dsh-perm-gate 5.2.0 → 5.3.0

package/lib/scan-text.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Argument keys that carry a document body rather than the operation itself.
+ * A file's text is not the operation: writing a document that *mentions* a token, a
+ * private key, or `credentials.yaml` must not hard-deny the write, and the deny-keyword
+ * layer must not refuse it either. Still consulted for executing tools, whose *other*
+ * keys are all operation-shaped.
+ *
+ * `plan` is the case that made this list look wrong (issue #2): it was missing, so a
+ * planning tool's prose was scanned as an operation.
+ */
+export declare const CONTENT_ARG_KEYS: ReadonlySet<string>;
+/**
+ * Keys that name an action for a non-executing tool: what a command would run, where a
+ * request goes, which path is touched, what a search looks for. Everything else such a
+ * tool carries is prose.
+ *
+ * `query` / `pattern` stay in on purpose: a search term is the whole operation of a
+ * lookup tool, and the tool-name doc already promises that a search whose query hits
+ * the blacklist is still vetoed (a `curl … ?token=` shape shipped in a search field is
+ * exactly as leaky as one in a `url`).
+ */
+export declare const OPERATION_ARG_KEYS: ReadonlySet<string>;
+/**
+ * A caller's additions to the two key sets (`extraContentArgKeys` / `extraOperationArgKeys`).
+ *
+ * Purely additive: the built-in sets are never replaced or cleared, because the bug this
+ * rule exists to prevent (issue #2) was exactly "the list of document keys forgot one".
+ * A setting that could drop `content` would let a profile author re-create that bug by
+ * omission, silently.
+ */
+export interface ScanKeyPolicy {
+    readonly content?: readonly string[];
+    readonly operation?: readonly string[];
+}
+interface KeySets {
+    readonly content: ReadonlySet<string>;
+    readonly operation: ReadonlySet<string>;
+}
+/** Merge the configured additions into the built-in sets. */
+export declare function mergeScanKeys(policy?: ScanKeyPolicy): KeySets;
+/**
+ * The scannable text of one call's arguments, with the rule above applied.
+ *
+ * Key precedence, in order (this ordering *is* the contract):
+ *
+ * 1. a key in the **operation** set is read, whatever the tool class and even if it also
+ *    landed in the content set — an explicit declaration that the field describes an act
+ *    (e.g. a workflow body that really executes) outranks a heuristic;
+ * 2. otherwise, for a non-executing tool, nothing else is read: its remaining fields are
+ *    documents, and `decide()` already classified the call as needing no approval;
+ * 3. otherwise (executor or a name the gate does not know) every key outside the content
+ *    set is read — an unfamiliar tool never gets the benefit of the doubt.
+ *
+ * Bounded and structure-preserving: values are joined with a single space, nesting is
+ * walked to a fixed depth, and nothing is escaped — the output is a haystack for
+ * keyword/credential matching, never something executed or logged as the call.
+ */
+export declare function operationText(args: Record<string, unknown>, tool?: string, policy?: ScanKeyPolicy): string;
+/**
+ * The text a blacklist keyword may match: the visible command plus the call's
+ * scannable arguments. Whitespace is collapsed so a command written with extra spaces
+ * still reads as the command it is.
+ *
+ * The command is placed first and is **not** subject to the key policy: no configuration
+ * of "which fields are documents" can take the executed command out of the blacklist's
+ * reach.
+ */
+export declare function keywordScanText(tool: string | undefined, args: Record<string, unknown>, commandText?: string, policy?: ScanKeyPolicy): string;
+export {};

package/lib/scan-text.js

@@ -0,0 +1,162 @@
+/**
+ * Which argument text a protective screen is allowed to read — one rule, shared.
+ *
+ * Two copies of this logic existed (`engine.operationText` for the P0 credential
+ * pre-screen, `runtime.denyScanText` for the deny-keyword blacklist) and both were a
+ * *denylist* of document-body keys. That is how GitHub issue #2 happened:
+ * `exit_plan_mode` carries its plan under `plan`, which was not in the list, so the
+ * whole plan text went into a screen built to catch *operations* — and a plan that
+ * honestly names `rm -rf` as a step it intends to ask about was hard-refused for
+ * describing it. The model then learns to reword plans to get past the gate, which is
+ * strictly worse than no gate.
+ *
+ * The list was also doomed to be re-filed for the next body key (`notes`, `summary`,
+ * `description`…), so this module changes the *shape* of the rule, per tool class:
+ *
+ * - a tool that **executes or is unknown** → every non-body key is read (the old,
+ *   conservative behaviour — an unfamiliar name never gets the benefit of the doubt);
+ * - a tool in {@link NON_EXECUTOR_TOOLS} (read / internal / file-write) → only keys
+ *   that *describe an action* are read: commands, urls, target paths, search queries.
+ *   Its document text is data, and `decide()` already classifies it as work that needs
+ *   no approval, so screening its prose contradicts that verdict.
+ *
+ * Residual, stated rather than hidden: a tool that *executes* a document body it was
+ * given (`workflow`, `skill`, `ralph`, `subagent`) is no longer read from that body
+ * here. Those paths delegate work that is gated as its own tool call, which is where an
+ * actual act becomes visible — see the comment on `INTERNAL_TOOLS` in `tool-names.ts`.
+ */
+import { NON_EXECUTOR_TOOLS } from './tool-names.js';
+/**
+ * Argument keys that carry a document body rather than the operation itself.
+ * A file's text is not the operation: writing a document that *mentions* a token, a
+ * private key, or `credentials.yaml` must not hard-deny the write, and the deny-keyword
+ * layer must not refuse it either. Still consulted for executing tools, whose *other*
+ * keys are all operation-shaped.
+ *
+ * `plan` is the case that made this list look wrong (issue #2): it was missing, so a
+ * planning tool's prose was scanned as an operation.
+ */
+export const CONTENT_ARG_KEYS = new Set([
+    'content', 'contents', 'text', 'body', 'message', 'prompt',
+    'new_string', 'old_string', 'newText', 'oldText', 'file_text', 'fileText',
+    'diff', 'patch', 'replacement', 'snippet', 'plan',
+]);
+/**
+ * Keys that name an action for a non-executing tool: what a command would run, where a
+ * request goes, which path is touched, what a search looks for. Everything else such a
+ * tool carries is prose.
+ *
+ * `query` / `pattern` stay in on purpose: a search term is the whole operation of a
+ * lookup tool, and the tool-name doc already promises that a search whose query hits
+ * the blacklist is still vetoed (a `curl … ?token=` shape shipped in a search field is
+ * exactly as leaky as one in a `url`).
+ */
+export const OPERATION_ARG_KEYS = new Set([
+    'command', 'cmd', 'script', 'shell', 'code',
+    'url', 'urls', 'href', 'uri', 'endpoint',
+    'path', 'paths', 'file', 'files', 'file_path', 'filePath', 'dir', 'directory',
+    'directories', 'cwd', 'workdir', 'target_path',
+    'query', 'pattern',
+]);
+/** Whether this tool's arguments describe an action rather than carry a document. */
+function actionOnlyTool(tool) {
+    return tool !== undefined && NON_EXECUTOR_TOOLS.has(tool);
+}
+/** The built-in pair, returned as-is when nothing was configured (no per-call Set churn). */
+const BUILTIN_KEYS = { content: CONTENT_ARG_KEYS, operation: OPERATION_ARG_KEYS };
+/** Blank and non-string entries are dropped rather than guessed at; empty input keeps the base set. */
+function withExtra(base, extra) {
+    if (extra === undefined)
+        return base;
+    const added = extra
+        .filter((key) => typeof key === 'string' && key.trim() !== '')
+        .map((key) => key.trim());
+    return added.length === 0 ? base : new Set([...base, ...added]);
+}
+/** Merge the configured additions into the built-in sets. */
+export function mergeScanKeys(policy) {
+    if (policy === undefined)
+        return BUILTIN_KEYS;
+    if (policy.content === undefined && policy.operation === undefined)
+        return BUILTIN_KEYS;
+    return {
+        content: withExtra(CONTENT_ARG_KEYS, policy.content),
+        operation: withExtra(OPERATION_ARG_KEYS, policy.operation),
+    };
+}
+/**
+ * The scannable text of one call's arguments, with the rule above applied.
+ *
+ * Key precedence, in order (this ordering *is* the contract):
+ *
+ * 1. a key in the **operation** set is read, whatever the tool class and even if it also
+ *    landed in the content set — an explicit declaration that the field describes an act
+ *    (e.g. a workflow body that really executes) outranks a heuristic;
+ * 2. otherwise, for a non-executing tool, nothing else is read: its remaining fields are
+ *    documents, and `decide()` already classified the call as needing no approval;
+ * 3. otherwise (executor or a name the gate does not know) every key outside the content
+ *    set is read — an unfamiliar tool never gets the benefit of the doubt.
+ *
+ * Bounded and structure-preserving: values are joined with a single space, nesting is
+ * walked to a fixed depth, and nothing is escaped — the output is a haystack for
+ * keyword/credential matching, never something executed or logged as the call.
+ */
+export function operationText(args, tool, policy) {
+    return collectText(args, tool, mergeScanKeys(policy), 0);
+}
+function collectText(args, tool, keys, depth) {
+    if (depth > 6)
+        return '';
+    const actionOnly = actionOnlyTool(tool);
+    // Whether a scalar sitting under `key` describes the operation.
+    const reads = (key) => keys.operation.has(key) || (!actionOnly && !keys.content.has(key));
+    // Whether to walk into `key`'s nested bag. A declared operation key and a neutral
+    // container (`{ params: { command: … } }`) both qualify; under a prose key the walk
+    // stops, so a document's nested fields cannot smuggle an operation back in.
+    const descends = (key) => !actionOnly || keys.operation.has(key) || CONTAINER_ARG_KEYS.has(key);
+    const parts = [];
+    for (const [key, value] of Object.entries(args)) {
+        if (typeof value === 'string') {
+            if (reads(key))
+                parts.push(value);
+            continue;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                // Array elements have no key of their own, so the parent decides: a `urls: […]`
+                // list is operation, a `notes: […]` list is prose.
+                if (typeof item === 'string') {
+                    if (reads(key))
+                        parts.push(item);
+                    continue;
+                }
+                if (item !== null && typeof item === 'object' && descends(key)) {
+                    parts.push(collectText(item, tool, keys, depth + 1));
+                }
+            }
+            continue;
+        }
+        if (value !== null && typeof value === 'object' && descends(key)) {
+            parts.push(collectText(value, tool, keys, depth + 1));
+        }
+    }
+    return parts.join(' ');
+}
+/** Keys whose value is a nested argument bag rather than a field of the call. */
+const CONTAINER_ARG_KEYS = new Set(['args', 'arguments', 'input', 'params', 'parameters', 'tool_input']);
+/**
+ * The text a blacklist keyword may match: the visible command plus the call's
+ * scannable arguments. Whitespace is collapsed so a command written with extra spaces
+ * still reads as the command it is.
+ *
+ * The command is placed first and is **not** subject to the key policy: no configuration
+ * of "which fields are documents" can take the executed command out of the blacklist's
+ * reach.
+ */
+export function keywordScanText(tool, args, commandText, policy) {
+    const parts = [];
+    if (typeof commandText === 'string' && commandText !== '')
+        parts.push(commandText);
+    parts.push(operationText(args, tool, policy));
+    return parts.join(' ').replace(/\s+/g, ' ');
+}

package/lib/script-review.d.ts

@@ -0,0 +1,50 @@
+export interface ScriptRef {
+    /** Exactly as it appeared in the command, so the ask context can match coverage. */
+    readonly ref: string;
+    /** Which interpreter runs it (`bash`, `pwsh`, … or `direct` for `./x.sh`). */
+    readonly interpreter: string;
+}
+/**
+ * Every script file the command runs, in order of appearance, deduplicated.
+ *
+ * Shapes covered: `bash x.sh`, `pwsh -File x.ps1`, `python -m pkg` (no file — nothing
+ * is returned), `node -e 'code'` (inline — nothing returned), `./deploy.sh`,
+ * `~/scripts/clean.sh`, `source env.sh`, `cmd /c build.bat`, and a pipeline of several
+ * of them. A `-c`/`-Command` payload is deliberately *not* mined for a nested script
+ * name: the code text is already what the gate grades.
+ */
+export declare function scriptRefs(commandText: string): readonly ScriptRef[];
+/** One script the call will run, with the text the reviewer gets. */
+export interface ScriptContent extends ScriptRef {
+    /** Absolute path actually read. */
+    readonly path: string;
+    readonly body: string;
+    /** True when the file is longer than the budget and `body` is a prefix. */
+    readonly truncated: boolean;
+    /** Set instead of `body` when nothing could be read (never silently empty). */
+    readonly unreadable?: 'missing' | 'not-a-file' | 'too-large' | 'binary' | 'unreadable';
+    readonly bytes: number;
+}
+/** Reading budget: enough for a real script, small enough for one grader round-trip. */
+export declare const SCRIPT_REVIEW_MAX_BODY_CHARS = 20000;
+export declare const SCRIPT_REVIEW_MAX_FILE_BYTES = 512000;
+export declare const SCRIPT_REVIEW_MAX_FILES = 4;
+/** `~` expansion plus cwd-relative resolution, without touching the filesystem. */
+export declare function resolveScriptPath(ref: string, cwd: string): string;
+/**
+ * Read the bodies of {@link scriptRefs}, bounded and best-effort: a file that cannot be
+ * read is *reported* as such (`unreadable`), because "we looked and could not see" is
+ * information the reviewer needs, while an empty body would read as a benign script.
+ *
+ * Never throws — a missing file, a permission error, or an undecodable blob all come
+ * back as a labelled entry.
+ */
+export declare function readScriptContents(refs: readonly ScriptRef[], cwd: string, limits?: {
+    readonly maxFiles?: number;
+    readonly maxBodyChars?: number;
+    readonly maxFileBytes?: number;
+}): readonly ScriptContent[];
+/** Whether every script the call runs has been read (i.e. the payload is now visible). */
+export declare function scriptsFullyCovered(refs: readonly ScriptRef[], contents: readonly ScriptContent[]): boolean;
+/** The readable summary the deterministic layers judge a script body alongside. */
+export declare function scriptBodyText(contents: readonly ScriptContent[]): string;

package/lib/script-review.js

@@ -0,0 +1,202 @@
+/**
+ * Script-body attachment for review — "what will run", not "which file was named".
+ *
+ * A call like `bash ./clean-home.sh` or `pwsh -File ~/scripts/clean-home.ps1` names a
+ * file; the *operation* is inside it. Before this module the grader saw only the
+ * filename, so a script that wipes `$HOME` while claiming to free up cache was graded
+ * on a sentence that contains nothing dangerous — and out-of-workspace scripts were
+ * pushed to the `U` tier (uninspectable), which is honest but also means nobody ever
+ * looked. So: when a call runs a script, read it (bounded) and hand the same text to
+ * the risk model and to the human, and let the deterministic nets judge the body too.
+ *
+ * Two boundaries are kept on purpose:
+ * - **Reading is not executing.** Only the bytes are looked at; nothing here runs,
+ *   sources, or resolves a shebang.
+ * - **The file is untrusted data.** The body reaches the grader inside a labelled
+ *   field and must never be treated as instructions by whoever consumes it; secrets in
+ *   it go through the same redaction as every other egress text.
+ *
+ * The pure half ({@link scriptRefs}) has no filesystem access so `ask-context.ts` can
+ * keep its "never touches fs" invariant; the reading half is used by the node runtime.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, resolve } from 'node:path';
+/** Extensions whose file *is* the payload of the call. */
+const SCRIPT_EXT = '(?:sh|bash|zsh|dash|ksh|ps1|psm1|psd1|py|py3|js|mjs|cjs|ts|mts|rb|pl|php|bat|cmd)';
+/** Interpreters that take a script file as a bare argument. */
+const FILE_INTERPRETERS = /^(?:sh|bash|zsh|dash|ksh|busybox|pwsh|powershell|cmd|python[23]?|node|nodejs|deno|bun|ruby|perl|php)$/i;
+/** Shell builtins that run a file in the current shell. */
+const SOURCE_HEADS = /^(?:source|\.)$/i;
+/**
+ * Flags that mean "the next argument is inline code, not a file". Attaching them as a
+ * script path would read a file named after a whole code string, and grading them as
+ * content is pointless — the code is already the command text.
+ *
+ * `cmd`'s `/c` and `/k` are deliberately **not** here: `cmd /c build.bat` is how a batch
+ * file is run, and the inline-code reading of `/c` (a quoted command string) still
+ * yields no file, because a code blob never ends in a script extension.
+ */
+const INLINE_CODE_FLAGS = /^-{1,2}(?:c\b|e\b|command|c=|encodedcommand|eval|exec)$|^-C$/i;
+/**
+ * Bare interpreter flags that may swallow the next token (`bash -x -c '…' script.sh`
+ * is not a file argument after `-c`, but `-x` leaves the next candidate alone).
+ */
+const SWITCH_ONLY_FLAGS = /^-+[\w-]+$/;
+/** Whether one token looks like a script file rather than a flag or an inline body. */
+function looksLikeScript(token) {
+    if (token === '' || token.startsWith('-') || token.startsWith('/'))
+        return false;
+    return new RegExp(`\\.${SCRIPT_EXT}$`, 'i').test(token);
+}
+/**
+ * Every script file the command runs, in order of appearance, deduplicated.
+ *
+ * Shapes covered: `bash x.sh`, `pwsh -File x.ps1`, `python -m pkg` (no file — nothing
+ * is returned), `node -e 'code'` (inline — nothing returned), `./deploy.sh`,
+ * `~/scripts/clean.sh`, `source env.sh`, `cmd /c build.bat`, and a pipeline of several
+ * of them. A `-c`/`-Command` payload is deliberately *not* mined for a nested script
+ * name: the code text is already what the gate grades.
+ */
+export function scriptRefs(commandText) {
+    const out = [];
+    const seen = new Set();
+    const push = (ref, interpreter) => {
+        if (ref === '' || seen.has(ref))
+            return;
+        seen.add(ref);
+        out.push({ ref, interpreter });
+    };
+    for (const segment of commandText.split(/[;&|\n]+/)) {
+        const tokens = segment.trim().split(/\s+/).filter((t) => t !== '');
+        if (tokens.length === 0)
+            continue;
+        const head = (tokens[0] ?? '').replace(/^["'`]+/, '').replace(/["'`]+$/, '');
+        const bare = head.split(/[\\/]/).pop() ?? head;
+        // `./deploy.sh`, `~/scripts/x.sh`, `/tmp/run.py` executed directly.
+        if (looksLikeScript(head)) {
+            push(head, 'direct');
+            continue;
+        }
+        if (!(FILE_INTERPRETERS.test(bare) || SOURCE_HEADS.test(head)))
+            continue;
+        const isFileFlagAware = FILE_INTERPRETERS.test(bare);
+        const isSource = SOURCE_HEADS.test(head);
+        for (let i = 1; i < tokens.length; i += 1) {
+            const tok = (tokens[i] ?? '').replace(/^["'`]+/, '').replace(/["'`]+$/, '');
+            if (tok === '')
+                continue;
+            // `source`/`.` runs the file in the current shell, and its argument need not
+            // carry a known extension (`source ~/.profile`, `. ./env`). Anything that is not
+            // a flag is the file.
+            if (isSource) {
+                if (!tok.startsWith('-'))
+                    push(tok, 'source');
+                continue;
+            }
+            if (isFileFlagAware && INLINE_CODE_FLAGS.test(tok))
+                break; // the rest is inline code
+            // `-File x.ps1` / `/c build.bat`: the flag itself is skipped, the value is read.
+            if (isFileFlagAware && SWITCH_ONLY_FLAGS.test(tok)) {
+                const next = (tokens[i + 1] ?? '').replace(/^["'`]+/, '').replace(/["'`]+$/, '');
+                if (looksLikeScript(next))
+                    push(next, bare.toLowerCase());
+                i += 1;
+                continue;
+            }
+            if (looksLikeScript(tok))
+                push(tok, bare.toLowerCase());
+        }
+    }
+    return out;
+}
+/** Reading budget: enough for a real script, small enough for one grader round-trip. */
+export const SCRIPT_REVIEW_MAX_BODY_CHARS = 20_000;
+export const SCRIPT_REVIEW_MAX_FILE_BYTES = 512_000;
+export const SCRIPT_REVIEW_MAX_FILES = 4;
+/** `~` expansion plus cwd-relative resolution, without touching the filesystem. */
+export function resolveScriptPath(ref, cwd) {
+    const cleaned = ref.replace(/^["'`]+/, '').replace(/["'`]+$/, '');
+    const expanded = cleaned === '~' || cleaned.startsWith('~/') || cleaned.startsWith('~\\')
+        ? resolve(homedir(), cleaned.slice(1).replace(/^[\\/]/, ''))
+        : cleaned;
+    return isAbsolute(expanded) ? expanded : resolve(cwd, expanded);
+}
+/** Whether a decoded body is text at all (a compiled artifact is not reviewable). */
+function looksBinary(text) {
+    if (text.includes('\u0000'))
+        return true;
+    const sample = text.slice(0, 2000);
+    if (sample === '')
+        return false;
+    let weird = 0;
+    for (const ch of sample) {
+        const code = ch.charCodeAt(0);
+        if (code === 9 || code === 10 || code === 13 || (code >= 32 && code !== 127))
+            continue;
+        weird += 1;
+    }
+    return weird / sample.length > 0.15;
+}
+/**
+ * Read the bodies of {@link scriptRefs}, bounded and best-effort: a file that cannot be
+ * read is *reported* as such (`unreadable`), because "we looked and could not see" is
+ * information the reviewer needs, while an empty body would read as a benign script.
+ *
+ * Never throws — a missing file, a permission error, or an undecodable blob all come
+ * back as a labelled entry.
+ */
+export function readScriptContents(refs, cwd, limits = {}) {
+    const maxFiles = limits.maxFiles ?? SCRIPT_REVIEW_MAX_FILES;
+    const maxBodyChars = limits.maxBodyChars ?? SCRIPT_REVIEW_MAX_BODY_CHARS;
+    const maxFileBytes = limits.maxFileBytes ?? SCRIPT_REVIEW_MAX_FILE_BYTES;
+    const out = [];
+    for (const ref of refs.slice(0, maxFiles)) {
+        const path = resolveScriptPath(ref.ref, cwd);
+        const entry = (body, truncated, bytes, unreadable) => ({
+            ...ref,
+            path,
+            body,
+            truncated,
+            bytes,
+            ...(unreadable === undefined ? {} : { unreadable }),
+        });
+        try {
+            const st = statSync(path);
+            if (!st.isFile()) {
+                out.push(entry('', false, 0, 'not-a-file'));
+                continue;
+            }
+            if (st.size > maxFileBytes) {
+                // The size still says something (a 40 MB "cleanup script" is worth a human look),
+                // but the body is out of budget.
+                out.push(entry('', true, st.size, 'too-large'));
+                continue;
+            }
+            const raw = readFileSync(path, 'utf8');
+            if (looksBinary(raw)) {
+                out.push(entry('', false, st.size, 'binary'));
+                continue;
+            }
+            out.push(entry(raw.slice(0, maxBodyChars), raw.length > maxBodyChars, st.size));
+        }
+        catch (err) {
+            const missing = err.code === 'ENOENT';
+            out.push(entry('', false, 0, missing ? 'missing' : 'unreadable'));
+        }
+    }
+    return out;
+}
+/** Whether every script the call runs has been read (i.e. the payload is now visible). */
+export function scriptsFullyCovered(refs, contents) {
+    if (refs.length === 0)
+        return false;
+    return refs.every((r) => contents.some((c) => c.ref === r.ref && c.unreadable === undefined && c.body !== ''));
+}
+/** The readable summary the deterministic layers judge a script body alongside. */
+export function scriptBodyText(contents) {
+    return contents
+        .filter((c) => c.unreadable === undefined)
+        .map((c) => `${c.ref}\n${c.body}`)
+        .join('\n');
+}

package/lib/shell.d.ts

@@ -39,6 +39,24 @@ export declare function commandArgv(cmd: SimpleCommand): string;
  * undecidable command to `ask` rather than guessing.
  */
 export declare function tokenizeShell(text: string): string[];
+/**
+ * Tokenize like {@link tokenizeShell}, but also emit the statement separators as
+ * their own tokens: `;`, `|`, `&&`, `||` and — the two that were missing — a **newline**
+ * and a **glued** operator with no spaces around it.
+ *
+ * This is the tokenizer {@link decomposeShellCommand} walks, and the reason it exists is
+ * a hole that two bug reports traced back to the same place. `tokenizeShell` swallows
+ * whitespace, so `ls\nrm -rf ~/.*` came out as one command whose head is `ls` and whose
+ * second statement sits in `args` — no `deny` rule matches it, and the per-segment
+ * checks never see it as a program. Same for `cd /tmp;rm -rf ~`. Meanwhile
+ * `irreversible.ts` was splitting on `[;&|\n]` all along, so the two layers disagreed
+ * about what "a command" is, and the layer that graded the string was the looser one.
+ *
+ * Quoted text is still opaque: `bash -c "a; b"` and `find -exec … ';'` do not produce
+ * separators, because the character is inside the argument's value. A lone `&` is left
+ * inside the token, not split out: `2>&1` and a backgrounded job must keep their shape.
+ */
+export declare function tokenizeShellSeparators(text: string): string[];
 /**
  * Recursively decompose a command string into simple commands, descending into
  * `-c`/`-Command` inline scripts. Throws on undecidable syntax (unclosed quote);

package/lib/shell.js

@@ -83,6 +83,107 @@ export function tokenizeShell(text) {
         tokens.push(cur);
     return tokens;
 }
+/**
+ * Tokenize like {@link tokenizeShell}, but also emit the statement separators as
+ * their own tokens: `;`, `|`, `&&`, `||` and — the two that were missing — a **newline**
+ * and a **glued** operator with no spaces around it.
+ *
+ * This is the tokenizer {@link decomposeShellCommand} walks, and the reason it exists is
+ * a hole that two bug reports traced back to the same place. `tokenizeShell` swallows
+ * whitespace, so `ls\nrm -rf ~/.*` came out as one command whose head is `ls` and whose
+ * second statement sits in `args` — no `deny` rule matches it, and the per-segment
+ * checks never see it as a program. Same for `cd /tmp;rm -rf ~`. Meanwhile
+ * `irreversible.ts` was splitting on `[;&|\n]` all along, so the two layers disagreed
+ * about what "a command" is, and the layer that graded the string was the looser one.
+ *
+ * Quoted text is still opaque: `bash -c "a; b"` and `find -exec … ';'` do not produce
+ * separators, because the character is inside the argument's value. A lone `&` is left
+ * inside the token, not split out: `2>&1` and a backgrounded job must keep their shape.
+ */
+export function tokenizeShellSeparators(text) {
+    const tokens = [];
+    let cur = '';
+    let quote = null;
+    let i = 0;
+    const n = text.length;
+    const flush = () => {
+        if (cur.length > 0) {
+            tokens.push(cur);
+            cur = '';
+        }
+    };
+    while (i < n) {
+        const ch = text[i];
+        if (quote === "'") {
+            if (ch === "'") {
+                quote = null;
+                i += 1;
+                continue;
+            }
+            cur += ch;
+            i += 1;
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === '"') {
+                quote = null;
+                i += 1;
+                continue;
+            }
+            if (ch === '\\' && i + 1 < n) {
+                cur += text[i + 1];
+                i += 2;
+                continue;
+            }
+            cur += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '\\' && i + 1 < n) {
+            cur += text[i + 1];
+            i += 2;
+            continue;
+        }
+        // Unquoted operator: end the current token and emit the operator itself. The
+        // two-character forms are matched first so `||` is not two `|` and `&&` not two `&`.
+        if (ch === ';' || ch === '\n' || ch === '\r') {
+            flush();
+            if (ch !== '\r' || text[i + 1] !== '\n')
+                tokens.push(';');
+            i += 1;
+            continue;
+        }
+        if (ch === '|') {
+            flush();
+            tokens.push(text[i + 1] === '|' ? '||' : '|');
+            i += text[i + 1] === '|' ? 2 : 1;
+            continue;
+        }
+        if (ch === '&' && text[i + 1] === '&') {
+            flush();
+            tokens.push('&&');
+            i += 2;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            flush();
+            i += 1;
+            continue;
+        }
+        cur += ch;
+        i += 1;
+    }
+    if (quote !== null) {
+        throw new Error('unterminated quote in command string');
+    }
+    flush();
+    return tokens;
+}
 /** Split into top-level simple-command token groups on `|`/`&&`/`;`/`||`. */
 function splitPipeline(tokens) {
     const groups = [];
@@ -141,7 +242,8 @@ function stripWrappers(args) {
  * callers route that to `ask`, never `allow`.
  */
 export function decomposeShellCommand(text) {
-    const tokens = tokenizeShell(text);
+    // Separators are tokenized, not swallowed: see `tokenizeShellSeparators`.
+    const tokens = tokenizeShellSeparators(text);
     const groups = splitPipeline(tokens);
     const commands = [];
     for (const group of groups) {