@sema-agent/core 5.17.0 → 5.18.0

package/dist/core/memory.d.ts

@@ -94,6 +94,8 @@ export interface NormalizedMemorySpec {
     writeScope: string | null;
     enabled: boolean;
     scopeContract?: "v2";
+    trustedTools?: string[];
+    execIsExternalContent?: boolean;
     scopeOrigins?: Readonly<Record<string, "deployment" | "request">>;
 }
 export type MemorySpecInput = {
@@ -101,6 +103,8 @@ export type MemorySpecInput = {
     writeScope?: string | null;
     enabled?: boolean;
     scopeContract?: "v2";
+    trustedTools?: ReadonlyArray<string>;
+    execIsExternalContent?: boolean;
     scopeOrigins?: Readonly<Record<string, "deployment" | "request">>;
 };
 export declare function normalizeMemorySpec(input: MemorySpecInput | undefined): NormalizedMemorySpec | undefined;

package/dist/core/memory.js

@@ -384,13 +384,26 @@ export function normalizeMemorySpec(input) {
     else {
         writeScope = scopes[scopes.length - 1];
     }
+    const trustedTools = [];
+    const trustedSeen = new Set();
+    for (const t of input.trustedTools ?? []) {
+        const name = typeof t === "string" ? t.trim() : "";
+        if (!name || trustedSeen.has(name))
+            continue;
+        trustedSeen.add(name);
+        trustedTools.push(name);
+    }
+    const contentSafety = {
+        ...(trustedTools.length > 0 ? { trustedTools } : {}),
+        ...(input.execIsExternalContent === true ? { execIsExternalContent: true } : {}),
+    };
     const origins = input.scopeOrigins !== undefined ? { scopeOrigins: input.scopeOrigins } : {};
     if (input.scopeContract === "v2") {
         for (const key of writeScope !== null ? [...scopes, writeScope] : scopes)
             parseScopeKey(key);
-        return { scopes, writeScope, enabled: input.enabled !== false, scopeContract: "v2", ...origins };
+        return { scopes, writeScope, enabled: input.enabled !== false, scopeContract: "v2", ...contentSafety, ...origins };
     }
-    return { scopes, writeScope, enabled: input.enabled !== false, ...origins };
+    return { scopes, writeScope, enabled: input.enabled !== false, ...contentSafety, ...origins };
 }
 export const MAX_MEMORY_BYTES = 100 * 1024;
 export const MEMORY_WRAPPER_TAGS = ["user_memory"];

package/dist/core/permission-rule-consent.d.ts

@@ -0,0 +1,131 @@
+import { type RuleScope, type RuleDot } from "./permission-rule-model.js";
+import type { PermissionRuleStoreProvider } from "./permission-rule-store.js";
+export interface RuleCandidate {
+    rule: string;
+    scope: RuleScope;
+}
+export type RuleApprovalKind = "card" | "import" | "starter";
+export interface RuleApprovalRecord {
+    id: string;
+    principal: string;
+    kind: RuleApprovalKind;
+    state: "pending" | "approved" | "redeemed";
+    candidates: RuleCandidate[];
+    createdAt: string;
+    toolCallId?: string;
+    boundInputHash?: string;
+    rev: number;
+    selectedCandidate?: number;
+    redeemedDots?: Record<number, RuleDot>;
+}
+export interface RuleApprovalRecordStore {
+    get(id: string): Promise<RuleApprovalRecord | undefined>;
+    cas(id: string, expectRev: number, next: RuleApprovalRecord): Promise<boolean>;
+    create(record: RuleApprovalRecord): Promise<void>;
+}
+export interface RuleConsentDeps {
+    provider: PermissionRuleStoreProvider;
+    approvals: RuleApprovalRecordStore;
+    now?: () => Date;
+    newId?: () => string;
+}
+export declare class InMemoryRuleApprovalRecordStore implements RuleApprovalRecordStore {
+    private readonly rows;
+    get(id: string): Promise<RuleApprovalRecord | undefined>;
+    create(record: RuleApprovalRecord): Promise<void>;
+    cas(id: string, expectRev: number, next: RuleApprovalRecord): Promise<boolean>;
+    size(): number;
+}
+export type RuleTicket = string;
+export declare function mintRuleTicket(recordId: string, candidateIndex: number): RuleTicket;
+export declare function prepareCardApproval(opts: {
+    principal: string;
+    toolName: string;
+    command: string;
+    toolCallId?: string;
+    boundInputHash?: string;
+    scope?: RuleScope;
+    deps: RuleConsentDeps;
+}): Promise<{
+    approvalId: string;
+    tickets: RuleTicket[];
+    candidates: RuleCandidate[];
+} | undefined>;
+export declare function confirmRuleApproval(opts: {
+    approvalId: string;
+    principal: string;
+    selectedCandidate?: number;
+    deps: RuleConsentDeps;
+}): Promise<boolean>;
+export type RedeemResult = {
+    status: "redeemed";
+    rule: string;
+    scope: RuleScope;
+    dot: RuleDot;
+    rev: number;
+    alreadyRedeemed: boolean;
+} | {
+    status: "refused";
+    reason: string;
+};
+export declare function redeemRuleTicket(opts: {
+    ticket: RuleTicket;
+    principal: string;
+    deps: RuleConsentDeps;
+}): Promise<RedeemResult>;
+export type ImportedSettingsLayer = "userSettings" | "projectSettings" | "localSettings";
+export interface CcImportLayer {
+    layer: ImportedSettingsLayer;
+    path: string;
+    root: string;
+    readFile: (path: string) => Promise<string | undefined>;
+}
+export interface ImportPreview {
+    candidates: RuleCandidate[];
+    skipped: Array<{
+        rule: string;
+        reason: string;
+    }>;
+    layers: Array<{
+        path: string;
+        layer: ImportedSettingsLayer;
+        found: boolean;
+    }>;
+    uncovered: {
+        flagSettings: "not-imported-v1";
+        policySettings: "not-imported-v1";
+    };
+}
+export interface ImportResult {
+    persisted: RuleCandidate[];
+    deduped: RuleCandidate[];
+    skippedAtRedeem: Array<{
+        rule: string;
+        reason: string;
+    }>;
+    rev: number;
+}
+export declare function prepareCcImport(opts: {
+    layers: CcImportLayer[];
+    principal: string;
+    deps: RuleConsentDeps;
+}): Promise<{
+    preview: ImportPreview;
+    approvalId: string;
+}>;
+export declare const STARTER_RULES: readonly string[];
+export declare function prepareStarterBatch(opts: {
+    principal: string;
+    deps: RuleConsentDeps;
+}): Promise<{
+    preview: RuleCandidate[];
+    approvalId: string;
+}>;
+export declare function redeemRuleBatch(opts: {
+    approvalId: string;
+    principal: string;
+    deps: RuleConsentDeps;
+}): Promise<ImportResult | {
+    status: "refused";
+    reason: string;
+}>;

package/dist/core/permission-rule-consent.js

@@ -0,0 +1,307 @@
+import { parseAllowRuleText, suggestRulesForCommand } from "./permission-rule-model.js";
+import { errText, sameScope, writerOf } from "./permission-rule-store.js";
+export class InMemoryRuleApprovalRecordStore {
+    rows = new Map();
+    async get(id) {
+        const r = this.rows.get(id);
+        return r === undefined ? undefined : structuredClone(r);
+    }
+    async create(record) {
+        if (this.rows.has(record.id))
+            throw new Error(`approval record ${record.id} already exists`);
+        this.rows.set(record.id, structuredClone(record));
+    }
+    async cas(id, expectRev, next) {
+        const cur = this.rows.get(id);
+        if (cur === undefined || cur.rev !== expectRev)
+            return false;
+        this.rows.set(id, structuredClone(next));
+        return true;
+    }
+    size() {
+        return this.rows.size;
+    }
+}
+function nowIso(deps) {
+    return (deps.now?.() ?? new Date()).toISOString();
+}
+function mintId(deps, prefix) {
+    if (deps.newId !== undefined)
+        return deps.newId();
+    return `${prefix}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+}
+function requirePrincipal(principal, entry) {
+    if (typeof principal !== "string" || principal === "") {
+        throw new Error(`${entry} requires a verified principal — refusing to create an approval record without one`);
+    }
+    return principal;
+}
+export function mintRuleTicket(recordId, candidateIndex) {
+    return `rt.${candidateIndex}.${recordId}`;
+}
+function parseRuleTicket(ticket) {
+    const m = /^rt\.(\d+)\.(.+)$/.exec(ticket);
+    if (m === null)
+        return undefined;
+    return { index: Number(m[1]), recordId: m[2] };
+}
+export async function prepareCardApproval(opts) {
+    const principal = requirePrincipal(opts.principal, "prepareCardApproval");
+    if (opts.toolName !== CARD_RULE_TOOL)
+        return undefined;
+    const scope = opts.scope ?? { kind: "global" };
+    const candidates = suggestRulesForCommand(opts.command).map((s) => ({ rule: s.rule, scope }));
+    if (candidates.length === 0)
+        return undefined;
+    const record = {
+        id: mintId(opts.deps, "rar"),
+        principal,
+        kind: "card",
+        state: "pending",
+        rev: 0,
+        candidates,
+        createdAt: nowIso(opts.deps),
+        ...(opts.toolCallId !== undefined ? { toolCallId: opts.toolCallId } : {}),
+        ...(opts.boundInputHash !== undefined ? { boundInputHash: opts.boundInputHash } : {}),
+    };
+    await opts.deps.approvals.create(record);
+    return { approvalId: record.id, tickets: candidates.map((_, i) => mintRuleTicket(record.id, i)), candidates };
+}
+const CARD_RULE_TOOL = "Bash";
+export async function confirmRuleApproval(opts) {
+    const principal = requirePrincipal(opts.principal, "confirmRuleApproval");
+    const rec = await opts.deps.approvals.get(opts.approvalId);
+    if (rec === undefined || rec.principal !== principal)
+        return false;
+    if (rec.kind === "card") {
+        const chosen = opts.selectedCandidate;
+        if (chosen === undefined || !Number.isInteger(chosen) || rec.candidates[chosen] === undefined)
+            return false;
+        if (rec.state === "approved" || rec.state === "redeemed")
+            return rec.selectedCandidate === chosen;
+        return await opts.deps.approvals.cas(rec.id, rec.rev, { ...rec, rev: rec.rev + 1, state: "approved", selectedCandidate: chosen });
+    }
+    if (opts.selectedCandidate !== undefined)
+        return false;
+    if (rec.state === "approved")
+        return true;
+    if (rec.state !== "pending")
+        return false;
+    return await opts.deps.approvals.cas(rec.id, rec.rev, { ...rec, rev: rec.rev + 1, state: "approved" });
+}
+export async function redeemRuleTicket(opts) {
+    const principal = requirePrincipal(opts.principal, "redeemRuleTicket");
+    const parsed = parseRuleTicket(opts.ticket);
+    if (parsed === undefined)
+        return { status: "refused", reason: "malformed ticket" };
+    const rec = await opts.deps.approvals.get(parsed.recordId);
+    if (rec === undefined)
+        return { status: "refused", reason: "no such approval record" };
+    if (rec.principal !== principal)
+        return { status: "refused", reason: "the ticket belongs to a different principal" };
+    if (rec.state === "pending")
+        return { status: "refused", reason: "the approval record has not been confirmed" };
+    const candidate = rec.candidates[parsed.index];
+    if (candidate === undefined)
+        return { status: "refused", reason: "the ticket names no candidate on this record" };
+    if (rec.kind === "card" && rec.selectedCandidate !== parsed.index) {
+        return { status: "refused", reason: "the ticket names an option the person did not choose" };
+    }
+    const parsedRule = parseAllowRuleText(candidate.rule);
+    if ("reject" in parsedRule)
+        return { status: "refused", reason: `${parsedRule.reject.code}: ${parsedRule.reject.message}` };
+    const store = opts.deps.provider.forPrincipal(principal);
+    const writer = writerOf(store);
+    if (writer === undefined)
+        return { status: "refused", reason: "the resolved permission-rule store has no write face" };
+    const known = rec.redeemedDots?.[parsed.index];
+    const dot = known ?? (await writer.nextDot());
+    if (known === undefined) {
+        const next = {
+            ...rec,
+            rev: rec.rev + 1,
+            state: "redeemed",
+            redeemedDots: { ...(rec.redeemedDots ?? {}), [parsed.index]: dot },
+        };
+        const ok = await opts.deps.approvals.cas(rec.id, rec.rev, next);
+        if (!ok) {
+            const again = await opts.deps.approvals.get(rec.id);
+            const theirs = again?.redeemedDots?.[parsed.index];
+            if (theirs === undefined)
+                return { status: "refused", reason: "the approval record changed state concurrently" };
+            return await applyRedemption({ ...opts, principal, candidate, parsedRule: parsedRule.rule, dot: theirs, recordId: rec.id, kind: rec.kind, replay: true });
+        }
+    }
+    return await applyRedemption({ ...opts, principal, candidate, parsedRule: parsedRule.rule, dot, recordId: rec.id, kind: rec.kind, replay: known !== undefined });
+}
+const REDEEM_MAX_ATTEMPTS = 8;
+async function applyRedemption(args) {
+    const store = args.deps.provider.forPrincipal(args.principal);
+    const writer = writerOf(store);
+    if (writer === undefined)
+        return { status: "refused", reason: "the resolved permission-rule store has no write face" };
+    const origin = originOfRecordKind(args.kind);
+    for (let attempt = 0; attempt < REDEEM_MAX_ATTEMPTS; attempt++) {
+        let rev;
+        try {
+            rev = (await store.list()).rev;
+        }
+        catch (err) {
+            return { status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` };
+        }
+        let res;
+        try {
+            res = await writer.apply({
+                kind: "redemption-add",
+                rule: args.parsedRule.rule,
+                scope: args.candidate.scope,
+                tool: args.parsedRule.tool,
+                match: args.parsedRule.match,
+                command: args.parsedRule.command,
+                add: { dot: args.dot, origin, createdAt: nowIso(args.deps) },
+                redemption: { recordId: args.recordId, principal: args.principal },
+            }, { expectedRev: rev });
+        }
+        catch (err) {
+            return { status: "refused", reason: `the permission-rule store refused the write: ${errText(err)}` };
+        }
+        if (!("conflict" in res)) {
+            return { status: "redeemed", rule: args.parsedRule.rule, scope: args.candidate.scope, dot: args.dot, rev: res.rev, alreadyRedeemed: args.replay };
+        }
+    }
+    return { status: "refused", reason: `optimistic-concurrency retries exhausted after ${REDEEM_MAX_ATTEMPTS} attempts` };
+}
+function originOfRecordKind(kind) {
+    return kind === "import" ? "imported-cc" : kind === "starter" ? "starter" : "user";
+}
+const IMPORT_UNCOVERED = { flagSettings: "not-imported-v1", policySettings: "not-imported-v1" };
+export async function prepareCcImport(opts) {
+    const principal = requirePrincipal(opts.principal, "prepareCcImport");
+    const candidates = [];
+    const skipped = [];
+    const layers = [];
+    for (const layer of opts.layers) {
+        let raw;
+        try {
+            raw = await layer.readFile(layer.path);
+        }
+        catch {
+            raw = undefined;
+        }
+        if (raw === undefined) {
+            layers.push({ path: layer.path, layer: layer.layer, found: false });
+            continue;
+        }
+        layers.push({ path: layer.path, layer: layer.layer, found: true });
+        let allow;
+        try {
+            allow = JSON.parse(raw)?.permissions?.allow;
+        }
+        catch (err) {
+            skipped.push({ rule: layer.path, reason: `settings file is not valid JSON (${errText(err)})` });
+            continue;
+        }
+        if (!Array.isArray(allow))
+            continue;
+        const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
+        for (const entry of allow) {
+            if (typeof entry !== "string") {
+                skipped.push({ rule: String(entry), reason: "settings entry is not a string" });
+                continue;
+            }
+            if (!entry.startsWith("Bash("))
+                continue;
+            const parsed = parseAllowRuleText(entry);
+            if ("reject" in parsed) {
+                skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
+                continue;
+            }
+            if (candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
+                continue;
+            candidates.push({ rule: parsed.rule.rule, scope });
+        }
+    }
+    const record = {
+        id: mintId(opts.deps, "rar"),
+        principal,
+        kind: "import",
+        state: "pending",
+        rev: 0,
+        candidates,
+        createdAt: nowIso(opts.deps),
+    };
+    await opts.deps.approvals.create(record);
+    return { preview: { candidates, skipped, layers, uncovered: IMPORT_UNCOVERED }, approvalId: record.id };
+}
+export const STARTER_RULES = [
+    "Bash(ls)",
+    "Bash(ls -la)",
+    "Bash(pwd)",
+    "Bash(whoami)",
+    "Bash(uname -a)",
+    "Bash(date)",
+    "Bash(df -h)",
+    "Bash(node --version)",
+    "Bash(npm --version)",
+];
+export async function prepareStarterBatch(opts) {
+    const principal = requirePrincipal(opts.principal, "prepareStarterBatch");
+    const candidates = [];
+    for (const text of STARTER_RULES) {
+        const parsed = parseAllowRuleText(text);
+        if ("reject" in parsed)
+            throw new Error(`starter rule "${text}" is not a valid rule: ${parsed.reject.message}`);
+        candidates.push({ rule: parsed.rule.rule, scope: { kind: "global" } });
+    }
+    const record = {
+        id: mintId(opts.deps, "rar"),
+        principal,
+        kind: "starter",
+        state: "pending",
+        rev: 0,
+        candidates,
+        createdAt: nowIso(opts.deps),
+    };
+    await opts.deps.approvals.create(record);
+    return { preview: candidates, approvalId: record.id };
+}
+export async function redeemRuleBatch(opts) {
+    const principal = requirePrincipal(opts.principal, "redeemRuleBatch");
+    const rec = await opts.deps.approvals.get(opts.approvalId);
+    if (rec === undefined)
+        return { status: "refused", reason: "no such approval record" };
+    if (rec.principal !== principal)
+        return { status: "refused", reason: "the record belongs to a different principal" };
+    if (rec.kind === "card")
+        return { status: "refused", reason: "a card record is redeemed by its chosen ticket, not as a batch" };
+    if (rec.state === "pending")
+        return { status: "refused", reason: "the approval record has not been confirmed" };
+    const persisted = [];
+    const deduped = [];
+    const skippedAtRedeem = [];
+    let rev = 0;
+    const store = opts.deps.provider.forPrincipal(principal);
+    for (let i = 0; i < rec.candidates.length; i++) {
+        const candidate = rec.candidates[i];
+        let alreadyThere = false;
+        try {
+            const snap = await store.list();
+            rev = snap.rev;
+            alreadyThere = snap.rules.some((r) => r.rule === candidate.rule && sameScope(r.scope, candidate.scope));
+        }
+        catch (err) {
+            return { status: "refused", reason: `could not read the permission-rule store: ${errText(err)}` };
+        }
+        const res = await redeemRuleTicket({ ticket: mintRuleTicket(rec.id, i), principal, deps: opts.deps });
+        if (res.status === "refused") {
+            skippedAtRedeem.push({ rule: candidate.rule, reason: res.reason });
+            continue;
+        }
+        rev = res.rev;
+        if (alreadyThere)
+            deduped.push(candidate);
+        else
+            persisted.push(candidate);
+    }
+    return { persisted, deduped, skippedAtRedeem, rev };
+}

package/dist/core/permission-rule-model.d.ts

@@ -0,0 +1,66 @@
+export type PersistedRuleTool = "Bash";
+export type PersistedRuleMatch = "exact" | "prefix";
+export type RuleScope = {
+    kind: "global";
+} | {
+    kind: "project";
+    root: string;
+};
+export interface RuleDot {
+    actor: string;
+    counter: number;
+}
+export type RuleAddOrigin = "user" | "imported-cc" | "starter";
+export interface RuleAdd {
+    dot: RuleDot;
+    origin: RuleAddOrigin;
+    createdAt: string;
+}
+export interface PersistedAllowRule {
+    rule: string;
+    tool: PersistedRuleTool;
+    match: PersistedRuleMatch;
+    command: string;
+    scope: RuleScope;
+    adds: RuleAdd[];
+}
+export interface RuleTombstone {
+    rule: string;
+    scope: RuleScope;
+    removedDots: RuleDot[];
+    deletedBy: RuleDot;
+}
+export type RuleRejectCode = "invalid.grammar" | "invalid.empty_command" | "invalid.not_simple_command" | "invalid.bare_interpreter_prefix" | "invalid.unbalanced_quotes" | "invalid.too_long" | "unsupported.tool" | "unsupported.wildcard";
+export interface RuleReject {
+    code: RuleRejectCode;
+    message: string;
+}
+export interface ParsedAllowRule {
+    rule: string;
+    tool: PersistedRuleTool;
+    match: PersistedRuleMatch;
+    command: string;
+}
+export declare const MAX_RULE_TEXT_CHARS = 512;
+export declare const BARE_INTERPRETER_NAMES: ReadonlySet<string>;
+export declare function parseAllowRuleText(text: string): {
+    rule: ParsedAllowRule;
+} | {
+    reject: RuleReject;
+};
+export declare function formatAllowRuleText(command: string, match: PersistedRuleMatch): string;
+export declare function ruleAdmitsCommand(rule: Pick<PersistedAllowRule, "match" | "command">, command: string): boolean;
+export declare function pathWithinRoot(path: string, root: string): boolean;
+export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined): boolean;
+export declare function isRuleLive(rule: PersistedAllowRule): boolean;
+export declare function findAdmittingRule(rules: readonly PersistedAllowRule[], call: {
+    tool: string;
+    command: string;
+    cwd: string | undefined;
+}): PersistedAllowRule | undefined;
+export interface RuleSuggestion {
+    rule: string;
+    match: PersistedRuleMatch;
+    command: string;
+}
+export declare function suggestRulesForCommand(command: string): RuleSuggestion[];

package/dist/core/permission-rule-model.js

@@ -0,0 +1,135 @@
+import { parsePermissionRule } from "./permission-rules.js";
+import { parseLeadingCommandName } from "../tools/fs/bash-readonly-classifier.js";
+export const MAX_RULE_TEXT_CHARS = 512;
+export const BARE_INTERPRETER_NAMES = new Set([
+    "bash", "sh", "zsh", "ksh", "csh", "tcsh", "dash", "fish",
+    "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php",
+    "osascript", "env", "eval", "exec", "xargs", "nohup", "sudo", "doas", "su", "ssh",
+]);
+function foldSpacing(s) {
+    let out = "";
+    let quote;
+    let pendingGap = false;
+    for (const ch of s) {
+        if (quote !== undefined) {
+            if (ch === quote)
+                quote = undefined;
+            out += ch;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            if (pendingGap) {
+                if (out !== "")
+                    out += " ";
+                pendingGap = false;
+            }
+            quote = ch;
+            out += ch;
+            continue;
+        }
+        if (ch === " " || ch === "\t") {
+            pendingGap = true;
+            continue;
+        }
+        if (pendingGap) {
+            if (out !== "")
+                out += " ";
+            pendingGap = false;
+        }
+        out += ch;
+    }
+    return quote === undefined ? out : undefined;
+}
+function reject(code, message) {
+    return { reject: { code, message } };
+}
+export function parseAllowRuleText(text) {
+    if (text.length > MAX_RULE_TEXT_CHARS) {
+        return reject("invalid.too_long", `rule text exceeds ${MAX_RULE_TEXT_CHARS} characters`);
+    }
+    const parsed = parsePermissionRule(text);
+    if (parsed.ruleContent === undefined) {
+        return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
+    }
+    if (parsed.toolName !== "Bash") {
+        return reject("unsupported.tool", `only Bash rules are supported in this version (got "${parsed.toolName}")`);
+    }
+    const content = parsed.ruleContent;
+    const prefixBody = /^(.+):\*$/.exec(content)?.[1];
+    const match = prefixBody !== undefined ? "prefix" : "exact";
+    const body = prefixBody ?? content;
+    if (body.includes("*")) {
+        return reject("unsupported.wildcard", `wildcard rule forms are not supported in this version ("${text}")`);
+    }
+    const floor = parseLeadingCommandName(body);
+    if ("reject" in floor) {
+        return body.trim() === ""
+            ? reject("invalid.empty_command", `rule "${text}" names no command`)
+            : reject("invalid.not_simple_command", `rule "${text}" is not a single simple command (${floor.reject})`);
+    }
+    if (match === "prefix" && BARE_INTERPRETER_NAMES.has(floor.name)) {
+        return reject("invalid.bare_interpreter_prefix", `prefix rule "${text}" is headed by the interpreter "${floor.name}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
+    }
+    const command = foldSpacing(body);
+    if (command === undefined) {
+        return reject("invalid.unbalanced_quotes", `rule "${text}" has unbalanced quoting, so the command it names is not determinable`);
+    }
+    return { rule: { rule: formatAllowRuleText(command, match), tool: "Bash", match, command } };
+}
+export function formatAllowRuleText(command, match) {
+    return `Bash(${command}${match === "prefix" ? ":*" : ""})`;
+}
+export function ruleAdmitsCommand(rule, command) {
+    const floor = parseLeadingCommandName(command);
+    if ("reject" in floor)
+        return false;
+    const folded = foldSpacing(command);
+    if (folded === undefined)
+        return false;
+    if (rule.match === "exact")
+        return folded === rule.command;
+    return folded === rule.command || folded.startsWith(rule.command + " ");
+}
+export function pathWithinRoot(path, root) {
+    if (path === root)
+        return true;
+    const base = root.endsWith("/") ? root : root + "/";
+    return path.startsWith(base);
+}
+export function scopeCoversCwd(scope, cwd) {
+    if (scope.kind === "global")
+        return true;
+    return cwd !== undefined && pathWithinRoot(cwd, scope.root);
+}
+export function isRuleLive(rule) {
+    return rule.adds.length > 0;
+}
+export function findAdmittingRule(rules, call) {
+    const floor = parseLeadingCommandName(call.command);
+    if ("reject" in floor)
+        return undefined;
+    for (const rule of rules) {
+        if (!isRuleLive(rule))
+            continue;
+        if (rule.tool !== call.tool)
+            continue;
+        if (!scopeCoversCwd(rule.scope, call.cwd))
+            continue;
+        if (ruleAdmitsCommand(rule, call.command))
+            return rule;
+    }
+    return undefined;
+}
+export function suggestRulesForCommand(command) {
+    const floor = parseLeadingCommandName(command);
+    if ("reject" in floor)
+        return [];
+    const folded = foldSpacing(command);
+    if (folded === undefined)
+        return [];
+    const out = [];
+    const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
+    if ("rule" in exact)
+        out.push({ rule: exact.rule.rule, match: "exact", command: exact.rule.command });
+    return out;
+}