@webpieces/rules-config 0.4.713 → 0.4.714
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@webpieces/rules-config",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.714",
|
|
4
4
|
"description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -105,14 +105,21 @@ that denied `rm -rf node_modules && pnpm install` while allowing a bare `pnpm in
|
|
|
105
105
|
| 12 | pnpm exec wp-install-ai-hooks (flags allowed, e.g. --target=project) | ALLOW |
|
|
106
106
|
| 13 | pnpm add -D @webpieces/ai-hook-rules (an @version and extra flags allowed) | ALLOW |
|
|
107
107
|
| 14 | read-only orientation: pwd, git status/log/diff/show/branch/rev-parse, git worktree list | ALLOW |
|
|
108
|
+
| 15 | CODEX ONLY - a read-shaped Bash command (the harness has no Read tool): cat, head, tail, less, more, bat, or sed -n '<range>p' | PASS |
|
|
108
109
|
|
|
109
110
|
- **PASS** — L0 has no objection; the call falls THROUGH so the downstream guards still judge it.
|
|
110
111
|
- **ALLOW** — terminal; bypasses everything, because a cure must stay reachable even when a
|
|
111
112
|
downstream guard would block it.
|
|
112
113
|
|
|
113
|
-
Every Bash entry is anchored to the WHOLE command.
|
|
114
|
-
and
|
|
115
|
-
|
|
114
|
+
Every Bash entry is anchored to the WHOLE command. Appending `&& git status` makes it a DIFFERENT
|
|
115
|
+
command and it is rejected again — that is not the guard refusing its own cure.
|
|
116
|
+
|
|
117
|
+
On an UNGATED entry a leading `cd <dir> &&`, a trailing `2>&1` and a pipe into `tail`/`head` are
|
|
118
|
+
tolerated; nothing else is. **The harness-gated read row tolerates NONE of the three** — not the
|
|
119
|
+
`cd` prefix, not the redirect, not the pipe — so `cat f 2>&1` and `cat f | head -20` are both
|
|
120
|
+
rejected. That is deliberate, not an oversight: the row means exactly what
|
|
121
|
+
`core/shell-read-parity.ts` means by "this is a read", and that module treats a pipe or a redirect
|
|
122
|
+
as proof the command is more than one. Type the bare command.
|
|
116
123
|
|
|
117
124
|
`git merge` is deliberately NOT on this list. Main is merged ONLY through the 3-point fork merge
|
|
118
125
|
(`pnpm wp-start-update`, or `pnpm wp-start-upsert-pr` when a PR is already open).
|