@seanmozeik/tripwire 0.8.0 → 0.9.0

package/dist/types/lib/bash/types.d.ts

@@ -20,6 +20,11 @@ interface ShellWord {
     readonly variable?: string;
 }
 interface ShellRedirect {
+    /** Source bytes for a heredoc; never execute these bytes during inspection. */
+    readonly heredoc?: {
+        readonly content: string;
+        readonly quoted: boolean;
+    };
     readonly op: '>' | '>>' | '<' | '<<' | '<<<' | '<>' | '>&' | '<&' | '&>' | '&>>';
     readonly target: ShellWord;
     readonly range: SourceRange;
@@ -48,6 +53,7 @@ interface ShellDiagnostic {
     readonly range: SourceRange;
 }
 interface ShellProgram {
+    readonly environmentAssignments?: readonly string[];
     readonly source: string;
     readonly invocations: readonly ShellInvocation[];
     readonly redirects: readonly ShellRedirect[];

package/dist/types/lib/code/analyze.d.ts

@@ -0,0 +1,3 @@
+import type { CodeLanguage, CodeReport } from './types';
+declare const analyzeCode: (language: CodeLanguage, source: string) => CodeReport;
+export { analyzeCode };

package/dist/types/lib/code/calls.d.ts

@@ -0,0 +1,8 @@
+import type { CodeLanguage, CodeOperation, CodeRange, Value } from './types';
+interface CallContext {
+    readonly language: CodeLanguage;
+    readonly range: CodeRange;
+    readonly operations: CodeOperation[];
+}
+declare const resolveCall: (fn: Value, args: readonly Value[], context: CallContext) => Value;
+export { resolveCall };

package/dist/types/lib/code/carriers.d.ts

@@ -0,0 +1,18 @@
+import type { ShellInvocation } from '../bash';
+import type { CodeLanguage } from './types';
+type CodeInput = {
+    readonly kind: 'source';
+    readonly language: CodeLanguage;
+    readonly source: string;
+} | {
+    readonly kind: 'command';
+    readonly argv: readonly string[];
+} | {
+    readonly kind: 'blocked';
+    readonly reason: string;
+} | {
+    readonly kind: 'irrelevant';
+};
+declare const interpreterLanguage: (head: string) => CodeLanguage | null;
+declare const interpreterInput: (invocation: ShellInvocation) => CodeInput;
+export { interpreterInput, interpreterLanguage };

package/dist/types/lib/code/containers.d.ts

@@ -0,0 +1,4 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { Value } from './types';
+declare const containerValue: (node: SyntaxNode, evaluate: (node: SyntaxNode) => Value, text: (node: SyntaxNode) => string) => Value | null;
+export { containerValue };

package/dist/types/lib/code/control.d.ts

@@ -0,0 +1,13 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { Value } from './types';
+interface ControlContext {
+    readonly bindings: Map<string, Value>;
+    readonly text: (node: SyntaxNode) => string;
+    readonly evaluate: (node: SyntaxNode) => Value;
+    readonly statement: (node: SyntaxNode) => void;
+}
+declare const inspectBranches: (node: SyntaxNode, context: ControlContext) => void;
+declare const inspectLoop: (node: SyntaxNode, context: ControlContext) => void;
+declare const inspectComprehension: (parts: readonly SyntaxNode[], context: ControlContext) => Value;
+export { inspectBranches, inspectComprehension, inspectLoop };
+export type { ControlContext };

package/dist/types/lib/code/data.d.ts

@@ -0,0 +1,9 @@
+import type { CodeLanguage, Value } from './types';
+declare const data: Value;
+declare const fileText: (path: string) => Value;
+declare const isData: (value: Value) => boolean;
+declare const requireData: (values: readonly Value[]) => void;
+declare const writeKind: (target: string, value: Value | undefined) => 'write' | 'truncate';
+declare const dataMethod: (receiver: Value, name: string, args: readonly Value[], language: CodeLanguage) => Value;
+declare const dataCall: (name: string, args: readonly Value[]) => Value | null;
+export { data, dataCall, dataMethod, fileText, isData, requireData, writeKind };

package/dist/types/lib/code/imports.d.ts

@@ -0,0 +1,5 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { CodeLanguage, Value } from './types';
+declare const pythonImport: (parts: readonly SyntaxNode[], text: (node: SyntaxNode) => string) => ReadonlyMap<string, Value>;
+declare const javascriptImport: (parts: readonly SyntaxNode[], text: (node: SyntaxNode) => string, language: CodeLanguage) => ReadonlyMap<string, Value>;
+export { javascriptImport, pythonImport };

package/dist/types/lib/code/members.d.ts

@@ -0,0 +1,4 @@
+import type { CodeLanguage, Value } from './types';
+declare const indexedValue: (value: Value, key: Value) => Value;
+declare const namedMember: (value: Value, member: string, language: CodeLanguage) => Value;
+export { indexedValue, namedMember };

package/dist/types/lib/code/syntax.d.ts

@@ -0,0 +1,10 @@
+import type { SyntaxNode } from '@lezer/common';
+import type { CodeLanguage } from './types';
+declare class CodeInspectionError extends Error {
+    name: string;
+}
+declare const failInspection: (message: string) => never;
+declare const children: (node: SyntaxNode) => SyntaxNode[];
+declare const parseCode: (language: CodeLanguage, source: string) => SyntaxNode;
+declare const stringLiteral: (text: string, language?: CodeLanguage) => string;
+export { CodeInspectionError, children, failInspection, parseCode, stringLiteral };

package/dist/types/lib/code/types.d.ts

@@ -0,0 +1,51 @@
+type CodeLanguage = 'python' | 'javascript' | 'typescript';
+interface CodeRange {
+    readonly start: number;
+    readonly end: number;
+}
+type CodeOperation = {
+    readonly kind: 'read' | 'write' | 'delete' | 'truncate';
+    readonly path: string;
+    readonly range: CodeRange;
+} | {
+    readonly kind: 'process';
+    readonly argv: readonly string[];
+    readonly range: CodeRange;
+};
+interface CodeReport {
+    readonly operations: readonly CodeOperation[];
+    /** Any gap blocks authorization, including parser recovery and budget exhaustion. */
+    readonly gap: string | null;
+}
+type Value = {
+    readonly kind: 'data';
+} | {
+    readonly kind: 'text';
+    readonly path: string | null;
+    readonly preservesNonempty: boolean;
+} | {
+    readonly kind: 'string';
+    readonly value: string;
+} | {
+    readonly kind: 'number';
+    readonly value: number;
+} | {
+    readonly kind: 'symbol';
+    readonly name: string;
+} | {
+    readonly kind: 'path' | 'file';
+    readonly path: string;
+} | {
+    readonly kind: 'method';
+    readonly receiver: Value;
+    readonly name: string;
+} | {
+    readonly kind: 'list';
+    readonly items: readonly Value[];
+} | {
+    readonly kind: 'object';
+    readonly entries: ReadonlyMap<string, Value>;
+} | {
+    readonly kind: 'unknown';
+};
+export type { CodeLanguage, CodeOperation, CodeRange, CodeReport, Value };

package/dist/types/lib/code/uv.d.ts

@@ -0,0 +1,13 @@
+import type { ShellInvocation } from '../bash';
+type UvInvocation = {
+    readonly kind: 'command';
+    readonly argv: readonly string[];
+    readonly noSync: boolean;
+} | {
+    readonly kind: 'blocked';
+    readonly reason: string;
+} | {
+    readonly kind: 'irrelevant';
+};
+declare const uvInvocation: (invocation: ShellInvocation) => UvInvocation;
+export { uvInvocation };

package/dist/types/lib/code/values.d.ts

@@ -0,0 +1,9 @@
+import type { CodeLanguage, Value } from './types';
+declare const unknown: Value;
+declare const symbol: (name: string) => Value;
+declare const textValue: (value: string) => Value;
+declare const valueString: (value: Value | undefined) => string;
+declare const initialBindings: (language: CodeLanguage) => Map<string, Value>;
+declare const moduleName: (name: string, language: CodeLanguage) => string;
+declare const pythonJoin: (parts: readonly string[]) => string;
+export { initialBindings, moduleName, pythonJoin, symbol, textValue, unknown, valueString };

package/dist/types/lib/event.d.ts

@@ -37,9 +37,15 @@ interface ReadResponse {
     };
 }
 declare const isBashInput: (x: unknown) => x is BashInput;
+declare const decodeCodeInput: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Option").Option<string | {
+    readonly code: string;
+}>;
+declare const decodeExecInput: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Option").Option<{
+    readonly cmd: string;
+}>;
 declare const isEditInput: (x: unknown) => x is EditInput;
 declare const isWriteInput: (x: unknown) => x is WriteInput;
 declare const isReadInput: (x: unknown) => x is ReadInput;
 declare const extractResponseText: (toolName: string, response: unknown) => string;
 export type { BashInput, BashResponse, EditInput, HookEventType as HookEvent, ReadInput, ReadResponse, WriteInput, };
-export { HookEvent as HookEventSchema, extractResponseText, isBashInput, isEditInput, isReadInput, isWriteInput, };
+export { HookEvent as HookEventSchema, extractResponseText, isBashInput, isEditInput, isReadInput, isWriteInput, decodeCodeInput, decodeExecInput, };

package/dist/types/rules/embedded-code.d.ts

@@ -0,0 +1,15 @@
+import { type ShellProgram } from '../lib/bash';
+import type { CodeLanguage } from '../lib/code/types';
+import type { SafePathsConfig } from '../lib/config';
+import { type Decision } from '../lib/decision';
+interface CodePolicy {
+    readonly safePaths: SafePathsConfig;
+    readonly cwd: string;
+    readonly inspectCommand: (command: string) => Decision;
+    readonly remoteHeads: ReadonlySet<string>;
+}
+declare const codeDeny: (message: string) => Decision;
+declare const inspectCode: (language: CodeLanguage, source: string, policy: CodePolicy) => Decision;
+declare const embeddedCode: (program: ShellProgram, policy: CodePolicy) => Decision;
+export { codeDeny, embeddedCode, inspectCode };
+export type { CodePolicy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanmozeik/tripwire",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Configurable safety hooks for Claude Code, Codex, Cursor, Pi, and Oh My Pi",
   "keywords": [
     "ai-agents",
@@ -60,16 +60,19 @@
     "verify": "bun run format:check && bun run lint && bun run typecheck && bun test && bun run build"
   },
   "dependencies": {
-    "unbash": "4.0.10"
+    "@lezer/common": "1.5.2",
+    "@lezer/javascript": "1.5.4",
+    "@lezer/python": "1.1.19",
+    "unbash": "4.0.11"
   },
   "devDependencies": {
     "@effect/platform-bun": "4.0.0-rc.112",
-    "@effect/tsgo": "0.38.0",
+    "@effect/tsgo": "0.45.0",
     "@seanmozeik/de-clank": "0.1.8",
-    "bun-types": "1.4.0",
+    "bun-types": "1.4.2",
     "effect": "4.0.0-rc.112",
-    "oxfmt": "0.65.0",
-    "oxlint": "1.80.0",
+    "oxfmt": "0.67.0",
+    "oxlint": "1.82.0",
     "oxlint-tsgolint": "7.0.2001",
     "typescript": "7.0.2"
   },
@@ -78,7 +81,7 @@
     "effect": "4.0.0-rc.112"
   },
   "optionalDependencies": {
-    "@seanmozeik/tripwire-darwin-arm64": "0.8.0"
+    "@seanmozeik/tripwire-darwin-arm64": "0.9.0"
   },
   "engines": {
     "bun": ">=1.4"