;IAC1C,eAAe;IACf,oCAAoC;IACpC,0DAA0D;IAC1D,aAAa;IACb,8CAA8C;IAC9C,wEAAwE;IACxE,gDAAgD;IAChD,oCAAoC;CACrC,CAAC;AAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACrC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,CAAC,CAAC,IAAI,EAAE,CAAC;AACX,CAAC,CAAC,CAAC"}

package/dist/utils/command-safety/scratch-tally.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=scratch-tally.test.d.ts.map

package/dist/utils/command-safety/scratch-tally.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scratch-tally.test.d.ts","sourceRoot":"","sources":["../../../source/utils/command-safety/scratch-tally.test.ts"],"names":[],"mappings":""}

package/dist/utils/command-safety/scratch-tally.test.js

@@ -1,68 +0,0 @@
-import test from 'ava';
-import { readFileSync } from 'fs';
-import { classifyCommandDetailed } from './index.js';
-test('tally evaluator false positives', (t) => {
-    const cmds = JSON.parse(readFileSync('/tmp/eval_cmds.json', 'utf8'));
-    const statusCount = { GREEN: 0, YELLOW: 0, RED: 0 };
-    const reasonCount = new Map();
-    const greenSamples = [];
-    for (const c of cmds) {
-        let r;
-        try {
-            r = classifyCommandDetailed(c);
-        }
-        catch (e) {
-            reasonCount.set('THREW: ' + e.message, (reasonCount.get('THREW') ?? 0) + 1);
-            continue;
-        }
-        statusCount[r.status] = (statusCount[r.status] ?? 0) + 1;
-        if (r.status === 'GREEN' && greenSamples.length < 8)
-            greenSamples.push(c.slice(0, 70));
-        if (r.status !== 'GREEN') {
-            // bucket each distinct reason *kind* (strip the variable tail)
-            for (const reason of r.reasons) {
-                if (reason.startsWith('GREEN'))
-                    continue;
-                const kind = reason
-                    .replace(/unknown or unlisted command: \S+/, 'unlisted command: <cmd>')
-                    .replace(/argument .+/, 'argument <path>')
-                    .replace(/redirect to .+/, 'redirect to <path>')
-                    .replace(/blocked command: \S+/, 'blocked command: <cmd>');
-                reasonCount.set(kind, (reasonCount.get(kind) ?? 0) + 1);
-            }
-        }
-    }
-    // eslint-disable-next-line no-console
-    console.log('STATUS', JSON.stringify(statusCount));
-    const sorted = [...reasonCount.entries()].sort((a, b) => b[1] - a[1]);
-    // eslint-disable-next-line no-console
-    console.log('REASONS (status-bearing commands):');
-    for (const [k, v] of sorted)
-        console.log(`  ${String(v).padStart(4)}  ${k}`);
-    // eslint-disable-next-line no-console
-    console.log('GREEN samples:', greenSamples);
-    // Which command NAMES are unlisted? (re-parse, collect first tokens of unlisted reasons)
-    const unlisted = new Map();
-    for (const c of cmds) {
-        let r;
-        try {
-            r = classifyCommandDetailed(c);
-        }
-        catch {
-            continue;
-        }
-        for (const reason of r.reasons) {
-            const m = reason.match(/unknown or unlisted command: (\S+)/);
-            if (m)
-                unlisted.set(m[1], (unlisted.get(m[1]) ?? 0) + 1);
-        }
-    }
-    // eslint-disable-next-line no-console
-    console.log('UNLISTED COMMAND NAMES:');
-    for (const [k, v] of [...unlisted.entries()].sort((a, b) => b[1] - a[1])) {
-        // eslint-disable-next-line no-console
-        console.log(`  ${String(v).padStart(4)}  ${k}`);
-    }
-    t.pass();
-});
-//# sourceMappingURL=scratch-tally.test.js.map