@warlock.js/ai-workspace 5.30.0 → 5.32.0

package/esm/policy/policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"policy.mjs","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"sourcesContent":["import path from \"node:path\";\nimport { realpath } from \"node:fs/promises\";\nimport { WorkspacePolicyError } from \"../errors\";\nimport { tokenizeCommand } from \"./tokenize-command\";\nimport type { WorkspacePolicy } from \"../contracts\";\n\n/**\n * The outcome of resolving a workspace-relative (or absolute) input path\n * against the jail — the canonical absolute location the backend should\n * touch, plus the workspace-relative form (POSIX-style, `/`-separated)\n * the agent and tool results echo back.\n */\nexport interface ResolvedPath {\n  /** Canonical absolute path (symlinks in existing ancestors collapsed). */\n  absolutePath: string;\n  /**\n   * The path relative to `policy.cwd`, `/`-separated regardless of OS,\n   * used in tool results so the agent always sees stable workspace paths.\n   * Empty string when the resolved path IS the jail root.\n   */\n  relativePath: string;\n}\n\n/**\n * Resolve the canonical absolute form of `target`, collapsing any\n * symlinks. `target` may not yet exist (a fresh `writeFile`/`mkdir`),\n * so we realpath the deepest **existing** ancestor and re-attach the\n * non-existent tail — a symlinked ancestor still cannot smuggle the\n * path out of the jail, while genuinely new leaves stay creatable.\n */\nasync function canonicalize(target: string): Promise<string> {\n  let resolvedTarget = path.resolve(target);\n  const tail: string[] = [];\n\n  // Walk up until an existing ancestor is found (or we hit the root).\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    try {\n      const real = await realpath(resolvedTarget);\n\n      return tail.length > 0 ? path.join(real, ...tail) : real;\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n\n      // Only ENOENT means \"this segment doesn't exist yet\" — keep\n      // walking up. Any other error (EACCES, ELOOP, …) is a real fault.\n      if (code !== \"ENOENT\") {\n        throw error;\n      }\n\n      const parent = path.dirname(resolvedTarget);\n\n      // Reached the filesystem root without finding an existing\n      // ancestor — give back the lexically-resolved path unchanged.\n      if (parent === resolvedTarget) {\n        return path.join(resolvedTarget, ...tail);\n      }\n\n      tail.unshift(path.basename(resolvedTarget));\n      resolvedTarget = parent;\n    }\n  }\n}\n\n/**\n * Whether `child` is contained within `root` (or equals it), comparing\n * canonical absolute paths. Guards against the `/srv/app-evil` vs\n * `/srv/app` prefix-collision by anchoring on a path separator.\n */\nfunction isInside(child: string, root: string): boolean {\n  const relative = path.relative(root, child);\n\n  return (\n    relative === \"\" ||\n    (!relative.startsWith(\"..\") && !path.isAbsolute(relative))\n  );\n}\n\n/**\n * Translate a glob (the small subset used by `denyPaths` — `*`, `**`,\n * `?`) into an anchored `RegExp` over a `/`-separated relative path.\n * `**` spans path separators; a single `*` does not.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let source = \"\";\n\n  for (let index = 0; index < glob.length; index++) {\n    const char = glob[index];\n\n    if (char === \"*\") {\n      if (glob[index + 1] === \"*\") {\n        // `**` — match across segments (and an optional trailing slash).\n        source += \".*\";\n        index++;\n\n        if (glob[index + 1] === \"/\") {\n          index++;\n        }\n      } else {\n        // `*` — match within a single segment.\n        source += \"[^/]*\";\n      }\n\n      continue;\n    }\n\n    if (char === \"?\") {\n      source += \"[^/]\";\n\n      continue;\n    }\n\n    // Escape everything else so it matches literally.\n    source += char.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  }\n\n  return new RegExp(`^${source}$`);\n}\n\n/**\n * Whether a workspace-relative (`/`-separated) path matches any of the\n * policy's `denyPaths` globs. A deny glob also blocks everything beneath\n * a matched directory (`\".git/**\"` blocks `.git/config`).\n */\nfunction matchesDeny(relativePath: string, denyPaths: string[]): boolean {\n  return denyPaths.some((glob) => {\n    if (globToRegExp(glob).test(relativePath)) {\n      return true;\n    }\n\n    // A bare directory glob (`\".git\"`, `\"node_modules\"`) should also\n    // block its contents, mirroring how `\".git/**\"` would behave.\n    if (!glob.includes(\"*\") && !glob.includes(\"?\")) {\n      const prefix = glob.endsWith(\"/\") ? glob : `${glob}/`;\n\n      return relativePath.startsWith(prefix);\n    }\n\n    return false;\n  });\n}\n\n/**\n * Resolve and jail a single input path against a {@link WorkspacePolicy}.\n *\n * The input is resolved against `policy.cwd`, canonicalized (symlinks in\n * existing ancestors collapsed so a symlinked directory cannot escape\n * the jail), then accepted **only** when it sits under `cwd` or one of\n * the `allowPaths` roots. A path that escapes, or that matches any\n * `denyPaths` glob even while inside `cwd`, is rejected with a\n * {@link WorkspacePolicyError} of type `\"path-escape\"`.\n *\n * @param policy - The bounding policy (its `cwd` is the jail root).\n * @param inputPath - A workspace-relative or absolute path to resolve.\n * @returns The canonical absolute path plus its `/`-separated relative form.\n * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.\n *\n * @example\n * const { absolutePath } = await resolveInJail(policy, \"src/index.ts\");\n */\nexport async function resolveInJail(\n  policy: WorkspacePolicy,\n  inputPath: string,\n): Promise<ResolvedPath> {\n  const jailRoot = await canonicalize(policy.cwd);\n  const requested = path.isAbsolute(inputPath)\n    ? inputPath\n    : path.join(policy.cwd, inputPath);\n  const absolutePath = await canonicalize(requested);\n\n  const insideCwd = isInside(absolutePath, jailRoot);\n  const allowRoots = policy.allowPaths ?? [];\n  let insideAllow = false;\n\n  if (!insideCwd) {\n    for (const root of allowRoots) {\n      const canonicalRoot = await canonicalize(root);\n\n      if (isInside(absolutePath, canonicalRoot)) {\n        insideAllow = true;\n\n        break;\n      }\n    }\n  }\n\n  if (!insideCwd && !insideAllow) {\n    throw new WorkspacePolicyError(\n      `Path \"${inputPath}\" resolves outside the workspace jail.`,\n      { type: \"path-escape\", path: inputPath },\n    );\n  }\n\n  // `denyPaths` is evaluated relative to the jail root and wins even\n  // when the path is comfortably inside `cwd`.\n  const relativeToJail = insideCwd\n    ? path.relative(jailRoot, absolutePath).split(path.sep).join(\"/\")\n    : \"\";\n\n  if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {\n    if (matchesDeny(relativeToJail, policy.denyPaths)) {\n      throw new WorkspacePolicyError(\n        `Path \"${inputPath}\" is blocked by the workspace deny list.`,\n        { type: \"path-escape\", path: inputPath },\n      );\n    }\n  }\n\n  return { absolutePath, relativePath: relativeToJail };\n}\n\n/**\n * Reduce an argv's first element to the basename the allow/deny policy is\n * keyed on. `\"npm\"` → `\"npm\"`; `\"/usr/bin/node\"` → `\"node\"`; `\"node.exe\"`\n * → `\"node\"` (the `.exe`/`.cmd`/`.bat`/`.com` Windows extension is\n * stripped).\n */\nfunction executableBasename(firstToken: string): string {\n  const base = path.basename(firstToken);\n\n  return base.replace(/\\.(exe|cmd|bat|com)$/i, \"\");\n}\n\n/**\n * Whether a shell command is permitted by the policy's `shell` sub-policy.\n *\n * The command is first tokenized via {@link tokenizeCommand} — a command\n * that cannot be represented as a single argv (unbalanced quotes, or\n * unquoted shell metacharacters such as `;`, `&&`, `|`, backticks, `$`,\n * redirection) is denied outright. The backend spawns the argv directly\n * with no shell, so such a command has no meaning here — and unquoted\n * metacharacters were exactly how an injected command chain used to ride\n * past the allowlist. The resolved `argv[0]` basename is then matched\n * against `shell.deny` then `shell.allow`. **Deny always wins.** When\n * `shell.allow` is set, the executable MUST appear in it (fail-closed\n * allowlist); when `allow` is absent/empty, any non-denied command is\n * permitted. An absent `shell` block means no command may run at all.\n *\n * Returns a plain `boolean` rather than throwing — the ops layer raises\n * the {@link WorkspacePolicyError} so the thrown context (`command`)\n * lives next to the call site.\n *\n * @example\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test\"); // true\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"rm -rf /\"); // false\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test; rm -rf /\"); // false\n */\nexport function isCommandAllowed(\n  policy: WorkspacePolicy,\n  command: string,\n): boolean {\n  const shell = policy.shell;\n\n  // No shell sub-policy ⇒ fail-closed: nothing may run.\n  if (!shell) {\n    return false;\n  }\n\n  const argv = tokenizeCommand(command);\n\n  if (argv === null) {\n    return false;\n  }\n\n  const executable = executableBasename(argv[0]);\n\n  if (executable === \"\") {\n    return false;\n  }\n\n  // Deny wins over everything else.\n  if (shell.deny && shell.deny.includes(executable)) {\n    return false;\n  }\n\n  // An allowlist, when present, is exhaustive.\n  if (shell.allow && shell.allow.length > 0) {\n    return shell.allow.includes(executable);\n  }\n\n  // No allowlist: anything not explicitly denied is permitted.\n  return true;\n}\n\n/**\n * Build the exact environment a spawned process receives — `process.env`\n * is **never** inherited wholesale. The result is\n * `{ ...pick(process.env, inheritEnv), ...shell.env }`, so a command\n * cannot see `PATH` (and thus often cannot find `node`/`npm`) unless the\n * policy opts in via `shell.inheritEnv: [\"PATH\"]`. Explicit `shell.env`\n * values override inherited ones on key collision.\n *\n * @example\n * buildEnv({ cwd, shell: { inheritEnv: [\"PATH\"], env: { CI: \"1\" } } });\n * // → { PATH: <process PATH>, CI: \"1\" }\n */\nexport function buildEnv(policy: WorkspacePolicy): Record<string, string> {\n  const shell = policy.shell;\n  const env: Record<string, string> = {};\n\n  if (!shell) {\n    return env;\n  }\n\n  for (const key of shell.inheritEnv ?? []) {\n    const value = process.env[key];\n\n    if (value !== undefined) {\n      env[key] = value;\n    }\n  }\n\n  if (shell.env) {\n    for (const [key, value] of Object.entries(shell.env)) {\n      env[key] = value;\n    }\n  }\n\n  return env;\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,eAAe,aAAa,QAAiC;CAC3D,IAAI,iBAAiB,KAAK,QAAQ,MAAM;CACxC,MAAM,OAAiB,CAAC;CAIxB,OAAO,MACL,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,cAAc;EAE1C,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,IAAI,IAAI;CACtD,SAAS,OAAO;EAKd,IAJc,MAAgC,SAIjC,UACX,MAAM;EAGR,MAAM,SAAS,KAAK,QAAQ,cAAc;EAI1C,IAAI,WAAW,gBACb,OAAO,KAAK,KAAK,gBAAgB,GAAG,IAAI;EAG1C,KAAK,QAAQ,KAAK,SAAS,cAAc,CAAC;EAC1C,iBAAiB;CACnB;AAEJ;;;;;;AAOA,SAAS,SAAS,OAAe,MAAuB;CACtD,MAAM,WAAW,KAAK,SAAS,MAAM,KAAK;CAE1C,OACE,aAAa,MACZ,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AAE5D;;;;;;AAOA,SAAS,aAAa,MAAsB;CAC1C,IAAI,SAAS;CAEb,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,OAAO,KAAK;EAElB,IAAI,SAAS,KAAK;GAChB,IAAI,KAAK,QAAQ,OAAO,KAAK;IAE3B,UAAU;IACV;IAEA,IAAI,KAAK,QAAQ,OAAO,KACtB;GAEJ,OAEE,UAAU;GAGZ;EACF;EAEA,IAAI,SAAS,KAAK;GAChB,UAAU;GAEV;EACF;EAGA,UAAU,KAAK,QAAQ,qBAAqB,MAAM;CACpD;CAEA,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE;AACjC;;;;;;AAOA,SAAS,YAAY,cAAsB,WAA8B;CACvE,OAAO,UAAU,MAAM,SAAS;EAC9B,IAAI,aAAa,IAAI,CAAC,CAAC,KAAK,YAAY,GACtC,OAAO;EAKT,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,SAAS,GAAG,GAAG;GAC9C,MAAM,SAAS,KAAK,SAAS,GAAG,IAAI,OAAO,GAAG,KAAK;GAEnD,OAAO,aAAa,WAAW,MAAM;EACvC;EAEA,OAAO;CACT,CAAC;AACH;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,cACpB,QACA,WACuB;CACvB,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;CAI9C,MAAM,eAAe,MAAM,aAHT,KAAK,WAAW,SAAS,IACvC,YACA,KAAK,KAAK,OAAO,KAAK,SAAS,CACc;CAEjD,MAAM,YAAY,SAAS,cAAc,QAAQ;CACjD,MAAM,aAAa,OAAO,cAAc,CAAC;CACzC,IAAI,cAAc;CAElB,IAAI,CAAC,WACH;OAAK,MAAM,QAAQ,YAGjB,IAAI,SAAS,cAAc,MAFC,aAAa,IAAI,CAEL,GAAG;GACzC,cAAc;GAEd;EACF;CACF;CAGF,IAAI,CAAC,aAAa,CAAC,aACjB,MAAM,IAAI,qBACR,SAAS,UAAU,yCACnB;EAAE,MAAM;EAAe,MAAM;CAAU,CACzC;CAKF,MAAM,iBAAiB,YACnB,KAAK,SAAS,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAC9D;CAEJ,IAAI,aAAa,OAAO,aAAa,OAAO,UAAU,SAAS,GAC7D;MAAI,YAAY,gBAAgB,OAAO,SAAS,GAC9C,MAAM,IAAI,qBACR,SAAS,UAAU,2CACnB;GAAE,MAAM;GAAe,MAAM;EAAU,CACzC;CACF;CAGF,OAAO;EAAE;EAAc,cAAc;CAAe;AACtD;;;;;;;AAQA,SAAS,mBAAmB,YAA4B;CAGtD,OAFa,KAAK,SAAS,UAEjB,CAAC,CAAC,QAAQ,yBAAyB,EAAE;AACjD;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,iBACd,QACA,SACS;CACT,MAAM,QAAQ,OAAO;CAGrB,IAAI,CAAC,OACH,OAAO;CAGT,MAAM,OAAO,gBAAgB,OAAO;CAEpC,IAAI,SAAS,MACX,OAAO;CAGT,MAAM,aAAa,mBAAmB,KAAK,EAAE;CAE7C,IAAI,eAAe,IACjB,OAAO;CAIT,IAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,UAAU,GAC9C,OAAO;CAIT,IAAI,MAAM,SAAS,MAAM,MAAM,SAAS,GACtC,OAAO,MAAM,MAAM,SAAS,UAAU;CAIxC,OAAO;AACT;;;;;;;;;;;;;AAcA,SAAgB,SAAS,QAAiD;CACxE,MAAM,QAAQ,OAAO;CACrB,MAAM,MAA8B,CAAC;CAErC,IAAI,CAAC,OACH,OAAO;CAGT,KAAK,MAAM,OAAO,MAAM,cAAc,CAAC,GAAG;EACxC,MAAM,QAAQ,QAAQ,IAAI;EAE1B,IAAI,UAAU,QACZ,IAAI,OAAO;CAEf;CAEA,IAAI,MAAM,KACR,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,GACjD,IAAI,OAAO;CAIf,OAAO;AACT"}
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"sourcesContent":["import path from \"node:path\";\nimport { realpath } from \"node:fs/promises\";\nimport { WorkspacePolicyError } from \"../errors\";\nimport type { WorkspacePolicy } from \"../contracts\";\nimport { isInside, matchesAnyGlob } from \"./jail\";\nimport { checkShellCommand } from \"./shell-check\";\n\n/**\n * The outcome of resolving a workspace-relative (or absolute) input path\n * against the jail — the canonical absolute location the backend should\n * touch, plus the workspace-relative form (POSIX-style, `/`-separated)\n * the agent and tool results echo back.\n */\nexport interface ResolvedPath {\n  /** Canonical absolute path (symlinks in existing ancestors collapsed). */\n  absolutePath: string;\n  /**\n   * The path relative to `policy.cwd`, `/`-separated regardless of OS,\n   * used in tool results so the agent always sees stable workspace paths.\n   * Empty string when the resolved path IS the jail root.\n   */\n  relativePath: string;\n}\n\n/**\n * Resolve the canonical absolute form of `target`, collapsing any\n * symlinks. `target` may not yet exist (a fresh `writeFile`/`mkdir`),\n * so we realpath the deepest **existing** ancestor and re-attach the\n * non-existent tail — a symlinked ancestor still cannot smuggle the\n * path out of the jail, while genuinely new leaves stay creatable.\n */\nasync function canonicalize(target: string): Promise<string> {\n  let resolvedTarget = path.resolve(target);\n  const tail: string[] = [];\n\n  // Walk up until an existing ancestor is found (or we hit the root).\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    try {\n      const real = await realpath(resolvedTarget);\n\n      return tail.length > 0 ? path.join(real, ...tail) : real;\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n\n      // Only ENOENT means \"this segment doesn't exist yet\" — keep\n      // walking up. Any other error (EACCES, ELOOP, …) is a real fault.\n      if (code !== \"ENOENT\") {\n        throw error;\n      }\n\n      const parent = path.dirname(resolvedTarget);\n\n      // Reached the filesystem root without finding an existing\n      // ancestor — give back the lexically-resolved path unchanged.\n      if (parent === resolvedTarget) {\n        return path.join(resolvedTarget, ...tail);\n      }\n\n      tail.unshift(path.basename(resolvedTarget));\n      resolvedTarget = parent;\n    }\n  }\n}\n\n/**\n * Resolve and jail a single input path against a {@link WorkspacePolicy}.\n *\n * The input is resolved against `policy.cwd`, canonicalized (symlinks in\n * existing ancestors collapsed so a symlinked directory cannot escape\n * the jail), then accepted **only** when it sits under `cwd` or one of\n * the `allowPaths` roots. A path that escapes, or that matches any\n * `denyPaths` glob even while inside `cwd`, is rejected with a\n * {@link WorkspacePolicyError} of type `\"path-escape\"`.\n *\n * Why this does not use `@warlock.js/fs`'s confined reader (`fs.confined`):\n * the two answer different questions. The confined reader refuses absolute\n * paths, refuses every symbolic link (or follows only links inside its one\n * root), requires the path to exist, and reads the file itself through a\n * no-follow, identity-checked open. This jail must instead accept absolute\n * paths inside `cwd`, several `allowPaths` roots, `denyPaths` globs, a\n * symlinked `cwd`, links whose target stays inside, and paths that do not\n * exist yet (`writeFile`, `mkdir`), and it returns a path that writes,\n * `exec`'s working directory and redirections use afterwards. Switching would\n * change what agents may touch, so the workspace keeps this resolver.\n *\n * @param policy - The bounding policy (its `cwd` is the jail root).\n * @param inputPath - A workspace-relative or absolute path to resolve.\n * @returns The canonical absolute path plus its `/`-separated relative form.\n * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.\n *\n * @example\n * const { absolutePath } = await resolveInJail(policy, \"src/index.ts\");\n */\nexport async function resolveInJail(\n  policy: WorkspacePolicy,\n  inputPath: string,\n): Promise<ResolvedPath> {\n  const jailRoot = await canonicalize(policy.cwd);\n  const requested = path.isAbsolute(inputPath) ? inputPath : path.join(policy.cwd, inputPath);\n  const absolutePath = await canonicalize(requested);\n\n  const insideCwd = isInside(absolutePath, jailRoot);\n  const allowRoots = policy.allowPaths ?? [];\n  let insideAllow = false;\n\n  if (!insideCwd) {\n    for (const root of allowRoots) {\n      const canonicalRoot = await canonicalize(root);\n\n      if (isInside(absolutePath, canonicalRoot)) {\n        insideAllow = true;\n\n        break;\n      }\n    }\n  }\n\n  if (!insideCwd && !insideAllow) {\n    throw new WorkspacePolicyError(`Path \"${inputPath}\" resolves outside the workspace jail.`, {\n      type: \"path-escape\",\n      path: inputPath,\n    });\n  }\n\n  // `denyPaths` is evaluated relative to the jail root and wins even\n  // when the path is comfortably inside `cwd`.\n  const relativeToJail = insideCwd\n    ? path.relative(jailRoot, absolutePath).split(path.sep).join(\"/\")\n    : \"\";\n\n  if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {\n    if (matchesAnyGlob(relativeToJail, policy.denyPaths)) {\n      throw new WorkspacePolicyError(`Path \"${inputPath}\" is blocked by the workspace deny list.`, {\n        type: \"path-escape\",\n        path: inputPath,\n      });\n    }\n  }\n\n  return { absolutePath, relativePath: relativeToJail };\n}\n\n/**\n * Whether a command line is permitted by the policy's `shell` sub-policy —\n * `checkShellCommand(policy, command).allowed`.\n *\n * In argv mode (the default) the command must tokenize into a single argv\n * (no unquoted `;`, `&&`, `|`, backticks, `$`, redirection, …): the backend\n * spawns it with no shell, and unquoted metacharacters were exactly how an\n * injected command chain used to ride past the allowlist. In shell mode\n * (`interpreter: \"sh\"`) every simple command in the line is checked. Each\n * argv's executable basename is matched against `shell.deny` (wins, case\n * insensitive) then `shell.allow` (exhaustive when non-empty), then\n * `shell.denyPatterns` and `shell.allowCommand`. An absent `shell` block\n * means no command may run at all.\n *\n * Returns a plain `boolean`; use {@link checkShellCommand} for the reason\n * and the model-facing message. Redirection targets are checked lexically\n * here; `exec` re-checks them with symlinks resolved.\n *\n * @example\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test\"); // true\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"rm -rf /\"); // false\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test; rm -rf /\"); // false\n */\nexport function isCommandAllowed(policy: WorkspacePolicy, command: string): boolean {\n  return checkShellCommand(policy, command).allowed;\n}\n\n/**\n * Build the exact environment a spawned process receives — `process.env`\n * is **never** inherited wholesale. The result is\n * `{ ...pick(process.env, inheritEnv), ...shell.env }`, so a command\n * cannot see `PATH` (and thus often cannot find `node`/`npm`) unless the\n * policy opts in via `shell.inheritEnv: [\"PATH\"]`. Explicit `shell.env`\n * values override inherited ones on key collision.\n *\n * @example\n * buildEnv({ cwd, shell: { inheritEnv: [\"PATH\"], env: { CI: \"1\" } } });\n * // → { PATH: <process PATH>, CI: \"1\" }\n */\nexport function buildEnv(policy: WorkspacePolicy): Record<string, string> {\n  const shell = policy.shell;\n  const env: Record<string, string> = {};\n\n  if (!shell) {\n    return env;\n  }\n\n  for (const key of shell.inheritEnv ?? []) {\n    const value = process.env[key];\n\n    if (value !== undefined) {\n      env[key] = value;\n    }\n  }\n\n  if (shell.env) {\n    for (const [key, value] of Object.entries(shell.env)) {\n      env[key] = value;\n    }\n  }\n\n  return env;\n}\n\n/**\n * Variables removed from the environment of a shell-mode (`interpreter:\n * \"sh\"`) command: each changes how the shell itself starts, parses or\n * resolves the line (`ENV`/`BASH_ENV` run a startup file, `SHELLOPTS` +\n * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that\n * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).\n */\nconst SHELL_STARTUP_VARIABLES = new Set([\n  \"ENV\",\n  \"BASH_ENV\",\n  \"SHELLOPTS\",\n  \"BASHOPTS\",\n  \"CDPATH\",\n  \"IFS\",\n  \"PS4\",\n  \"GLOBIGNORE\",\n]);\n\n/**\n * The environment a command actually receives: {@link buildEnv}, minus the\n * shell start-up variables when the policy runs lines through a shell.\n * Compared case-insensitively, because Windows environment names are.\n */\nexport function buildCommandEnv(policy: WorkspacePolicy): Record<string, string> {\n  const env = buildEnv(policy);\n\n  if ((policy.shell?.interpreter ?? \"none\") !== \"sh\") {\n    return env;\n  }\n\n  for (const key of Object.keys(env)) {\n    const upper = key.toUpperCase();\n\n    if (SHELL_STARTUP_VARIABLES.has(upper) || upper.startsWith(\"BASH_FUNC_\")) {\n      delete env[key];\n    }\n  }\n\n  return env;\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,eAAe,aAAa,QAAiC;CAC3D,IAAI,iBAAiB,KAAK,QAAQ,MAAM;CACxC,MAAM,OAAiB,CAAC;CAIxB,OAAO,MACL,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,cAAc;EAE1C,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,IAAI,IAAI;CACtD,SAAS,OAAO;EAKd,IAJc,MAAgC,SAIjC,UACX,MAAM;EAGR,MAAM,SAAS,KAAK,QAAQ,cAAc;EAI1C,IAAI,WAAW,gBACb,OAAO,KAAK,KAAK,gBAAgB,GAAG,IAAI;EAG1C,KAAK,QAAQ,KAAK,SAAS,cAAc,CAAC;EAC1C,iBAAiB;CACnB;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,eAAsB,cACpB,QACA,WACuB;CACvB,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;CAE9C,MAAM,eAAe,MAAM,aADT,KAAK,WAAW,SAAS,IAAI,YAAY,KAAK,KAAK,OAAO,KAAK,SAAS,CACzC;CAEjD,MAAM,YAAY,SAAS,cAAc,QAAQ;CACjD,MAAM,aAAa,OAAO,cAAc,CAAC;CACzC,IAAI,cAAc;CAElB,IAAI,CAAC,WACH,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,gBAAgB,MAAM,aAAa,IAAI;EAE7C,IAAI,SAAS,cAAc,aAAa,GAAG;GACzC,cAAc;GAEd;EACF;CACF;CAGF,IAAI,CAAC,aAAa,CAAC,aACjB,MAAM,IAAI,qBAAqB,SAAS,UAAU,yCAAyC;EACzF,MAAM;EACN,MAAM;CACR,CAAC;CAKH,MAAM,iBAAiB,YACnB,KAAK,SAAS,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAC9D;CAEJ,IAAI,aAAa,OAAO,aAAa,OAAO,UAAU,SAAS,GAC7D;MAAI,eAAe,gBAAgB,OAAO,SAAS,GACjD,MAAM,IAAI,qBAAqB,SAAS,UAAU,2CAA2C;GAC3F,MAAM;GACN,MAAM;EACR,CAAC;CACH;CAGF,OAAO;EAAE;EAAc,cAAc;CAAe;AACtD;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,QAAyB,SAA0B;CAClF,OAAO,kBAAkB,QAAQ,OAAO,CAAC,CAAC;AAC5C;;;;;;;;;;;;;AAcA,SAAgB,SAAS,QAAiD;CACxE,MAAM,QAAQ,OAAO;CACrB,MAAM,MAA8B,CAAC;CAErC,IAAI,CAAC,OACH,OAAO;CAGT,KAAK,MAAM,OAAO,MAAM,cAAc,CAAC,GAAG;EACxC,MAAM,QAAQ,QAAQ,IAAI;EAE1B,IAAI,UAAU,QACZ,IAAI,OAAO;CAEf;CAEA,IAAI,MAAM,KACR,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,GACjD,IAAI,OAAO;CAIf,OAAO;AACT;;;;;;;;AASA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,gBAAgB,QAAiD;CAC/E,MAAM,MAAM,SAAS,MAAM;CAE3B,KAAK,OAAO,OAAO,eAAe,YAAY,MAC5C,OAAO;CAGT,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAAG;EAClC,MAAM,QAAQ,IAAI,YAAY;EAE9B,IAAI,wBAAwB,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,GACrE,OAAO,IAAI;CAEf;CAEA,OAAO;AACT"}

package/esm/policy/shell-check.d.mts

@@ -0,0 +1,63 @@
+import { WorkspacePolicy } from "../contracts/workspace-policy.type.mjs";
+import "../contracts/index.mjs";
+import { WorkspaceShellRefusalReason } from "../errors.mjs";
+//#region ../../packages/ai-workspace/src/policy/shell-check.d.ts
+/** How a shell-mode line touches a path the jail has to vet. */
+export type WorkspaceShellPathAccess = "read" | "write" | "cwd";
+/** A path a shell-mode line redirects to/from or `cd`s into. */
+export interface WorkspaceShellPath {
+  /** Absolute path, resolved lexically against the workspace root (or an earlier `cd`). */
+  path: string;
+  /** What the line does with it. */
+  access: WorkspaceShellPathAccess;
+  /** The target as written in the line. */
+  target: string;
+}
+/**
+ * The shell policy's verdict on one command line — see
+ * {@link checkShellCommand}.
+ */
+export interface WorkspaceShellCheck {
+  /** Whether the line may run (path targets still get a symlink-aware recheck in `exec`). */
+  allowed: boolean;
+  /** Why it was refused. */
+  reason?: WorkspaceShellRefusalReason;
+  /** Model-facing refusal text: the cause, and how to fix the command. */
+  message?: string;
+  /** The executable the refusal is about, when there is one. */
+  executable?: string;
+  /** The redirection target or `cd` directory a `"path-escape"` refusal is about. */
+  path?: string;
+  /** The argv of every simple command checked, in order (wrapped commands included). */
+  commands: string[][];
+  /** Shell mode: every redirection target and `cd` directory, for the jail recheck. */
+  paths: WorkspaceShellPath[];
+}
+/**
+ * The shell policy's verdict on a command line, without touching the
+ * filesystem.
+ *
+ * - **argv mode** (`interpreter: "none"`, the default): the line must
+ *   tokenize into one argv; otherwise it is refused with a
+ *   `"metacharacter"` / `"unbalanced-quotes"` reason and a message that
+ *   names the operator and suggests the split.
+ * - **shell mode** (`interpreter: "sh"`): the line is parsed and every
+ *   simple command — inside `;`, `&&`, `||`, pipes, subshells, `$( )`,
+ *   backticks and here-documents — is checked; redirection targets and `cd`
+ *   directories must stay in the jail (checked lexically here; `exec`
+ *   re-checks them with symlinks resolved).
+ *
+ * Every argv goes through `deny` (case-insensitive, wins), `allow`
+ * (exhaustive when non-empty), `denyPatterns` and `allowCommand`.
+ * Wrappers (`env`, `time`, `timeout`, `nice`, `nohup`, `command`,
+ * `builtin`, `exec`) and `find -exec` are followed to the command they run.
+ * A runner the policy cannot see into (`bash -c`, `eval`, `xargs`, `sudo`,
+ * …) is refused while the policy has deny rules, unless `allow` names it.
+ *
+ * @example
+ * checkShellCommand({ cwd, shell: { allow: ["git"] } }, "git add -A && git commit -m wip");
+ * // { allowed: false, reason: "metacharacter", message: "`&&` is not supported in argv mode: run `git add -A`, then `git commit -m wip`, …" }
+ */
+export declare function checkShellCommand(policy: WorkspacePolicy, command: string): WorkspaceShellCheck;
+//#endregion
+//# sourceMappingURL=shell-check.d.mts.map

package/esm/policy/shell-check.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-check.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/shell-check.ts"],"mappings":";;;;;YAmBY;;iBAGK;;EAEf;;EAEA,QAAQ;;EAER;;;;;;iBAOe;;EAEf;;EAEA,SAAS;;EAET;;EAEA;;EAEA;;EAEA;;EAEA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6hCO,kBAAkB,QAAQ,iBAAiB,kBAAkB"}