@seanmozeik/tripwire 0.7.2 → 0.9.0

package/dist/types/dispatch.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Effect } from 'effect';
+import { type BashAnalysisOptions } from './lib/bash';
 import { type Config, type ResolvedConfig, type SecretScannerConfig } from './lib/config';
 import { type Decision } from './lib/decision';
 import { type HookEvent } from './lib/event.ts';
@@ -9,10 +10,11 @@ interface Rule {
     readonly name: string;
     readonly fn: RuleFn;
 }
-declare const collectPreToolUseRules: (tool: string, input: unknown, config: ResolvedConfig) => Rule[];
+declare const collectPreToolUseRules: (tool: string, input: unknown, config: ResolvedConfig, cwd?: string) => Rule[];
 declare const collectPostToolUseRules: (tool: string, response: unknown, secretScanner: SecretScannerConfig) => Rule[];
 declare const runRules: (rules: readonly Rule[], timeoutMs: number) => Effect.Effect<Decision>;
 declare const runRulesSync: (rules: readonly Rule[]) => Decision;
 declare const decide: (event: HookEvent, config?: Config) => Decision;
+declare const decideBash: (command: string, config?: Config, options?: BashAnalysisOptions) => Decision;
 declare const runHook: () => void;
-export { collectPostToolUseRules, collectPreToolUseRules, decide, normalizeToolName, runHook, runRules, runRulesSync, };
+export { collectPostToolUseRules, collectPreToolUseRules, decide, decideBash, normalizeToolName, runHook, runRules, runRulesSync, };

package/dist/types/index.d.ts

@@ -2,5 +2,5 @@ export type { Decision } from './lib/decision';
 export type { HookEvent } from './lib/event';
 export type { Config, ConfigLoad, ResolvedConfig } from './lib/config';
 export { allow, deny, ask, warn } from './lib/decision';
-export { decide } from './dispatch';
+export { decide, decideBash } from './dispatch';
 export { getDefaultConfig, loadConfig, loadConfigResult, mergeWithDefaults } from './lib/config';

package/dist/types/lib/bash/analyze.d.ts

@@ -0,0 +1,3 @@
+import type { BashAnalysisOptions, ShellProgram } from './types';
+declare const analyzeBash: (source: string, options?: BashAnalysisOptions) => ShellProgram;
+export { analyzeBash };

package/dist/types/lib/bash/carriers.d.ts

@@ -0,0 +1,11 @@
+import type { Command } from 'unbash';
+import type { ExecutionContext, ExecutionHost } from './execution-types';
+import type { ExecutionCarrierAlias, ShellInvocation } from './types';
+import type { Environment } from './values';
+declare class ExecutionCarriers {
+    #private;
+    constructor(host: ExecutionHost, aliases: readonly ExecutionCarrierAlias[]);
+    isCarrierCommand(command: Command): boolean;
+    inspect(invocation: ShellInvocation, environment: Environment, context: ExecutionContext): boolean;
+}
+export { ExecutionCarriers };

package/dist/types/lib/bash/config.d.ts

@@ -0,0 +1,17 @@
+import { Schema } from 'effect';
+declare const ExecutionCarrierKindSchema: Schema.Literal<"ssh">;
+declare const ExecutionCarrierAliasSchema: Schema.Struct<{
+    readonly command: Schema.$Array<Schema.NonEmptyString>;
+    readonly equivalentTo: Schema.Literal<"ssh">;
+}>;
+declare const ShellConfigSchema: Schema.Struct<{
+    readonly executionCarrierAliases: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly command: Schema.$Array<Schema.NonEmptyString>;
+        readonly equivalentTo: Schema.Literal<"ssh">;
+    }>>>;
+}>;
+type ExecutionCarrierAlias = typeof ExecutionCarrierAliasSchema.Type;
+type ExecutionCarrierKind = typeof ExecutionCarrierKindSchema.Type;
+type ShellConfig = typeof ShellConfigSchema.Type;
+export type { ExecutionCarrierAlias, ExecutionCarrierKind, ShellConfig };
+export { ExecutionCarrierAliasSchema, ExecutionCarrierKindSchema, ShellConfigSchema };

package/dist/types/lib/bash/execution-types.d.ts

@@ -0,0 +1,13 @@
+import type { ShellDiagnosticKind, ShellInvocation, ShellWord, SourceRange } from './types';
+import type { Environment } from './values';
+interface ExecutionContext {
+    readonly inspectedPipelineInput: boolean;
+    readonly source: string;
+    readonly pipeline: ShellInvocation['pipeline'];
+}
+interface ExecutionHost {
+    readonly addDiagnostic: (kind: ShellDiagnosticKind, message: string, range: SourceRange) => void;
+    readonly emitSynthetic: (words: readonly ShellWord[], parent: ShellInvocation, environment: Environment, context: ExecutionContext) => void;
+    readonly inspectShellSource: (word: ShellWord | undefined, environment: Environment, context: ExecutionContext) => void;
+}
+export type { ExecutionContext, ExecutionHost };

package/dist/types/lib/bash/execution.d.ts

@@ -0,0 +1,13 @@
+import type { Node, Redirect } from 'unbash';
+import type { ExecutionContext, ExecutionHost } from './execution-types';
+import type { ExecutionCarrierAlias, ShellInvocation } from './types';
+import { type Environment } from './values';
+declare class ExecutionInspector {
+    #private;
+    constructor(host: ExecutionHost, carrierAliases: readonly ExecutionCarrierAlias[]);
+    inspectShellInput(invocation: ShellInvocation, redirects: readonly Redirect[], environment: Environment, context: ExecutionContext): boolean;
+    inspectWrapper(invocation: ShellInvocation, environment: Environment, context: ExecutionContext, inlineShellSource?: boolean): void;
+    inspectPipelineInputs(commands: readonly Node[], environment: Environment, context: ExecutionContext): ReadonlySet<number>;
+}
+export { ExecutionInspector };
+export type { ExecutionContext } from './execution-types';

package/dist/types/lib/bash/index.d.ts

@@ -0,0 +1,8 @@
+import type { ShellProgram } from './types';
+declare const isSafePathTarget: (raw: string, extraRelative?: readonly string[], extraAbsolute?: readonly string[]) => boolean;
+declare const safeScopesSummary: (extraRelative?: readonly string[], extraAbsolute?: readonly string[]) => string;
+declare const hasBypass: (program: ShellProgram) => boolean;
+export type { BashAnalysisOptions, ExecutionCarrierAlias, ExecutionCarrierKind, PipelinePosition, ShellDiagnostic, ShellDiagnosticKind, ShellInvocation, ShellProgram, ShellRedirect, ShellWord, ShellWordKind, SourceRange, } from './types';
+export { analyzeBash } from './analyze';
+export { DYNAMIC_VALUE } from './values';
+export { hasBypass, isSafePathTarget, safeScopesSummary };

package/dist/types/lib/bash/pipeline-inputs.d.ts

@@ -0,0 +1,10 @@
+import type { Node } from 'unbash';
+import type { ExecutionCarriers } from './carriers';
+import type { ExecutionContext, ExecutionHost } from './execution-types';
+import type { Environment } from './values';
+declare class PipelineInputInspector {
+    #private;
+    constructor(host: ExecutionHost, carriers: ExecutionCarriers);
+    inspect(commands: readonly Node[], environment: Environment, context: ExecutionContext): ReadonlySet<number>;
+}
+export { PipelineInputInspector };

package/dist/types/lib/bash/static-command.d.ts

@@ -0,0 +1,9 @@
+import type { Command } from 'unbash';
+import type { ShellWord, SourceRange } from './types';
+declare const rangeOf: (node: {
+    readonly pos: number;
+    readonly end: number;
+}) => SourceRange;
+declare const basename: (value: string) => string;
+declare const staticCommandWords: (command: Command) => ShellWord[] | null;
+export { basename, rangeOf, staticCommandWords };

package/dist/types/lib/bash/types.d.ts

@@ -0,0 +1,64 @@
+import type { ExecutionCarrierAlias } from './config';
+interface SourceRange {
+    readonly start: number;
+    readonly end: number;
+}
+type ShellWordKind = 'literal' | 'dynamic' | 'trusted-temp-path' | 'background-pid';
+interface BashAnalysisOptions {
+    readonly cwd?: string;
+    readonly executionCarrierAliases?: readonly ExecutionCarrierAlias[];
+    readonly positionalArguments?: readonly string[];
+}
+interface ShellWord {
+    /** Raw shell source for this word. */
+    readonly source: string;
+    /** Dequoted policy value. Dynamic values use a fail-closed sentinel. */
+    readonly value: string;
+    readonly kind: ShellWordKind;
+    readonly range: SourceRange;
+    readonly quoted: boolean;
+    readonly variable?: string;
+}
+interface ShellRedirect {
+    /** Source bytes for a heredoc; never execute these bytes during inspection. */
+    readonly heredoc?: {
+        readonly content: string;
+        readonly quoted: boolean;
+    };
+    readonly op: '>' | '>>' | '<' | '<<' | '<<<' | '<>' | '>&' | '<&' | '&>' | '&>>';
+    readonly target: ShellWord;
+    readonly range: SourceRange;
+}
+interface PipelinePosition {
+    readonly id: number;
+    readonly index: number;
+}
+interface ShellInvocation {
+    readonly id: number;
+    readonly head: string;
+    readonly words: readonly ShellWord[];
+    readonly tokens: readonly string[];
+    readonly args: readonly string[];
+    readonly flags: readonly string[];
+    readonly redirects: readonly ShellRedirect[];
+    readonly raw: string;
+    readonly range: SourceRange;
+    readonly pipeline: PipelinePosition | undefined;
+    readonly synthetic: boolean;
+}
+type ShellDiagnosticKind = 'parse-error' | 'dynamic-executable' | 'dynamic-shell-source' | 'eval' | 'function' | 'alias';
+interface ShellDiagnostic {
+    readonly kind: ShellDiagnosticKind;
+    readonly message: string;
+    readonly range: SourceRange;
+}
+interface ShellProgram {
+    readonly environmentAssignments?: readonly string[];
+    readonly source: string;
+    readonly invocations: readonly ShellInvocation[];
+    readonly redirects: readonly ShellRedirect[];
+    readonly diagnostics: readonly ShellDiagnostic[];
+    readonly hasBypass: boolean;
+}
+export type { BashAnalysisOptions, PipelinePosition, ShellDiagnostic, ShellDiagnosticKind, ShellInvocation, ShellProgram, ShellRedirect, ShellWord, ShellWordKind, SourceRange, };
+export type { ExecutionCarrierAlias, ExecutionCarrierKind } from './config';

package/dist/types/lib/bash/values.d.ts

@@ -0,0 +1,25 @@
+import type { Function as BashFunction, Word, WordPart } from 'unbash';
+import type { ShellWord } from './types';
+declare const DYNAMIC_VALUE = "__tripwire_dynamic_shell_value__";
+declare const BACKGROUND_PID_VALUE = "__tripwire_background_pid__";
+interface TrustedTempValue {
+    readonly variable: string;
+}
+interface Environment {
+    readonly aliases: Map<string, string>;
+    backgroundPidAvailable: boolean;
+    readonly bindings: Map<string, ShellWord>;
+    readonly functions: Map<string, BashFunction>;
+    readonly temps: Map<string, TrustedTempValue>;
+}
+declare const emptyEnvironment: () => Environment;
+declare const cloneEnvironment: (environment: Environment) => Environment;
+declare const isQuotedPart: (part: WordPart) => boolean;
+declare const wordIsStatic: (word: Word) => boolean;
+declare const staticGeneratedValue: (word: Word, environment: Environment) => string | null;
+declare const isTrustedMktemp: (word: Word, environment: Environment) => boolean;
+declare const trustedTempWord: (word: Word, environment: Environment) => ShellWord | null;
+declare const boundWord: (word: Word, environment: Environment) => ShellWord | null;
+declare const backgroundPidWord: (word: Word, environment: Environment) => ShellWord | null;
+export { DYNAMIC_VALUE, BACKGROUND_PID_VALUE, backgroundPidWord, boundWord, cloneEnvironment, emptyEnvironment, isQuotedPart, isTrustedMktemp, staticGeneratedValue, trustedTempWord, wordIsStatic, };
+export type { Environment };

package/dist/types/lib/bash/wrappers.d.ts

@@ -0,0 +1,21 @@
+import type { ShellInvocation, ShellWord } from './types';
+declare const SHELL_WRAPPER_HEADS: ReadonlySet<string>;
+declare const HEAD_RENAMING_HEADS: ReadonlySet<string>;
+declare const skipOptions: (words: readonly ShellWord[], start: number, valueFlags: ReadonlySet<string>) => number;
+declare const skipHeadRenamingPrefix: (invocation: ShellInvocation) => number;
+declare const commandFlagValueIndex: (words: readonly ShellWord[], flag: string) => number | null;
+declare const namedFlagValueIndex: (words: readonly ShellWord[], flags: ReadonlySet<string>, start?: number) => number | null;
+declare const pickExecRoot: (words: readonly ShellWord[], execFlagIndex: number, kind: 'fd' | 'find') => ShellWord;
+declare const FD_EXEC_FLAGS: ReadonlySet<string>;
+declare const FD_PLACEHOLDERS: ReadonlySet<string>;
+declare const FIND_EXEC_FLAGS: ReadonlySet<string>;
+declare const FIND_PLACEHOLDERS: ReadonlySet<string>;
+declare const RTK_WRAPPER_SUBCOMMANDS: ReadonlySet<string>;
+interface PrefixWrapper {
+    readonly valueFlags: ReadonlySet<string>;
+    readonly skipPositionals: number;
+    readonly shellFlag: boolean;
+}
+declare const PREFIX_WRAPPERS: Readonly<Record<string, PrefixWrapper>>;
+export type { PrefixWrapper };
+export { FD_EXEC_FLAGS, FD_PLACEHOLDERS, FIND_EXEC_FLAGS, FIND_PLACEHOLDERS, HEAD_RENAMING_HEADS, PREFIX_WRAPPERS, RTK_WRAPPER_SUBCOMMANDS, SHELL_WRAPPER_HEADS, commandFlagValueIndex, namedFlagValueIndex, pickExecRoot, skipHeadRenamingPrefix, skipOptions, };

package/dist/types/lib/code/analyze.d.ts

@@ -0,0 +1,3 @@
+import type { CodeLanguage, CodeReport } from './types';
+declare const analyzeCode: (language: CodeLanguage, source: string) => CodeReport;
+export { analyzeCode };

package/dist/types/lib/code/calls.d.ts

@@ -0,0 +1,8 @@
+import type { CodeLanguage, CodeOperation, CodeRange, Value } from './types';
+interface CallContext {
+    readonly language: CodeLanguage;
+    readonly range: CodeRange;
+    readonly operations: CodeOperation[];
+}
+declare const resolveCall: (fn: Value, args: readonly Value[], context: CallContext) => Value;
+export { resolveCall };

package/dist/types/lib/code/carriers.d.ts

@@ -0,0 +1,18 @@
+import type { ShellInvocation } from '../bash';
+import type { CodeLanguage } from './types';
+type CodeInput = {
+    readonly kind: 'source';
+    readonly language: CodeLanguage;
+    readonly source: string;
+} | {
+    readonly kind: 'command';
+    readonly argv: readonly string[];
+} | {
+    readonly kind: 'blocked';
+    readonly reason: string;
+} | {
+    readonly kind: 'irrelevant';
+};
+declare const interpreterLanguage: (head: string) => CodeLanguage | null;
+declare const interpreterInput: (invocation: ShellInvocation) => CodeInput;
+export { interpreterInput, interpreterLanguage };

package/dist/types/lib/code/containers.d.ts

@@ -0,0 +1,4 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { Value } from './types';
+declare const containerValue: (node: SyntaxNode, evaluate: (node: SyntaxNode) => Value, text: (node: SyntaxNode) => string) => Value | null;
+export { containerValue };

package/dist/types/lib/code/control.d.ts

@@ -0,0 +1,13 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { Value } from './types';
+interface ControlContext {
+    readonly bindings: Map<string, Value>;
+    readonly text: (node: SyntaxNode) => string;
+    readonly evaluate: (node: SyntaxNode) => Value;
+    readonly statement: (node: SyntaxNode) => void;
+}
+declare const inspectBranches: (node: SyntaxNode, context: ControlContext) => void;
+declare const inspectLoop: (node: SyntaxNode, context: ControlContext) => void;
+declare const inspectComprehension: (parts: readonly SyntaxNode[], context: ControlContext) => Value;
+export { inspectBranches, inspectComprehension, inspectLoop };
+export type { ControlContext };

package/dist/types/lib/code/data.d.ts

@@ -0,0 +1,9 @@
+import type { CodeLanguage, Value } from './types';
+declare const data: Value;
+declare const fileText: (path: string) => Value;
+declare const isData: (value: Value) => boolean;
+declare const requireData: (values: readonly Value[]) => void;
+declare const writeKind: (target: string, value: Value | undefined) => 'write' | 'truncate';
+declare const dataMethod: (receiver: Value, name: string, args: readonly Value[], language: CodeLanguage) => Value;
+declare const dataCall: (name: string, args: readonly Value[]) => Value | null;
+export { data, dataCall, dataMethod, fileText, isData, requireData, writeKind };

package/dist/types/lib/code/imports.d.ts

@@ -0,0 +1,5 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { CodeLanguage, Value } from './types';
+declare const pythonImport: (parts: readonly SyntaxNode[], text: (node: SyntaxNode) => string) => ReadonlyMap<string, Value>;
+declare const javascriptImport: (parts: readonly SyntaxNode[], text: (node: SyntaxNode) => string, language: CodeLanguage) => ReadonlyMap<string, Value>;
+export { javascriptImport, pythonImport };

package/dist/types/lib/code/members.d.ts

@@ -0,0 +1,4 @@
+import type { CodeLanguage, Value } from './types';
+declare const indexedValue: (value: Value, key: Value) => Value;
+declare const namedMember: (value: Value, member: string, language: CodeLanguage) => Value;
+export { indexedValue, namedMember };

package/dist/types/lib/code/syntax.d.ts

@@ -0,0 +1,10 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { CodeLanguage } from './types';
+declare class CodeInspectionError extends Error {
+    name: string;
+}
+declare const failInspection: (message: string) => never;
+declare const children: (node: SyntaxNode) => SyntaxNode[];
+declare const parseCode: (language: CodeLanguage, source: string) => SyntaxNode;
+declare const stringLiteral: (text: string, language?: CodeLanguage) => string;
+export { CodeInspectionError, children, failInspection, parseCode, stringLiteral };

package/dist/types/lib/code/types.d.ts

@@ -0,0 +1,51 @@
+type CodeLanguage = 'python' | 'javascript' | 'typescript';
+interface CodeRange {
+    readonly start: number;
+    readonly end: number;
+}
+type CodeOperation = {
+    readonly kind: 'read' | 'write' | 'delete' | 'truncate';
+    readonly path: string;
+    readonly range: CodeRange;
+} | {
+    readonly kind: 'process';
+    readonly argv: readonly string[];
+    readonly range: CodeRange;
+};
+interface CodeReport {
+    readonly operations: readonly CodeOperation[];
+    /** Any gap blocks authorization, including parser recovery and budget exhaustion. */
+    readonly gap: string | null;
+}
+type Value = {
+    readonly kind: 'data';
+} | {
+    readonly kind: 'text';
+    readonly path: string | null;
+    readonly preservesNonempty: boolean;
+} | {
+    readonly kind: 'string';
+    readonly value: string;
+} | {
+    readonly kind: 'number';
+    readonly value: number;
+} | {
+    readonly kind: 'symbol';
+    readonly name: string;
+} | {
+    readonly kind: 'path' | 'file';
+    readonly path: string;
+} | {
+    readonly kind: 'method';
+    readonly receiver: Value;
+    readonly name: string;
+} | {
+    readonly kind: 'list';
+    readonly items: readonly Value[];
+} | {
+    readonly kind: 'object';
+    readonly entries: ReadonlyMap<string, Value>;
+} | {
+    readonly kind: 'unknown';
+};
+export type { CodeLanguage, CodeOperation, CodeRange, CodeReport, Value };

package/dist/types/lib/code/uv.d.ts

@@ -0,0 +1,13 @@
+import type { ShellInvocation } from '../bash';
+type UvInvocation = {
+    readonly kind: 'command';
+    readonly argv: readonly string[];
+    readonly noSync: boolean;
+} | {
+    readonly kind: 'blocked';
+    readonly reason: string;
+} | {
+    readonly kind: 'irrelevant';
+};
+declare const uvInvocation: (invocation: ShellInvocation) => UvInvocation;
+export { uvInvocation };

package/dist/types/lib/code/values.d.ts

@@ -0,0 +1,9 @@
+import type { CodeLanguage, Value } from './types';
+declare const unknown: Value;
+declare const symbol: (name: string) => Value;
+declare const textValue: (value: string) => Value;
+declare const valueString: (value: Value | undefined) => string;
+declare const initialBindings: (language: CodeLanguage) => Map<string, Value>;
+declare const moduleName: (name: string, language: CodeLanguage) => string;
+declare const pythonJoin: (parts: readonly string[]) => string;
+export { initialBindings, moduleName, pythonJoin, symbol, textValue, unknown, valueString };

package/dist/types/lib/config.d.ts

@@ -1,4 +1,6 @@
 import { Effect, Schema } from 'effect';
+import { type ExecutionCarrierAlias } from './bash/config';
+import { type RuleActions } from './rule-actions';
 declare const BlockRuleSchema: Schema.Struct<{
     readonly pattern: Schema.String;
     readonly message: Schema.String;
@@ -72,10 +74,35 @@ declare const ConfigSchema: Schema.Struct<{
             readonly values: Schema.$Array<Schema.String>;
         }>>>;
     }>>>;
+    readonly ruleActions: Schema.optional<Schema.Struct<{
+        readonly 'brew-mutation': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'chmod-777-recursive': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'defaults-write': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'dscl-mutate': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'launchctl-mutation': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'mas-mutation': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'no-gpg-sign': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'no-verify': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly osascript: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'pmset-write': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'rsync-delete': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'scutil-set': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'security-keychain-add-write': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly 'softwareupdate-install': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly sudo: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly systemsetup: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+        readonly topgrade: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    }>>;
     readonly secretScanner: Schema.optional<Schema.Struct<{
         readonly executable: Schema.String;
         readonly timeoutMs: Schema.Finite;
     }>>;
+    readonly shell: Schema.optional<Schema.Struct<{
+        readonly executionCarrierAliases: Schema.optional<Schema.$Array<Schema.Struct<{
+            readonly command: Schema.$Array<Schema.NonEmptyString>;
+            readonly equivalentTo: Schema.Literal<"ssh">;
+        }>>>;
+    }>>;
 }>;
 declare const CONFIG_PATH: string;
 declare const getDefaultConfig: () => ResolvedConfig;
@@ -94,6 +121,7 @@ export type GitConfig = typeof GitConfigSchema.Type;
 export type SafePathsConfig = typeof SafePathsConfigSchema.Type;
 export type ToolPolicy = typeof ToolPolicySchema.Type;
 export type SecretScannerConfig = typeof SecretScannerConfigSchema.Type;
+export type { ExecutionCarrierAlias, ShellConfig } from './bash/config';
 export type Config = typeof ConfigSchema.Type;
 export interface ResolvedConfig {
     readonly git: {
@@ -104,7 +132,11 @@ export interface ResolvedConfig {
     readonly toolPolicies: readonly ToolPolicy[];
     readonly blockedCommands: readonly BlockRule[];
     readonly allowedCommands: readonly BlockRule[];
+    readonly ruleActions: RuleActions;
     readonly secretScanner: SecretScannerConfig;
+    readonly shell: {
+        readonly executionCarrierAliases: readonly ExecutionCarrierAlias[];
+    };
 }
 export type { ConfigLoad };
 export { CONFIG_PATH, ConfigSchema, SecretScannerConfigSchema, getDefaultConfig, mergeWithDefaults, };

package/dist/types/lib/event.d.ts

@@ -37,9 +37,15 @@ interface ReadResponse {
     };
 }
 declare const isBashInput: (x: unknown) => x is BashInput;
+declare const decodeCodeInput: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Option").Option<string | {
+    readonly code: string;
+}>;
+declare const decodeExecInput: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Option").Option<{
+    readonly cmd: string;
+}>;
 declare const isEditInput: (x: unknown) => x is EditInput;
 declare const isWriteInput: (x: unknown) => x is WriteInput;
 declare const isReadInput: (x: unknown) => x is ReadInput;
 declare const extractResponseText: (toolName: string, response: unknown) => string;
 export type { BashInput, BashResponse, EditInput, HookEventType as HookEvent, ReadInput, ReadResponse, WriteInput, };
-export { HookEvent as HookEventSchema, extractResponseText, isBashInput, isEditInput, isReadInput, isWriteInput, };
+export { HookEvent as HookEventSchema, extractResponseText, isBashInput, isEditInput, isReadInput, isWriteInput, decodeCodeInput, decodeExecInput, };

package/dist/types/lib/rule-actions.d.ts

@@ -0,0 +1,27 @@
+import { Schema } from 'effect';
+import { type Decision } from './decision';
+declare const RuleActionSchema: Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>;
+declare const RuleActionsSchema: Schema.Struct<{
+    readonly 'brew-mutation': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'chmod-777-recursive': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'defaults-write': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'dscl-mutate': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'launchctl-mutation': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'mas-mutation': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'no-gpg-sign': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'no-verify': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly osascript: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'pmset-write': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'rsync-delete': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'scutil-set': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'security-keychain-add-write': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly 'softwareupdate-install': Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly sudo: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly systemsetup: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+    readonly topgrade: Schema.optional<Schema.Literals<readonly ["allow", "warn", "ask", "deny"]>>;
+}>;
+type RuleAction = typeof RuleActionSchema.Type;
+type RuleActions = typeof RuleActionsSchema.Type;
+declare const applyRuleAction: (decision: Decision, actions: RuleActions) => Decision;
+export type { RuleAction, RuleActions };
+export { applyRuleAction, RuleActionSchema, RuleActionsSchema };

package/dist/types/rules/bash-bypass.d.ts

@@ -0,0 +1,5 @@
+import type { ShellProgram } from '../lib/bash';
+import { type Decision } from '../lib/decision';
+declare const NON_BYPASSABLE_RULES: ReadonlySet<string>;
+declare const applyShellBypass: (program: ShellProgram, decision: Decision) => Decision;
+export { applyShellBypass, NON_BYPASSABLE_RULES };

package/dist/types/rules/bash-deny.d.ts

@@ -1,5 +1,5 @@
-import { type Segment } from '../lib/bash';
+import type { ShellProgram } from '../lib/bash';
 import { type Decision } from '../lib/decision';
-declare const UNBYPASSABLE_RULES: ReadonlySet<string>;
-declare const bashDeny: (segments: readonly Segment[], cmd: string) => Decision;
-export { bashDeny, UNBYPASSABLE_RULES };
+import { type RuleActions } from '../lib/rule-actions';
+declare const bashDeny: (program: ShellProgram, ruleActions?: RuleActions) => Decision;
+export { bashDeny };

package/dist/types/rules/bash-git.d.ts

@@ -1,5 +1,5 @@
-import { type Segment } from '../lib/bash';
+import type { ShellProgram } from '../lib/bash';
 import type { GitConfig } from '../lib/config';
 import { type Decision } from '../lib/decision';
-declare const bashGit: (segments: readonly Segment[], cmd: string, config: GitConfig) => Decision;
+declare const bashGit: (program: ShellProgram, config: GitConfig) => Decision;
 export { bashGit };

package/dist/types/rules/bash-network-install.d.ts

@@ -1,4 +1,4 @@
-import { type Segment } from '../lib/bash';
+import type { ShellProgram } from '../lib/bash';
 import { type Decision } from '../lib/decision';
-declare const bashNetworkInstall: (segments: readonly Segment[], cmd: string) => Decision;
+declare const bashNetworkInstall: (program: ShellProgram) => Decision;
 export { bashNetworkInstall };

package/dist/types/rules/bash-redirect.d.ts

@@ -1,4 +1,4 @@
-import { type Segment } from '../lib/bash';
+import type { ShellProgram } from '../lib/bash';
 import { type Decision } from '../lib/decision';
-declare const bashRedirect: (segments: readonly Segment[], cmd: string) => Decision;
+declare const bashRedirect: (program: ShellProgram) => Decision;
 export { bashRedirect };

package/dist/types/rules/bash-scoped-rm.d.ts

@@ -1,5 +1,5 @@
-import { type Segment } from '../lib/bash';
+import { type ShellProgram } from '../lib/bash';
 import type { SafePathsConfig } from '../lib/config';
 import { type Decision } from '../lib/decision';
-declare const bashScopedRm: (segments: readonly Segment[], cmd: string, config: SafePathsConfig) => Decision;
+declare const bashScopedRm: (program: ShellProgram, config: SafePathsConfig) => Decision;
 export { bashScopedRm };

package/dist/types/rules/bash-tar-explosion.d.ts

@@ -1,4 +1,4 @@
-import { type Segment } from '../lib/bash';
+import type { ShellProgram } from '../lib/bash';
 import { type Decision } from '../lib/decision';
-declare const bashTarExplosion: (segments: readonly Segment[], cmd: string) => Decision;
+declare const bashTarExplosion: (program: ShellProgram) => Decision;
 export { bashTarExplosion };

package/dist/types/rules/config-custom.d.ts

@@ -1,6 +1,6 @@
-import { type Segment } from '../lib/bash';
+import { type ShellProgram } from '../lib/bash';
 import type { BlockRule } from '../lib/config';
 import { type Decision } from '../lib/decision';
-declare const matchPattern: (segments: readonly Segment[], rule: BlockRule) => boolean;
-export declare const configCustom: (segments: readonly Segment[], cmd: string, blockedCommands: readonly BlockRule[], allowedCommands: readonly BlockRule[]) => Decision;
+declare const matchPattern: (program: ShellProgram, rule: BlockRule) => boolean;
+export declare const configCustom: (program: ShellProgram, blockedCommands: readonly BlockRule[], allowedCommands: readonly BlockRule[]) => Decision;
 export { matchPattern };

package/dist/types/rules/embedded-code.d.ts

@@ -0,0 +1,15 @@
+import { type ShellProgram } from '../lib/bash';
+import type { CodeLanguage } from '../lib/code/types';
+import type { SafePathsConfig } from '../lib/config';
+import { type Decision } from '../lib/decision';
+interface CodePolicy {
+    readonly safePaths: SafePathsConfig;
+    readonly cwd: string;
+    readonly inspectCommand: (command: string) => Decision;
+    readonly remoteHeads: ReadonlySet<string>;
+}
+declare const codeDeny: (message: string) => Decision;
+declare const inspectCode: (language: CodeLanguage, source: string, policy: CodePolicy) => Decision;
+declare const embeddedCode: (program: ShellProgram, policy: CodePolicy) => Decision;
+export { codeDeny, embeddedCode, inspectCode };
+export type { CodePolicy };

package/dist/types/rules/tool-policy.d.ts

@@ -1,5 +1,5 @@
-import { type Segment } from '../lib/bash';
+import type { ShellProgram } from '../lib/bash';
 import type { ToolPolicy } from '../lib/config';
 import { type Decision } from '../lib/decision';
-declare const toolPolicy: (segments: readonly Segment[], command: string, policies: readonly ToolPolicy[]) => Decision;
+declare const toolPolicy: (program: ShellProgram, policies: readonly ToolPolicy[]) => Decision;
 export { toolPolicy };