approval-md 0.4.2 → 0.4.5

package/dist/src/cli/wordmark.d.ts

@@ -10,13 +10,13 @@
  * half-blocks, no box-drawing, no emoji, because those are the characters that
  * break in Terminal.app's default font and in every CI log. And it DEGRADES —
  * with colour off it collapses to a single line, so a pipe, a `NO_COLOR`
- * terminal or an ASCII locale gets `approval.md v0.4.2` and no decoration at
+ * terminal or an ASCII locale gets `approval.md v0.4.5` and no decoration at
  * all. The banner is ornament; the name and the version are the information,
  * and only the information survives the degradation.
  */
 import { type Style } from "./style.js";
 /** Kept in step with package.json by a test rather than by memory. */
-export declare const VERSION = "0.4.2";
+export declare const VERSION = "0.4.5";
 export declare const TAGLINE = "human approval for agent actions";
 /** The one-line form, and the only form a pipe ever sees. */
 export declare function plainWordmark(): string;

package/dist/src/cli/wordmark.js

@@ -10,13 +10,13 @@
  * half-blocks, no box-drawing, no emoji, because those are the characters that
  * break in Terminal.app's default font and in every CI log. And it DEGRADES —
  * with colour off it collapses to a single line, so a pipe, a `NO_COLOR`
- * terminal or an ASCII locale gets `approval.md v0.4.2` and no decoration at
+ * terminal or an ASCII locale gets `approval.md v0.4.5` and no decoration at
  * all. The banner is ornament; the name and the version are the information,
  * and only the information survives the degradation.
  */
 import { style as processStyle } from "./style.js";
 /** Kept in step with package.json by a test rather than by memory. */
-export const VERSION = "0.4.2";
+export const VERSION = "0.4.5";
 export const TAGLINE = "human approval for agent actions";
 /**
  * The six-line form. Written as a raw array so no editor reflows it: every

package/dist/src/core/command-class.d.ts

@@ -401,6 +401,12 @@ interface LexSegment {
     text: string;
     words: LexWord[];
     redirects: LexRedirect[];
+    /**
+     * The `$(…)` found in the bodies of unquoted heredocs consumed on this
+     * segment's line (APRV-504, folded into APRV-508). The shell expands them
+     * when the body is read, so they are classified like any other.
+     */
+    bodySubstitutions: string[];
     /** Set when the segment contains a construct whose effect cannot be read. */
     opaque: string | null;
 }
@@ -481,6 +487,15 @@ interface RuleContext {
      * (APRV-114's fetch refinement) needs to know that one of them is a hole.
      */
     substituted: boolean;
+    /**
+     * Did the segment carry a `NAME=value` assignment before the binary (or
+     * before a sandbox wrapper around it)? The classifier strips assignments to
+     * find the binary, so a rule never sees them; a rule whose answer rests on
+     * the argv saying WHICH file runs needs to know the environment may say
+     * otherwise (APRV-502: `BUN_OPTIONS='--cwd ../x'`, `NODE_OPTIONS`,
+     * `PYTHONPATH`, `PYTHONSTARTUP`, `HOME`).
+     */
+    assigned: boolean;
     /** What the caller knows about the machine (APRV-267). Never read from here. */
     context: ClassifierContext;
 }
@@ -531,6 +546,31 @@ export interface CommandRule {
      * answer it has today.
      */
     probe?: boolean;
+    /**
+     * Match only an argv that runs a skill script (APRV-502): allowlisted inert
+     * flags, then a `skills/<skill>/scripts/<file>` path, with no word of the
+     * segment carrying a command substitution and no `NAME=value` assignment
+     * before the binary ({@link skillScriptArg}, {@link matchRule}).
+     *
+     * The same device as `probe`, for the same reason: the row is a SHAPE, and
+     * an argv outside the shape must not match it at all, so `bun --cwd /etc x`
+     * and `python3 -m x` keep the `unclassified` answer they have today rather
+     * than being refined into some other refusal.
+     */
+    skillScript?: boolean;
+    /**
+     * Match only an argv this predicate accepts (APRV-508).
+     *
+     * The general form of `probe` and `skillScript`: the row is a SHAPE, and an
+     * argv outside it does not match the row at all, so the segment keeps the
+     * answer it had before the row existed (`unclassified`, for a binary no other
+     * row names). Before the predicate is asked, a shape row is declined by a
+     * substituted word (its text is a hole) and by a binary spelled with a path
+     * outside the system directories ({@link isSystemBinWord}: `./date` is
+     * whatever program sits in the working directory). `assignments` are the
+     * `NAME=value` words in front of the binary, verbatim.
+     */
+    shape?: (args: readonly string[], assignments: readonly string[]) => boolean;
 }
 /**
  * The suffix that marks a Muse model as training on what it is shown.
@@ -545,6 +585,42 @@ export declare const CONTRIBUTOR_SUFFIX = "-contributor";
 export declare const READ_OUT_OF_SCOPE_RULE = "read-out-of-scope";
 /** The rule id for a read target whose expansion the text cannot show. */
 export declare const READ_UNREADABLE_TARGET_RULE = "read-unreadable-path";
+/** The rule id for `bun` / `python` / `python3` running a skill script. */
+export declare const SKILL_SCRIPT_RULE = "skill-script";
+/** The rule id `refineNode` returns for `node` running a skill script. */
+export declare const NODE_SKILL_SCRIPT_RULE = "node-skill-script";
+/**
+ * Is `word` a skill-script path, in exactly one of the two shapes (APRV-502)?
+ *
+ * - Relative: `skills/<skill>/scripts/<file>`, with any number of leading
+ *   `./` normalised away. Four segments, no more: `skills/x/scripts/sub/f.ts`
+ *   and `.hermes/skills/x/scripts/f.ts` are not this shape.
+ * - Absolute: a path ending `.hermes/skills/<skill>/scripts/<file>` or
+ *   `.hermes/profiles/<p>/skills/<skill>/scripts/<file>`, the same Hermes-home
+ *   grammar {@link protectedPathClass} reads (a profile home is a home of its
+ *   own, one level down).
+ *
+ * Every segment of either shape, the absolute prefix included, must pass
+ * {@link isSkillScriptSegment}: an empty segment (`skills//x`), a `.` or `..`
+ * anywhere, a glob, a variable or a backtick, and the shape does not match.
+ * An unexpanded `$HERMES_HOME/skills/…` or `~/.hermes/skills/…` is therefore
+ * not this rule; the text cannot say where it points.
+ *
+ * Text only, like everything in this file. Whether the file really sits in
+ * the directory it was spelled in is `src/cli/hook.ts`'s disk pass, which can
+ * only tighten this answer.
+ */
+export declare function isSkillScriptPath(word: string): boolean;
+/**
+ * The skill script this interpreter argv runs, or `null` when the argv is not
+ * exactly `[allowlisted flags…] <skill-script path> [arguments…]` (APRV-502).
+ *
+ * Words AFTER the script are the script's own arguments and are not read here:
+ * `python3 skills/agent-commons/scripts/search_forum.py --q x` is the shape.
+ * They are still scanned for protected and credential paths by
+ * `classifySegment`, which runs after the table and can only tighten.
+ */
+export declare function skillScriptArg(bin: string, args: readonly string[]): string | null;
 /**
  * The table.
  *