@yagni-app/code 0.2.1 → 0.3.1

package/dist/extension/execPolicy.js

@@ -0,0 +1,936 @@
+/**
+ * Exec policy engine — classifies bash commands via prefix rules + lightweight
+ * shell tokenization (YAG-504, restructured in YAG-510).
+ *
+ * Pure: no I/O, no network, no model. Loads at startup and classifies
+ * synchronously. The curated default set auto-allows read-only commands
+ * (ls, cat, rg, git status/log/diff), forbids destructive ones (rm -rf,
+ * git reset --hard, git push --force, pipe-to-shell), and prompts for the
+ * ambiguous middle band (npm install, git commit, curl, …).
+ *
+ * The `prompt` band is what the Guardian arbitrates — see guardian.ts.
+ *
+ * Classification composes three signals and takes the STRICTEST:
+ *   1. prefix-rule matching on every segment (newlines, ;, &&, ||, | split);
+ *   2. a construct floor — commands using redirects, substitution, or
+ *      background & can never be auto-allowed (floor: prompt);
+ *   3. dangerScan — a best-effort sweep of command-substitution inner text
+ *      ($(...) and backticks, including inside double quotes) against the
+ *      FORBIDDEN rules only. Danger anywhere upgrades to forbidden; the scan
+ *      can never make anything more permissive.
+ * This is the codex two-parser lesson: fail closed to prove safety, scan
+ * best-effort to prove danger. A forbidden match must win even when the
+ * command also carries constructs (`rm -rf / &` is forbidden, not prompt).
+ *
+ * Command words are matched through a leading-token strip (env assignments,
+ * sudo/env/command wrappers, shell reserved words, a leading backslash) and
+ * basename normalization (/bin/rm → rm) — both applied ASYMMETRICALLY: they
+ * can make a command land on forbidden/prompt rules, but a stripped or
+ * path-prefixed command is never auto-allowed (`sudo ls` and `./ls` stay in
+ * the prompt band; an attacker-named local `./rm` binary must not ride the
+ * allow list, and `/bin/ls` pays the same price by design).
+ *
+ * Tokenization is a lightweight inline parser — not shell-quote — because the
+ * extension is bundled into @yagni-app/code's dist (a file copy, not a real
+ * bundler), and external dependencies aren't resolvable from the bundled path.
+ */
+/**
+ * Parse a shell command string into tokens and control operators.
+ *
+ * Handles:
+ * - Single and double quoted strings (preserves spaces inside)
+ * - Control operators: |, &&, ||, ;, and newlines (a newline separates
+ *   commands exactly like `;` — treating it as whitespace let multiline
+ *   commands smuggle anything behind an allow-listed first line)
+ * - `#` comments (start-of-word to end-of-line, outside quotes)
+ * - Shell constructs we flag as unanalyzable: $(), backticks (INCLUDING
+ *   inside double quotes — bash executes those), >, <, background &
+ * - Redirect metadata: stdout/stderr redirects carry fd + target so that
+ *   safe redirects (2>/dev/null, 2>&1) can be distinguished from unsafe ones
+ *   (> file.txt). Stdin redirects (<, <<) carry no metadata — they always
+ *   floor. Background & emits a distinct `background` op (not `semi`) so
+ *   hasUnhandledConstructs can always catch it.
+ *
+ * Does NOT handle: variable expansion, glob patterns, heredocs beyond the
+ * redirect flag, nested subshells beyond depth tracking. Commands using
+ * those are classified as "prompt" at minimum (construct floor).
+ */
+export function shellParse(command) {
+    const tokens = [];
+    let i = 0;
+    let current = "";
+    let inSingle = false;
+    let inDouble = false;
+    let hasConstruct = false;
+    const pushCurrent = () => {
+        if (current.length > 0) {
+            tokens.push(current);
+            current = "";
+        }
+    };
+    while (i < command.length) {
+        const ch = command[i];
+        if (inSingle) {
+            if (ch === "'") {
+                inSingle = false;
+            }
+            else {
+                current += ch;
+            }
+            i++;
+            continue;
+        }
+        if (inDouble) {
+            if (ch === '"') {
+                inDouble = false;
+                i++;
+                continue;
+            }
+            // Backslash escapes that bash honors inside double quotes: \$ \` \" \\.
+            // Without this, `echo "\$(safe)"` would false-flag as a substitution.
+            if (ch === "\\" && (command[i + 1] === "$" || command[i + 1] === "`" || command[i + 1] === '"' || command[i + 1] === "\\")) {
+                current += command[i + 1];
+                i += 2;
+                continue;
+            }
+            // Bash EXECUTES $(...) and backticks inside double quotes; the old
+            // tokenizer treated them as literal text, which made
+            // `echo "$(rm -rf x)"` classify as a plain echo → allow. Flag as a
+            // construct; dangerScan sweeps the inner text separately.
+            if ((ch === "$" && command[i + 1] === "(") || ch === "`") {
+                hasConstruct = true;
+            }
+            current += ch;
+            i++;
+            continue;
+        }
+        switch (ch) {
+            case "'":
+                inSingle = true;
+                i++;
+                continue;
+            case '"':
+                inDouble = true;
+                i++;
+                continue;
+            case "#":
+                // Comment: only at a word boundary (bash rule). `echo a#b` keeps the #.
+                if (current.length === 0) {
+                    while (i < command.length && command[i] !== "\n")
+                        i++;
+                    continue;
+                }
+                current += ch;
+                i++;
+                continue;
+            case " ":
+            case "\t":
+                pushCurrent();
+                i++;
+                continue;
+            case "\n":
+            case "\r":
+                // Newlines separate commands like `;` — NOT whitespace.
+                pushCurrent();
+                tokens.push({ op: "semi" });
+                i++;
+                continue;
+            case "|":
+                if (command[i + 1] === "|") {
+                    pushCurrent();
+                    tokens.push({ op: "or" });
+                    i += 2;
+                }
+                else {
+                    pushCurrent();
+                    tokens.push({ op: "pipe" });
+                    i++;
+                }
+                continue;
+            case "&":
+                if (command[i + 1] === "&") {
+                    pushCurrent();
+                    tokens.push({ op: "and" });
+                    i += 2;
+                }
+                else {
+                    // Single & — background operator. Emits a distinct `background` op
+                    // (not `semi`) so hasUnhandledConstructs can always catch it and
+                    // floor the command. The command before it must still be rule-
+                    // matched: `rm -rf / &` has to stay forbidden, so emit a separator
+                    // rather than gluing.
+                    pushCurrent();
+                    tokens.push({ op: "background" });
+                    hasConstruct = true;
+                    i++;
+                }
+                continue;
+            case ";":
+                pushCurrent();
+                tokens.push({ op: "semi" });
+                i++;
+                continue;
+            case ">": {
+                pushCurrent();
+                // Check for a preceding fd digit: `2>` → stderr, `1>` → stdout.
+                // The digit was emitted as a string token — pop it and use as fd.
+                let fd = "stdout";
+                if (tokens.length > 0 && typeof tokens[tokens.length - 1] === "string") {
+                    const last = tokens[tokens.length - 1];
+                    if (last === "2") {
+                        fd = "stderr";
+                        tokens.pop();
+                    }
+                    else if (last === "1") {
+                        fd = "stdout";
+                        tokens.pop();
+                    }
+                }
+                let append = false;
+                i++;
+                if (command[i] === ">") {
+                    append = true;
+                    i++;
+                }
+                while (command[i] === " " || command[i] === "\t")
+                    i++;
+                // Read the target — handles quoted targets (mirrors the main loop's
+                // quote logic), fd merges (&N), and bare words.
+                let target = "";
+                if (command[i] === "&") {
+                    // fd merge: &1, &2, etc.
+                    i++;
+                    let digits = "";
+                    while (command[i] >= "0" && command[i] <= "9") {
+                        digits += command[i];
+                        i++;
+                    }
+                    target = "&" + digits;
+                }
+                else if (command[i] === "'") {
+                    i++;
+                    while (i < command.length && command[i] !== "'") {
+                        target += command[i];
+                        i++;
+                    }
+                    if (i < command.length)
+                        i++;
+                }
+                else if (command[i] === '"') {
+                    i++;
+                    while (i < command.length && command[i] !== '"') {
+                        if (command[i] === "\\" && i + 1 < command.length) {
+                            target += command[i + 1];
+                            i += 2;
+                        }
+                        else {
+                            target += command[i];
+                            i++;
+                        }
+                    }
+                    if (i < command.length)
+                        i++;
+                }
+                else {
+                    while (i < command.length &&
+                        command[i] !== " " && command[i] !== "\t" &&
+                        command[i] !== "\n" && command[i] !== "\r" &&
+                        command[i] !== "|" && command[i] !== "&" &&
+                        command[i] !== ";" && command[i] !== ">" &&
+                        command[i] !== "<") {
+                        target += command[i];
+                        i++;
+                    }
+                }
+                tokens.push({ op: "redirect", direction: "out", fd, target, append });
+                hasConstruct = true;
+                continue;
+            }
+            case "<": {
+                pushCurrent();
+                // Stdin redirect — always floors (changes program behavior).
+                i++;
+                if (command[i] === "<")
+                    i++; // << heredoc — skip delimiter
+                while (command[i] === " " || command[i] === "\t")
+                    i++;
+                // Consume the target (filename or heredoc delimiter) so it doesn't
+                // appear as a segment token — mirrors the > case's target reading.
+                if (command[i] === "'") {
+                    i++;
+                    while (i < command.length && command[i] !== "'")
+                        i++;
+                    if (i < command.length)
+                        i++;
+                }
+                else if (command[i] === '"') {
+                    i++;
+                    while (i < command.length && command[i] !== '"') {
+                        if (command[i] === "\\" && i + 1 < command.length)
+                            i += 2;
+                        else
+                            i++;
+                    }
+                    if (i < command.length)
+                        i++;
+                }
+                else {
+                    while (i < command.length &&
+                        command[i] !== " " && command[i] !== "\t" &&
+                        command[i] !== "\n" && command[i] !== "\r" &&
+                        command[i] !== "|" && command[i] !== "&" &&
+                        command[i] !== ";" && command[i] !== ">" &&
+                        command[i] !== "<") {
+                        i++;
+                    }
+                }
+                tokens.push({ op: "redirect", direction: "in" });
+                hasConstruct = true;
+                continue;
+            }
+            case "$":
+                if (command[i + 1] === "(") {
+                    pushCurrent();
+                    tokens.push({ op: "substitution" });
+                    hasConstruct = true;
+                    // Skip until matching )
+                    i += 2;
+                    let depth = 1;
+                    while (i < command.length && depth > 0) {
+                        if (command[i] === "(")
+                            depth++;
+                        if (command[i] === ")")
+                            depth--;
+                        i++;
+                    }
+                    continue;
+                }
+                current += ch;
+                i++;
+                continue;
+            case "`":
+                pushCurrent();
+                tokens.push({ op: "substitution" });
+                hasConstruct = true;
+                i++;
+                while (i < command.length && command[i] !== "`")
+                    i++;
+                if (i < command.length)
+                    i++;
+                continue;
+            default:
+                current += ch;
+                i++;
+                continue;
+        }
+    }
+    pushCurrent();
+    // If we detected constructs but didn't emit them as operator tokens
+    // (e.g. double-quoted substitution), surface that via a trailing
+    // substitution token so hasUnhandledConstructs sees it. Background & now
+    // emits its own distinct op, so it no longer relies on this fallback.
+    if (hasConstruct && !tokens.some((t) => typeof t === "object" && (t.op === "redirect" || t.op === "substitution" || t.op === "background"))) {
+        tokens.push({ op: "substitution" });
+    }
+    return tokens;
+}
+/**
+ * Extract the inner text of every command substitution — $(...) and
+ * backticks — respecting single-quote literalness and backslash escapes.
+ * Includes substitutions inside double quotes (bash executes those).
+ * Best-effort, used ONLY by dangerScan to prove danger, never safety.
+ */
+export function extractSubstitutions(command) {
+    const found = [];
+    let i = 0;
+    let inSingle = false;
+    while (i < command.length) {
+        const ch = command[i];
+        if (inSingle) {
+            if (ch === "'")
+                inSingle = false;
+            i++;
+            continue;
+        }
+        if (ch === "'") {
+            inSingle = true;
+            i++;
+            continue;
+        }
+        if (ch === "\\") {
+            i += 2;
+            continue;
+        }
+        if (ch === "$" && command[i + 1] === "(") {
+            const start = i + 2;
+            let depth = 1;
+            let j = start;
+            while (j < command.length && depth > 0) {
+                if (command[j] === "(")
+                    depth++;
+                if (command[j] === ")")
+                    depth--;
+                j++;
+            }
+            found.push(command.slice(start, depth === 0 ? j - 1 : j));
+            i = j;
+            continue;
+        }
+        if (ch === "`") {
+            const start = i + 1;
+            let j = start;
+            while (j < command.length && command[j] !== "`")
+                j++;
+            found.push(command.slice(start, j));
+            i = j < command.length ? j + 1 : j;
+            continue;
+        }
+        i++;
+    }
+    return found;
+}
+/** Interpreters that, when piped into, indicate code execution — always forbidden. */
+const PIPE_TO_SHELL = new Set([
+    "sh", "bash", "zsh", "fish", "nc", "ncat", "socat",
+    "python", "python3", "perl", "ruby", "node",
+]);
+/** Wrapper words that forward to another command (`sudo rm …` runs rm). */
+const WRAPPER_WORDS = new Set(["sudo", "env", "command", "builtin", "exec", "nohup", "time", "nice"]);
+/** Shell reserved words that can precede a command inside control flow. */
+const RESERVED_WORDS = new Set(["do", "then", "else", "elif", "if", "while", "until", "done", "fi", "esac", "!"]);
+/** Bash env-assignment prefix: FOO=bar cmd … */
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+/**
+ * Parse a command string into tokens using our lightweight tokenizer. Returns
+ * string tokens only (control operators and constructs are filtered out —
+ * detected separately).
+ */
+export function tokenize(command) {
+    return shellParse(command).filter((t) => typeof t === "string");
+}
+/** Ops that split compound commands into segments (pipe, &&, ||, ;, background &). */
+const SPLIT_OPS = new Set(["pipe", "and", "or", "semi", "background"]);
+/** Ops that are safe splittable separators — they do NOT trigger the construct floor.
+ * Background & is in SPLIT_OPS (splits segments) but NOT here (always floors). */
+const SAFE_SPLIT_OPS = new Set(["pipe", "and", "or", "semi"]);
+/** A redirect to /dev/null (discard) or &N (fd merge) is safe — no file created. */
+function isSafeRedirect(t) {
+    if (typeof t === "string")
+        return false;
+    if (t.op !== "redirect")
+        return false;
+    if (t.direction === "in")
+        return false; // stdin redirect — always floor
+    if (t.target === "/dev/null")
+        return true; // discard stderr/stdout — safe
+    if (t.target.startsWith("&") && t.target.length > 1)
+        return true; // fd merge (2>&1, 1>&2) — safe; bare "&" (>& with no digit) is NOT safe
+    return false; // > file.txt, >> file.txt — unsafe
+}
+/**
+ * Detect whether the command uses shell constructs we can't statically
+ * classify (command substitution, unsafe redirects, background &) — anything
+ * that is NOT a safe splittable operator or a safe redirect. These impose a
+ * floor of `prompt`: a command carrying them is never auto-allowed, but
+ * forbidden matches still win.
+ */
+function hasUnhandledConstructs(command) {
+    return shellParse(command).some((t) => typeof t === "object" && !SAFE_SPLIT_OPS.has(t.op) && !isSafeRedirect(t));
+}
+/**
+ * Split a command into token-array segments at control operators (|, &&, ||,
+ * ;, newline, background &). Redirect targets are consumed inside the
+ * tokenizer's > / < cases (stored on the redirect op), so no skipNext logic
+ * is needed. Token arrays are carried through (never re-joined into strings)
+ * so quoting survives.
+ */
+function splitSegmentsTokens(command) {
+    const parsed = shellParse(command);
+    const segments = [];
+    let current = [];
+    for (const t of parsed) {
+        if (typeof t === "object") {
+            if (SPLIT_OPS.has(t.op)) {
+                if (current.length > 0)
+                    segments.push(current);
+                current = [];
+            }
+            // redirect and substitution ops are construct markers; their targets
+            // are consumed inside the tokenizer, and the inner text of $(...) is
+            // handled by dangerScan via extractSubstitutions.
+        }
+        else {
+            current.push(t);
+        }
+    }
+    if (current.length > 0)
+        segments.push(current);
+    return segments;
+}
+/** basename("/usr/bin/git") → "git"; leaves plain words untouched. */
+function basenameToken(token) {
+    const idx = token.lastIndexOf("/");
+    return idx >= 0 ? token.slice(idx + 1) : token;
+}
+/**
+ * Unified leading-token strip: remove env assignments, wrapper words (plus
+ * their immediate dash-flags), shell reserved words, leading `(`/`{` (even
+ * glued: `(rm`), and a leading backslash on the command word. Used to FIND
+ * the command word for forbidden/prompt matching — callers must treat a
+ * stripped result as never-allow (see classifySegmentTokens).
+ */
+function stripLeadingTokens(tokens) {
+    const out = [...tokens];
+    let stripped = false;
+    let guard = 0;
+    while (out.length > 0 && guard++ < 32) {
+        let t = out[0];
+        // Leading ( or { — possibly glued to the command word.
+        if (t.startsWith("(") || t.startsWith("{")) {
+            const trimmed = t.replace(/^[({]+/, "");
+            stripped = true;
+            if (trimmed.length === 0) {
+                out.shift();
+            }
+            else {
+                out[0] = trimmed;
+            }
+            continue;
+        }
+        // Trailing ) } on a lone closer token — drop (e.g. segment "rm -rf /)" ).
+        if (/^[)}]+$/.test(t)) {
+            out.shift();
+            stripped = true;
+            continue;
+        }
+        if (RESERVED_WORDS.has(t)) {
+            out.shift();
+            stripped = true;
+            continue;
+        }
+        if (ENV_ASSIGNMENT_RE.test(t)) {
+            out.shift();
+            stripped = true;
+            continue;
+        }
+        if (WRAPPER_WORDS.has(basenameToken(t))) {
+            out.shift();
+            stripped = true;
+            // Wrapper flags (env -i, sudo -n, …). Imperfect for flags that take a
+            // separate value (sudo -u alice); worst case the "command word" is the
+            // value and we land in the prompt band — never allow.
+            while (out.length > 0 && out[0].startsWith("-"))
+                out.shift();
+            continue;
+        }
+        if (t.startsWith("\\") && t.length > 1) {
+            out[0] = t.slice(1);
+            stripped = true;
+            continue;
+        }
+        break;
+    }
+    return { tokens: out, stripped };
+}
+/**
+ * git accepts global options between `git` and the subcommand (`git -C /x
+ * push --force`). Skip them so subcommand rules and flagsAnywhere see the
+ * real shape. Matching-only — never mutates what actually runs.
+ */
+function normalizeGitTokens(tokens) {
+    if (tokens[0] !== "git")
+        return tokens;
+    const out = ["git"];
+    let i = 1;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (t === "-C" || t === "-c") {
+            i += 2; // option + its value
+            continue;
+        }
+        if (t.startsWith("--git-dir") ||
+            t.startsWith("--work-tree") ||
+            t.startsWith("--exec-path") ||
+            t === "-p" ||
+            t === "--paginate" ||
+            t === "--no-pager") {
+            i += 1;
+            continue;
+        }
+        break;
+    }
+    out.push(...tokens.slice(i));
+    return out;
+}
+/** Glob-aware token match shared by unlessTokens and flagsAnywhere. */
+function tokenMatchesEntry(token, entry) {
+    return entry.endsWith("*") ? token.startsWith(entry.slice(0, -1)) : token === entry;
+}
+/** Match a token array against a prefix rule's pattern. */
+function matchRule(tokens, rule) {
+    if (tokens.length < rule.pattern.length)
+        return false;
+    for (let i = 0; i < rule.pattern.length; i++) {
+        const pat = rule.pattern[i];
+        const tok = tokens[i];
+        if (typeof pat === "string") {
+            if (pat !== tok)
+                return false;
+        }
+        else {
+            if (!pat.includes(tok))
+                return false;
+        }
+    }
+    if (rule.flagsAnywhere) {
+        const rest = tokens.slice(rule.pattern.length);
+        const hit = rest.some((tok) => rule.flagsAnywhere.some((f) => tokenMatchesEntry(tok, f)));
+        if (!hit)
+            return false;
+    }
+    if (rule.unlessTokens) {
+        for (const tok of tokens.slice(rule.pattern.length)) {
+            for (const unless of rule.unlessTokens) {
+                if (tokenMatchesEntry(tok, unless))
+                    return false;
+            }
+        }
+    }
+    return true;
+}
+/** Decision severity: forbidden > prompt > allow. */
+const SEVERITY = { allow: 0, prompt: 1, forbidden: 2 };
+function stricter(a, b) {
+    return SEVERITY[b.decision] > SEVERITY[a.decision] ? b : a;
+}
+/** Depth cap for substitution/xargs recursion (matches codex's wrapper cap). */
+const MAX_SCAN_DEPTH = 8;
+/** Classify one segment's tokens against the rules. */
+function classifySegmentTokens(rawTokens, policy, opts) {
+    if (rawTokens.length === 0) {
+        return { decision: "prompt", justification: "empty command segment" };
+    }
+    const { tokens: strippedTokens, stripped } = stripLeadingTokens(rawTokens);
+    if (strippedTokens.length === 0) {
+        return opts.forbiddenOnly
+            ? { decision: "allow", justification: "no forbidden match" }
+            : { decision: "prompt", justification: "empty command segment" };
+    }
+    // Asymmetric basename normalization: /bin/rm → rm for matching, but a
+    // path-prefixed command word disqualifies allow (see below).
+    const cmdWord = strippedTokens[0];
+    const normalizedWord = basenameToken(cmdWord);
+    const pathPrefixed = normalizedWord !== cmdWord;
+    let tokens = pathPrefixed ? [normalizedWord, ...strippedTokens.slice(1)] : strippedTokens;
+    tokens = normalizeGitTokens(tokens);
+    const neverAllow = stripped || pathPrefixed;
+    // xargs forwards to its argv tail: classify the tail as its own segment so
+    // `xargs rm -rf` inherits rm's forbidden. xargs itself is never allow.
+    if (tokens[0] === "xargs" && opts.depth < MAX_SCAN_DEPTH) {
+        let j = 1;
+        while (j < tokens.length && tokens[j].startsWith("-"))
+            j++;
+        const tail = tokens.slice(j);
+        if (tail.length > 0) {
+            const tailResult = classifySegmentTokens(tail, policy, { ...opts, depth: opts.depth + 1 });
+            if (tailResult.decision === "forbidden")
+                return tailResult;
+            if (tailResult.decision === "allow" && !neverAllow) {
+                return { decision: "allow", justification: "xargs forwards to a read-only command" };
+            }
+        }
+        if (opts.forbiddenOnly)
+            return { decision: "allow", justification: "no forbidden match" };
+        return { decision: "prompt", justification: "xargs executes its argument command — review the target" };
+    }
+    // First match wins (rules are ordered; more specific rules come first).
+    for (const rule of policy.rules) {
+        if (opts.forbiddenOnly && rule.decision !== "forbidden")
+            continue;
+        if (matchRule(tokens, rule)) {
+            if (rule.decision === "allow" && neverAllow) {
+                return {
+                    decision: "prompt",
+                    justification: "wrapper- or path-prefixed command cannot be auto-allowed",
+                };
+            }
+            return { decision: rule.decision, justification: rule.justification, matchedRule: rule };
+        }
+    }
+    if (opts.forbiddenOnly) {
+        return { decision: "allow", justification: "no forbidden match" };
+    }
+    // No rule matched → prompt (fail toward review, not toward allow)
+    return { decision: "prompt", justification: `no policy rule matched for "${tokens[0]}"` };
+}
+/** Check if any segment pipes into a known shell/network interpreter. */
+function isPipeToShell(command) {
+    const parsed = shellParse(command);
+    for (let i = 0; i < parsed.length - 1; i++) {
+        const t = parsed[i];
+        if (typeof t === "object" && t.op === "pipe") {
+            const next = parsed[i + 1];
+            if (typeof next !== "string")
+                continue;
+            const word = basenameToken(next.startsWith("\\") ? next.slice(1) : next);
+            if (PIPE_TO_SHELL.has(word))
+                return true;
+            // `… | env sh` / `… | /usr/bin/env sh`
+            if (word === "env") {
+                const after = parsed[i + 2];
+                if (typeof after === "string" && PIPE_TO_SHELL.has(basenameToken(after)))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Best-effort danger sweep of command-substitution inner text ($(...) and
+ * backticks, including inside double quotes). Matches FORBIDDEN rules only —
+ * can upgrade the classification, never relax it.
+ */
+function dangerScanSubstitutions(command, policy, depth) {
+    if (depth > MAX_SCAN_DEPTH)
+        return null;
+    for (const inner of extractSubstitutions(command)) {
+        if (inner.trim().length === 0)
+            continue;
+        if (isPipeToShell(inner)) {
+            return {
+                decision: "forbidden",
+                justification: "piping into a shell or network interpreter is forbidden",
+            };
+        }
+        for (const seg of splitSegmentsTokens(inner)) {
+            const r = classifySegmentTokens(seg, policy, { forbiddenOnly: true, depth: depth + 1 });
+            if (r.decision === "forbidden")
+                return r;
+        }
+        const nested = dangerScanSubstitutions(inner, policy, depth + 1);
+        if (nested)
+            return nested;
+    }
+    return null;
+}
+/**
+ * Classify a full bash command string against the exec policy.
+ *
+ * Compound commands (pipes, &&, ||, ;, newlines) are split into segments and
+ * each is classified independently; the strictest decision wins (forbidden >
+ * prompt > allow). Commands with shell constructs (substitution, redirects,
+ * background &) have a floor of `prompt`, and their substitution inner text
+ * is danger-scanned against the forbidden rules. Pipe-to-shell is always
+ * forbidden.
+ */
+export function classifyCommand(command, policy) {
+    // Pipe-to-shell is always forbidden regardless of other rules.
+    if (isPipeToShell(command)) {
+        return {
+            decision: "forbidden",
+            justification: "piping into a shell or network interpreter is forbidden",
+        };
+    }
+    const constructFloor = hasUnhandledConstructs(command);
+    const segments = splitSegmentsTokens(command);
+    let result = null;
+    for (const seg of segments) {
+        const segResult = classifySegmentTokens(seg, policy, { depth: 0 });
+        result = result === null ? segResult : stricter(result, segResult);
+        if (result.decision === "forbidden")
+            break;
+    }
+    if (result === null) {
+        result = { decision: "prompt", justification: "empty command segment" };
+    }
+    // Danger sweep of substitution inner text — upgrade-only.
+    if (result.decision !== "forbidden") {
+        const danger = dangerScanSubstitutions(command, policy, 0);
+        if (danger)
+            result = danger;
+    }
+    // Construct floor: redirects/substitutions/background can never auto-allow.
+    if (constructFloor && result.decision === "allow") {
+        result = {
+            decision: "prompt",
+            justification: "command uses shell constructs (substitution/redirect/background) that cannot be statically analyzed",
+        };
+    }
+    return result;
+}
+/** Curated default rules — the shipped safety floor. */
+export const DEFAULT_EXEC_POLICY = {
+    rules: [
+        // --- forbidden: position-independent dangerous-flag rules (checked first;
+        //     GNU getopt permutes flags, so `rm x -rf` and `git push origin
+        //     --force` carry the flag after positional args) ---
+        {
+            pattern: ["rm"],
+            flagsAnywhere: ["-r*", "-f*", "--recursive*", "--force*"],
+            decision: "forbidden",
+            justification: "recursive/forced deletion is destructive and irreversible",
+        },
+        {
+            // Exact --force/-f only: --force-with-lease is the guarded variant and
+            // deliberately stays in the prompt band (Guardian reviews it) — but the
+            // grants layer fences ALL --force* so a prefix approval never covers it
+            // (approvedPrefixes.ts).
+            pattern: ["git", "push"],
+            flagsAnywhere: ["--force", "-f", "--mirror", "--delete", "-d", "--receive-pack*", "--exec*"],
+            decision: "forbidden",
+            justification: "force/delete/mirror push rewrites or removes shared history",
+        },
+        {
+            pattern: ["git", "clean"],
+            flagsAnywhere: ["-f*", "-d*", "-x*", "--force*"],
+            decision: "forbidden",
+            justification: "git clean removes untracked files irreversibly",
+        },
+        {
+            pattern: ["chmod"],
+            flagsAnywhere: ["777", "0777", "a+rwx"],
+            decision: "forbidden",
+            justification: "world-writable permission change weakens security",
+        },
+        {
+            pattern: ["chown"],
+            flagsAnywhere: ["-R*", "--recursive*"],
+            decision: "forbidden",
+            justification: "recursive ownership change",
+        },
+        {
+            pattern: ["kill"],
+            flagsAnywhere: ["-9", "-KILL", "-SIGKILL"],
+            decision: "forbidden",
+            justification: "force kill is destructive",
+        },
+        // --- forbidden: destructive commands (positional) ---
+        {
+            pattern: ["rm", ["-rf", "-fr", "-r", "-f", "--recursive", "--force"]],
+            decision: "forbidden",
+            justification: "recursive/forced deletion is destructive and irreversible",
+        },
+        { pattern: ["git", "reset", "--hard"], decision: "forbidden", justification: "hard reset discards uncommitted changes irreversibly" },
+        { pattern: ["git", "checkout", "--"], decision: "forbidden", justification: "discards working tree changes" },
+        { pattern: ["dd"], decision: "forbidden", justification: "low-level disk operations are destructive" },
+        { pattern: ["mkfs"], decision: "forbidden", justification: "filesystem formatting is destructive" },
+        { pattern: ["shutdown"], decision: "forbidden", justification: "system shutdown" },
+        { pattern: ["reboot"], decision: "forbidden", justification: "system reboot" },
+        { pattern: ["truncate"], decision: "forbidden", justification: "truncates files destructively" },
+        // --- allow: read-only commands ---
+        { pattern: ["ls"], decision: "allow", justification: "list directory contents" },
+        { pattern: ["cat"], decision: "allow", justification: "read file contents" },
+        { pattern: ["head"], decision: "allow", justification: "read file head" },
+        { pattern: ["tail"], decision: "allow", justification: "read file tail" },
+        { pattern: ["wc"], decision: "allow", justification: "count lines/words" },
+        { pattern: ["pwd"], decision: "allow", justification: "print working directory" },
+        { pattern: ["which"], decision: "allow", justification: "locate a command" },
+        { pattern: ["echo"], decision: "allow", justification: "print text" },
+        { pattern: ["true"], decision: "allow", justification: "no-op success" },
+        { pattern: ["false"], decision: "allow", justification: "no-op failure" },
+        { pattern: ["test"], decision: "allow", justification: "test condition" },
+        {
+            pattern: ["find"],
+            decision: "allow",
+            justification: "search for files (read-only without -delete/-exec)",
+            unlessTokens: ["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint*", "-fls"],
+        },
+        { pattern: ["grep"], decision: "allow", justification: "search text" },
+        { pattern: ["rg"], decision: "allow", justification: "search text (ripgrep)" },
+        { pattern: ["ag"], decision: "allow", justification: "search text (silver searcher)" },
+        { pattern: ["cd"], decision: "allow", justification: "change directory (scoped to this bash invocation)" },
+        {
+            pattern: ["sed"],
+            decision: "allow",
+            justification: "stream-edit text to stdout (read-only without -i)",
+            unlessTokens: ["-i*", "--in-place*"],
+        },
+        { pattern: ["awk"], decision: "allow", justification: "text processing to stdout" },
+        { pattern: ["sort"], decision: "allow", justification: "sort lines" },
+        { pattern: ["uniq"], decision: "allow", justification: "filter duplicate lines" },
+        { pattern: ["cut"], decision: "allow", justification: "extract columns" },
+        { pattern: ["tr"], decision: "allow", justification: "translate characters" },
+        { pattern: ["diff"], decision: "allow", justification: "compare files" },
+        { pattern: ["nl"], decision: "allow", justification: "number lines" },
+        { pattern: ["jq"], decision: "allow", justification: "filter JSON to stdout" },
+        { pattern: ["stat"], decision: "allow", justification: "show file metadata" },
+        { pattern: ["file"], decision: "allow", justification: "identify file type" },
+        { pattern: ["strings"], decision: "allow", justification: "extract printable strings from binary files (read-only)" },
+        { pattern: ["basename"], decision: "allow", justification: "strip directory from path" },
+        { pattern: ["dirname"], decision: "allow", justification: "extract directory from path" },
+        { pattern: ["realpath"], decision: "allow", justification: "resolve a path" },
+        { pattern: ["readlink"], decision: "allow", justification: "resolve a symlink" },
+        { pattern: ["tree"], decision: "allow", justification: "list directory tree" },
+        { pattern: ["du"], decision: "allow", justification: "show disk usage" },
+        { pattern: ["df"], decision: "allow", justification: "show filesystem usage" },
+        { pattern: ["date"], decision: "allow", justification: "show date/time" },
+        { pattern: ["printf"], decision: "allow", justification: "print formatted text" },
+        { pattern: ["whoami"], decision: "allow", justification: "show current user" },
+        { pattern: ["uname"], decision: "allow", justification: "show system info" },
+        { pattern: ["git", "status"], decision: "allow", justification: "show working tree status" },
+        { pattern: ["git", "log"], decision: "allow", justification: "show commit log" },
+        { pattern: ["git", "diff"], decision: "allow", justification: "show changes" },
+        { pattern: ["git", "branch"], decision: "allow", justification: "list branches" },
+        { pattern: ["git", "show"], decision: "allow", justification: "show a commit" },
+        { pattern: ["git", "remote"], decision: "allow", justification: "list remotes" },
+        { pattern: ["git", "rev-parse"], decision: "allow", justification: "resolve git refs" },
+        { pattern: ["git", "worktree", "list"], decision: "allow", justification: "list worktrees" },
+        { pattern: ["git", "blame"], decision: "allow", justification: "show line authorship" },
+        { pattern: ["git", "grep"], decision: "allow", justification: "search tracked files" },
+        { pattern: ["git", "ls-files"], decision: "allow", justification: "list tracked files" },
+        { pattern: ["git", "describe"], decision: "allow", justification: "describe a commit" },
+        { pattern: ["git", "shortlog"], decision: "allow", justification: "summarize commit log" },
+        { pattern: ["git", "stash", "list"], decision: "allow", justification: "list stashes" },
+        { pattern: ["gh", "pr", ["view", "list", "diff", "checks", "status"]], decision: "allow", justification: "read pull request data" },
+        { pattern: ["gh", "issue", ["view", "list", "status"]], decision: "allow", justification: "read issue data" },
+        { pattern: ["gh", "run", ["view", "list"]], decision: "allow", justification: "read workflow run data" },
+        { pattern: ["gh", "repo", "view"], decision: "allow", justification: "read repository data" },
+        { pattern: ["gh", "search"], decision: "allow", justification: "search GitHub" },
+        { pattern: ["node", "--version"], decision: "allow", justification: "check node version" },
+        { pattern: ["node", "-v"], decision: "allow", justification: "check node version" },
+        { pattern: ["npm", "ls"], decision: "allow", justification: "list installed packages" },
+        { pattern: ["npm", "list"], decision: "allow", justification: "list installed packages" },
+        { pattern: ["pnpm", "ls"], decision: "allow", justification: "list installed packages" },
+        { pattern: ["pnpm", "list"], decision: "allow", justification: "list installed packages" },
+        { pattern: ["pnpm", "--version"], decision: "allow", justification: "check pnpm version" },
+        { pattern: ["tsc", "--version"], decision: "allow", justification: "check typescript version" },
+        // --- prompt: potentially destructive but context-dependent ---
+        { pattern: ["rm"], decision: "prompt", justification: "file deletion — review the target" },
+        { pattern: ["git", "commit"], decision: "prompt", justification: "creates a commit — confirm intent" },
+        { pattern: ["git", "push"], decision: "prompt", justification: "pushes to remote — confirm intent" },
+        { pattern: ["git", "merge"], decision: "prompt", justification: "merges branches — may conflict" },
+        { pattern: ["git", "rebase"], decision: "prompt", justification: "rebases — rewrites history" },
+        { pattern: ["git", "stash"], decision: "prompt", justification: "stashes working changes" },
+        { pattern: ["git", "checkout"], decision: "prompt", justification: "switches branch or restores files" },
+        { pattern: ["git", "switch"], decision: "prompt", justification: "switches branch" },
+        { pattern: ["git", "reset"], decision: "prompt", justification: "resets HEAD — may discard changes" },
+        { pattern: ["git", "revert"], decision: "prompt", justification: "creates a revert commit" },
+        { pattern: ["git", "cherry-pick"], decision: "prompt", justification: "applies a specific commit" },
+        { pattern: ["npm", "install"], decision: "prompt", justification: "installs packages — modifies node_modules" },
+        { pattern: ["npm", "ci"], decision: "prompt", justification: "clean install — modifies node_modules" },
+        { pattern: ["pnpm", "install"], decision: "prompt", justification: "installs packages — modifies node_modules" },
+        { pattern: ["pnpm", "add"], decision: "prompt", justification: "adds a dependency" },
+        { pattern: ["pnpm", "remove"], decision: "prompt", justification: "removes a dependency" },
+        { pattern: ["npm", "run"], decision: "prompt", justification: "runs a script — may have side effects" },
+        { pattern: ["pnpm", ["run", "exec"]], decision: "prompt", justification: "runs a script or binary — may have side effects" },
+        { pattern: ["npx"], decision: "prompt", justification: "executes a package — may have side effects" },
+        { pattern: ["curl"], decision: "prompt", justification: "network request — review the URL" },
+        { pattern: ["wget"], decision: "prompt", justification: "network download — review the URL" },
+        { pattern: ["docker"], decision: "prompt", justification: "docker command — may have side effects" },
+        { pattern: ["psql"], decision: "prompt", justification: "database command — may modify data" },
+        { pattern: ["fly"], decision: "prompt", justification: "Fly.io command — may affect production" },
+        { pattern: ["kubectl"], decision: "prompt", justification: "Kubernetes command — may affect production" },
+        { pattern: ["mv"], decision: "prompt", justification: "moves files — may overwrite" },
+        { pattern: ["cp"], decision: "prompt", justification: "copies files" },
+        { pattern: ["mkdir"], decision: "prompt", justification: "creates directories" },
+        { pattern: ["touch"], decision: "prompt", justification: "creates or updates file timestamps" },
+        { pattern: ["tar"], decision: "prompt", justification: "archive operation" },
+        { pattern: ["zip"], decision: "prompt", justification: "archive operation" },
+        { pattern: ["unzip"], decision: "prompt", justification: "archive operation" },
+        { pattern: ["ps"], decision: "prompt", justification: "lists processes" },
+        { pattern: ["kill"], decision: "prompt", justification: "sends a signal to a process" },
+        { pattern: ["chmod"], decision: "prompt", justification: "permission change — review the mode" },
+        { pattern: ["chown"], decision: "prompt", justification: "ownership change" },
+    ],
+};
+//# sourceMappingURL=execPolicy.js.map