approval-md 0.4.3 → 0.4.6

package/dist/src/core/sysinfo-argv.js

@@ -0,0 +1,340 @@
+/**
+ * The system-information readers' safe forms (APRV-508).
+ *
+ * `uptime`, `whoami`, `hostname`, `df`, `free`, `seq` and `paste` each print
+ * something and change nothing in the forms below, and some of them change
+ * something in forms that look almost the same: `hostname NAME` and `hostname
+ * -F FILE` SET the host name, `free -s N` loops forever, `uptime FILE` reads a
+ * utmp file. So each binary gets a STRICT allow-grammar rather than a seat in
+ * the read table:
+ *
+ * - every flag is matched by its exact spelling. No abbreviation (getopt and
+ *   clap both accept a unique prefix of a long option), no cluster except the
+ *   ones a table below lists word for word, no `=` joined to a short flag;
+ * - `--` is never accepted;
+ * - an operand is accepted only where the binary's grammar names one, and
+ *   only in the shape it names (a number for `seq`, a file for `paste`);
+ * - a word carrying `$`, a backtick, a glob or a brace is never accepted,
+ *   since the shell may expand it into words this grammar never saw;
+ * - nothing else. An argv this file does not recognise answers `false`, and
+ *   the classifier row does not match, so the command keeps the
+ *   `unclassified` refusal it had before the row existed.
+ *
+ * Two implementations are read at once: GNU (coreutils, procps, net-tools
+ * `hostname`) and uutils coreutils 0.10, which the hosted boxes run. Where a
+ * spelling exists in one and not the other, the other errors out on it, which
+ * is a refusal by the tool rather than a different act.
+ */
+/**
+ * Characters the shell may expand into more words, or into other words. A
+ * leading `~` is not among them: it expands to one path and never splits, and
+ * the read scope already judges a `~` path as one it cannot place.
+ */
+const UNREADABLE_WORD = /[$`*?[\]{}]/u;
+/** No word of this argv is one the shell may expand. */
+function literal(args) {
+    return !args.some((arg) => UNREADABLE_WORD.test(arg));
+}
+/**
+ * The option each flag word sets, so that two spellings of one option count
+ * as a repeat (`-s --serial`, `-h --human-readable`, `-h -hT`). A word not in
+ * the map is its own option.
+ */
+const SAME_OPTION = {
+    "--human-readable": ["-h"],
+    "--si": ["-H"],
+    "--print-type": ["-T"],
+    "--inodes": ["-i"],
+    "--all": ["-a"],
+    "--local": ["-l"],
+    "--portability": ["-P"],
+    "-hT": ["-h", "-T"],
+    "-Th": ["-h", "-T"],
+    "-hi": ["-h", "-i"],
+    "-ih": ["-h", "-i"],
+    "-hl": ["-h", "-l"],
+    "-lh": ["-h", "-l"],
+    "--bytes": ["-b"],
+    "--kibi": ["-k"],
+    "--mebi": ["-m"],
+    "--gibi": ["-g"],
+    "--human": ["-h"],
+    "--lohi": ["-l"],
+    "--total": ["-t"],
+    "--wide": ["-w"],
+    "--committed": ["-v"],
+    "-ht": ["-h", "-t"],
+    "-th": ["-h", "-t"],
+    "-hw": ["-h", "-w"],
+    "-wh": ["-h", "-w"],
+    "--equal-width": ["-w"],
+    "--separator": ["-s"],
+    "--format": ["-f"],
+    "--serial": ["-s"],
+    "--zero-terminated": ["-z"],
+};
+/**
+ * No option is given twice, in any spelling. clap (uutils) refuses a repeated
+ * option where getopt takes the last one, so the grammar admits neither.
+ * `-dX` / `--delimiters=X` and `--separator=X` / `--format=X` count by name.
+ */
+function noRepeatedFlag(args, valueWords = []) {
+    const seen = new Set();
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (!arg.startsWith("-") || arg === "-" || /^-[\d.]/u.test(arg))
+            continue;
+        let name = arg;
+        if (arg.startsWith("--delimiters=") || (arg.startsWith("-d") && !arg.startsWith("--")))
+            name = "-d";
+        else if (arg.startsWith("--separator="))
+            name = "-s";
+        else if (arg.startsWith("--format="))
+            name = "-f";
+        for (const option of SAME_OPTION[name] ?? [name]) {
+            if (seen.has(option))
+                return false;
+            seen.add(option);
+        }
+        // A separate-word value is not a flag, even when it looks like one.
+        if (valueWords.includes(arg))
+            index += 1;
+    }
+    return true;
+}
+/** `--help` or `--version`, alone. */
+function isHelpOrVersion(args) {
+    return args.length === 1 && (args[0] === "--help" || args[0] === "--version");
+}
+/** `uptime` and `whoami`: nothing, or `--help` / `--version`. */
+export function isBareInfo(args) {
+    return args.length === 0 || isHelpOrVersion(args);
+}
+/**
+ * `hostname`: nothing, or ONE display flag. Any operand sets the host name,
+ * and `-F`/`--file`/`-b`/`--boot` set it from a file or at boot, so none of
+ * them is in the list.
+ */
+const HOSTNAME_FLAGS = [
+    "-s",
+    "--short",
+    "-f",
+    "--fqdn",
+    "--long",
+    "-d",
+    "--domain",
+    "-i",
+    "--ip-address",
+    "-I",
+    "--all-ip-addresses",
+    "--help",
+    "--version",
+];
+export function isHostnameDisplay(args) {
+    if (args.length === 0)
+        return true;
+    return args.length === 1 && HOSTNAME_FLAGS.includes(args[0]);
+}
+/**
+ * `df`: display flags only. A path operand would be a read the read scope
+ * judges, and the agents asking need the mount table, so operands are not in
+ * the grammar. `--output` and the type filters are left out with them.
+ */
+const DF_FLAGS = [
+    "-h",
+    "--human-readable",
+    "-H",
+    "--si",
+    "-k",
+    "-T",
+    "--print-type",
+    "-i",
+    "--inodes",
+    "-a",
+    "--all",
+    "-l",
+    "--local",
+    "-P",
+    "--portability",
+    "--total",
+    "--help",
+    "--version",
+    // The clusters, by exact spelling.
+    "-hT",
+    "-Th",
+    "-hi",
+    "-ih",
+    "-hl",
+    "-lh",
+];
+export function isDfDisplay(args) {
+    return literal(args) && noRepeatedFlag(args) && args.every((arg) => DF_FLAGS.includes(arg));
+}
+/**
+ * `free`: display flags only. `-s`/`--seconds` and `-c`/`--count` repeat the
+ * report on a timer, which holds the turn rather than reading anything, and
+ * stay out.
+ */
+const FREE_FLAGS = [
+    "-b",
+    "--bytes",
+    "-k",
+    "--kibi",
+    "--kilo",
+    "-m",
+    "--mebi",
+    "--mega",
+    "-g",
+    "--gibi",
+    "--giga",
+    "-h",
+    "--human",
+    "--si",
+    "-l",
+    "--lohi",
+    "-t",
+    "--total",
+    "-w",
+    "--wide",
+    "-v",
+    "--committed",
+    "--help",
+    "--version",
+    "-ht",
+    "-th",
+    "-hw",
+    "-wh",
+];
+export function isFreeDisplay(args) {
+    return literal(args) && noRepeatedFlag(args) && args.every((arg) => FREE_FLAGS.includes(arg));
+}
+/** A decimal number, signed or not, with an optional exponent. No hex, `inf` or `nan`. */
+const SEQ_NUMBER = /^[-+]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][-+]?\d+)?$/u;
+/**
+ * The most values an admitted `seq` prints (refutation S4). `seq 1e18` is a
+ * read in the sense that it changes nothing, but it holds the turn the way
+ * `free -s` does, so a range past this is not admitted.
+ */
+export const SEQ_MAX_VALUES = 100_000;
+/**
+ * Can a double hold this number exactly enough to count with? (Recheck S-R2.)
+ * GNU and uutils count digit strings exactly, so a range narrower than half a
+ * ULP of its ends (`seq 1e30-ish 1e30-ish+5e13`) reads as one value to a
+ * double and prints fifty trillion. No more than 15 significant digits, and no
+ * magnitude above 2^53, keeps every admitted operand exact enough.
+ */
+function isCountable(word) {
+    const mantissa = word.replace(/^[-+]/u, "").replace(/[eE].*$/u, "").replace(".", "");
+    const significant = mantissa.replace(/^0+/u, "");
+    if (significant.length > 15)
+        return false;
+    return Math.abs(Number(word)) <= 2 ** 53;
+}
+/** How many values `seq FIRST [INCREMENT] LAST` prints; Infinity when it never ends. */
+function seqCount(numbers) {
+    const [first, increment, last] = numbers.length === 1
+        ? [1, 1, numbers[0]]
+        : numbers.length === 2
+            ? [numbers[0], 1, numbers[1]]
+            : [numbers[0], numbers[1], numbers[2]];
+    if (![first, increment, last].every((n) => Number.isFinite(n)))
+        return Infinity;
+    if (increment === 0)
+        return Infinity;
+    const steps = Math.floor((last - first) / increment);
+    return steps < 0 ? 0 : steps + 1;
+}
+/** One floating-point directive, `%%` escapes around it, nothing else. */
+const SEQ_FORMAT = /^(?:[^%]|%%)*%[-+ #0]*\d*(?:\.\d+)?[eEfFgG](?:[^%]|%%)*$/u;
+/** A separator: any literal text that does not look like a flag. */
+function isSeqSeparator(value) {
+    return value !== undefined && !value.startsWith("-");
+}
+/**
+ * `seq`: one to three numbers, with `-w`/`--equal-width`, `-s SEP` /
+ * `--separator=SEP` and `-f FMT` / `--format=FMT`. A separate-word value is
+ * the next word; the attached short spellings (`-s,`) are not in the grammar.
+ * Every flag comes BEFORE the first number: uutils reads a word after a number
+ * as another number (`seq 1 -w` is an error there and a flag to GNU), and the
+ * grammar takes the reading both agree on.
+ */
+export function isSeqDisplay(args) {
+    if (!literal(args) || !noRepeatedFlag(args, ["-s", "--separator", "-f", "--format"]))
+        return false;
+    if (isHelpOrVersion(args))
+        return true;
+    let numbers = 0;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (numbers > 0) {
+            if (!SEQ_NUMBER.test(arg))
+                return false;
+            numbers += 1;
+            continue;
+        }
+        if (arg === "-w" || arg === "--equal-width")
+            continue;
+        if (arg === "-s" || arg === "--separator") {
+            index += 1;
+            if (!isSeqSeparator(args[index]))
+                return false;
+            continue;
+        }
+        if (arg.startsWith("--separator="))
+            continue;
+        if (arg === "-f" || arg === "--format") {
+            index += 1;
+            // A flag-shaped value is the value to getopt and the next flag to clap.
+            const value = args[index] ?? "";
+            if (value.startsWith("-") || !SEQ_FORMAT.test(value))
+                return false;
+            continue;
+        }
+        if (arg.startsWith("--format=")) {
+            if (!SEQ_FORMAT.test(arg.slice("--format=".length)))
+                return false;
+            continue;
+        }
+        if (!SEQ_NUMBER.test(arg))
+            return false;
+        numbers += 1;
+    }
+    // GNU and uutils both refuse a format beside equal width.
+    const width = args.includes("-w") || args.includes("--equal-width");
+    const format = args.some((arg) => arg === "-f" || arg === "--format" || arg.startsWith("--format="));
+    if (width && format)
+        return false;
+    if (numbers < 1 || numbers > 3)
+        return false;
+    const operands = args.slice(args.length - numbers);
+    if (!operands.every((word) => isCountable(word)))
+        return false;
+    return seqCount(operands.map(Number)) <= SEQ_MAX_VALUES;
+}
+/**
+ * `paste`: files (or `-`, standard input) with `-s`/`--serial`,
+ * `-z`/`--zero-terminated`, and the delimiter list ATTACHED (`-d,`,
+ * `--delimiters=,`). Attached, so that every positional is a file: the read
+ * scope takes paste's operands exactly as it takes `cat`'s (`READ_TARGET_SHAPES`
+ * in read-scope.ts), and a delimiter in its own word would be taken for one.
+ */
+const PASTE_FLAGS = ["-s", "--serial", "-z", "--zero-terminated", "--help", "--version"];
+export function isPasteRead(args) {
+    if (!literal(args) || !noRepeatedFlag(args))
+        return false;
+    for (const arg of args) {
+        if (PASTE_FLAGS.includes(arg))
+            continue;
+        if (arg.startsWith("--delimiters="))
+            continue;
+        if (arg.startsWith("-d") && arg.length > 2)
+            continue;
+        // A file, or `-` for standard input. Every other flag-shaped word is not
+        // in the grammar (`--`, `-d` with a separate value, abbreviations).
+        if (arg === "-" || !arg.startsWith("-"))
+            continue;
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=sysinfo-argv.js.map

package/dist/src/core/sysinfo-argv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sysinfo-argv.js","sourceRoot":"","sources":["../../../src/core/sysinfo-argv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;GAIG;AACH,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,wDAAwD;AACxD,SAAS,OAAO,CAAC,IAAuB;IACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAgD;IAC/D,kBAAkB,EAAE,CAAC,IAAI,CAAC;IAC1B,MAAM,EAAE,CAAC,IAAI,CAAC;IACd,cAAc,EAAE,CAAC,IAAI,CAAC;IACtB,UAAU,EAAE,CAAC,IAAI,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,eAAe,EAAE,CAAC,IAAI,CAAC;IACvB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,aAAa,EAAE,CAAC,IAAI,CAAC;IACrB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IACnB,eAAe,EAAE,CAAC,IAAI,CAAC;IACvB,aAAa,EAAE,CAAC,IAAI,CAAC;IACrB,UAAU,EAAE,CAAC,IAAI,CAAC;IAClB,UAAU,EAAE,CAAC,IAAI,CAAC;IAClB,mBAAmB,EAAE,CAAC,IAAI,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAuB,EAAE,UAAU,GAAsB,EAAE;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1E,IAAI,IAAI,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;aAC/F,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;aAChD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,oEAAoE;QACpE,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sCAAsC;AACtC,SAAS,eAAe,CAAC,IAAuB;IAC9C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAsB;IACxC,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,oBAAoB;IACpB,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,QAAQ,GAAsB;IAClC,IAAI;IACJ,kBAAkB;IAClB,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,eAAe;IACf,SAAS;IACT,QAAQ;IACR,WAAW;IACX,mCAAmC;IACnC,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAsB;IACpC,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,aAAa;IACb,QAAQ;IACR,WAAW;IACX,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,GAAG,kDAAkD,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAC5B,OAAO,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAW,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAW,CAAC;YACjD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAW,EAAE,OAAO,CAAC,CAAC,CAAW,EAAE,OAAO,CAAC,CAAC,CAAW,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC;IACrD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAE/E,oEAAoE;AACpE,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,OAAO,IAAI,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,eAAe;YAAE,SAAS;QACtD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,SAAS;QAC7C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,CAAC;YACX,wEAAwE;YACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,0DAA0D;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACrG,IAAI,KAAK,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,cAAc,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE5G,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,SAAS;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACrD,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/daemon/git-evidence.d.ts

@@ -71,9 +71,9 @@ import type { LogHead } from "../core/log.js";
  * because a module that resolves its own package root differs between the source
  * tree and the build output for no benefit at all.
  */
-export declare const APPROVALD_VERSION = "0.4.3";
+export declare const APPROVALD_VERSION = "0.4.6";
 /** `user.name` on every commit this module makes. */
-export declare const GIT_EVIDENCE_AUTHOR_NAME = "approvald 0.4.3";
+export declare const GIT_EVIDENCE_AUTHOR_NAME = "approvald 0.4.6";
 /** `user.email` on every commit: fixed, and deliberately undeliverable. */
 export declare const GIT_EVIDENCE_AUTHOR_EMAIL = "approvald@noreply.approval.md";
 /**

package/dist/src/daemon/git-evidence.js

@@ -75,7 +75,7 @@ import { PAYLOAD_STORE_DIRNAME } from "../core/payload-store.js";
  * because a module that resolves its own package root differs between the source
  * tree and the build output for no benefit at all.
  */
-export const APPROVALD_VERSION = "0.4.3";
+export const APPROVALD_VERSION = "0.4.6";
 /** `user.name` on every commit this module makes. */
 export const GIT_EVIDENCE_AUTHOR_NAME = `approvald ${APPROVALD_VERSION}`;
 /** `user.email` on every commit: fixed, and deliberately undeliverable. */

package/docs/README-extended.md

@@ -341,6 +341,7 @@ semantics: SPEC.md section 5.
 | `audit.skew_tolerance` | How far a gate-typed event's timestamp may step back before verification reports an anomaly. Report-only; default 2 seconds (§8). |
 | `audit.checkpoint_keys` | Public halves of the Ed25519 keys permitted to sign a `log.checkpoint`, base64 DER SPKI. The private halves live in the vault and never in this file. A list, so a retired key stays listed: a checkpoint signed by a key the list does not carry is refused. Absent, empty or unreadable means verification skips the checkpoint check with a reason and never reports it as a pass (§9, APRV-220). |
 | `delegation` | The judge's bounds (a pinned model that may later review samples, advise on cards and decide manual cards in named classes). RESERVED in 0.4.2: the block is validated and loads only in its off form (`model: null`, every list empty, `max_autonomy: manual`, `daily_cap: 0`, `advice: false`; `{}` is the same), which changes nothing. Any other value fails the policy closed with `delegation-not-supported`, so every class resolves `manual`. Absent means no judge, exactly as before the key existed. Cores before 0.4.2 refuse the key outright (§5.2 proposed, APRV-500; `docs/cli-reference.md`, policy check). |
+| `exec` | What the operator attests about opaque agent code (`python3 -c`, `node -e`, `deno eval` and kin, an interpreter running a file that is not a skill script, Hermes `execute_code`). `exec.code.custody: attested` opens the `exec.code` class, which then resolves like any class and is recorded by the program's SHA-256 and length, never its text; `exec.code.execute_code: hooked` beside it opens Hermes `execute_code`. Absent, those calls are refused exactly as before the key existed; a policy that names `exec.code` without custody refuses `hook-exec-code-custody-unattested`. Cores before 0.4.5 refuse the key and fail the policy closed (§5.2 and §7 proposed, APRV-510; `docs/hermes-hook.md`). |
 | `delegation.model` | The judge identity, `model:<name>@<major>.<minor>.<patch>`, or `null`. Reserved: non-null is `delegation-not-supported` (APRV-500). |
 | `delegation.classes` | Exact keys of `classes` the judge may act on: no wildcard, not `human-only`, not `autonomous`. Reserved: non-empty is `delegation-not-supported` (APRV-500). |
 | `delegation.max_autonomy` | `manual` (default), `supervised-live` or `supervised-retro`: a pin, so every delegated class must declare an autonomy at least as strict. Reserved: anything but `manual` is `delegation-not-supported` (APRV-500). |
@@ -740,9 +741,9 @@ and the reference phone channel is one app, Telegram.
 | [`backlog/`](../backlog/) | Implementation work and remaining acceptance criteria. A task's existence is not a shipped feature. |
 | [`index.html`](../index.html), [`features/`](../features/), [`llms.txt`](../llms.txt), [`llms-full.txt`](../llms-full.txt) | The website and its machine-readable companions. |
 | [`metrics/`](../metrics/), [`brand/`](../brand/) | Agent-hour badge data and visual assets. Badge activity is not an adoption or security certification. |
-| [`hosted/`](../hosted/README.md), [`judgy/`](../judgy/README.md) | Hosting scaffolding and reviewer/demo pages; separate from the core runtime contract. |
+| [`hosted/`](../hosted/README.md) | Hosting scaffolding; separate from the core runtime contract. |
 
-The hosted directory contains a policy builder and tenant launcher, not a complete account system or managed multi-tenant control plane. Judgy's pages render supplied data and retain simulated/replay/not-run provenance labels; a visualization is not a new authorization path. Neither should be advertised as a finished service merely because its directory exists.
+The hosted directory contains a policy builder and tenant launcher, not a complete account system or managed multi-tenant control plane. It should not be advertised as a finished service merely because its directory exists. The judgy reviewer pages that used to sit beside it left the repository under APRV-393; commit `49574e4d` is the last one that holds them.
 
 ### Running the checks
 

package/docs/cli-reference.md

@@ -3424,9 +3424,13 @@ The checks, at length:
   **fail-closed version floor** (a build at or after `main` `118984d7` of
   2026-09-20) FAILS, because `v0.21.3` ignores `fail_closed` silently and every
   broken hook on it proceeds. That half is read from `hermes --version` rather than
-  from a record — Hermes prints its build stamp behind a non-ASCII separator the
-  write boundary refuses, so no record can carry it — and it compares the build
-  date and the upstream commit, because the two builds report the same semver.
+  from a record, because a record keeps only the printable-ASCII prefix of
+  Hermes's line (APRV-419): the build date survives and the upstream commit
+  behind the non-ASCII separator does not. It compares the build date and the
+  upstream commit, because the two builds report the same semver. Since APRV-419
+  the unverified-change half compares Hermes like any other harness: the prefix,
+  for example `Hermes Agent v0.21.3 (2026.9.14)`, on the newest hook record
+  against the prefix of what `hermes --version` prints now.
 - **live-draw** — whether a daemon is answering `supervised-live` draws for this
   log (APRV-208). SKIP when the policy declares no live class: no draw is ever
   made, and a missing socket is nothing. It FAILS in three shapes, all of them
@@ -4595,7 +4599,7 @@ to.
 
 | Command  | What it does |
 | -------- | ------------ |
-| `/queue` | Replies with the summary and a numbered list of every pending request (action key, task, class, age), marking the one this listener has selected. Derived from the verified log at reply time, and it works while a request is selected. |
+| `/queue` | Replies with the count line and a numbered list of every pending request (the agent's summary and its age, no action key or task id), marking the one this listener has selected. Derived from the verified log at reply time, and it works while a request is selected. |
 | `/skip`  | Selects the next request; the skipped one goes to the BACK of this process's order and comes round again after the rest, with a fresh card when it does. |
 | `/next`  | Selects the next request; this process does not offer the passed-over one again, and sends no further card for it. |
 
@@ -4609,7 +4613,7 @@ it away from you.
 **`/queue` is a list, and it says so** (APRV-256). The reply carries no decision
 buttons of its own, and it names no position for the ones it points at: a
 request is decided on its own approval card, wherever that card has ended up in
-the chat. The marker on the selected line reads `selected — card sent earlier`,
+the chat. The marker on the selected line reads `sent to you earlier`,
 because that is the whole of what the listener knows. Delivery bookkeeping
 records that a send returned success; the Bot API never reports that a message
 is still there, and a card can be deleted, buried, or lost with the chat
@@ -5652,7 +5656,11 @@ semantic-version-shaped tag, `tag <name>`, `--tags`, or `--follow-tags` is
 that DELETES a remote ref — `--delete`, `-d`, or a colon refspec such as
 `:refs/heads/x` — is `vcs.ref.delete` with the ref names bound (APRV-352), and a
 tag deletion keeps `release.publish`; ordinary branch pushes retain their branch
-or trunk class.
+or trunk class. Flags are read the way git's option parser reads them, short
+bundles (`-ud`) and unique-prefix abbreviations (`--del`, `--m`) included, and
+`--prune` is a deletion too (APRV-517); a push git would refuse, or one naming
+a far-side program (`--exec`, `--receive-pack`), is `opaque`, and a word the
+shell may expand is `vcs.history.rewrite`.
 
 `git tag` splits on its flags since APRV-397: a LISTING (`-l`, `--list`, `-n`,
 `-n<num>`, `--contains`, `--points-at`, `--merged`, `--sort`, `--format`,
@@ -5715,7 +5723,12 @@ its own flags are not parsed as this verb's.
   ONE inline script is classified by that script since APRV-380, so
   `zsh -lc 'git push origin main'` is `vcs.push.main`; a script file, an extra
   word, a redirection on the wrapper, an assignment prefix and a nested shell
-  all stay opaque.
+  all stay opaque. So does a shell that is not the system's, named as written
+  (APRV-523): one spelled by a path outside `/bin`, `/usr/bin`,
+  `/usr/local/bin`, `/sbin` and `/usr/sbin` (a relative path, a Homebrew
+  shell under `/opt`), or by a word with an expansion or a backslash in it.
+  An assignment-shaped shell word with a quoted or escaped name is
+  `hook-unclassified`.
 - `hook-unparseable` — the command line could not be tokenized.
 - `hook-rejected` — a human said no.
 - `hook-revoked` — a granted approval was withdrawn.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "approval-md",
-  "version": "0.4.3",
+  "version": "0.4.6",
   "description": "Human approval for agent actions. CLI runtime for the approval.md convention (pre-release).",
   "type": "module",
   "bin": {
@@ -59,5 +59,5 @@
     "better-sqlite3": "12.11.1",
     "yaml": "2.9.0"
   },
-  "gitHead": "bd5c7562b226424e1c3b0715d55731604ff33088"
+  "gitHead": "539cf3b6b847b0446730ed110b7f188660f2a9d7"
 }

package/schema/event.schema.json

@@ -136,7 +136,7 @@
           "minLength": 1,
           "maxLength": 64,
           "pattern": "^[\\u0020-\\u007e]+$",
-          "description": "SPEC.md §10.1 (amended, APRV-227): the version of the harness binary that issued this record, taken from the hook event where the harness supplies one and otherwise from `<binary> --version`, normalized to its first line. SELF-REPORTED, and informational only: nothing in the runtime reads it back as an input to a verdict, a floor, a budget, a streak or a sampling draw, so it satisfies SPEC.md §11.1 invariant 4 by having no path along which it could reduce scrutiny — its single reader is a doctor row that can only ADD a red line. Its SHAPE is constrained here because the value is the output of a third-party process being written to an append-only log: one line, printable ASCII, capped at 64 characters, so a banner or a stack trace (and whatever a stack trace quotes) cannot arrive through it. §11.1 invariant 3 has no exception for provenance. OPTIONAL and additive."
+          "description": "SPEC.md §10.1 (amended, APRV-227): the version of the harness binary that issued this record, taken from the hook event where the harness supplies one and otherwise from `<binary> --version`, normalized to its first line. SELF-REPORTED, and informational only: nothing in the runtime reads it back as an input to a verdict, a floor, a budget, a streak or a sampling draw, so it satisfies SPEC.md §11.1 invariant 4 by having no path along which it could reduce scrutiny — its single reader is a doctor row that can only ADD a red line. Its SHAPE is constrained here because the value is the output of a third-party process being written to an append-only log: one line, printable ASCII, capped at 64 characters, so a banner or a stack trace (and whatever a stack trace quotes) cannot arrive through it. §11.1 invariant 3 has no exception for provenance. APRV-419 chose option (c) in its no-schema form: a writer records the first line's printable-ASCII PREFIX, trimmed, cutting everything from the first character outside U+0020..U+007E, where it used to refuse the whole line. That is why a Hermes record carries `Hermes Agent v0.21.3 (2026.9.14)` from the line `Hermes Agent v0.21.3 (2026.9.14) \u00b7 upstream 913d4098`. Every value the prefix rule produces already satisfied this pattern and cap, so neither moved and no record changes validity. OPTIONAL and additive."
         },
         "est_cost_usd": {
           "$ref": "#/$defs/usd_amount",

package/schema/fixtures/policy/invalid/exec-code-custody-boolean.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.1",
+  "defaults": {
+    "autonomy": "manual"
+  },
+  "exec": {
+    "code": {
+      "custody": true
+    }
+  }
+}

package/schema/fixtures/policy/invalid/exec-code-execute-code-value.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.1",
+  "defaults": {
+    "autonomy": "manual"
+  },
+  "exec": {
+    "code": {
+      "execute_code": "yes"
+    }
+  }
+}

package/schema/fixtures/policy/invalid/exec-code-unknown-key.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.1",
+  "defaults": {
+    "autonomy": "manual"
+  },
+  "exec": {
+    "code": {
+      "custody": "attested",
+      "inline": "on"
+    }
+  }
+}

package/schema/fixtures/policy/valid/exec-code-both.json

@@ -0,0 +1,17 @@
+{
+  "version": "0.1",
+  "defaults": {
+    "autonomy": "manual"
+  },
+  "exec": {
+    "code": {
+      "custody": "attested",
+      "execute_code": "hooked"
+    }
+  },
+  "classes": {
+    "exec.code": {
+      "autonomy": "autonomous"
+    }
+  }
+}

package/schema/fixtures/policy/valid/exec-code-custody.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.1",
+  "defaults": {
+    "autonomy": "manual"
+  },
+  "exec": {
+    "code": {
+      "custody": "attested"
+    }
+  }
+}

package/schema/policy.schema.json

@@ -197,6 +197,29 @@
         }
       ]
     },
+    "exec": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "SPEC.md §5.2 and §7 (APRV-510, proposed; 0.4.5 candidate): what an operator has attested about opaque agent code. Absent, every policy behaves exactly as before the key existed: `python3 -c`, `node -e` and kin are refused `hook-opaque`, an interpreter running a file that is not a skill script is refused `hook-unclassified`, and a Hermes `execute_code` call is refused `hook-hermes-execute-code-unbound`. A core that predates this key refuses it at the schema, and the whole policy then fails closed (every class `manual`), so a tenant receives this block only after its pinned core knows it.",
+      "properties": {
+        "code": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "The `exec.code` class (APRV-510). Each key opens one thing and only the attested policy can set it; an absent key is the closed answer. With `custody: attested`, an inline program or a non-skill interpreter file run is classified `exec.code` and resolved by the policy like any class (an `exec.code` row, an `exec.*` family row, or `defaults.autonomy`), and a record of it binds the program's SHA-256 and length, never its text. The record says the program existed; it authorizes nothing the program then does through other tools, each of which is its own hook event.",
+          "properties": {
+            "custody": {
+              "enum": ["attested", "unattested"],
+              "description": "`attested`: the operator states that credential custody is in place for this agent (the code it runs cannot read credentials it should not hold), which is the precondition for opening the class at all, because opaque code run without it bypasses every gate that guards a credential. `unattested`, or the key absent: the class stays closed, and where the policy names `exec.code` anywhere the refusal is `hook-exec-code-custody-unattested`, naming this key."
+            },
+            "execute_code": {
+              "enum": ["hooked", "unhooked"],
+              "description": "Hermes `execute_code` only, and only beside `custody: attested`. `hooked`: the operator has observed that a tool call made from inside the `execute_code` kernel re-fires the hook (the lane L1 probe's answer), so the call is classified `exec.code` with the program's hash bound. `unhooked`, or the key absent: `execute_code` is refused `hook-hermes-execute-code-unbound` as before. Set it only on the probe's yes: if inner calls do not re-fire the hook, one `execute_code` call is an unbounded bypass of the whole adapter."
+            }
+          }
+        }
+      },
+      "examples": [{ "code": { "custody": "attested" } }, { "code": { "custody": "attested", "execute_code": "hooked" } }]
+    },
     "read_scope": {
       "type": "object",
       "additionalProperties": false,