codictator 0.0.0 → 0.1.3

package/dist/kernel/shell-bypass.js

@@ -0,0 +1,151 @@
+// SPEC §4.19.2 human-only commands: blocked for agents by the shell guard.
+const HUMAN_ONLY = new Set([
+    "init",
+    "uninstall",
+    "waive",
+    "pack accept",
+    "task ack",
+    "baseline capture",
+]);
+function normalizePath(path) {
+    const forward = path.replaceAll("\\", "/");
+    return forward.startsWith("./") ? forward.slice(2) : forward;
+}
+// SPEC §4.14.3 target rows: every generated state path plus the generated
+// CI workflow. Harness config files are entries-mode (drift, EC-6), so user
+// additions there stay allowed and are not protected here.
+export function isProtectedPath(path) {
+    const target = normalizePath(path);
+    if (target === ".codictator" || target.startsWith(".codictator/")) {
+        return true;
+    }
+    if (target === ".githooks" || target.startsWith(".githooks/")) {
+        return true;
+    }
+    if (target === ".husky" || target.startsWith(".husky/")) {
+        return true;
+    }
+    return (target.startsWith(".github/workflows/codictator") &&
+        (target.endsWith(".yml") || target.endsWith(".yaml")));
+}
+function matchGitHooksPath(args) {
+    if (args[0] === "-c" && args[1]?.includes("core.hooksPath") === true) {
+        return "git -c core.hooksPath overrides the installed hooks";
+    }
+    if (args[0] === "config" && args.some((a) => a.includes("core.hooksPath"))) {
+        return "git config core.hooksPath moves hooks away from the installed dir";
+    }
+    return undefined;
+}
+function matchGitNoVerify(args) {
+    if (args[0] === "commit" &&
+        args.some((a) => a === "-n" || a === "--no-verify")) {
+        return "git commit --no-verify skips the pre-commit and commit-msg gates";
+    }
+    if (args[0] === "push" && args.includes("--no-verify")) {
+        return "git push --no-verify skips the pre-push gate";
+    }
+    return undefined;
+}
+function matchGitRm(args) {
+    if (args[0] === "rm" && args.some((a) => isProtectedPath(a))) {
+        return "git rm on a protected guardrail path";
+    }
+    return undefined;
+}
+function matchGit(cmd) {
+    if (cmd.name !== "git") {
+        return undefined;
+    }
+    return (matchGitHooksPath(cmd.argv) ??
+        matchGitNoVerify(cmd.argv) ??
+        matchGitRm(cmd.argv));
+}
+function matchDestructive(cmd) {
+    if (cmd.name === "chmod" &&
+        cmd.argv.includes("-x") &&
+        cmd.argv.some((a) => a === ".githooks" ||
+            a.startsWith(".githooks/") ||
+            a.startsWith(".husky/"))) {
+        return "chmod -x on hooks disables the git gates";
+    }
+    if ((cmd.name === "rm" || cmd.name === "mv") &&
+        cmd.argv.some((a) => isProtectedPath(a))) {
+        return `${cmd.name} on a protected guardrail path`;
+    }
+    return undefined;
+}
+function matchHost(cmd) {
+    if (cmd.name !== "gh") {
+        return undefined;
+    }
+    const args = cmd.argv;
+    if (args[0] === "workflow" && args[1] === "disable") {
+        return "gh workflow disable turns off the merge gate";
+    }
+    if (args[0] === "api" &&
+        args.some((a) => /rules|protection|rulesets/.test(a))) {
+        const flagAt = args.findIndex((a) => a === "-X" || a === "--method");
+        const method = flagAt >= 0 ? args[flagAt + 1] : undefined;
+        if (method !== undefined && method !== "GET") {
+            return "gh api writes to branch protection or rulesets";
+        }
+    }
+    return undefined;
+}
+function matchNpm(cmd) {
+    if (cmd.name === "npm" &&
+        ["uninstall", "remove", "un", "rm"].includes(cmd.argv[0] ?? "") &&
+        cmd.argv.some((a) => a === "codictator")) {
+        return "npm uninstall codictator removes the engine the gates run on";
+    }
+    return undefined;
+}
+function matchHumanOnly(cmd) {
+    const at = cmd.argv.findIndex((a) => a === "codictator" || a.endsWith("/codictator"));
+    const base = at >= 0
+        ? cmd.argv.slice(at + 1)
+        : cmd.name === "codictator"
+            ? cmd.argv
+            : [];
+    if (base.length === 0) {
+        return undefined;
+    }
+    const head = `${base[0]}${base[1] === undefined ? "" : ` ${base[1]}`}`;
+    if (HUMAN_ONLY.has(base[0] ?? "") || HUMAN_ONLY.has(head)) {
+        return `human-only codictator command \`${head}\` invoked by an agent`;
+    }
+    return undefined;
+}
+// SPEC §4.14.3 command table: the bypass shapes matched against each
+// parsed command. The caller collects the commands so wrappers (bash -c,
+// env, $(…)) are analysed, not trusted.
+export function matchBypassCommand(cmd) {
+    return (matchGit(cmd) ??
+        matchDestructive(cmd) ??
+        matchHost(cmd) ??
+        matchNpm(cmd) ??
+        matchHumanOnly(cmd));
+}
+// SPEC §4.7.2 backstop: raw tokens catch bypass shapes the structured parse
+// missed; parse failure alone never becomes an allow.
+export function scanBypassRawText(text) {
+    const lowered = ` ${text.toLowerCase()} `;
+    if (lowered.includes("--no-verify")) {
+        return "raw --no-verify flag bypasses the git gates";
+    }
+    if (/(^|\s)git\s.*\scommit\s.*\s-n(\s|$)/.test(`${text} `)) {
+        return "raw git commit -n bypasses the git gates";
+    }
+    if (lowered.includes("core.hookspath")) {
+        return "raw core.hooksPath override moves hooks away from the installed dir";
+    }
+    if (/(^|\s)husky=0(\s|;|$)/.test(lowered) ||
+        /(^|\s)skip=[^\s]+/.test(lowered)) {
+        return "raw HUSKY=0/SKIP= assignment disables the hooks";
+    }
+    if (lowered.includes("workflow disable")) {
+        return "raw workflow disable turns off the merge gate";
+    }
+    return undefined;
+}

package/dist/kernel/shell-cmd.d.ts

@@ -0,0 +1,6 @@
+import type { SimpleCommand } from "./shell.ts";
+export declare function commandName(command: SimpleCommand): string;
+export declare function nonFlagArgs(command: SimpleCommand): Array<string>;
+export declare const SCRIPT_NAMES: Set<string>;
+export declare function baseName(word: string): string;
+export declare function buildShellCommand(pipeline: Array<SimpleCommand>, words: ReadonlyArray<string>, raw: string, raised: boolean, scripts: ReadonlyArray<string>, descend: (inner: string) => void): void;

package/dist/kernel/shell-cmd.js

@@ -0,0 +1,213 @@
+export function commandName(command) {
+    return command.name.replace(/\\/g, "/").split("/").pop()?.toLowerCase() ?? "";
+}
+export function nonFlagArgs(command) {
+    const kept = [];
+    let index = 0;
+    const argv = command.argv;
+    while (index < argv.length) {
+        const word = argv[index];
+        if (word === undefined) {
+            break;
+        }
+        if (word === "--") {
+            kept.push(...argv.slice(index + 1));
+            break;
+        }
+        if (word.startsWith("-") && word !== "-") {
+            index += 1;
+            continue;
+        }
+        kept.push(word);
+        index += 1;
+    }
+    return kept;
+}
+export const SCRIPT_NAMES = new Set([
+    "sh",
+    "bash",
+    "dash",
+    "zsh",
+    "ksh",
+    "pwsh",
+    "powershell",
+]);
+const STRIP_NAMES = new Set(["env", "command", "nohup", "time"]);
+const KEYWORDS = new Set([
+    "if",
+    "then",
+    "elif",
+    "else",
+    "fi",
+    "for",
+    "while",
+    "until",
+    "do",
+    "done",
+    "case",
+    "esac",
+    "select",
+    "in",
+    "function",
+    "coproc",
+    "time",
+]);
+const ASSIGNMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const FUNCTION_HEAD_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*\(\)$/;
+export function baseName(word) {
+    const slashed = word.replace(/\\/g, "/");
+    const last = slashed.lastIndexOf("/");
+    const bare = last < 0 ? slashed : slashed.slice(last + 1);
+    return bare.endsWith(".exe") ? bare.slice(0, -4) : bare;
+}
+function skipFlagValues(words, valueFlags) {
+    const kept = [];
+    let index = 0;
+    while (index < words.length) {
+        const word = words[index];
+        if (word === undefined) {
+            break;
+        }
+        if (word === "--") {
+            kept.push(...words.slice(index + 1));
+            break;
+        }
+        if (word.startsWith("-") && word !== "-") {
+            if (valueFlags.has(word.toLowerCase())) {
+                index += 2;
+                continue;
+            }
+            index += 1;
+            continue;
+        }
+        kept.push(word);
+        index += 1;
+    }
+    return kept;
+}
+const SUDO_VALUE_FLAGS = new Set([
+    "-u",
+    "--user",
+    "-g",
+    "--group",
+]);
+function stripSudoPrefix(rest) {
+    const skipped = skipFlagValues(rest.slice(1), SUDO_VALUE_FLAGS);
+    if (skipped.length > 0 &&
+        (skipped[0] === "-c" || skipped[0] === "--command")) {
+        const script = skipped[1];
+        return {
+            rest: [],
+            scripts: script === undefined ? [] : [script],
+            bare: true,
+        };
+    }
+    return { rest: skipped, scripts: [], bare: false };
+}
+function stripPrefixes(words) {
+    let rest = [...words];
+    let raised = false;
+    const scripts = [];
+    while (rest.length > 0) {
+        const head = rest[0];
+        if (head === undefined) {
+            break;
+        }
+        if (ASSIGNMENT_PATTERN.test(head)) {
+            rest = rest.slice(1);
+            continue;
+        }
+        const lowered = baseName(head).toLowerCase();
+        if (lowered === "sudo" || lowered === "su") {
+            const sudo = stripSudoPrefix(rest);
+            raised = true;
+            rest = [...sudo.rest];
+            scripts.push(...sudo.scripts);
+            if (sudo.bare) {
+                return { rest: [], raised, scripts, bare: true };
+            }
+            continue;
+        }
+        if (STRIP_NAMES.has(lowered)) {
+            rest = skipFlagValues(rest.slice(1), new Set());
+            continue;
+        }
+        break;
+    }
+    return { rest, raised, scripts, bare: false };
+}
+function scriptFlagIndex(rest, lowered) {
+    if (!SCRIPT_NAMES.has(lowered) && lowered !== "cmd") {
+        return -1;
+    }
+    return rest.findIndex((word) => word === "-c" ||
+        word === "--command" ||
+        word.toLowerCase() === "-command" ||
+        word === "/c" ||
+        word === "/C");
+}
+function buildStripped(pipeline, raw, rest, raised, scripts, descend) {
+    if (rest.length === 0) {
+        return;
+    }
+    const name = rest[0];
+    if (name === undefined || name.startsWith("-")) {
+        return;
+    }
+    const lowered = baseName(name).toLowerCase();
+    if (KEYWORDS.has(lowered)) {
+        if (rest.length > 1) {
+            descend(rest.slice(1).join(" "));
+        }
+        return;
+    }
+    if (lowered === "xargs") {
+        const target = skipFlagValues(rest.slice(1), new Set(["-i", "-n", "-p", "-s", "-l", "-a"]));
+        if (target.length > 0) {
+            buildShellCommand(pipeline, target, raw, raised, scripts, descend);
+        }
+        return;
+    }
+    const extra = lowered === "eval" && rest.length > 1 ? [rest.slice(1).join(" ")] : [];
+    const at = scriptFlagIndex(rest, lowered);
+    const single = rest[at + 1];
+    const joined = rest.slice(at + 1).join(" ");
+    const embedded = at >= 0
+        ? [
+            ...scripts,
+            ...(SCRIPT_NAMES.has(lowered)
+                ? single === undefined || single === ""
+                    ? []
+                    : [single]
+                : [joined]),
+        ]
+        : [...scripts, ...extra];
+    pipeline.push({
+        name,
+        argv: rest.slice(1),
+        raw,
+        elevated: raised,
+        embedded,
+    });
+}
+// SPEC §4.7.2: one parsed word list becomes one simple command, with
+// prefixes stripped and embedded scripts collected for the deny matcher.
+export function buildShellCommand(pipeline, words, raw, raised, scripts, descend) {
+    if (words.every((word) => FUNCTION_HEAD_PATTERN.test(word))) {
+        return;
+    }
+    const stripped = stripPrefixes(words);
+    const totalRaised = raised || stripped.raised;
+    const totalScripts = [...scripts, ...stripped.scripts];
+    if (stripped.bare) {
+        pipeline.push({
+            name: "su",
+            argv: [],
+            raw,
+            elevated: totalRaised,
+            embedded: totalScripts,
+        });
+        return;
+    }
+    buildStripped(pipeline, raw, stripped.rest, totalRaised, totalScripts, descend);
+}

package/dist/kernel/shell-deny-cmd.d.ts

@@ -0,0 +1,7 @@
+import type { SimpleCommand } from "./shell.ts";
+import type { ShellViolation } from "./shell-deny.ts";
+import { checkDd, checkDel, checkFormat, checkRemoveItem, checkRm } from "./shell-deny-destroy.ts";
+import { classifyTarget, flag, type TargetKind } from "./shell-deny-target.ts";
+export { checkChmod, checkGh, checkGit, readsSecret, secretReadTargets, } from "./shell-deny-escalate.ts";
+export { checkDd, checkDel, checkFormat, checkRemoveItem, checkRm, classifyTarget, flag, type TargetKind, };
+export declare function dispatchToolCheck(command: SimpleCommand, out: Array<ShellViolation>): void;

package/dist/kernel/shell-deny-cmd.js

@@ -0,0 +1,35 @@
+import { commandName } from "./shell-cmd.js";
+import { checkDd, checkDel, checkFormat, checkRemoveItem, checkRm, } from "./shell-deny-destroy.js";
+import { checkChmod, checkGh, checkGit } from "./shell-deny-escalate.js";
+import { classifyTarget, flag } from "./shell-deny-target.js";
+export { checkChmod, checkGh, checkGit, readsSecret, secretReadTargets, } from "./shell-deny-escalate.js";
+export { checkDd, checkDel, checkFormat, checkRemoveItem, checkRm, classifyTarget, flag, };
+// SPEC §4.7.2: one command family, one deny class. Destruction, privilege
+// and history destruction match here.
+export function dispatchToolCheck(command, out) {
+    const name = commandName(command);
+    if (name === "rm") {
+        checkRm(command, out);
+    }
+    else if (name === "remove-item" || name === "ri" || name === "rmdir") {
+        checkRemoveItem(command, out);
+    }
+    else if (name === "del" || name === "erase" || name === "rd") {
+        checkDel(command, out);
+    }
+    else if (name === "chmod" || name === "chown") {
+        checkChmod(command, out);
+    }
+    else if (name === "dd") {
+        checkDd(command, out);
+    }
+    else if (name === "git") {
+        checkGit(command, out);
+    }
+    else if (name === "gh") {
+        checkGh(command, out);
+    }
+    else if (name === "format") {
+        checkFormat(command, out);
+    }
+}

package/dist/kernel/shell-deny-destroy.d.ts

@@ -0,0 +1,7 @@
+import type { SimpleCommand } from "./shell.ts";
+import type { ShellViolation } from "./shell-deny.ts";
+export declare function checkRm(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function checkRemoveItem(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function checkDel(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function checkDd(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function checkFormat(command: SimpleCommand, out: Array<ShellViolation>): void;

package/dist/kernel/shell-deny-destroy.js

@@ -0,0 +1,71 @@
+import { commandName, nonFlagArgs } from "./shell-cmd.js";
+import { classifyTarget, flag } from "./shell-deny-target.js";
+function rmTargets(command) {
+    return nonFlagArgs(command).filter((word) => word !== "-");
+}
+export function checkRm(command, out) {
+    const recursive = command.argv.some((word) => word === "--recursive" ||
+        (word.startsWith("-") &&
+            !word.startsWith("--") &&
+            (word.includes("r") || word.includes("R"))));
+    const targets = rmTargets(command);
+    if (recursive) {
+        const bad = targets.find((target) => classifyTarget(target) !== "inside");
+        if (bad !== undefined || targets.length === 0) {
+            flag(out, "destruction", command.raw, "recursive remove outside the repo root");
+        }
+        return;
+    }
+    const bad = targets.find((target) => classifyTarget(target) === "root");
+    if (bad !== undefined) {
+        flag(out, "destruction", command.raw, "remove of a filesystem root");
+    }
+}
+export function checkRemoveItem(command, out) {
+    const recursive = command.argv.some((word) => word === "-r" || word.toLowerCase().startsWith("-rec"));
+    const targets = nonFlagArgs(command);
+    if (recursive) {
+        const bad = targets.find((target) => classifyTarget(target) !== "inside");
+        if (bad !== undefined || targets.length === 0) {
+            flag(out, "destruction", command.raw, "recursive remove outside the repo root");
+        }
+        return;
+    }
+    const bad = targets.find((target) => classifyTarget(target) === "root");
+    if (bad !== undefined) {
+        flag(out, "destruction", command.raw, "remove of a drive root");
+    }
+}
+export function checkDel(command, out) {
+    const recursive = commandName(command) === "rd" &&
+        command.argv.some((word) => word.toLowerCase().startsWith("/s"));
+    const targets = command.argv.filter((word) => !word.startsWith("/") && !word.startsWith("-"));
+    if (recursive) {
+        const bad = targets.find((target) => classifyTarget(target) !== "inside");
+        if (bad !== undefined || targets.length === 0) {
+            flag(out, "destruction", command.raw, "recursive remove outside the repo root");
+        }
+        return;
+    }
+    const bad = targets.find((target) => classifyTarget(target) !== "inside");
+    if (bad !== undefined) {
+        flag(out, "destruction", command.raw, "remove outside the repo root");
+    }
+}
+export function checkDd(command, out) {
+    const output = command.argv.find((word) => word.startsWith("of="));
+    if (output === undefined) {
+        return;
+    }
+    const target = output.slice("of=".length);
+    if (target.startsWith("/dev/")) {
+        flag(out, "destruction", command.raw, "direct write to a device");
+    }
+}
+export function checkFormat(command, out) {
+    const targets = command.argv.filter((word) => !word.startsWith("/"));
+    const bad = targets.find((target) => classifyTarget(target) !== "inside");
+    if (bad !== undefined || targets.length === 0) {
+        flag(out, "destruction", command.raw, "drive format");
+    }
+}

package/dist/kernel/shell-deny-escalate.d.ts

@@ -0,0 +1,7 @@
+import type { SimpleCommand } from "./shell.ts";
+import type { ShellViolation } from "./shell-deny.ts";
+export declare function checkChmod(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function checkGit(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function checkGh(command: SimpleCommand, out: Array<ShellViolation>): void;
+export declare function secretReadTargets(command: SimpleCommand): Array<string>;
+export declare function readsSecret(command: SimpleCommand): boolean;

package/dist/kernel/shell-deny-escalate.js

@@ -0,0 +1,96 @@
+// SPEC §4.7.2: privilege, history-destruction and secret-read deny checks
+// for the shell analyser. Destruction checks own shell-deny-destroy.ts;
+// the target classification owns shell-deny-target.ts.
+import { isSecretReadPath } from "./secret-paths.js";
+import { commandName, nonFlagArgs } from "./shell-cmd.js";
+import { classifyTarget, flag } from "./shell-deny-target.js";
+function chmodRiskyFlags(command) {
+    const recursive = command.argv.some((word) => word === "--recursive" ||
+        (word.startsWith("-") && !word.startsWith("--") && word.includes("R")));
+    const mode777 = command.argv.some((word) => word === "777" || word === "0777" || word === "a+rwx");
+    return recursive || mode777;
+}
+function chmodOutsideTarget(command) {
+    const targets = nonFlagArgs(command).filter((word) => !/^[0-7]{3,4}$/.test(word) && !word.includes("=") && !word.includes(","));
+    return targets.some((target) => classifyTarget(target) !== "inside");
+}
+export function checkChmod(command, out) {
+    if (chmodRiskyFlags(command) || chmodOutsideTarget(command)) {
+        flag(out, "privilege", command.raw, "permission change outside safe bounds");
+    }
+}
+const PROTECTED_BRANCHES = new Set(["main", "master", "trunk", "develop"]);
+function gitForceTarget(command, args) {
+    const forced = command.argv.some((word) => word === "--force" || word === "--force-with-lease" || word === "-f");
+    if (!forced) {
+        return false;
+    }
+    const branches = args.slice(1).flatMap((word) => {
+        const colon = word.lastIndexOf(":");
+        return colon < 0 ? [word] : [word.slice(colon + 1)];
+    });
+    const blocked = branches.find((branch) => PROTECTED_BRANCHES.has(branch) ||
+        branch.startsWith("release/") ||
+        branch === "HEAD");
+    return blocked !== undefined || branches.length === 0;
+}
+export function checkGit(command, out) {
+    const args = nonFlagArgs(command).filter((word) => !word.includes("="));
+    const subcommand = args[0] ?? "";
+    if (subcommand === "filter-branch" || subcommand === "filter-repo") {
+        flag(out, "history-destruction", command.raw, "history rewrite");
+        return;
+    }
+    if (subcommand === "update-ref" && args.includes("-d")) {
+        flag(out, "history-destruction", command.raw, "ref deletion");
+        return;
+    }
+    if (subcommand === "reflog" && args.includes("expire")) {
+        flag(out, "history-destruction", command.raw, "reflog expiry");
+        return;
+    }
+    if (subcommand !== "push") {
+        return;
+    }
+    if (gitForceTarget(command, args)) {
+        flag(out, "history-destruction", command.raw, "force push to a protected branch or an unknown target");
+    }
+}
+export function checkGh(command, out) {
+    const args = nonFlagArgs(command);
+    if ((args[0] === "repo" || args[0] === "release") && args[1] === "delete") {
+        flag(out, "history-destruction", command.raw, "remote deletion");
+    }
+}
+export function secretReadTargets(command) {
+    return nonFlagArgs(command).filter((word) => isSecretReadPath(word));
+}
+const READERS = new Set([
+    "cat",
+    "less",
+    "more",
+    "head",
+    "tail",
+    "grep",
+    "sed",
+    "awk",
+    "get-content",
+    "gc",
+    "type",
+    "bat",
+    "strings",
+    "xxd",
+    "od",
+]);
+// SPEC §4.7.2 credential exfiltration: bare env/printenv/set print secrets
+// into the context; reader commands print the secret paths they are given.
+export function readsSecret(command) {
+    const name = commandName(command);
+    if (name === "env" || name === "printenv" || name === "set") {
+        return command.argv.length === 0;
+    }
+    if (!READERS.has(name)) {
+        return false;
+    }
+    return secretReadTargets(command).length > 0;
+}

package/dist/kernel/shell-deny-target.d.ts

@@ -0,0 +1,4 @@
+import type { ShellViolation } from "./shell-deny.ts";
+export type TargetKind = "inside" | "outside" | "root";
+export declare function classifyTarget(target: string): TargetKind;
+export declare function flag(out: Array<ShellViolation>, className: ShellViolation["class"], raw: string, detail: string): void;

package/dist/kernel/shell-deny-target.js

@@ -0,0 +1,51 @@
+function isHomeRoot(slashed) {
+    const bracedHome = "$" + "{HOME}";
+    return (slashed === "~" ||
+        slashed.startsWith("~/") ||
+        slashed === "$HOME" ||
+        slashed.startsWith("$HOME/") ||
+        slashed === bracedHome ||
+        slashed.startsWith(`${bracedHome}/`) ||
+        slashed === "%USERPROFILE%" ||
+        slashed.startsWith("%USERPROFILE%/"));
+}
+function rootKindOf(slashed) {
+    if (isHomeRoot(slashed)) {
+        return "root";
+    }
+    const drive = /^[A-Za-z]:(\/|$)/.exec(slashed);
+    if (drive !== null) {
+        const rest = slashed.slice(2);
+        return rest === "" || rest === "/" ? "root" : "outside";
+    }
+    if (slashed.startsWith("/") || slashed.startsWith("//")) {
+        return slashed === "/" ? "root" : "outside";
+    }
+    return undefined;
+}
+function relativeKindOf(slashed) {
+    const kept = [];
+    for (const part of slashed.split("/")) {
+        if (part === "" || part === ".") {
+            continue;
+        }
+        if (part === "..") {
+            if (kept.pop() === undefined) {
+                return "outside";
+            }
+            continue;
+        }
+        kept.push(part);
+    }
+    return "inside";
+}
+export function classifyTarget(target) {
+    if (target === "" || target === "-") {
+        return "inside";
+    }
+    const slashed = target.replace(/\\/g, "/");
+    return rootKindOf(slashed) ?? relativeKindOf(slashed);
+}
+export function flag(out, className, raw, detail) {
+    out.push({ class: className, raw, detail });
+}

package/dist/kernel/shell-deny.d.ts

@@ -0,0 +1,8 @@
+import type { ShellAnalysis } from "./shell.ts";
+export type ShellViolationClass = "destruction" | "remote-code" | "privilege" | "exfiltration" | "secret-read" | "history-destruction" | "unparseable";
+export interface ShellViolation {
+    readonly class: ShellViolationClass;
+    readonly raw: string;
+    readonly detail: string;
+}
+export declare function matchDangerousShell(analysis: ShellAnalysis): Array<ShellViolation>;