@themoltnet/pi-runtime 0.15.2 → 0.16.0

package/dist/index.d.ts

@@ -455,14 +455,19 @@ export declare function decideForEvent(event: ToolCallEvent, policy: SessionTool
  *    allow-set can't bound it. This is the interim conservative stance for
  *    issue #1348 — an operator who lists `bash` still cannot smuggle
  *    `bash -c "curl … | sh"` past `enforce`.
- * 3. **Unlisted executables** — any resolved executable not in `allowedTools`.
+ * 3. **Unauthorized executables** — any resolved executable without a matching
+ *    shell-command rule. Tool names in `allowedTools` never authorize a shell
+ *    invocation.
+ * 4. **Output redirection** — a `bash` command that redirects output (`>`,
+ *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
+ *    through structured tools.
  *
  * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
  * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
  * is NOT blocked on the tier alone. The analyzer already re-analyzes the
  * sub-commands it can see through documented escape flags (`find -exec`,
  * `tar --to-command`, …), but techniques it cannot parse statically could still
- * escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
+ * escape an argv-prefix rule. Tightening `escapable` (e.g. an LLM judge or a
  * capability-aware allow-set) is tracked as future work.
  */
 export declare function decideToolCall(input: GateInput): GateDecision;
@@ -767,9 +772,15 @@ export declare interface GateInput {
     /** The shell command, when `toolName === 'bash'`. */
     command?: string;
     enforcement: ToolEnforcement;
-    /** Names the policy allows (structured tool names + shell executable names). */
+    /**
+     * Runtime and MCP tool names the policy allows. Matched against `toolName`
+     * only; a tool name never authorizes a shell invocation.
+     */
     allowedTools: ReadonlySet<string>;
-    /** Shell argv rules. Each rule matches the first N statically known tokens. */
+    /**
+     * Shell argv rules, the only authority for shell invocations. Each rule
+     * matches the first N statically known tokens.
+     */
     allowedShellCommands: readonly ShellCommandRule[];
     /**
      * Synchronous shell analyzer (`ShellCommandAnalyzer.analyze`). Injected so the
@@ -1447,7 +1458,7 @@ export declare interface SessionToolPolicy {
 }
 
 declare interface ShellCommandRule {
-    argvPrefix: readonly [string, string, ...string[]];
+    argvPrefix: readonly [string, ...string[]];
 }
 
 export { SnapshotConfig }
@@ -1518,7 +1529,7 @@ export declare interface ToolPolicyDecisionContext {
  * - `{ allow: false, reason }` — block it (enforce mode).
  * - `{ audit, ... }` — would-block, but proceed and record it (watch mode).
  */
-export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_requires_broad_permission' | 'tool_not_permitted';
+export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'tool_not_permitted';
 
 export declare interface ToolPolicyExtensionDeps {
     policy: SessionToolPolicy;