@warlock.js/ai-workspace 5.30.0 → 5.31.0

package/esm/policy/policy.d.mts

@@ -26,6 +26,17 @@ interface ResolvedPath {
  * `denyPaths` glob even while inside `cwd`, is rejected with a
  * {@link WorkspacePolicyError} of type `"path-escape"`.
  *
+ * Why this does not use `@warlock.js/fs`'s confined reader (`fs.confined`):
+ * the two answer different questions. The confined reader refuses absolute
+ * paths, refuses every symbolic link (or follows only links inside its one
+ * root), requires the path to exist, and reads the file itself through a
+ * no-follow, identity-checked open. This jail must instead accept absolute
+ * paths inside `cwd`, several `allowPaths` roots, `denyPaths` globs, a
+ * symlinked `cwd`, links whose target stays inside, and paths that do not
+ * exist yet (`writeFile`, `mkdir`), and it returns a path that writes,
+ * `exec`'s working directory and redirections use afterwards. Switching would
+ * change what agents may touch, so the workspace keeps this resolver.
+ *
  * @param policy - The bounding policy (its `cwd` is the jail root).
  * @param inputPath - A workspace-relative or absolute path to resolve.
  * @returns The canonical absolute path plus its `/`-separated relative form.
@@ -36,23 +47,22 @@ interface ResolvedPath {
  */
 declare function resolveInJail(policy: WorkspacePolicy, inputPath: string): Promise<ResolvedPath>;
 /**
- * Whether a shell command is permitted by the policy's `shell` sub-policy.
+ * Whether a command line is permitted by the policy's `shell` sub-policy —
+ * `checkShellCommand(policy, command).allowed`.
  *
- * The command is first tokenized via {@link tokenizeCommand} — a command
- * that cannot be represented as a single argv (unbalanced quotes, or
- * unquoted shell metacharacters such as `;`, `&&`, `|`, backticks, `$`,
- * redirection) is denied outright. The backend spawns the argv directly
- * with no shell, so such a command has no meaning here — and unquoted
- * metacharacters were exactly how an injected command chain used to ride
- * past the allowlist. The resolved `argv[0]` basename is then matched
- * against `shell.deny` then `shell.allow`. **Deny always wins.** When
- * `shell.allow` is set, the executable MUST appear in it (fail-closed
- * allowlist); when `allow` is absent/empty, any non-denied command is
- * permitted. An absent `shell` block means no command may run at all.
+ * In argv mode (the default) the command must tokenize into a single argv
+ * (no unquoted `;`, `&&`, `|`, backticks, `$`, redirection, …): the backend
+ * spawns it with no shell, and unquoted metacharacters were exactly how an
+ * injected command chain used to ride past the allowlist. In shell mode
+ * (`interpreter: "sh"`) every simple command in the line is checked. Each
+ * argv's executable basename is matched against `shell.deny` (wins, case
+ * insensitive) then `shell.allow` (exhaustive when non-empty), then
+ * `shell.denyPatterns` and `shell.allowCommand`. An absent `shell` block
+ * means no command may run at all.
  *
- * Returns a plain `boolean` rather than throwing — the ops layer raises
- * the {@link WorkspacePolicyError} so the thrown context (`command`)
- * lives next to the call site.
+ * Returns a plain `boolean`; use {@link checkShellCommand} for the reason
+ * and the model-facing message. Redirection targets are checked lexically
+ * here; `exec` re-checks them with symlinks resolved.
  *
  * @example
  * isCommandAllowed({ cwd, shell: { allow: ["npm"] } }, "npm test"); // true

package/esm/policy/policy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"mappings":";;;;;AAYA;;;UAAiB,YAAA;EAQH;EANZ,YAAA;EAkJiC;;;;;EA5IjC,YAAY;AAAA;;;;;;;AA+IS;AAoFvB;;;;;;;;AAEiB;AA+CjB;;iBAxIsB,aAAA,CACpB,MAAA,EAAQ,eAAA,EACR,SAAA,WACC,OAAA,CAAQ,YAAA;;;;;;AAqI8C;;;;;;;;;;;;;;;;;;;iBAjDzC,gBAAA,CACd,MAAA,EAAQ,eAAe,EACvB,OAAA;;;;;;;;;;;;;iBA+Cc,QAAA,CAAS,MAAA,EAAQ,eAAA,GAAkB,MAAM"}
+{"version":3,"file":"policy.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"mappings":";;;;;AAaA;;;UAAiB,YAAA;EAQH;EANZ,YAAA;EA+EiC;;;;;EAzEjC,YAAY;AAAA;;;;;;;AA4ES;AAqEvB;;;;;;;;AAAyE;AAgBzE;;;;;;;;AAAyD;;;;;iBAxFnC,aAAA,CACpB,MAAA,EAAQ,eAAA,EACR,SAAA,WACC,OAAA,CAAQ,YAAA;;;;;;;;;;;;;;;;;;;;;;;;iBAqEK,gBAAA,CAAiB,MAAA,EAAQ,eAAe,EAAE,OAAA;;;;;;;;;;;;;iBAgB1C,QAAA,CAAS,MAAA,EAAQ,eAAA,GAAkB,MAAM"}

package/esm/policy/policy.mjs

@@ -1,5 +1,6 @@
 import { WorkspacePolicyError } from "../errors.mjs";
-import { tokenizeCommand } from "./tokenize-command.mjs";
+import { isInside, matchesAnyGlob } from "./jail.mjs";
+import { checkShellCommand } from "./shell-check.mjs";
 import path from "node:path";
 import { realpath } from "node:fs/promises";
 
@@ -26,55 +27,6 @@ async function canonicalize(target) {
 	}
 }
 /**
-* Whether `child` is contained within `root` (or equals it), comparing
-* canonical absolute paths. Guards against the `/srv/app-evil` vs
-* `/srv/app` prefix-collision by anchoring on a path separator.
-*/
-function isInside(child, root) {
-	const relative = path.relative(root, child);
-	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
-}
-/**
-* Translate a glob (the small subset used by `denyPaths` — `*`, `**`,
-* `?`) into an anchored `RegExp` over a `/`-separated relative path.
-* `**` spans path separators; a single `*` does not.
-*/
-function globToRegExp(glob) {
-	let source = "";
-	for (let index = 0; index < glob.length; index++) {
-		const char = glob[index];
-		if (char === "*") {
-			if (glob[index + 1] === "*") {
-				source += ".*";
-				index++;
-				if (glob[index + 1] === "/") index++;
-			} else source += "[^/]*";
-			continue;
-		}
-		if (char === "?") {
-			source += "[^/]";
-			continue;
-		}
-		source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-	}
-	return new RegExp(`^${source}$`);
-}
-/**
-* Whether a workspace-relative (`/`-separated) path matches any of the
-* policy's `denyPaths` globs. A deny glob also blocks everything beneath
-* a matched directory (`".git/**"` blocks `.git/config`).
-*/
-function matchesDeny(relativePath, denyPaths) {
-	return denyPaths.some((glob) => {
-		if (globToRegExp(glob).test(relativePath)) return true;
-		if (!glob.includes("*") && !glob.includes("?")) {
-			const prefix = glob.endsWith("/") ? glob : `${glob}/`;
-			return relativePath.startsWith(prefix);
-		}
-		return false;
-	});
-}
-/**
 * Resolve and jail a single input path against a {@link WorkspacePolicy}.
 *
 * The input is resolved against `policy.cwd`, canonicalized (symlinks in
@@ -84,6 +36,17 @@ function matchesDeny(relativePath, denyPaths) {
 * `denyPaths` glob even while inside `cwd`, is rejected with a
 * {@link WorkspacePolicyError} of type `"path-escape"`.
 *
+* Why this does not use `@warlock.js/fs`'s confined reader (`fs.confined`):
+* the two answer different questions. The confined reader refuses absolute
+* paths, refuses every symbolic link (or follows only links inside its one
+* root), requires the path to exist, and reads the file itself through a
+* no-follow, identity-checked open. This jail must instead accept absolute
+* paths inside `cwd`, several `allowPaths` roots, `denyPaths` globs, a
+* symlinked `cwd`, links whose target stays inside, and paths that do not
+* exist yet (`writeFile`, `mkdir`), and it returns a path that writes,
+* `exec`'s working directory and redirections use afterwards. Switching would
+* change what agents may touch, so the workspace keeps this resolver.
+*
 * @param policy - The bounding policy (its `cwd` is the jail root).
 * @param inputPath - A workspace-relative or absolute path to resolve.
 * @returns The canonical absolute path plus its `/`-separated relative form.
@@ -110,7 +73,7 @@ async function resolveInJail(policy, inputPath) {
 	});
 	const relativeToJail = insideCwd ? path.relative(jailRoot, absolutePath).split(path.sep).join("/") : "";
 	if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {
-		if (matchesDeny(relativeToJail, policy.denyPaths)) throw new WorkspacePolicyError(`Path "${inputPath}" is blocked by the workspace deny list.`, {
+		if (matchesAnyGlob(relativeToJail, policy.denyPaths)) throw new WorkspacePolicyError(`Path "${inputPath}" is blocked by the workspace deny list.`, {
 			type: "path-escape",
 			path: inputPath
 		});
@@ -121,32 +84,22 @@ async function resolveInJail(policy, inputPath) {
 	};
 }
 /**
-* Reduce an argv's first element to the basename the allow/deny policy is
-* keyed on. `"npm"` → `"npm"`; `"/usr/bin/node"` → `"node"`; `"node.exe"`
-* → `"node"` (the `.exe`/`.cmd`/`.bat`/`.com` Windows extension is
-* stripped).
-*/
-function executableBasename(firstToken) {
-	return path.basename(firstToken).replace(/\.(exe|cmd|bat|com)$/i, "");
-}
-/**
-* Whether a shell command is permitted by the policy's `shell` sub-policy.
+* Whether a command line is permitted by the policy's `shell` sub-policy —
+* `checkShellCommand(policy, command).allowed`.
 *
-* The command is first tokenized via {@link tokenizeCommand} — a command
-* that cannot be represented as a single argv (unbalanced quotes, or
-* unquoted shell metacharacters such as `;`, `&&`, `|`, backticks, `$`,
-* redirection) is denied outright. The backend spawns the argv directly
-* with no shell, so such a command has no meaning here — and unquoted
-* metacharacters were exactly how an injected command chain used to ride
-* past the allowlist. The resolved `argv[0]` basename is then matched
-* against `shell.deny` then `shell.allow`. **Deny always wins.** When
-* `shell.allow` is set, the executable MUST appear in it (fail-closed
-* allowlist); when `allow` is absent/empty, any non-denied command is
-* permitted. An absent `shell` block means no command may run at all.
+* In argv mode (the default) the command must tokenize into a single argv
+* (no unquoted `;`, `&&`, `|`, backticks, `$`, redirection, …): the backend
+* spawns it with no shell, and unquoted metacharacters were exactly how an
+* injected command chain used to ride past the allowlist. In shell mode
+* (`interpreter: "sh"`) every simple command in the line is checked. Each
+* argv's executable basename is matched against `shell.deny` (wins, case
+* insensitive) then `shell.allow` (exhaustive when non-empty), then
+* `shell.denyPatterns` and `shell.allowCommand`. An absent `shell` block
+* means no command may run at all.
 *
-* Returns a plain `boolean` rather than throwing — the ops layer raises
-* the {@link WorkspacePolicyError} so the thrown context (`command`)
-* lives next to the call site.
+* Returns a plain `boolean`; use {@link checkShellCommand} for the reason
+* and the model-facing message. Redirection targets are checked lexically
+* here; `exec` re-checks them with symlinks resolved.
 *
 * @example
 * isCommandAllowed({ cwd, shell: { allow: ["npm"] } }, "npm test"); // true
@@ -154,15 +107,7 @@ function executableBasename(firstToken) {
 * isCommandAllowed({ cwd, shell: { allow: ["npm"] } }, "npm test; rm -rf /"); // false
 */
 function isCommandAllowed(policy, command) {
-	const shell = policy.shell;
-	if (!shell) return false;
-	const argv = tokenizeCommand(command);
-	if (argv === null) return false;
-	const executable = executableBasename(argv[0]);
-	if (executable === "") return false;
-	if (shell.deny && shell.deny.includes(executable)) return false;
-	if (shell.allow && shell.allow.length > 0) return shell.allow.includes(executable);
-	return true;
+	return checkShellCommand(policy, command).allowed;
 }
 /**
 * Build the exact environment a spawned process receives — `process.env`
@@ -187,7 +132,38 @@ function buildEnv(policy) {
 	if (shell.env) for (const [key, value] of Object.entries(shell.env)) env[key] = value;
 	return env;
 }
+/**
+* Variables removed from the environment of a shell-mode (`interpreter:
+* "sh"`) command: each changes how the shell itself starts, parses or
+* resolves the line (`ENV`/`BASH_ENV` run a startup file, `SHELLOPTS` +
+* `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that
+* shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).
+*/
+const SHELL_STARTUP_VARIABLES = new Set([
+	"ENV",
+	"BASH_ENV",
+	"SHELLOPTS",
+	"BASHOPTS",
+	"CDPATH",
+	"IFS",
+	"PS4",
+	"GLOBIGNORE"
+]);
+/**
+* The environment a command actually receives: {@link buildEnv}, minus the
+* shell start-up variables when the policy runs lines through a shell.
+* Compared case-insensitively, because Windows environment names are.
+*/
+function buildCommandEnv(policy) {
+	const env = buildEnv(policy);
+	if ((policy.shell?.interpreter ?? "none") !== "sh") return env;
+	for (const key of Object.keys(env)) {
+		const upper = key.toUpperCase();
+		if (SHELL_STARTUP_VARIABLES.has(upper) || upper.startsWith("BASH_FUNC_")) delete env[key];
+	}
+	return env;
+}
 
 //#endregion
-export { buildEnv, isCommandAllowed, resolveInJail };
+export { buildCommandEnv, buildEnv, isCommandAllowed, resolveInJail };
 //# sourceMappingURL=policy.mjs.map

package/esm/policy/policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"policy.mjs","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"sourcesContent":["import path from \"node:path\";\nimport { realpath } from \"node:fs/promises\";\nimport { WorkspacePolicyError } from \"../errors\";\nimport { tokenizeCommand } from \"./tokenize-command\";\nimport type { WorkspacePolicy } from \"../contracts\";\n\n/**\n * The outcome of resolving a workspace-relative (or absolute) input path\n * against the jail — the canonical absolute location the backend should\n * touch, plus the workspace-relative form (POSIX-style, `/`-separated)\n * the agent and tool results echo back.\n */\nexport interface ResolvedPath {\n  /** Canonical absolute path (symlinks in existing ancestors collapsed). */\n  absolutePath: string;\n  /**\n   * The path relative to `policy.cwd`, `/`-separated regardless of OS,\n   * used in tool results so the agent always sees stable workspace paths.\n   * Empty string when the resolved path IS the jail root.\n   */\n  relativePath: string;\n}\n\n/**\n * Resolve the canonical absolute form of `target`, collapsing any\n * symlinks. `target` may not yet exist (a fresh `writeFile`/`mkdir`),\n * so we realpath the deepest **existing** ancestor and re-attach the\n * non-existent tail — a symlinked ancestor still cannot smuggle the\n * path out of the jail, while genuinely new leaves stay creatable.\n */\nasync function canonicalize(target: string): Promise<string> {\n  let resolvedTarget = path.resolve(target);\n  const tail: string[] = [];\n\n  // Walk up until an existing ancestor is found (or we hit the root).\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    try {\n      const real = await realpath(resolvedTarget);\n\n      return tail.length > 0 ? path.join(real, ...tail) : real;\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n\n      // Only ENOENT means \"this segment doesn't exist yet\" — keep\n      // walking up. Any other error (EACCES, ELOOP, …) is a real fault.\n      if (code !== \"ENOENT\") {\n        throw error;\n      }\n\n      const parent = path.dirname(resolvedTarget);\n\n      // Reached the filesystem root without finding an existing\n      // ancestor — give back the lexically-resolved path unchanged.\n      if (parent === resolvedTarget) {\n        return path.join(resolvedTarget, ...tail);\n      }\n\n      tail.unshift(path.basename(resolvedTarget));\n      resolvedTarget = parent;\n    }\n  }\n}\n\n/**\n * Whether `child` is contained within `root` (or equals it), comparing\n * canonical absolute paths. Guards against the `/srv/app-evil` vs\n * `/srv/app` prefix-collision by anchoring on a path separator.\n */\nfunction isInside(child: string, root: string): boolean {\n  const relative = path.relative(root, child);\n\n  return (\n    relative === \"\" ||\n    (!relative.startsWith(\"..\") && !path.isAbsolute(relative))\n  );\n}\n\n/**\n * Translate a glob (the small subset used by `denyPaths` — `*`, `**`,\n * `?`) into an anchored `RegExp` over a `/`-separated relative path.\n * `**` spans path separators; a single `*` does not.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let source = \"\";\n\n  for (let index = 0; index < glob.length; index++) {\n    const char = glob[index];\n\n    if (char === \"*\") {\n      if (glob[index + 1] === \"*\") {\n        // `**` — match across segments (and an optional trailing slash).\n        source += \".*\";\n        index++;\n\n        if (glob[index + 1] === \"/\") {\n          index++;\n        }\n      } else {\n        // `*` — match within a single segment.\n        source += \"[^/]*\";\n      }\n\n      continue;\n    }\n\n    if (char === \"?\") {\n      source += \"[^/]\";\n\n      continue;\n    }\n\n    // Escape everything else so it matches literally.\n    source += char.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  }\n\n  return new RegExp(`^${source}$`);\n}\n\n/**\n * Whether a workspace-relative (`/`-separated) path matches any of the\n * policy's `denyPaths` globs. A deny glob also blocks everything beneath\n * a matched directory (`\".git/**\"` blocks `.git/config`).\n */\nfunction matchesDeny(relativePath: string, denyPaths: string[]): boolean {\n  return denyPaths.some((glob) => {\n    if (globToRegExp(glob).test(relativePath)) {\n      return true;\n    }\n\n    // A bare directory glob (`\".git\"`, `\"node_modules\"`) should also\n    // block its contents, mirroring how `\".git/**\"` would behave.\n    if (!glob.includes(\"*\") && !glob.includes(\"?\")) {\n      const prefix = glob.endsWith(\"/\") ? glob : `${glob}/`;\n\n      return relativePath.startsWith(prefix);\n    }\n\n    return false;\n  });\n}\n\n/**\n * Resolve and jail a single input path against a {@link WorkspacePolicy}.\n *\n * The input is resolved against `policy.cwd`, canonicalized (symlinks in\n * existing ancestors collapsed so a symlinked directory cannot escape\n * the jail), then accepted **only** when it sits under `cwd` or one of\n * the `allowPaths` roots. A path that escapes, or that matches any\n * `denyPaths` glob even while inside `cwd`, is rejected with a\n * {@link WorkspacePolicyError} of type `\"path-escape\"`.\n *\n * @param policy - The bounding policy (its `cwd` is the jail root).\n * @param inputPath - A workspace-relative or absolute path to resolve.\n * @returns The canonical absolute path plus its `/`-separated relative form.\n * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.\n *\n * @example\n * const { absolutePath } = await resolveInJail(policy, \"src/index.ts\");\n */\nexport async function resolveInJail(\n  policy: WorkspacePolicy,\n  inputPath: string,\n): Promise<ResolvedPath> {\n  const jailRoot = await canonicalize(policy.cwd);\n  const requested = path.isAbsolute(inputPath)\n    ? inputPath\n    : path.join(policy.cwd, inputPath);\n  const absolutePath = await canonicalize(requested);\n\n  const insideCwd = isInside(absolutePath, jailRoot);\n  const allowRoots = policy.allowPaths ?? [];\n  let insideAllow = false;\n\n  if (!insideCwd) {\n    for (const root of allowRoots) {\n      const canonicalRoot = await canonicalize(root);\n\n      if (isInside(absolutePath, canonicalRoot)) {\n        insideAllow = true;\n\n        break;\n      }\n    }\n  }\n\n  if (!insideCwd && !insideAllow) {\n    throw new WorkspacePolicyError(\n      `Path \"${inputPath}\" resolves outside the workspace jail.`,\n      { type: \"path-escape\", path: inputPath },\n    );\n  }\n\n  // `denyPaths` is evaluated relative to the jail root and wins even\n  // when the path is comfortably inside `cwd`.\n  const relativeToJail = insideCwd\n    ? path.relative(jailRoot, absolutePath).split(path.sep).join(\"/\")\n    : \"\";\n\n  if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {\n    if (matchesDeny(relativeToJail, policy.denyPaths)) {\n      throw new WorkspacePolicyError(\n        `Path \"${inputPath}\" is blocked by the workspace deny list.`,\n        { type: \"path-escape\", path: inputPath },\n      );\n    }\n  }\n\n  return { absolutePath, relativePath: relativeToJail };\n}\n\n/**\n * Reduce an argv's first element to the basename the allow/deny policy is\n * keyed on. `\"npm\"` → `\"npm\"`; `\"/usr/bin/node\"` → `\"node\"`; `\"node.exe\"`\n * → `\"node\"` (the `.exe`/`.cmd`/`.bat`/`.com` Windows extension is\n * stripped).\n */\nfunction executableBasename(firstToken: string): string {\n  const base = path.basename(firstToken);\n\n  return base.replace(/\\.(exe|cmd|bat|com)$/i, \"\");\n}\n\n/**\n * Whether a shell command is permitted by the policy's `shell` sub-policy.\n *\n * The command is first tokenized via {@link tokenizeCommand} — a command\n * that cannot be represented as a single argv (unbalanced quotes, or\n * unquoted shell metacharacters such as `;`, `&&`, `|`, backticks, `$`,\n * redirection) is denied outright. The backend spawns the argv directly\n * with no shell, so such a command has no meaning here — and unquoted\n * metacharacters were exactly how an injected command chain used to ride\n * past the allowlist. The resolved `argv[0]` basename is then matched\n * against `shell.deny` then `shell.allow`. **Deny always wins.** When\n * `shell.allow` is set, the executable MUST appear in it (fail-closed\n * allowlist); when `allow` is absent/empty, any non-denied command is\n * permitted. An absent `shell` block means no command may run at all.\n *\n * Returns a plain `boolean` rather than throwing — the ops layer raises\n * the {@link WorkspacePolicyError} so the thrown context (`command`)\n * lives next to the call site.\n *\n * @example\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test\"); // true\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"rm -rf /\"); // false\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test; rm -rf /\"); // false\n */\nexport function isCommandAllowed(\n  policy: WorkspacePolicy,\n  command: string,\n): boolean {\n  const shell = policy.shell;\n\n  // No shell sub-policy ⇒ fail-closed: nothing may run.\n  if (!shell) {\n    return false;\n  }\n\n  const argv = tokenizeCommand(command);\n\n  if (argv === null) {\n    return false;\n  }\n\n  const executable = executableBasename(argv[0]);\n\n  if (executable === \"\") {\n    return false;\n  }\n\n  // Deny wins over everything else.\n  if (shell.deny && shell.deny.includes(executable)) {\n    return false;\n  }\n\n  // An allowlist, when present, is exhaustive.\n  if (shell.allow && shell.allow.length > 0) {\n    return shell.allow.includes(executable);\n  }\n\n  // No allowlist: anything not explicitly denied is permitted.\n  return true;\n}\n\n/**\n * Build the exact environment a spawned process receives — `process.env`\n * is **never** inherited wholesale. The result is\n * `{ ...pick(process.env, inheritEnv), ...shell.env }`, so a command\n * cannot see `PATH` (and thus often cannot find `node`/`npm`) unless the\n * policy opts in via `shell.inheritEnv: [\"PATH\"]`. Explicit `shell.env`\n * values override inherited ones on key collision.\n *\n * @example\n * buildEnv({ cwd, shell: { inheritEnv: [\"PATH\"], env: { CI: \"1\" } } });\n * // → { PATH: <process PATH>, CI: \"1\" }\n */\nexport function buildEnv(policy: WorkspacePolicy): Record<string, string> {\n  const shell = policy.shell;\n  const env: Record<string, string> = {};\n\n  if (!shell) {\n    return env;\n  }\n\n  for (const key of shell.inheritEnv ?? []) {\n    const value = process.env[key];\n\n    if (value !== undefined) {\n      env[key] = value;\n    }\n  }\n\n  if (shell.env) {\n    for (const [key, value] of Object.entries(shell.env)) {\n      env[key] = value;\n    }\n  }\n\n  return env;\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,eAAe,aAAa,QAAiC;CAC3D,IAAI,iBAAiB,KAAK,QAAQ,MAAM;CACxC,MAAM,OAAiB,CAAC;CAIxB,OAAO,MACL,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,cAAc;EAE1C,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,IAAI,IAAI;CACtD,SAAS,OAAO;EAKd,IAJc,MAAgC,SAIjC,UACX,MAAM;EAGR,MAAM,SAAS,KAAK,QAAQ,cAAc;EAI1C,IAAI,WAAW,gBACb,OAAO,KAAK,KAAK,gBAAgB,GAAG,IAAI;EAG1C,KAAK,QAAQ,KAAK,SAAS,cAAc,CAAC;EAC1C,iBAAiB;CACnB;AAEJ;;;;;;AAOA,SAAS,SAAS,OAAe,MAAuB;CACtD,MAAM,WAAW,KAAK,SAAS,MAAM,KAAK;CAE1C,OACE,aAAa,MACZ,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AAE5D;;;;;;AAOA,SAAS,aAAa,MAAsB;CAC1C,IAAI,SAAS;CAEb,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,OAAO,KAAK;EAElB,IAAI,SAAS,KAAK;GAChB,IAAI,KAAK,QAAQ,OAAO,KAAK;IAE3B,UAAU;IACV;IAEA,IAAI,KAAK,QAAQ,OAAO,KACtB;GAEJ,OAEE,UAAU;GAGZ;EACF;EAEA,IAAI,SAAS,KAAK;GAChB,UAAU;GAEV;EACF;EAGA,UAAU,KAAK,QAAQ,qBAAqB,MAAM;CACpD;CAEA,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE;AACjC;;;;;;AAOA,SAAS,YAAY,cAAsB,WAA8B;CACvE,OAAO,UAAU,MAAM,SAAS;EAC9B,IAAI,aAAa,IAAI,CAAC,CAAC,KAAK,YAAY,GACtC,OAAO;EAKT,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,SAAS,GAAG,GAAG;GAC9C,MAAM,SAAS,KAAK,SAAS,GAAG,IAAI,OAAO,GAAG,KAAK;GAEnD,OAAO,aAAa,WAAW,MAAM;EACvC;EAEA,OAAO;CACT,CAAC;AACH;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,cACpB,QACA,WACuB;CACvB,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;CAI9C,MAAM,eAAe,MAAM,aAHT,KAAK,WAAW,SAAS,IACvC,YACA,KAAK,KAAK,OAAO,KAAK,SAAS,CACc;CAEjD,MAAM,YAAY,SAAS,cAAc,QAAQ;CACjD,MAAM,aAAa,OAAO,cAAc,CAAC;CACzC,IAAI,cAAc;CAElB,IAAI,CAAC,WACH;OAAK,MAAM,QAAQ,YAGjB,IAAI,SAAS,cAAc,MAFC,aAAa,IAAI,CAEL,GAAG;GACzC,cAAc;GAEd;EACF;CACF;CAGF,IAAI,CAAC,aAAa,CAAC,aACjB,MAAM,IAAI,qBACR,SAAS,UAAU,yCACnB;EAAE,MAAM;EAAe,MAAM;CAAU,CACzC;CAKF,MAAM,iBAAiB,YACnB,KAAK,SAAS,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAC9D;CAEJ,IAAI,aAAa,OAAO,aAAa,OAAO,UAAU,SAAS,GAC7D;MAAI,YAAY,gBAAgB,OAAO,SAAS,GAC9C,MAAM,IAAI,qBACR,SAAS,UAAU,2CACnB;GAAE,MAAM;GAAe,MAAM;EAAU,CACzC;CACF;CAGF,OAAO;EAAE;EAAc,cAAc;CAAe;AACtD;;;;;;;AAQA,SAAS,mBAAmB,YAA4B;CAGtD,OAFa,KAAK,SAAS,UAEjB,CAAC,CAAC,QAAQ,yBAAyB,EAAE;AACjD;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,iBACd,QACA,SACS;CACT,MAAM,QAAQ,OAAO;CAGrB,IAAI,CAAC,OACH,OAAO;CAGT,MAAM,OAAO,gBAAgB,OAAO;CAEpC,IAAI,SAAS,MACX,OAAO;CAGT,MAAM,aAAa,mBAAmB,KAAK,EAAE;CAE7C,IAAI,eAAe,IACjB,OAAO;CAIT,IAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,UAAU,GAC9C,OAAO;CAIT,IAAI,MAAM,SAAS,MAAM,MAAM,SAAS,GACtC,OAAO,MAAM,MAAM,SAAS,UAAU;CAIxC,OAAO;AACT;;;;;;;;;;;;;AAcA,SAAgB,SAAS,QAAiD;CACxE,MAAM,QAAQ,OAAO;CACrB,MAAM,MAA8B,CAAC;CAErC,IAAI,CAAC,OACH,OAAO;CAGT,KAAK,MAAM,OAAO,MAAM,cAAc,CAAC,GAAG;EACxC,MAAM,QAAQ,QAAQ,IAAI;EAE1B,IAAI,UAAU,QACZ,IAAI,OAAO;CAEf;CAEA,IAAI,MAAM,KACR,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,GACjD,IAAI,OAAO;CAIf,OAAO;AACT"}
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"sourcesContent":["import path from \"node:path\";\nimport { realpath } from \"node:fs/promises\";\nimport { WorkspacePolicyError } from \"../errors\";\nimport type { WorkspacePolicy } from \"../contracts\";\nimport { isInside, matchesAnyGlob } from \"./jail\";\nimport { checkShellCommand } from \"./shell-check\";\n\n/**\n * The outcome of resolving a workspace-relative (or absolute) input path\n * against the jail — the canonical absolute location the backend should\n * touch, plus the workspace-relative form (POSIX-style, `/`-separated)\n * the agent and tool results echo back.\n */\nexport interface ResolvedPath {\n  /** Canonical absolute path (symlinks in existing ancestors collapsed). */\n  absolutePath: string;\n  /**\n   * The path relative to `policy.cwd`, `/`-separated regardless of OS,\n   * used in tool results so the agent always sees stable workspace paths.\n   * Empty string when the resolved path IS the jail root.\n   */\n  relativePath: string;\n}\n\n/**\n * Resolve the canonical absolute form of `target`, collapsing any\n * symlinks. `target` may not yet exist (a fresh `writeFile`/`mkdir`),\n * so we realpath the deepest **existing** ancestor and re-attach the\n * non-existent tail — a symlinked ancestor still cannot smuggle the\n * path out of the jail, while genuinely new leaves stay creatable.\n */\nasync function canonicalize(target: string): Promise<string> {\n  let resolvedTarget = path.resolve(target);\n  const tail: string[] = [];\n\n  // Walk up until an existing ancestor is found (or we hit the root).\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    try {\n      const real = await realpath(resolvedTarget);\n\n      return tail.length > 0 ? path.join(real, ...tail) : real;\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n\n      // Only ENOENT means \"this segment doesn't exist yet\" — keep\n      // walking up. Any other error (EACCES, ELOOP, …) is a real fault.\n      if (code !== \"ENOENT\") {\n        throw error;\n      }\n\n      const parent = path.dirname(resolvedTarget);\n\n      // Reached the filesystem root without finding an existing\n      // ancestor — give back the lexically-resolved path unchanged.\n      if (parent === resolvedTarget) {\n        return path.join(resolvedTarget, ...tail);\n      }\n\n      tail.unshift(path.basename(resolvedTarget));\n      resolvedTarget = parent;\n    }\n  }\n}\n\n/**\n * Resolve and jail a single input path against a {@link WorkspacePolicy}.\n *\n * The input is resolved against `policy.cwd`, canonicalized (symlinks in\n * existing ancestors collapsed so a symlinked directory cannot escape\n * the jail), then accepted **only** when it sits under `cwd` or one of\n * the `allowPaths` roots. A path that escapes, or that matches any\n * `denyPaths` glob even while inside `cwd`, is rejected with a\n * {@link WorkspacePolicyError} of type `\"path-escape\"`.\n *\n * Why this does not use `@warlock.js/fs`'s confined reader (`fs.confined`):\n * the two answer different questions. The confined reader refuses absolute\n * paths, refuses every symbolic link (or follows only links inside its one\n * root), requires the path to exist, and reads the file itself through a\n * no-follow, identity-checked open. This jail must instead accept absolute\n * paths inside `cwd`, several `allowPaths` roots, `denyPaths` globs, a\n * symlinked `cwd`, links whose target stays inside, and paths that do not\n * exist yet (`writeFile`, `mkdir`), and it returns a path that writes,\n * `exec`'s working directory and redirections use afterwards. Switching would\n * change what agents may touch, so the workspace keeps this resolver.\n *\n * @param policy - The bounding policy (its `cwd` is the jail root).\n * @param inputPath - A workspace-relative or absolute path to resolve.\n * @returns The canonical absolute path plus its `/`-separated relative form.\n * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.\n *\n * @example\n * const { absolutePath } = await resolveInJail(policy, \"src/index.ts\");\n */\nexport async function resolveInJail(\n  policy: WorkspacePolicy,\n  inputPath: string,\n): Promise<ResolvedPath> {\n  const jailRoot = await canonicalize(policy.cwd);\n  const requested = path.isAbsolute(inputPath) ? inputPath : path.join(policy.cwd, inputPath);\n  const absolutePath = await canonicalize(requested);\n\n  const insideCwd = isInside(absolutePath, jailRoot);\n  const allowRoots = policy.allowPaths ?? [];\n  let insideAllow = false;\n\n  if (!insideCwd) {\n    for (const root of allowRoots) {\n      const canonicalRoot = await canonicalize(root);\n\n      if (isInside(absolutePath, canonicalRoot)) {\n        insideAllow = true;\n\n        break;\n      }\n    }\n  }\n\n  if (!insideCwd && !insideAllow) {\n    throw new WorkspacePolicyError(`Path \"${inputPath}\" resolves outside the workspace jail.`, {\n      type: \"path-escape\",\n      path: inputPath,\n    });\n  }\n\n  // `denyPaths` is evaluated relative to the jail root and wins even\n  // when the path is comfortably inside `cwd`.\n  const relativeToJail = insideCwd\n    ? path.relative(jailRoot, absolutePath).split(path.sep).join(\"/\")\n    : \"\";\n\n  if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {\n    if (matchesAnyGlob(relativeToJail, policy.denyPaths)) {\n      throw new WorkspacePolicyError(`Path \"${inputPath}\" is blocked by the workspace deny list.`, {\n        type: \"path-escape\",\n        path: inputPath,\n      });\n    }\n  }\n\n  return { absolutePath, relativePath: relativeToJail };\n}\n\n/**\n * Whether a command line is permitted by the policy's `shell` sub-policy —\n * `checkShellCommand(policy, command).allowed`.\n *\n * In argv mode (the default) the command must tokenize into a single argv\n * (no unquoted `;`, `&&`, `|`, backticks, `$`, redirection, …): the backend\n * spawns it with no shell, and unquoted metacharacters were exactly how an\n * injected command chain used to ride past the allowlist. In shell mode\n * (`interpreter: \"sh\"`) every simple command in the line is checked. Each\n * argv's executable basename is matched against `shell.deny` (wins, case\n * insensitive) then `shell.allow` (exhaustive when non-empty), then\n * `shell.denyPatterns` and `shell.allowCommand`. An absent `shell` block\n * means no command may run at all.\n *\n * Returns a plain `boolean`; use {@link checkShellCommand} for the reason\n * and the model-facing message. Redirection targets are checked lexically\n * here; `exec` re-checks them with symlinks resolved.\n *\n * @example\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test\"); // true\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"rm -rf /\"); // false\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test; rm -rf /\"); // false\n */\nexport function isCommandAllowed(policy: WorkspacePolicy, command: string): boolean {\n  return checkShellCommand(policy, command).allowed;\n}\n\n/**\n * Build the exact environment a spawned process receives — `process.env`\n * is **never** inherited wholesale. The result is\n * `{ ...pick(process.env, inheritEnv), ...shell.env }`, so a command\n * cannot see `PATH` (and thus often cannot find `node`/`npm`) unless the\n * policy opts in via `shell.inheritEnv: [\"PATH\"]`. Explicit `shell.env`\n * values override inherited ones on key collision.\n *\n * @example\n * buildEnv({ cwd, shell: { inheritEnv: [\"PATH\"], env: { CI: \"1\" } } });\n * // → { PATH: <process PATH>, CI: \"1\" }\n */\nexport function buildEnv(policy: WorkspacePolicy): Record<string, string> {\n  const shell = policy.shell;\n  const env: Record<string, string> = {};\n\n  if (!shell) {\n    return env;\n  }\n\n  for (const key of shell.inheritEnv ?? []) {\n    const value = process.env[key];\n\n    if (value !== undefined) {\n      env[key] = value;\n    }\n  }\n\n  if (shell.env) {\n    for (const [key, value] of Object.entries(shell.env)) {\n      env[key] = value;\n    }\n  }\n\n  return env;\n}\n\n/**\n * Variables removed from the environment of a shell-mode (`interpreter:\n * \"sh\"`) command: each changes how the shell itself starts, parses or\n * resolves the line (`ENV`/`BASH_ENV` run a startup file, `SHELLOPTS` +\n * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that\n * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).\n */\nconst SHELL_STARTUP_VARIABLES = new Set([\n  \"ENV\",\n  \"BASH_ENV\",\n  \"SHELLOPTS\",\n  \"BASHOPTS\",\n  \"CDPATH\",\n  \"IFS\",\n  \"PS4\",\n  \"GLOBIGNORE\",\n]);\n\n/**\n * The environment a command actually receives: {@link buildEnv}, minus the\n * shell start-up variables when the policy runs lines through a shell.\n * Compared case-insensitively, because Windows environment names are.\n */\nexport function buildCommandEnv(policy: WorkspacePolicy): Record<string, string> {\n  const env = buildEnv(policy);\n\n  if ((policy.shell?.interpreter ?? \"none\") !== \"sh\") {\n    return env;\n  }\n\n  for (const key of Object.keys(env)) {\n    const upper = key.toUpperCase();\n\n    if (SHELL_STARTUP_VARIABLES.has(upper) || upper.startsWith(\"BASH_FUNC_\")) {\n      delete env[key];\n    }\n  }\n\n  return env;\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,eAAe,aAAa,QAAiC;CAC3D,IAAI,iBAAiB,KAAK,QAAQ,MAAM;CACxC,MAAM,OAAiB,CAAC;CAIxB,OAAO,MACL,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,cAAc;EAE1C,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,IAAI,IAAI;CACtD,SAAS,OAAO;EAKd,IAJc,MAAgC,SAIjC,UACX,MAAM;EAGR,MAAM,SAAS,KAAK,QAAQ,cAAc;EAI1C,IAAI,WAAW,gBACb,OAAO,KAAK,KAAK,gBAAgB,GAAG,IAAI;EAG1C,KAAK,QAAQ,KAAK,SAAS,cAAc,CAAC;EAC1C,iBAAiB;CACnB;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,eAAsB,cACpB,QACA,WACuB;CACvB,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;CAE9C,MAAM,eAAe,MAAM,aADT,KAAK,WAAW,SAAS,IAAI,YAAY,KAAK,KAAK,OAAO,KAAK,SAAS,CACzC;CAEjD,MAAM,YAAY,SAAS,cAAc,QAAQ;CACjD,MAAM,aAAa,OAAO,cAAc,CAAC;CACzC,IAAI,cAAc;CAElB,IAAI,CAAC,WACH;OAAK,MAAM,QAAQ,YAGjB,IAAI,SAAS,cAAc,MAFC,aAAa,IAAI,CAEL,GAAG;GACzC,cAAc;GAEd;EACF;CACF;CAGF,IAAI,CAAC,aAAa,CAAC,aACjB,MAAM,IAAI,qBAAqB,SAAS,UAAU,yCAAyC;EACzF,MAAM;EACN,MAAM;CACR,CAAC;CAKH,MAAM,iBAAiB,YACnB,KAAK,SAAS,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAC9D;CAEJ,IAAI,aAAa,OAAO,aAAa,OAAO,UAAU,SAAS,GAC7D;MAAI,eAAe,gBAAgB,OAAO,SAAS,GACjD,MAAM,IAAI,qBAAqB,SAAS,UAAU,2CAA2C;GAC3F,MAAM;GACN,MAAM;EACR,CAAC;CACH;CAGF,OAAO;EAAE;EAAc,cAAc;CAAe;AACtD;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,QAAyB,SAA0B;CAClF,OAAO,kBAAkB,QAAQ,OAAO,CAAC,CAAC;AAC5C;;;;;;;;;;;;;AAcA,SAAgB,SAAS,QAAiD;CACxE,MAAM,QAAQ,OAAO;CACrB,MAAM,MAA8B,CAAC;CAErC,IAAI,CAAC,OACH,OAAO;CAGT,KAAK,MAAM,OAAO,MAAM,cAAc,CAAC,GAAG;EACxC,MAAM,QAAQ,QAAQ,IAAI;EAE1B,IAAI,UAAU,QACZ,IAAI,OAAO;CAEf;CAEA,IAAI,MAAM,KACR,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,GACjD,IAAI,OAAO;CAIf,OAAO;AACT;;;;;;;;AASA,MAAM,0BAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,gBAAgB,QAAiD;CAC/E,MAAM,MAAM,SAAS,MAAM;CAE3B,KAAK,OAAO,OAAO,eAAe,YAAY,MAC5C,OAAO;CAGT,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAAG;EAClC,MAAM,QAAQ,IAAI,YAAY;EAE9B,IAAI,wBAAwB,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,GACrE,OAAO,IAAI;CAEf;CAEA,OAAO;AACT"}

package/esm/policy/shell-check.d.mts

@@ -0,0 +1,64 @@
+import { WorkspacePolicy } from "../contracts/workspace-policy.type.mjs";
+import { WorkspaceShellRefusalReason } from "../errors.mjs";
+
+//#region ../../packages/ai-workspace/src/policy/shell-check.d.ts
+/** How a shell-mode line touches a path the jail has to vet. */
+type WorkspaceShellPathAccess = "read" | "write" | "cwd";
+/** A path a shell-mode line redirects to/from or `cd`s into. */
+interface WorkspaceShellPath {
+  /** Absolute path, resolved lexically against the workspace root (or an earlier `cd`). */
+  path: string;
+  /** What the line does with it. */
+  access: WorkspaceShellPathAccess;
+  /** The target as written in the line. */
+  target: string;
+}
+/**
+ * The shell policy's verdict on one command line — see
+ * {@link checkShellCommand}.
+ */
+interface WorkspaceShellCheck {
+  /** Whether the line may run (path targets still get a symlink-aware recheck in `exec`). */
+  allowed: boolean;
+  /** Why it was refused. */
+  reason?: WorkspaceShellRefusalReason;
+  /** Model-facing refusal text: the cause, and how to fix the command. */
+  message?: string;
+  /** The executable the refusal is about, when there is one. */
+  executable?: string;
+  /** The redirection target or `cd` directory a `"path-escape"` refusal is about. */
+  path?: string;
+  /** The argv of every simple command checked, in order (wrapped commands included). */
+  commands: string[][];
+  /** Shell mode: every redirection target and `cd` directory, for the jail recheck. */
+  paths: WorkspaceShellPath[];
+}
+/**
+ * The shell policy's verdict on a command line, without touching the
+ * filesystem.
+ *
+ * - **argv mode** (`interpreter: "none"`, the default): the line must
+ *   tokenize into one argv; otherwise it is refused with a
+ *   `"metacharacter"` / `"unbalanced-quotes"` reason and a message that
+ *   names the operator and suggests the split.
+ * - **shell mode** (`interpreter: "sh"`): the line is parsed and every
+ *   simple command — inside `;`, `&&`, `||`, pipes, subshells, `$( )`,
+ *   backticks and here-documents — is checked; redirection targets and `cd`
+ *   directories must stay in the jail (checked lexically here; `exec`
+ *   re-checks them with symlinks resolved).
+ *
+ * Every argv goes through `deny` (case-insensitive, wins), `allow`
+ * (exhaustive when non-empty), `denyPatterns` and `allowCommand`.
+ * Wrappers (`env`, `time`, `timeout`, `nice`, `nohup`, `command`,
+ * `builtin`, `exec`) and `find -exec` are followed to the command they run.
+ * A runner the policy cannot see into (`bash -c`, `eval`, `xargs`, `sudo`,
+ * …) is refused while the policy has deny rules, unless `allow` names it.
+ *
+ * @example
+ * checkShellCommand({ cwd, shell: { allow: ["git"] } }, "git add -A && git commit -m wip");
+ * // { allowed: false, reason: "metacharacter", message: "`&&` is not supported in argv mode: run `git add -A`, then `git commit -m wip`, …" }
+ */
+declare function checkShellCommand(policy: WorkspacePolicy, command: string): WorkspaceShellCheck;
+//#endregion
+export { WorkspaceShellCheck, WorkspaceShellPath, WorkspaceShellPathAccess, checkShellCommand };
+//# sourceMappingURL=shell-check.d.mts.map

package/esm/policy/shell-check.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-check.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/shell-check.ts"],"mappings":";;;;;KAmBY,wBAAA;AAAZ;AAAA,UAGiB,kBAAA;;EAEf,IAAA;EALkC;EAOlC,MAAA,EAAQ,wBAAwB;EAJC;EAMjC,MAAA;AAAA;;;;;UAOe,mBAAA;EAPT;EASN,OAAA;EAFkC;EAIlC,MAAA,GAAS,2BAAA;EAUgB;EARzB,OAAA;EAFA;EAIA,UAAA;EAFA;EAIA,IAAA;EAAA;EAEA,QAAA;EAEA;EAAA,KAAA,EAAO,kBAAkB;AAAA;;AA6hCqE;;;;;;;;;;;;;;;;;;;;;;;;iBAAhF,iBAAA,CAAkB,MAAA,EAAQ,eAAA,EAAiB,OAAA,WAAkB,mBAAmB"}