open-multi-agent-kit 0.90.8 → 0.91.0

package/dist/core/agent-tool-settings.d.ts

@@ -0,0 +1,35 @@
+import type { AgentOptions } from "omk-agent-core";
+import type { SettingsManager } from "./settings-manager.ts";
+/** §6.3 timeout categories. `undefined` category falls through to the global setting. */
+export type ToolTimeoutCategory = "read" | "write" | "mcp" | "process" | "browser";
+/** §6.3 category default timeouts (ms): read/list/search 30s, write/edit 60s, MCP 120s, bash/process 300s, browser/computer-use 180s. */
+export declare const TOOL_CATEGORY_TIMEOUTS: Readonly<Record<ToolTimeoutCategory, number>>;
+/**
+ * Classify a tool name into its §6.3 timeout category. Conservative on
+ * purpose: unknown names return `undefined` and keep the global timeout.
+ * A browser/computer-use match wins over the generic MCP category because
+ * browser automation is the slower bound.
+ */
+export declare function resolveToolTimeoutCategory(toolName: string): ToolTimeoutCategory | undefined;
+/**
+ * Fill §6.3 category default timeouts for every active tool name that has no
+ * explicit per-name entry. Explicit entries (user settings and built-in
+ * defaults) always win and are all preserved; names without a category are
+ * omitted so they fall through to the global `toolTimeoutMs` at runtime.
+ */
+export declare function applyCategoryTimeoutDefaults(toolNames: Iterable<string>, explicit: Readonly<Record<string, number>>): Record<string, number>;
+type ToolScheduler = NonNullable<AgentOptions["toolScheduler"]>;
+export interface ResolvedAgentToolSettings {
+    readonly toolScheduler: ToolScheduler;
+    readonly maxToolConcurrency: number | undefined;
+    readonly strictExtensionClaims: boolean;
+    readonly toolTimeoutMs: number;
+    readonly toolTimeouts: Record<string, number>;
+}
+export declare class AgentToolSettingsError extends Error {
+    readonly settingName: string;
+    constructor(settingName: string);
+}
+export declare function resolveAgentToolSettings(settingsManager: SettingsManager, env?: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>): ResolvedAgentToolSettings;
+export {};
+//# sourceMappingURL=agent-tool-settings.d.ts.map

package/dist/core/agent-tool-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tool-settings.d.ts","sourceRoot":"","sources":["../../src/core/agent-tool-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAwB,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAiBnF,0FAAyF;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnF,0IAAyI;AACzI,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAM/E,CAAC;AASH;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAO5F;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC3C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC3B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;AAEhE,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,YAAY,WAAW,EAAE,MAAM,EAI9B;CACD;AAiFD,wBAAgB,wBAAwB,CACvC,eAAe,EAAE,eAAe,EAChC,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GACjF,yBAAyB,CAc3B","sourcesContent":["import type { AgentOptions } from \"omk-agent-core\";\nimport type { AgentRuntimeSettings, SettingsManager } from \"./settings-manager.ts\";\n\nconst DEFAULT_TOOL_SCHEDULER = \"dag-v2\";\nconst DEFAULT_MAX_TOOL_CONCURRENCY = 4;\nconst DEFAULT_TOOL_TIMEOUT_MS = 0;\nconst MAX_TOOL_TIMEOUT_MS = 2_147_483_647;\n\nconst DEFAULT_BUILTIN_TOOL_TIMEOUTS: Readonly<Record<string, number>> = {\n\tbash: 300_000,\n\tedit: 60_000,\n\tfind: 30_000,\n\tgrep: 30_000,\n\tls: 30_000,\n\tread: 30_000,\n\twrite: 60_000,\n};\n\n/** §6.3 timeout categories. `undefined` category falls through to the global setting. */\nexport type ToolTimeoutCategory = \"read\" | \"write\" | \"mcp\" | \"process\" | \"browser\";\n\n/** §6.3 category default timeouts (ms): read/list/search 30s, write/edit 60s, MCP 120s, bash/process 300s, browser/computer-use 180s. */\nexport const TOOL_CATEGORY_TIMEOUTS: Readonly<Record<ToolTimeoutCategory, number>> = Object.freeze({\n\tread: 30_000,\n\twrite: 60_000,\n\tmcp: 120_000,\n\tprocess: 300_000,\n\tbrowser: 180_000,\n});\n\nconst READ_CATEGORY_TOOLS = new Set([\"read\", \"ls\", \"find\", \"grep\", \"glob\", \"list\", \"search\"]);\nconst WRITE_CATEGORY_TOOLS = new Set([\"write\", \"edit\"]);\nconst PROCESS_CATEGORY_TOOLS = new Set([\"bash\"]);\n// Matches direct browser/computer-use tools and browser tools bridged through\n// MCP servers (e.g. `mcp__playwright__browser_click`).\nconst BROWSER_TOOL_PATTERN = /(^|__)(browser_|computer[-_]?use$|computer_)/;\n\n/**\n * Classify a tool name into its §6.3 timeout category. Conservative on\n * purpose: unknown names return `undefined` and keep the global timeout.\n * A browser/computer-use match wins over the generic MCP category because\n * browser automation is the slower bound.\n */\nexport function resolveToolTimeoutCategory(toolName: string): ToolTimeoutCategory | undefined {\n\tif (READ_CATEGORY_TOOLS.has(toolName)) return \"read\";\n\tif (WRITE_CATEGORY_TOOLS.has(toolName)) return \"write\";\n\tif (PROCESS_CATEGORY_TOOLS.has(toolName)) return \"process\";\n\tif (BROWSER_TOOL_PATTERN.test(toolName)) return \"browser\";\n\tif (toolName.startsWith(\"mcp__\")) return \"mcp\";\n\treturn undefined;\n}\n\n/**\n * Fill §6.3 category default timeouts for every active tool name that has no\n * explicit per-name entry. Explicit entries (user settings and built-in\n * defaults) always win and are all preserved; names without a category are\n * omitted so they fall through to the global `toolTimeoutMs` at runtime.\n */\nexport function applyCategoryTimeoutDefaults(\n\ttoolNames: Iterable<string>,\n\texplicit: Readonly<Record<string, number>>,\n): Record<string, number> {\n\tconst merged: Record<string, number> = Object.create(null);\n\tfor (const toolName of toolNames) {\n\t\tif (Object.hasOwn(explicit, toolName)) continue;\n\t\tconst category = resolveToolTimeoutCategory(toolName);\n\t\tif (category !== undefined) {\n\t\t\tmerged[toolName] = TOOL_CATEGORY_TIMEOUTS[category];\n\t\t}\n\t}\n\tfor (const [toolName, timeoutMs] of Object.entries(explicit)) {\n\t\tmerged[toolName] = timeoutMs;\n\t}\n\treturn merged;\n}\n\ntype ToolScheduler = NonNullable<AgentOptions[\"toolScheduler\"]>;\n\nexport interface ResolvedAgentToolSettings {\n\treadonly toolScheduler: ToolScheduler;\n\treadonly maxToolConcurrency: number | undefined;\n\treadonly strictExtensionClaims: boolean;\n\treadonly toolTimeoutMs: number;\n\treadonly toolTimeouts: Record<string, number>;\n}\n\nexport class AgentToolSettingsError extends Error {\n\treadonly settingName: string;\n\n\tconstructor(settingName: string) {\n\t\tsuper(`Invalid ${settingName} setting`);\n\t\tthis.name = \"AgentToolSettingsError\";\n\t\tthis.settingName = settingName;\n\t}\n}\n\nfunction parseScheduler(value: unknown, settingName: string): ToolScheduler | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tif (value === \"waves-v1\" || value === \"dag-v2\") {\n\t\treturn value;\n\t}\n\tthrow new AgentToolSettingsError(settingName);\n}\n\nfunction parseTimeout(value: unknown, settingName: string, defaultValue: number): number {\n\tif (value === undefined) {\n\t\treturn defaultValue;\n\t}\n\tif (typeof value !== \"number\" || !Number.isInteger(value) || value < 0 || value > MAX_TOOL_TIMEOUT_MS) {\n\t\tthrow new AgentToolSettingsError(settingName);\n\t}\n\treturn value;\n}\n\nfunction parseConcurrency(value: unknown): number | undefined {\n\tif (value === undefined) {\n\t\treturn DEFAULT_MAX_TOOL_CONCURRENCY;\n\t}\n\tif (typeof value !== \"number\" || !Number.isInteger(value) || value < 0) {\n\t\tthrow new AgentToolSettingsError(\"agent.maxToolConcurrency\");\n\t}\n\treturn value === 0 ? undefined : value;\n}\n\nfunction parseAgentSettings(value: AgentRuntimeSettings | undefined, settingName: string): AgentRuntimeSettings {\n\tif (value === undefined) {\n\t\treturn {};\n\t}\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new AgentToolSettingsError(settingName);\n\t}\n\treturn value;\n}\n\nfunction parseToolTimeoutEntries(\n\tvalue: AgentRuntimeSettings[\"toolTimeouts\"],\n\tsettingName: string,\n): readonly (readonly [string, number])[] {\n\tif (value === undefined) {\n\t\treturn [];\n\t}\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new AgentToolSettingsError(settingName);\n\t}\n\n\treturn Object.entries(value).map(([toolName, timeoutMs]) => {\n\t\tif (toolName.length === 0) {\n\t\t\tthrow new AgentToolSettingsError(settingName);\n\t\t}\n\t\treturn [toolName, parseTimeout(timeoutMs, `${settingName}.${toolName}`, DEFAULT_TOOL_TIMEOUT_MS)] as const;\n\t});\n}\n\nfunction resolveToolTimeouts(\n\tglobalSettings: AgentRuntimeSettings,\n\tprojectSettings: AgentRuntimeSettings,\n\teffectiveSettings: AgentRuntimeSettings,\n): Record<string, number> {\n\tconst timeouts: Record<string, number> = Object.create(null);\n\tconst entryGroups = [\n\t\tObject.entries(DEFAULT_BUILTIN_TOOL_TIMEOUTS),\n\t\tparseToolTimeoutEntries(globalSettings.toolTimeouts, \"agent.toolTimeouts\"),\n\t\tparseToolTimeoutEntries(projectSettings.toolTimeouts, \"agent.toolTimeouts\"),\n\t\tparseToolTimeoutEntries(effectiveSettings.toolTimeouts, \"agent.toolTimeouts\"),\n\t];\n\tfor (const entries of entryGroups) {\n\t\tfor (const [toolName, timeoutMs] of entries) {\n\t\t\ttimeouts[toolName] = timeoutMs;\n\t\t}\n\t}\n\treturn timeouts;\n}\n\nexport function resolveAgentToolSettings(\n\tsettingsManager: SettingsManager,\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): ResolvedAgentToolSettings {\n\tconst globalSettings = parseAgentSettings(settingsManager.getGlobalSettings().agent, \"agent\");\n\tconst projectSettings = parseAgentSettings(settingsManager.getProjectSettings().agent, \"agent\");\n\tconst settings = parseAgentSettings(settingsManager.getAgentRuntimeSettings(), \"agent\");\n\tconst envScheduler = parseScheduler(env.OMK_TOOL_SCHEDULER, \"OMK_TOOL_SCHEDULER\");\n\tconst settingsScheduler = parseScheduler(settings.toolScheduler, \"agent.toolScheduler\");\n\n\treturn {\n\t\ttoolScheduler: envScheduler ?? settingsScheduler ?? DEFAULT_TOOL_SCHEDULER,\n\t\tmaxToolConcurrency: parseConcurrency(settings.maxToolConcurrency),\n\t\tstrictExtensionClaims: true,\n\t\ttoolTimeoutMs: parseTimeout(settings.toolTimeoutMs, \"agent.toolTimeoutMs\", DEFAULT_TOOL_TIMEOUT_MS),\n\t\ttoolTimeouts: resolveToolTimeouts(globalSettings, projectSettings, settings),\n\t};\n}\n"]}

package/dist/core/agent-tool-settings.js

@@ -0,0 +1,155 @@
+const DEFAULT_TOOL_SCHEDULER = "dag-v2";
+const DEFAULT_MAX_TOOL_CONCURRENCY = 4;
+const DEFAULT_TOOL_TIMEOUT_MS = 0;
+const MAX_TOOL_TIMEOUT_MS = 2_147_483_647;
+const DEFAULT_BUILTIN_TOOL_TIMEOUTS = {
+    bash: 300_000,
+    edit: 60_000,
+    find: 30_000,
+    grep: 30_000,
+    ls: 30_000,
+    read: 30_000,
+    write: 60_000,
+};
+/** §6.3 category default timeouts (ms): read/list/search 30s, write/edit 60s, MCP 120s, bash/process 300s, browser/computer-use 180s. */
+export const TOOL_CATEGORY_TIMEOUTS = Object.freeze({
+    read: 30_000,
+    write: 60_000,
+    mcp: 120_000,
+    process: 300_000,
+    browser: 180_000,
+});
+const READ_CATEGORY_TOOLS = new Set(["read", "ls", "find", "grep", "glob", "list", "search"]);
+const WRITE_CATEGORY_TOOLS = new Set(["write", "edit"]);
+const PROCESS_CATEGORY_TOOLS = new Set(["bash"]);
+// Matches direct browser/computer-use tools and browser tools bridged through
+// MCP servers (e.g. `mcp__playwright__browser_click`).
+const BROWSER_TOOL_PATTERN = /(^|__)(browser_|computer[-_]?use$|computer_)/;
+/**
+ * Classify a tool name into its §6.3 timeout category. Conservative on
+ * purpose: unknown names return `undefined` and keep the global timeout.
+ * A browser/computer-use match wins over the generic MCP category because
+ * browser automation is the slower bound.
+ */
+export function resolveToolTimeoutCategory(toolName) {
+    if (READ_CATEGORY_TOOLS.has(toolName))
+        return "read";
+    if (WRITE_CATEGORY_TOOLS.has(toolName))
+        return "write";
+    if (PROCESS_CATEGORY_TOOLS.has(toolName))
+        return "process";
+    if (BROWSER_TOOL_PATTERN.test(toolName))
+        return "browser";
+    if (toolName.startsWith("mcp__"))
+        return "mcp";
+    return undefined;
+}
+/**
+ * Fill §6.3 category default timeouts for every active tool name that has no
+ * explicit per-name entry. Explicit entries (user settings and built-in
+ * defaults) always win and are all preserved; names without a category are
+ * omitted so they fall through to the global `toolTimeoutMs` at runtime.
+ */
+export function applyCategoryTimeoutDefaults(toolNames, explicit) {
+    const merged = Object.create(null);
+    for (const toolName of toolNames) {
+        if (Object.hasOwn(explicit, toolName))
+            continue;
+        const category = resolveToolTimeoutCategory(toolName);
+        if (category !== undefined) {
+            merged[toolName] = TOOL_CATEGORY_TIMEOUTS[category];
+        }
+    }
+    for (const [toolName, timeoutMs] of Object.entries(explicit)) {
+        merged[toolName] = timeoutMs;
+    }
+    return merged;
+}
+export class AgentToolSettingsError extends Error {
+    settingName;
+    constructor(settingName) {
+        super(`Invalid ${settingName} setting`);
+        this.name = "AgentToolSettingsError";
+        this.settingName = settingName;
+    }
+}
+function parseScheduler(value, settingName) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === "waves-v1" || value === "dag-v2") {
+        return value;
+    }
+    throw new AgentToolSettingsError(settingName);
+}
+function parseTimeout(value, settingName, defaultValue) {
+    if (value === undefined) {
+        return defaultValue;
+    }
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > MAX_TOOL_TIMEOUT_MS) {
+        throw new AgentToolSettingsError(settingName);
+    }
+    return value;
+}
+function parseConcurrency(value) {
+    if (value === undefined) {
+        return DEFAULT_MAX_TOOL_CONCURRENCY;
+    }
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+        throw new AgentToolSettingsError("agent.maxToolConcurrency");
+    }
+    return value === 0 ? undefined : value;
+}
+function parseAgentSettings(value, settingName) {
+    if (value === undefined) {
+        return {};
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new AgentToolSettingsError(settingName);
+    }
+    return value;
+}
+function parseToolTimeoutEntries(value, settingName) {
+    if (value === undefined) {
+        return [];
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new AgentToolSettingsError(settingName);
+    }
+    return Object.entries(value).map(([toolName, timeoutMs]) => {
+        if (toolName.length === 0) {
+            throw new AgentToolSettingsError(settingName);
+        }
+        return [toolName, parseTimeout(timeoutMs, `${settingName}.${toolName}`, DEFAULT_TOOL_TIMEOUT_MS)];
+    });
+}
+function resolveToolTimeouts(globalSettings, projectSettings, effectiveSettings) {
+    const timeouts = Object.create(null);
+    const entryGroups = [
+        Object.entries(DEFAULT_BUILTIN_TOOL_TIMEOUTS),
+        parseToolTimeoutEntries(globalSettings.toolTimeouts, "agent.toolTimeouts"),
+        parseToolTimeoutEntries(projectSettings.toolTimeouts, "agent.toolTimeouts"),
+        parseToolTimeoutEntries(effectiveSettings.toolTimeouts, "agent.toolTimeouts"),
+    ];
+    for (const entries of entryGroups) {
+        for (const [toolName, timeoutMs] of entries) {
+            timeouts[toolName] = timeoutMs;
+        }
+    }
+    return timeouts;
+}
+export function resolveAgentToolSettings(settingsManager, env = process.env) {
+    const globalSettings = parseAgentSettings(settingsManager.getGlobalSettings().agent, "agent");
+    const projectSettings = parseAgentSettings(settingsManager.getProjectSettings().agent, "agent");
+    const settings = parseAgentSettings(settingsManager.getAgentRuntimeSettings(), "agent");
+    const envScheduler = parseScheduler(env.OMK_TOOL_SCHEDULER, "OMK_TOOL_SCHEDULER");
+    const settingsScheduler = parseScheduler(settings.toolScheduler, "agent.toolScheduler");
+    return {
+        toolScheduler: envScheduler ?? settingsScheduler ?? DEFAULT_TOOL_SCHEDULER,
+        maxToolConcurrency: parseConcurrency(settings.maxToolConcurrency),
+        strictExtensionClaims: true,
+        toolTimeoutMs: parseTimeout(settings.toolTimeoutMs, "agent.toolTimeoutMs", DEFAULT_TOOL_TIMEOUT_MS),
+        toolTimeouts: resolveToolTimeouts(globalSettings, projectSettings, settings),
+    };
+}
+//# sourceMappingURL=agent-tool-settings.js.map

package/dist/core/agent-tool-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tool-settings.js","sourceRoot":"","sources":["../../src/core/agent-tool-settings.ts"],"names":[],"mappings":"AAGA,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AACxC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AACvC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAE1C,MAAM,6BAA6B,GAAqC;IACvE,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;CACb,CAAC;AAKF,0IAAyI;AACzI,MAAM,CAAC,MAAM,sBAAsB,GAAkD,MAAM,CAAC,MAAM,CAAC;IAClG,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,GAAG,EAAE,OAAO;IACZ,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9F,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACxD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACjD,8EAA8E;AAC9E,uDAAuD;AACvD,MAAM,oBAAoB,GAAG,8CAA8C,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAmC;IAC7F,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,SAAS,CAAC;AAAA,CACjB;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC3C,SAA2B,EAC3B,QAA0C,EACjB;IACzB,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,SAAS;QAChD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAYD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACvC,WAAW,CAAS;IAE7B,YAAY,WAAmB,EAAE;QAChC,KAAK,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAAA,CAC/B;CACD;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,WAAmB,EAA6B;IACvF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;AAAA,CAC9C;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,WAAmB,EAAE,YAAoB,EAAU;IACxF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACvG,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAsB;IAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,4BAA4B,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAAA,CACvC;AAED,SAAS,kBAAkB,CAAC,KAAuC,EAAE,WAAmB,EAAwB;IAC/G,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,uBAAuB,CAC/B,KAA2C,EAC3C,WAAmB,EACsB;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,WAAW,IAAI,QAAQ,EAAE,EAAE,uBAAuB,CAAC,CAAU,CAAC;IAAA,CAC3G,CAAC,CAAC;AAAA,CACH;AAED,SAAS,mBAAmB,CAC3B,cAAoC,EACpC,eAAqC,EACrC,iBAAuC,EACd;IACzB,MAAM,QAAQ,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG;QACnB,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC;QAC7C,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC1E,uBAAuB,CAAC,eAAe,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC3E,uBAAuB,CAAC,iBAAiB,CAAC,YAAY,EAAE,oBAAoB,CAAC;KAC7E,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7C,QAAQ,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;QAChC,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,wBAAwB,CACvC,eAAgC,EAChC,GAAG,GAAqE,OAAO,CAAC,GAAG,EACvD;IAC5B,MAAM,cAAc,GAAG,kBAAkB,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,eAAe,GAAG,kBAAkB,CAAC,eAAe,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,CAAC,uBAAuB,EAAE,EAAE,OAAO,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,iBAAiB,GAAG,cAAc,CAAC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAExF,OAAO;QACN,aAAa,EAAE,YAAY,IAAI,iBAAiB,IAAI,sBAAsB;QAC1E,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACjE,qBAAqB,EAAE,IAAI;QAC3B,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QACnG,YAAY,EAAE,mBAAmB,CAAC,cAAc,EAAE,eAAe,EAAE,QAAQ,CAAC;KAC5E,CAAC;AAAA,CACF","sourcesContent":["import type { AgentOptions } from \"omk-agent-core\";\nimport type { AgentRuntimeSettings, SettingsManager } from \"./settings-manager.ts\";\n\nconst DEFAULT_TOOL_SCHEDULER = \"dag-v2\";\nconst DEFAULT_MAX_TOOL_CONCURRENCY = 4;\nconst DEFAULT_TOOL_TIMEOUT_MS = 0;\nconst MAX_TOOL_TIMEOUT_MS = 2_147_483_647;\n\nconst DEFAULT_BUILTIN_TOOL_TIMEOUTS: Readonly<Record<string, number>> = {\n\tbash: 300_000,\n\tedit: 60_000,\n\tfind: 30_000,\n\tgrep: 30_000,\n\tls: 30_000,\n\tread: 30_000,\n\twrite: 60_000,\n};\n\n/** §6.3 timeout categories. `undefined` category falls through to the global setting. */\nexport type ToolTimeoutCategory = \"read\" | \"write\" | \"mcp\" | \"process\" | \"browser\";\n\n/** §6.3 category default timeouts (ms): read/list/search 30s, write/edit 60s, MCP 120s, bash/process 300s, browser/computer-use 180s. */\nexport const TOOL_CATEGORY_TIMEOUTS: Readonly<Record<ToolTimeoutCategory, number>> = Object.freeze({\n\tread: 30_000,\n\twrite: 60_000,\n\tmcp: 120_000,\n\tprocess: 300_000,\n\tbrowser: 180_000,\n});\n\nconst READ_CATEGORY_TOOLS = new Set([\"read\", \"ls\", \"find\", \"grep\", \"glob\", \"list\", \"search\"]);\nconst WRITE_CATEGORY_TOOLS = new Set([\"write\", \"edit\"]);\nconst PROCESS_CATEGORY_TOOLS = new Set([\"bash\"]);\n// Matches direct browser/computer-use tools and browser tools bridged through\n// MCP servers (e.g. `mcp__playwright__browser_click`).\nconst BROWSER_TOOL_PATTERN = /(^|__)(browser_|computer[-_]?use$|computer_)/;\n\n/**\n * Classify a tool name into its §6.3 timeout category. Conservative on\n * purpose: unknown names return `undefined` and keep the global timeout.\n * A browser/computer-use match wins over the generic MCP category because\n * browser automation is the slower bound.\n */\nexport function resolveToolTimeoutCategory(toolName: string): ToolTimeoutCategory | undefined {\n\tif (READ_CATEGORY_TOOLS.has(toolName)) return \"read\";\n\tif (WRITE_CATEGORY_TOOLS.has(toolName)) return \"write\";\n\tif (PROCESS_CATEGORY_TOOLS.has(toolName)) return \"process\";\n\tif (BROWSER_TOOL_PATTERN.test(toolName)) return \"browser\";\n\tif (toolName.startsWith(\"mcp__\")) return \"mcp\";\n\treturn undefined;\n}\n\n/**\n * Fill §6.3 category default timeouts for every active tool name that has no\n * explicit per-name entry. Explicit entries (user settings and built-in\n * defaults) always win and are all preserved; names without a category are\n * omitted so they fall through to the global `toolTimeoutMs` at runtime.\n */\nexport function applyCategoryTimeoutDefaults(\n\ttoolNames: Iterable<string>,\n\texplicit: Readonly<Record<string, number>>,\n): Record<string, number> {\n\tconst merged: Record<string, number> = Object.create(null);\n\tfor (const toolName of toolNames) {\n\t\tif (Object.hasOwn(explicit, toolName)) continue;\n\t\tconst category = resolveToolTimeoutCategory(toolName);\n\t\tif (category !== undefined) {\n\t\t\tmerged[toolName] = TOOL_CATEGORY_TIMEOUTS[category];\n\t\t}\n\t}\n\tfor (const [toolName, timeoutMs] of Object.entries(explicit)) {\n\t\tmerged[toolName] = timeoutMs;\n\t}\n\treturn merged;\n}\n\ntype ToolScheduler = NonNullable<AgentOptions[\"toolScheduler\"]>;\n\nexport interface ResolvedAgentToolSettings {\n\treadonly toolScheduler: ToolScheduler;\n\treadonly maxToolConcurrency: number | undefined;\n\treadonly strictExtensionClaims: boolean;\n\treadonly toolTimeoutMs: number;\n\treadonly toolTimeouts: Record<string, number>;\n}\n\nexport class AgentToolSettingsError extends Error {\n\treadonly settingName: string;\n\n\tconstructor(settingName: string) {\n\t\tsuper(`Invalid ${settingName} setting`);\n\t\tthis.name = \"AgentToolSettingsError\";\n\t\tthis.settingName = settingName;\n\t}\n}\n\nfunction parseScheduler(value: unknown, settingName: string): ToolScheduler | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tif (value === \"waves-v1\" || value === \"dag-v2\") {\n\t\treturn value;\n\t}\n\tthrow new AgentToolSettingsError(settingName);\n}\n\nfunction parseTimeout(value: unknown, settingName: string, defaultValue: number): number {\n\tif (value === undefined) {\n\t\treturn defaultValue;\n\t}\n\tif (typeof value !== \"number\" || !Number.isInteger(value) || value < 0 || value > MAX_TOOL_TIMEOUT_MS) {\n\t\tthrow new AgentToolSettingsError(settingName);\n\t}\n\treturn value;\n}\n\nfunction parseConcurrency(value: unknown): number | undefined {\n\tif (value === undefined) {\n\t\treturn DEFAULT_MAX_TOOL_CONCURRENCY;\n\t}\n\tif (typeof value !== \"number\" || !Number.isInteger(value) || value < 0) {\n\t\tthrow new AgentToolSettingsError(\"agent.maxToolConcurrency\");\n\t}\n\treturn value === 0 ? undefined : value;\n}\n\nfunction parseAgentSettings(value: AgentRuntimeSettings | undefined, settingName: string): AgentRuntimeSettings {\n\tif (value === undefined) {\n\t\treturn {};\n\t}\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new AgentToolSettingsError(settingName);\n\t}\n\treturn value;\n}\n\nfunction parseToolTimeoutEntries(\n\tvalue: AgentRuntimeSettings[\"toolTimeouts\"],\n\tsettingName: string,\n): readonly (readonly [string, number])[] {\n\tif (value === undefined) {\n\t\treturn [];\n\t}\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new AgentToolSettingsError(settingName);\n\t}\n\n\treturn Object.entries(value).map(([toolName, timeoutMs]) => {\n\t\tif (toolName.length === 0) {\n\t\t\tthrow new AgentToolSettingsError(settingName);\n\t\t}\n\t\treturn [toolName, parseTimeout(timeoutMs, `${settingName}.${toolName}`, DEFAULT_TOOL_TIMEOUT_MS)] as const;\n\t});\n}\n\nfunction resolveToolTimeouts(\n\tglobalSettings: AgentRuntimeSettings,\n\tprojectSettings: AgentRuntimeSettings,\n\teffectiveSettings: AgentRuntimeSettings,\n): Record<string, number> {\n\tconst timeouts: Record<string, number> = Object.create(null);\n\tconst entryGroups = [\n\t\tObject.entries(DEFAULT_BUILTIN_TOOL_TIMEOUTS),\n\t\tparseToolTimeoutEntries(globalSettings.toolTimeouts, \"agent.toolTimeouts\"),\n\t\tparseToolTimeoutEntries(projectSettings.toolTimeouts, \"agent.toolTimeouts\"),\n\t\tparseToolTimeoutEntries(effectiveSettings.toolTimeouts, \"agent.toolTimeouts\"),\n\t];\n\tfor (const entries of entryGroups) {\n\t\tfor (const [toolName, timeoutMs] of entries) {\n\t\t\ttimeouts[toolName] = timeoutMs;\n\t\t}\n\t}\n\treturn timeouts;\n}\n\nexport function resolveAgentToolSettings(\n\tsettingsManager: SettingsManager,\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): ResolvedAgentToolSettings {\n\tconst globalSettings = parseAgentSettings(settingsManager.getGlobalSettings().agent, \"agent\");\n\tconst projectSettings = parseAgentSettings(settingsManager.getProjectSettings().agent, \"agent\");\n\tconst settings = parseAgentSettings(settingsManager.getAgentRuntimeSettings(), \"agent\");\n\tconst envScheduler = parseScheduler(env.OMK_TOOL_SCHEDULER, \"OMK_TOOL_SCHEDULER\");\n\tconst settingsScheduler = parseScheduler(settings.toolScheduler, \"agent.toolScheduler\");\n\n\treturn {\n\t\ttoolScheduler: envScheduler ?? settingsScheduler ?? DEFAULT_TOOL_SCHEDULER,\n\t\tmaxToolConcurrency: parseConcurrency(settings.maxToolConcurrency),\n\t\tstrictExtensionClaims: true,\n\t\ttoolTimeoutMs: parseTimeout(settings.toolTimeoutMs, \"agent.toolTimeoutMs\", DEFAULT_TOOL_TIMEOUT_MS),\n\t\ttoolTimeouts: resolveToolTimeouts(globalSettings, projectSettings, settings),\n\t};\n}\n"]}

package/dist/core/atomic-session-file.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Atomically and durably replace the contents of `targetPath`.
+ *
+ * Writes a uniquely named temp file in the same directory, preserves the
+ * exact private mode 0600, fsyncs and closes the temp file, then renames it
+ * over the target so readers only ever observe the complete old or
+ * complete new content, never a truncated file. The parent directory is
+ * fsynced where supported. Windows and explicit unsupported-filesystem codes
+ * skip that final operation; real durability failures propagate. On any failure
+ * before the rename completes, the temp file is
+ * removed (best-effort) and the original target is left untouched.
+ */
+export declare function atomicRewriteFileSync(targetPath: string, data: string | Uint8Array): void;
+//# sourceMappingURL=atomic-session-file.d.ts.map

package/dist/core/atomic-session-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-session-file.d.ts","sourceRoot":"","sources":["../../src/core/atomic-session-file.ts"],"names":[],"mappings":"AAuBA;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAkEzF","sourcesContent":["import { randomBytes } from \"crypto\";\nimport {\n\tcloseSync,\n\tfsyncSync,\n\tlstatSync,\n\topenSync,\n\trealpathSync,\n\trenameSync,\n\tstatSync,\n\tunlinkSync,\n\twriteSync,\n} from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport { enforcePrivateFileDescriptorModeSync } from \"./durable-file-mode.ts\";\n\nfunction assertRewriteTargetSafe(path: string): void {\n\ttry {\n\t\tif (statSync(path).nlink > 1) throw new Error(\"Atomic rewrite refused for a target with more than one hard link\");\n\t} catch (error) {\n\t\tif (!(error instanceof Error) || !(\"code\" in error) || Reflect.get(error, \"code\") !== \"ENOENT\") throw error;\n\t}\n}\n\n/**\n * Atomically and durably replace the contents of `targetPath`.\n *\n * Writes a uniquely named temp file in the same directory, preserves the\n * exact private mode 0600, fsyncs and closes the temp file, then renames it\n * over the target so readers only ever observe the complete old or\n * complete new content, never a truncated file. The parent directory is\n * fsynced where supported. Windows and explicit unsupported-filesystem codes\n * skip that final operation; real durability failures propagate. On any failure\n * before the rename completes, the temp file is\n * removed (best-effort) and the original target is left untouched.\n */\nexport function atomicRewriteFileSync(targetPath: string, data: string | Uint8Array): void {\n\tlet rewritePath: string;\n\ttry {\n\t\trewritePath = realpathSync.native(targetPath);\n\t} catch (error) {\n\t\tconst code = error instanceof Error && \"code\" in error ? Reflect.get(error, \"code\") : undefined;\n\t\tif (code !== \"ENOENT\") throw error;\n\t\tlet danglingLink = false;\n\t\ttry {\n\t\t\tdanglingLink = lstatSync(targetPath).isSymbolicLink();\n\t\t} catch (lstatError) {\n\t\t\tconst lstatCode =\n\t\t\t\tlstatError instanceof Error && \"code\" in lstatError ? Reflect.get(lstatError, \"code\") : undefined;\n\t\t\tif (lstatCode !== \"ENOENT\") throw lstatError;\n\t\t}\n\t\tif (danglingLink) throw error;\n\t\trewritePath = targetPath;\n\t}\n\tconst dir = dirname(rewritePath);\n\n\tassertRewriteTargetSafe(rewritePath);\n\tconst tempPath = join(dir, `.${basename(rewritePath)}.${process.pid}.${randomBytes(6).toString(\"hex\")}.tmp`);\n\tlet fd: number | undefined;\n\ttry {\n\t\tfd = openSync(tempPath, \"wx\", 0o600);\n\t\tenforcePrivateFileDescriptorModeSync(fd, rewritePath);\n\t\tconst buffer = typeof data === \"string\" ? Buffer.from(data, \"utf8\") : Buffer.from(data);\n\t\tlet offset = 0;\n\t\twhile (offset < buffer.length) {\n\t\t\toffset += writeSync(fd, buffer, offset);\n\t\t}\n\t\tfsyncSync(fd);\n\t\tcloseSync(fd);\n\t\tfd = undefined;\n\t\tassertRewriteTargetSafe(rewritePath);\n\t\trenameSync(tempPath, rewritePath);\n\t} catch (error) {\n\t\tif (fd !== undefined) {\n\t\t\ttry {\n\t\t\t\tcloseSync(fd);\n\t\t\t} catch (cleanupError) {\n\t\t\t\tif (!(cleanupError instanceof Error)) throw cleanupError;\n\t\t\t}\n\t\t}\n\t\ttry {\n\t\t\tunlinkSync(tempPath);\n\t\t} catch (cleanupError) {\n\t\t\tif (!(cleanupError instanceof Error)) throw cleanupError;\n\t\t}\n\t\tthrow error;\n\t}\n\n\tif (process.platform === \"win32\") return;\n\ttry {\n\t\tconst dirFd = openSync(dir, \"r\");\n\t\ttry {\n\t\t\tfsyncSync(dirFd);\n\t\t} finally {\n\t\t\tcloseSync(dirFd);\n\t\t}\n\t} catch (error) {\n\t\tconst code = error instanceof Error && \"code\" in error ? Reflect.get(error, \"code\") : undefined;\n\t\tif (typeof code !== \"string\" || !new Set([\"EINVAL\", \"ENOTSUP\", \"EOPNOTSUPP\", \"ENOSYS\"]).has(code)) {\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"]}

package/dist/core/atomic-session-file.js

@@ -0,0 +1,104 @@
+import { randomBytes } from "crypto";
+import { closeSync, fsyncSync, lstatSync, openSync, realpathSync, renameSync, statSync, unlinkSync, writeSync, } from "fs";
+import { basename, dirname, join } from "path";
+import { enforcePrivateFileDescriptorModeSync } from "./durable-file-mode.js";
+function assertRewriteTargetSafe(path) {
+    try {
+        if (statSync(path).nlink > 1)
+            throw new Error("Atomic rewrite refused for a target with more than one hard link");
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || Reflect.get(error, "code") !== "ENOENT")
+            throw error;
+    }
+}
+/**
+ * Atomically and durably replace the contents of `targetPath`.
+ *
+ * Writes a uniquely named temp file in the same directory, preserves the
+ * exact private mode 0600, fsyncs and closes the temp file, then renames it
+ * over the target so readers only ever observe the complete old or
+ * complete new content, never a truncated file. The parent directory is
+ * fsynced where supported. Windows and explicit unsupported-filesystem codes
+ * skip that final operation; real durability failures propagate. On any failure
+ * before the rename completes, the temp file is
+ * removed (best-effort) and the original target is left untouched.
+ */
+export function atomicRewriteFileSync(targetPath, data) {
+    let rewritePath;
+    try {
+        rewritePath = realpathSync.native(targetPath);
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? Reflect.get(error, "code") : undefined;
+        if (code !== "ENOENT")
+            throw error;
+        let danglingLink = false;
+        try {
+            danglingLink = lstatSync(targetPath).isSymbolicLink();
+        }
+        catch (lstatError) {
+            const lstatCode = lstatError instanceof Error && "code" in lstatError ? Reflect.get(lstatError, "code") : undefined;
+            if (lstatCode !== "ENOENT")
+                throw lstatError;
+        }
+        if (danglingLink)
+            throw error;
+        rewritePath = targetPath;
+    }
+    const dir = dirname(rewritePath);
+    assertRewriteTargetSafe(rewritePath);
+    const tempPath = join(dir, `.${basename(rewritePath)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    let fd;
+    try {
+        fd = openSync(tempPath, "wx", 0o600);
+        enforcePrivateFileDescriptorModeSync(fd, rewritePath);
+        const buffer = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data);
+        let offset = 0;
+        while (offset < buffer.length) {
+            offset += writeSync(fd, buffer, offset);
+        }
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        assertRewriteTargetSafe(rewritePath);
+        renameSync(tempPath, rewritePath);
+    }
+    catch (error) {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch (cleanupError) {
+                if (!(cleanupError instanceof Error))
+                    throw cleanupError;
+            }
+        }
+        try {
+            unlinkSync(tempPath);
+        }
+        catch (cleanupError) {
+            if (!(cleanupError instanceof Error))
+                throw cleanupError;
+        }
+        throw error;
+    }
+    if (process.platform === "win32")
+        return;
+    try {
+        const dirFd = openSync(dir, "r");
+        try {
+            fsyncSync(dirFd);
+        }
+        finally {
+            closeSync(dirFd);
+        }
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? Reflect.get(error, "code") : undefined;
+        if (typeof code !== "string" || !new Set(["EINVAL", "ENOTSUP", "EOPNOTSUPP", "ENOSYS"]).has(code)) {
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=atomic-session-file.js.map

package/dist/core/atomic-session-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-session-file.js","sourceRoot":"","sources":["../../src/core/atomic-session-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACN,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,GACT,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,oCAAoC,EAAE,MAAM,wBAAwB,CAAC;AAE9E,SAAS,uBAAuB,CAAC,IAAY,EAAQ;IACpD,IAAI,CAAC;QACJ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACnH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAC7G,CAAC;AAAA,CACD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,IAAyB,EAAQ;IAC1F,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACnC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACJ,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACrB,MAAM,SAAS,GACd,UAAU,YAAY,KAAK,IAAI,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnG,IAAI,SAAS,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC;QAC9C,CAAC;QACD,IAAI,YAAY;YAAE,MAAM,KAAK,CAAC;QAC9B,WAAW,GAAG,UAAU,CAAC;IAC1B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEjC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7G,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,oCAAoC,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,GAAG,SAAS,CAAC;QACf,uBAAuB,CAAC,WAAW,CAAC,CAAC;QACrC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,YAAY,YAAY,KAAK,CAAC;oBAAE,MAAM,YAAY,CAAC;YAC1D,CAAC;QACF,CAAC;QACD,IAAI,CAAC;YACJ,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,YAAY,YAAY,KAAK,CAAC;gBAAE,MAAM,YAAY,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACJ,SAAS,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnG,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;AAAA,CACD","sourcesContent":["import { randomBytes } from \"crypto\";\nimport {\n\tcloseSync,\n\tfsyncSync,\n\tlstatSync,\n\topenSync,\n\trealpathSync,\n\trenameSync,\n\tstatSync,\n\tunlinkSync,\n\twriteSync,\n} from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport { enforcePrivateFileDescriptorModeSync } from \"./durable-file-mode.ts\";\n\nfunction assertRewriteTargetSafe(path: string): void {\n\ttry {\n\t\tif (statSync(path).nlink > 1) throw new Error(\"Atomic rewrite refused for a target with more than one hard link\");\n\t} catch (error) {\n\t\tif (!(error instanceof Error) || !(\"code\" in error) || Reflect.get(error, \"code\") !== \"ENOENT\") throw error;\n\t}\n}\n\n/**\n * Atomically and durably replace the contents of `targetPath`.\n *\n * Writes a uniquely named temp file in the same directory, preserves the\n * exact private mode 0600, fsyncs and closes the temp file, then renames it\n * over the target so readers only ever observe the complete old or\n * complete new content, never a truncated file. The parent directory is\n * fsynced where supported. Windows and explicit unsupported-filesystem codes\n * skip that final operation; real durability failures propagate. On any failure\n * before the rename completes, the temp file is\n * removed (best-effort) and the original target is left untouched.\n */\nexport function atomicRewriteFileSync(targetPath: string, data: string | Uint8Array): void {\n\tlet rewritePath: string;\n\ttry {\n\t\trewritePath = realpathSync.native(targetPath);\n\t} catch (error) {\n\t\tconst code = error instanceof Error && \"code\" in error ? Reflect.get(error, \"code\") : undefined;\n\t\tif (code !== \"ENOENT\") throw error;\n\t\tlet danglingLink = false;\n\t\ttry {\n\t\t\tdanglingLink = lstatSync(targetPath).isSymbolicLink();\n\t\t} catch (lstatError) {\n\t\t\tconst lstatCode =\n\t\t\t\tlstatError instanceof Error && \"code\" in lstatError ? Reflect.get(lstatError, \"code\") : undefined;\n\t\t\tif (lstatCode !== \"ENOENT\") throw lstatError;\n\t\t}\n\t\tif (danglingLink) throw error;\n\t\trewritePath = targetPath;\n\t}\n\tconst dir = dirname(rewritePath);\n\n\tassertRewriteTargetSafe(rewritePath);\n\tconst tempPath = join(dir, `.${basename(rewritePath)}.${process.pid}.${randomBytes(6).toString(\"hex\")}.tmp`);\n\tlet fd: number | undefined;\n\ttry {\n\t\tfd = openSync(tempPath, \"wx\", 0o600);\n\t\tenforcePrivateFileDescriptorModeSync(fd, rewritePath);\n\t\tconst buffer = typeof data === \"string\" ? Buffer.from(data, \"utf8\") : Buffer.from(data);\n\t\tlet offset = 0;\n\t\twhile (offset < buffer.length) {\n\t\t\toffset += writeSync(fd, buffer, offset);\n\t\t}\n\t\tfsyncSync(fd);\n\t\tcloseSync(fd);\n\t\tfd = undefined;\n\t\tassertRewriteTargetSafe(rewritePath);\n\t\trenameSync(tempPath, rewritePath);\n\t} catch (error) {\n\t\tif (fd !== undefined) {\n\t\t\ttry {\n\t\t\t\tcloseSync(fd);\n\t\t\t} catch (cleanupError) {\n\t\t\t\tif (!(cleanupError instanceof Error)) throw cleanupError;\n\t\t\t}\n\t\t}\n\t\ttry {\n\t\t\tunlinkSync(tempPath);\n\t\t} catch (cleanupError) {\n\t\t\tif (!(cleanupError instanceof Error)) throw cleanupError;\n\t\t}\n\t\tthrow error;\n\t}\n\n\tif (process.platform === \"win32\") return;\n\ttry {\n\t\tconst dirFd = openSync(dir, \"r\");\n\t\ttry {\n\t\t\tfsyncSync(dirFd);\n\t\t} finally {\n\t\t\tcloseSync(dirFd);\n\t\t}\n\t} catch (error) {\n\t\tconst code = error instanceof Error && \"code\" in error ? Reflect.get(error, \"code\") : undefined;\n\t\tif (typeof code !== \"string\" || !new Set([\"EINVAL\", \"ENOTSUP\", \"EOPNOTSUPP\", \"ENOSYS\"]).has(code)) {\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"]}

package/dist/core/command-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-safety.d.ts","sourceRoot":"","sources":["../../src/core/command-safety.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CACf;AAsoBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAEpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D","sourcesContent":["// allow: SIZE_OK - legacy safety rules table; this change only preserves existing typed behavior.\nexport type CommandRisk = \"block\" | \"confirm\" | \"allow\";\n\nexport interface CommandVerdict {\n\trisk: CommandRisk;\n\trule: string;\n\treason: string;\n}\n\ninterface CommandPrefixResult {\n\ttokens: string[];\n\tprivilege: string | undefined;\n}\n\nconst RISK_RANK: Readonly<Record<CommandRisk, number>> = {\n\tallow: 0,\n\tconfirm: 1,\n\tblock: 2,\n};\n\nconst PRIVILEGE_COMMANDS = new Set([\"sudo\", \"su\", \"doas\", \"pkexec\"]);\nconst SUDO_OPTIONS_WITH_VALUE = new Set([\n\t\"-C\",\n\t\"--close-from\",\n\t\"-g\",\n\t\"--group\",\n\t\"-h\",\n\t\"--host\",\n\t\"-p\",\n\t\"--prompt\",\n\t\"-T\",\n\t\"--command-timeout\",\n\t\"-u\",\n\t\"--user\",\n]);\nconst GIT_GLOBAL_OPTIONS_WITH_VALUE = new Set([\"-C\", \"-c\", \"--git-dir\", \"--work-tree\", \"--namespace\"]);\n\n/** Maximum recursion depth when unwrapping shell wrappers (bash -c, eval, xargs, find -exec). */\nconst MAX_WRAP_DEPTH = 6;\n\n/** Executables that run an inline command string passed via a `-c`-style flag. */\nconst SHELL_WRAPPERS = new Set([\"bash\", \"sh\", \"zsh\", \"dash\", \"ksh\", \"ash\"]);\n\n/**\n * Script interpreters that execute an inline program string (via a -c/-e/-r\n * style flag). Running inline code can execute arbitrary shell commands, so a\n * matched destructive/exec keyword inside the program escalates the call to\n * confirm-tier. A plain script-file path stays allow-tier.\n */\nconst INTERPRETER_INLINE_FLAGS: Readonly<Record<string, readonly string[]>> = {\n\tpython: [\"-c\"],\n\tpython2: [\"-c\"],\n\tpython3: [\"-c\"],\n\tnode: [\"-e\", \"--eval\", \"-p\", \"--print\"],\n\tperl: [\"-e\", \"-E\"],\n\truby: [\"-e\", \"-E\"],\n\tphp: [\"-r\", \"--run\"],\n\tlua: [\"-e\"],\n\texpect: [\"-c\"],\n};\n\n/**\n * Patterns that indicate an inline program invokes a shell command or\n * performs a destructive filesystem operation. Matching any of these inside\n * a `-c`/`-e`/`-r` program string escalates the call to confirm-tier.\n */\nconst INLINE_DESTRUCTIVE_PATTERNS: readonly RegExp[] = [\n\t/\\bos\\.system\\s*\\(/,\n\t/\\bos\\.remove\\s*\\(/,\n\t/\\bos\\.unlink\\s*\\(/,\n\t/\\bshutil\\.rmtree\\s*\\(/,\n\t/\\bsubprocess\\.(?:call|run|check_call|check_output|Popen)\\s*\\(/,\n\t/\\bexec(?:Sync|File)?\\s*\\(/,\n\t/\\bspawn(?:Sync)?\\s*\\(/,\n\t/\\bchild_process\\b/,\n\t/\\brequire\\s*\\(\\s*['\"]child_process['\"]\\s*\\)/,\n\t/\\b(?:system|popen)\\s*\\(/,\n\t/`[^`]*\\brm\\s+-/m,\n\t/\\$\\(\\s*[^)]*\\brm\\s+-/,\n];\n\n/** xargs options that consume a following value token before the wrapped command begins. */\nconst XARGS_OPTIONS_WITH_VALUE = new Set([\n\t\"-I\",\n\t\"-i\",\n\t\"-n\",\n\t\"-L\",\n\t\"-P\",\n\t\"-d\",\n\t\"-E\",\n\t\"-s\",\n\t\"-a\",\n\t\"--max-args\",\n\t\"--max-procs\",\n\t\"--delimiter\",\n\t\"--arg-file\",\n\t\"--max-lines\",\n\t\"--replace\",\n]);\n\n/**\n * Credential / secret file patterns. A bash argv token matching one of these is\n * treated as a `confirm`-tier access: headless callers (LLM tool calls, RPC bash)\n * deny by default, while an interactive user can still approve reading their own\n * files. These complement the §0.1 freedom safety floor, which hard-denies the\n * same paths on the entry points it guards.\n */\nconst SECRET_FILE_STRICT_PATTERNS: readonly RegExp[] = [\n\t/(^|\\/)\\.env(\\.|$)/i,\n\t/(^|\\/)\\.npmrc$/i,\n\t/(^|\\/)\\.netrc$/i,\n\t/(^|\\/)\\.pgpass$/i,\n\t/(^|\\/)\\.aws\\/credentials$/i,\n\t/(^|\\/)credentials$/i,\n\t/(^|\\/)auth\\.json$/i,\n\t/(^|\\/)id_(rsa|dsa|ecdsa|ed25519)$/i,\n\t/\\.(pem|key|p12|pfx|keystore|jks)$/i,\n\t/(^|\\/)secrets?(\\.[^/]+)?$/i,\n];\n\n/** Benign sibling files that look secret-ish but never hold credentials. */\nconst SECRET_FILE_ALLOW_PATTERNS: readonly RegExp[] = [/(^|\\/)\\.env\\.(example|sample|template|dist|defaults?)$/i];\nconst SEARCH_COMMANDS = new Set([\"grep\", \"egrep\", \"fgrep\", \"rg\"]);\nconst HOME_VARIABLE_RM_TARGETS = new Set([\"$home\", \"$\" + \"{home}\", \"$home/\", \"$\" + \"{home}/\"]);\n\nfunction verdict(risk: CommandRisk, rule: string, reason: string): CommandVerdict {\n\treturn { risk, rule, reason };\n}\n\nfunction allowVerdict(): CommandVerdict {\n\treturn verdict(\"allow\", \"command.allow\", \"No destructive or protected command pattern matched.\");\n}\n\nfunction isEnvAssignment(token: string | undefined): boolean {\n\treturn token !== undefined && /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(token);\n}\n\nfunction tokenizeShellSegment(segment: string): string[] {\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet quote: string | undefined;\n\tlet escaped = false;\n\n\tfor (const character of segment.trim()) {\n\t\tif (escaped) {\n\t\t\tcurrent += character;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (character === quote) {\n\t\t\t\tquote = undefined;\n\t\t\t} else {\n\t\t\t\tcurrent += character;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"'\" || character === '\"') {\n\t\t\tquote = character;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/\\s/.test(character)) {\n\t\t\tif (current) {\n\t\t\t\ttokens.push(current);\n\t\t\t\tcurrent = \"\";\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += character;\n\t}\n\n\tif (escaped) current += \"\\\\\";\n\tif (current) tokens.push(current);\n\treturn tokens;\n}\n\nfunction splitShellCommands(command: string): string[] {\n\tconst segments: string[] = [];\n\tlet current = \"\";\n\tlet quote: string | undefined;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst character = command[index];\n\t\tconst next = command[index + 1];\n\t\tif (escaped) {\n\t\t\tcurrent += character;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcurrent += character;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tcurrent += character;\n\t\t\tif (character === quote) quote = undefined;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"'\" || character === '\"') {\n\t\t\tquote = character;\n\t\t\tcurrent += character;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \";\" || character === \"|\" || character === \"\\n\" || character === \"\\r\") {\n\t\t\tif (current.trim()) segments.push(current.trim());\n\t\t\tcurrent = \"\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"&\") {\n\t\t\tif (current.trim()) segments.push(current.trim());\n\t\t\tcurrent = \"\";\n\t\t\tif (next === \"&\") index += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += character;\n\t}\n\n\tif (current.trim()) segments.push(current.trim());\n\treturn segments;\n}\n\nfunction skipEnvironmentPrefix(tokens: readonly string[], startIndex: number): number {\n\tlet index = startIndex;\n\twhile (isEnvAssignment(tokens[index])) index += 1;\n\tif (tokens[index]?.toLowerCase() !== \"env\") return index;\n\n\tindex += 1;\n\twhile (index < tokens.length) {\n\t\tconst token = tokens[index];\n\t\tif (isEnvAssignment(token)) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token?.startsWith(\"-\")) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tbreak;\n\t}\n\treturn index;\n}\n\nfunction optionConsumesValue(option: string, optionsWithValue: ReadonlySet<string>): boolean {\n\tif (option.includes(\"=\")) return false;\n\treturn optionsWithValue.has(option);\n}\n\nfunction skipPrivilegeOptions(tokens: readonly string[], startIndex: number, privilege: string): number {\n\tif (privilege !== \"sudo\" && privilege !== \"doas\") return startIndex;\n\n\tlet index = startIndex;\n\twhile (index < tokens.length) {\n\t\tconst token = tokens[index];\n\t\tif (!token?.startsWith(\"-\")) break;\n\t\tindex += 1;\n\t\tif (token === \"--\") break;\n\t\tif (optionConsumesValue(token, SUDO_OPTIONS_WITH_VALUE)) index += 1;\n\t}\n\treturn index;\n}\n\nfunction stripCommandPrefixes(tokens: readonly string[]): CommandPrefixResult {\n\tlet index = skipEnvironmentPrefix(tokens, 0);\n\tconst privilege = tokens[index]?.toLowerCase();\n\tif (!PRIVILEGE_COMMANDS.has(privilege ?? \"\")) {\n\t\treturn { tokens: tokens.slice(index), privilege: undefined };\n\t}\n\n\tindex += 1;\n\tindex = skipPrivilegeOptions(tokens, index, privilege ?? \"\");\n\tindex = skipEnvironmentPrefix(tokens, index);\n\treturn { tokens: tokens.slice(index), privilege };\n}\n\nfunction hasForkBomb(command: string): boolean {\n\treturn command.replace(/\\s/g, \"\").includes(\":(){:|:&};:\");\n}\n\nfunction normalizePathTarget(target: string): string {\n\treturn target.replace(/\\/+$/g, (match) => (target === match ? \"/\" : \"\")).replace(/\\/+/g, \"/\");\n}\n\nfunction classifyRmTarget(target: string): CommandVerdict | null {\n\tconst normalized = normalizePathTarget(target);\n\tif (normalized === \"/\" || normalized === \"/*\" || normalized === \"/.*\") {\n\t\treturn verdict(\"block\", \"fs.rm_rf_root\", \"Recursive forced rm targets filesystem root.\");\n\t}\n\tif (normalized === \"~\" || normalized === \"~/\" || normalized === \"~/*\" || normalized === \"~/.*\") {\n\t\treturn verdict(\"block\", \"fs.rm_rf_home\", \"Recursive forced rm targets the home directory.\");\n\t}\n\t// $HOME / ${HOME} expands to the user home directory at runtime.\n\tconst lower = normalized.toLowerCase();\n\tif (HOME_VARIABLE_RM_TARGETS.has(lower)) {\n\t\treturn verdict(\n\t\t\t\"confirm\",\n\t\t\t\"fs.rm_rf_home_var\",\n\t\t\t\"Recursive forced rm targets $HOME, which expands to the user home directory.\",\n\t\t);\n\t}\n\t// ~username targets another user home directory.\n\tif (/^~[A-Za-z0-9._-]/.test(normalized)) {\n\t\treturn verdict(\"confirm\", \"fs.rm_rf_user_home\", \"Recursive forced rm targets another user home directory.\");\n\t}\n\t// \".\" or \"./\" — current working directory (project root deletion risk).\n\tif (normalized === \".\") {\n\t\treturn verdict(\"confirm\", \"fs.rm_rf_cwd\", \"Recursive forced rm targets the current working directory.\");\n\t}\n\t// \"..\" — parent directory.\n\tif (normalized === \"..\") {\n\t\treturn verdict(\"confirm\", \"fs.rm_rf_parent\", \"Recursive forced rm targets the parent directory.\");\n\t}\n\treturn null;\n}\n\nfunction classifyRm(tokens: readonly string[]): CommandVerdict | null {\n\tlet hasRecursive = false;\n\tlet hasForce = false;\n\tlet endOfOptions = false;\n\tconst targets: string[] = [];\n\n\tfor (const token of tokens.slice(1)) {\n\t\tif (!endOfOptions && token === \"--\") {\n\t\t\tendOfOptions = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!endOfOptions && token.startsWith(\"-\") && token !== \"-\") {\n\t\t\tif (token === \"--recursive\") hasRecursive = true;\n\t\t\tif (token === \"--force\") hasForce = true;\n\t\t\tif (!token.startsWith(\"--\")) {\n\t\t\t\tconst flagCharacters = token.slice(1).split(\"\");\n\t\t\t\tif (flagCharacters.some((flag) => flag === \"r\" || flag === \"R\")) hasRecursive = true;\n\t\t\t\tif (flagCharacters.includes(\"f\")) hasForce = true;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\ttargets.push(token);\n\t}\n\n\tif (!hasRecursive || !hasForce) return null;\n\tfor (const target of targets) {\n\t\tconst targetVerdict = classifyRmTarget(target);\n\t\tif (targetVerdict) return targetVerdict;\n\t}\n\treturn null;\n}\n\nfunction isBlockDeviceOutput(token: string): boolean {\n\treturn /^of=\\/dev\\/(?:sd[a-z][a-z0-9]*|nvme[0-9a-z]+|disk(?:[0-9].*|\\/.*|$))/i.test(token);\n}\n\nfunction classifyDestructiveFilesystemCommand(command: string): CommandVerdict | null {\n\tif (hasForkBomb(command)) {\n\t\treturn verdict(\"block\", \"process.fork_bomb\", \"Shell fork bomb pattern would exhaust process resources.\");\n\t}\n\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tconst executable = tokens[0]?.toLowerCase();\n\tif (!executable) return null;\n\tif (executable === \"rm\") return classifyRm(tokens);\n\tif (executable.startsWith(\"mkfs\")) {\n\t\treturn verdict(\"block\", \"fs.mkfs\", \"Filesystem formatting commands are blocked.\");\n\t}\n\tif (executable === \"dd\" && tokens.slice(1).some(isBlockDeviceOutput)) {\n\t\treturn verdict(\"block\", \"fs.dd_block_device\", \"dd writes directly to a block-device output path.\");\n\t}\n\treturn null;\n}\n\nfunction findGitCommand(tokens: readonly string[]): { command: string; args: string[]; originalArgs: string[] } | null {\n\tif (tokens[0]?.toLowerCase() !== \"git\") return null;\n\tlet index = 1;\n\twhile (index < tokens.length && tokens[index]?.startsWith(\"-\")) {\n\t\tconst option = tokens[index];\n\t\tconst normalizedOption = option.toLowerCase();\n\t\tindex += 1;\n\t\tif (option === \"--\") break;\n\t\tif (\n\t\t\toptionConsumesValue(option, GIT_GLOBAL_OPTIONS_WITH_VALUE) ||\n\t\t\toptionConsumesValue(normalizedOption, GIT_GLOBAL_OPTIONS_WITH_VALUE)\n\t\t) {\n\t\t\tindex += 1;\n\t\t}\n\t}\n\tconst command = tokens[index]?.toLowerCase();\n\tif (!command) return null;\n\tconst originalArgs = tokens.slice(index + 1);\n\treturn {\n\t\tcommand,\n\t\targs: originalArgs.map((argument) => argument.toLowerCase()),\n\t\toriginalArgs,\n\t};\n}\n\nfunction hasGitCleanForceDirectory(args: readonly string[]): boolean {\n\tlet hasForce = false;\n\tlet hasDirectory = false;\n\tfor (const arg of args) {\n\t\tif (arg === \"--force\") hasForce = true;\n\t\tif (arg === \"-f\") hasForce = true;\n\t\tif (arg === \"-d\") hasDirectory = true;\n\t\tif (arg.startsWith(\"-\") && !arg.startsWith(\"--\")) {\n\t\t\tconst flags = arg.slice(1).split(\"\");\n\t\t\tif (flags.includes(\"f\")) hasForce = true;\n\t\t\tif (flags.includes(\"d\")) hasDirectory = true;\n\t\t}\n\t}\n\treturn hasForce && hasDirectory;\n}\n\nfunction classifyProtectedGitCommand(command: string): CommandVerdict | null {\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tconst gitCommand = findGitCommand(tokens);\n\tif (!gitCommand) return null;\n\n\tif (gitCommand.command === \"reset\" && gitCommand.args.includes(\"--hard\")) {\n\t\treturn verdict(\"confirm\", \"git.reset_hard\", \"git reset --hard can discard worktree changes.\");\n\t}\n\tif (gitCommand.command === \"restore\") {\n\t\tconst targetAll = gitCommand.originalArgs.includes(\".\") || gitCommand.originalArgs.includes(\"*\");\n\t\tconst rewritesWorktree = gitCommand.args.includes(\"--worktree\") || gitCommand.args.includes(\"--source\");\n\t\tif (targetAll || rewritesWorktree) {\n\t\t\treturn verdict(\"confirm\", \"git.restore\", \"git restore can discard or overwrite local worktree changes.\");\n\t\t}\n\t}\n\tif (gitCommand.command === \"checkout\" && gitCommand.originalArgs.includes(\".\")) {\n\t\treturn verdict(\"confirm\", \"git.checkout_dot\", \"git checkout . can overwrite local worktree changes.\");\n\t}\n\tif (gitCommand.command === \"clean\" && hasGitCleanForceDirectory(gitCommand.args)) {\n\t\treturn verdict(\"confirm\", \"git.clean_force\", \"git clean -fd can delete untracked files and directories.\");\n\t}\n\tif (gitCommand.command === \"stash\" && gitCommand.originalArgs.length === 0) {\n\t\treturn verdict(\"confirm\", \"git.stash_bare\", \"Bare git stash can hide local worktree changes.\");\n\t}\n\tif (gitCommand.command === \"add\") {\n\t\tif (gitCommand.originalArgs.includes(\".\")) {\n\t\t\treturn verdict(\"confirm\", \"git.add_dot\", \"git add . can stage unrelated local changes.\");\n\t\t}\n\t\tif (gitCommand.originalArgs.includes(\"-A\") || gitCommand.args.includes(\"--all\")) {\n\t\t\treturn verdict(\"confirm\", \"git.add_all\", \"git add -A can stage unrelated local changes.\");\n\t\t}\n\t}\n\tif (gitCommand.command === \"commit\" && gitCommand.args.includes(\"--no-verify\")) {\n\t\treturn verdict(\"confirm\", \"git.no_verify\", \"git commit --no-verify bypasses repository verification hooks.\");\n\t}\n\tif (gitCommand.command === \"push\" && gitCommand.args.includes(\"--no-verify\")) {\n\t\treturn verdict(\"confirm\", \"git.push_no_verify\", \"git push --no-verify bypasses remote verification hooks.\");\n\t}\n\tif (\n\t\tgitCommand.command === \"push\" &&\n\t\t(gitCommand.originalArgs.includes(\"-f\") ||\n\t\t\tgitCommand.args.includes(\"--force\") ||\n\t\t\tgitCommand.args.includes(\"--force-with-lease\"))\n\t) {\n\t\treturn verdict(\"confirm\", \"git.force_push\", \"Force-pushing can rewrite remote history.\");\n\t}\n\treturn null;\n}\n\nfunction classifyPrivilegeCommand(command: string): CommandVerdict | null {\n\tconst tokens = tokenizeShellSegment(command);\n\tconst index = skipEnvironmentPrefix(tokens, 0);\n\tconst privilege = tokens[index]?.toLowerCase();\n\tif (!PRIVILEGE_COMMANDS.has(privilege ?? \"\")) return null;\n\treturn verdict(\"confirm\", `priv.${privilege}`, `${privilege} requires explicit per-command confirmation.`);\n}\n\n/**\n * Locate the inline command-string argument for a `shell -c \"<cmd>\"` invocation.\n * Returns the token index of the command string, or -1 when the shell runs a\n * script file (no inline command to classify).\n */\nfunction findShellCommandStringIndex(tokens: readonly string[]): number {\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index];\n\t\tif (!token.startsWith(\"-\")) return -1;\n\t\tif (/^-[a-z]*c$/i.test(token)) {\n\t\t\treturn index + 1 < tokens.length ? index + 1 : -1;\n\t\t}\n\t}\n\treturn -1;\n}\n\n/**\n * Locate the inline program-string argument for an interpreter invocation\n * (`python -c`, `node -e`, `perl -e`, ...). Returns the token index of the\n * program string, or -1 when the interpreter runs a script file (no inline\n * program to classify).\n */\nfunction findInterpreterInlineIndex(tokens: readonly string[], flags: readonly string[]): number {\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index];\n\t\tif (token === \"--\") return -1;\n\t\tif (!token.startsWith(\"-\")) return -1;\n\t\tif (flags.includes(token) || flags.includes(token.toLowerCase())) {\n\t\t\treturn index + 1 < tokens.length ? index + 1 : -1;\n\t\t}\n\t}\n\treturn -1;\n}\n\n/** Drop leading xargs options (and their values) to expose the wrapped command. */\nfunction stripXargsOptions(args: readonly string[]): string[] {\n\tlet index = 0;\n\twhile (index < args.length) {\n\t\tconst token = args[index];\n\t\tif (!token.startsWith(\"-\") || token === \"-\") break;\n\t\tindex += 1;\n\t\tif (token === \"--\") break;\n\t\tif (!token.includes(\"=\") && XARGS_OPTIONS_WITH_VALUE.has(token)) index += 1;\n\t}\n\treturn args.slice(index);\n}\n\n/** Extract the command tokens of a `find ... -exec <cmd> {} ;|+` clause, if present. */\nfunction extractFindExec(tokens: readonly string[]): string[] | null {\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index].toLowerCase();\n\t\tif (token === \"-exec\" || token === \"-execdir\" || token === \"-ok\" || token === \"-okdir\") {\n\t\t\tconst collected: string[] = [];\n\t\t\tfor (let inner = index + 1; inner < tokens.length; inner += 1) {\n\t\t\t\tconst piece = tokens[inner];\n\t\t\t\tif (piece === \";\" || piece === \"+\") break;\n\t\t\t\tif (piece === \"{}\") continue;\n\t\t\t\tcollected.push(piece);\n\t\t\t}\n\t\t\treturn collected.length > 0 ? collected : null;\n\t\t}\n\t}\n\treturn null;\n}\n\n/**\n * Classify the effective command hidden inside a wrapper executable so a\n * destructive or protected command cannot be smuggled past the classifier via\n * `bash -c`, `eval`, `xargs`, or `find -exec`. Returns null when the segment is\n * not a recognized wrapper.\n */\nfunction classifyWrappedCommand(command: string, depth: number): CommandVerdict | null {\n\tif (depth >= MAX_WRAP_DEPTH) return null;\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tconst executable = tokens[0]?.toLowerCase();\n\tif (!executable) return null;\n\n\tif (SHELL_WRAPPERS.has(executable)) {\n\t\tconst innerIndex = findShellCommandStringIndex(tokens);\n\t\tconst inner = innerIndex === -1 ? undefined : tokens[innerIndex];\n\t\treturn inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t}\n\tif (executable === \"eval\") {\n\t\tconst inner = tokens.slice(1).join(\" \").trim();\n\t\treturn inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t}\n\tif (executable === \"xargs\") {\n\t\tconst inner = stripXargsOptions(tokens.slice(1)).join(\" \").trim();\n\t\treturn inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t}\n\tif (executable === \"find\") {\n\t\tconst lowered = tokens.map((token) => token.toLowerCase());\n\t\tconst hasDelete = lowered.includes(\"-delete\");\n\t\tconst execTokens = extractFindExec(tokens);\n\t\tconst inner = execTokens?.join(\" \").trim();\n\t\tconst innerVerdict = inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t\tif (hasDelete) {\n\t\t\tconst deleteVerdict = verdict(\n\t\t\t\t\"confirm\",\n\t\t\t\t\"fs.find_delete\",\n\t\t\t\t\"find -delete removes matched files and directories.\",\n\t\t\t);\n\t\t\tif (!innerVerdict || RISK_RANK[deleteVerdict.risk] > RISK_RANK[innerVerdict.risk]) {\n\t\t\t\treturn deleteVerdict;\n\t\t\t}\n\t\t}\n\t\treturn innerVerdict ?? null;\n\t}\n\tconst inlineFlags = INTERPRETER_INLINE_FLAGS[executable];\n\tif (inlineFlags) {\n\t\tconst innerIndex = findInterpreterInlineIndex(tokens, inlineFlags);\n\t\tif (innerIndex === -1) return null; // script file path — allow\n\t\tconst program = tokens[innerIndex];\n\t\tif (INLINE_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(program))) {\n\t\t\treturn verdict(\n\t\t\t\t\"confirm\",\n\t\t\t\t`interp.${executable}_inline_destructive`,\n\t\t\t\t`${executable} inline program can execute destructive shell commands.`,\n\t\t\t);\n\t\t}\n\t\treturn null;\n\t}\n\treturn null;\n}\n\nfunction isSearchPatternArgument(tokens: readonly string[], index: number): boolean {\n\tconst executable = tokens[0]?.toLowerCase();\n\treturn SEARCH_COMMANDS.has(executable ?? \"\") && tokens[index - 1] === \"--\";\n}\n\n/** Flag commands that read, copy, or transmit a credential / secret file path. */\nfunction classifySecretAccess(command: string): CommandVerdict | null {\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tif (tokens.length === 0) return null;\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index];\n\t\tif (!token || token.startsWith(\"-\")) continue;\n\t\tif (isSearchPatternArgument(tokens, index)) continue;\n\t\tif (/\\s/.test(token)) continue;\n\t\tif (SECRET_FILE_ALLOW_PATTERNS.some((pattern) => pattern.test(token))) continue;\n\t\tif (SECRET_FILE_STRICT_PATTERNS.some((pattern) => pattern.test(token))) {\n\t\t\treturn verdict(\"confirm\", \"secret.read_path\", \"Command references a credential or secret file path.\");\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction classifySingleCommand(command: string, depth: number): CommandVerdict {\n\tconst trimmed = command.trim();\n\tif (!trimmed) return allowVerdict();\n\n\tconst destructiveFilesystem = classifyDestructiveFilesystemCommand(trimmed);\n\tif (destructiveFilesystem) return destructiveFilesystem;\n\n\tconst wrapped = classifyWrappedCommand(trimmed, depth);\n\tif (wrapped && wrapped.risk === \"block\") return wrapped;\n\n\tconst protectedGit = classifyProtectedGitCommand(trimmed);\n\tif (protectedGit) return protectedGit;\n\n\tconst privilege = classifyPrivilegeCommand(trimmed);\n\tif (privilege) return privilege;\n\n\tconst secret = classifySecretAccess(trimmed);\n\tif (secret) return secret;\n\n\tif (wrapped && RISK_RANK[wrapped.risk] > RISK_RANK.allow) return wrapped;\n\n\treturn allowVerdict();\n}\n\nfunction classifyShellCommandInternal(command: string, depth: number): CommandVerdict {\n\tlet selected = classifySingleCommand(command, depth);\n\tfor (const segment of splitShellCommands(command)) {\n\t\tconst candidate = classifySingleCommand(segment, depth);\n\t\tif (RISK_RANK[candidate.risk] > RISK_RANK[selected.risk]) selected = candidate;\n\t\tif (selected.risk === \"block\") break;\n\t}\n\treturn selected;\n}\n\nexport function classifyShellCommand(command: string): CommandVerdict {\n\treturn classifyShellCommandInternal(command, 0);\n}\n\nexport function isDestructiveFilesystem(command: string): boolean {\n\treturn classifyDestructiveFilesystemCommand(command) !== null;\n}\n\nexport function isProtectedGitOperation(command: string): boolean {\n\treturn classifyProtectedGitCommand(command) !== null;\n}\n\nexport function isPrivilegeEscalation(command: string): boolean {\n\treturn classifyPrivilegeCommand(command) !== null;\n}\n"]}
+{"version":3,"file":"command-safety.d.ts","sourceRoot":"","sources":["../../src/core/command-safety.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CACf;AA8nBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAEpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D","sourcesContent":["// allow: SIZE_OK - legacy safety rules table; this change only preserves existing typed behavior.\nexport type CommandRisk = \"block\" | \"confirm\" | \"allow\";\n\nexport interface CommandVerdict {\n\trisk: CommandRisk;\n\trule: string;\n\treason: string;\n}\n\ninterface CommandPrefixResult {\n\ttokens: string[];\n\tprivilege: string | undefined;\n}\n\nconst RISK_RANK: Readonly<Record<CommandRisk, number>> = {\n\tallow: 0,\n\tconfirm: 1,\n\tblock: 2,\n};\n\nconst PRIVILEGE_COMMANDS = new Set([\"sudo\", \"su\", \"doas\", \"pkexec\"]);\nconst SUDO_OPTIONS_WITH_VALUE = new Set([\n\t\"-C\",\n\t\"--close-from\",\n\t\"-g\",\n\t\"--group\",\n\t\"-h\",\n\t\"--host\",\n\t\"-p\",\n\t\"--prompt\",\n\t\"-T\",\n\t\"--command-timeout\",\n\t\"-u\",\n\t\"--user\",\n]);\nconst GIT_GLOBAL_OPTIONS_WITH_VALUE = new Set([\"-C\", \"-c\", \"--git-dir\", \"--work-tree\", \"--namespace\"]);\n\n/** Maximum recursion depth when unwrapping shell wrappers (bash -c, eval, xargs, find -exec). */\nconst MAX_WRAP_DEPTH = 6;\n\n/** Executables that run an inline command string passed via a `-c`-style flag. */\nconst SHELL_WRAPPERS = new Set([\"bash\", \"sh\", \"zsh\", \"dash\", \"ksh\", \"ash\"]);\n\n/**\n * Script interpreters that execute an inline program string (via a -c/-e/-r\n * style flag). Running inline code can execute arbitrary shell commands, so a\n * matched destructive/exec keyword inside the program escalates the call to\n * confirm-tier. A plain script-file path stays allow-tier.\n */\nconst INTERPRETER_INLINE_FLAGS: Readonly<Record<string, readonly string[]>> = {\n\tpython: [\"-c\"],\n\tpython2: [\"-c\"],\n\tpython3: [\"-c\"],\n\tnode: [\"-e\", \"--eval\", \"-p\", \"--print\"],\n\tperl: [\"-e\", \"-E\"],\n\truby: [\"-e\", \"-E\"],\n\tphp: [\"-r\", \"--run\"],\n\tlua: [\"-e\"],\n\texpect: [\"-c\"],\n};\n\n/**\n * Patterns that indicate an inline program invokes a shell command or\n * performs a destructive filesystem operation. Matching any of these inside\n * a `-c`/`-e`/`-r` program string escalates the call to confirm-tier.\n */\nconst INLINE_DESTRUCTIVE_PATTERNS: readonly RegExp[] = [\n\t/\\bos\\.system\\s*\\(/,\n\t/\\bos\\.remove\\s*\\(/,\n\t/\\bos\\.unlink\\s*\\(/,\n\t/\\bshutil\\.rmtree\\s*\\(/,\n\t/\\bsubprocess\\.(?:call|run|check_call|check_output|Popen)\\s*\\(/,\n\t/\\bexec(?:Sync|File)?\\s*\\(/,\n\t/\\bspawn(?:Sync)?\\s*\\(/,\n\t/\\bchild_process\\b/,\n\t/\\brequire\\s*\\(\\s*['\"]child_process['\"]\\s*\\)/,\n\t/\\b(?:system|popen)\\s*\\(/,\n\t/`[^`]*\\brm\\s+-/m,\n\t/\\$\\(\\s*[^)]*\\brm\\s+-/,\n];\n\n/** xargs options that consume a following value token before the wrapped command begins. */\nconst XARGS_OPTIONS_WITH_VALUE = new Set([\n\t\"-I\",\n\t\"-i\",\n\t\"-n\",\n\t\"-L\",\n\t\"-P\",\n\t\"-d\",\n\t\"-E\",\n\t\"-s\",\n\t\"-a\",\n\t\"--max-args\",\n\t\"--max-procs\",\n\t\"--delimiter\",\n\t\"--arg-file\",\n\t\"--max-lines\",\n\t\"--replace\",\n]);\n\n/**\n * Credential / secret file patterns. A bash argv token matching one of these is\n * treated as a `confirm`-tier access: headless callers (LLM tool calls, RPC bash)\n * deny by default, while an interactive user can still approve reading their own\n * files. These complement the §0.1 freedom safety floor, which hard-denies the\n * same paths on the entry points it guards.\n */\nconst SECRET_FILE_STRICT_PATTERNS: readonly RegExp[] = [\n\t/(^|\\/)\\.env(\\.|$)/i,\n\t/(^|\\/)\\.npmrc$/i,\n\t/(^|\\/)\\.netrc$/i,\n\t/(^|\\/)\\.pgpass$/i,\n\t/(^|\\/)\\.aws\\/credentials$/i,\n\t/(^|\\/)credentials$/i,\n\t/(^|\\/)auth\\.json$/i,\n\t/(^|\\/)id_(rsa|dsa|ecdsa|ed25519)$/i,\n\t/\\.(pem|key|p12|pfx|keystore|jks)$/i,\n\t/(^|\\/)secrets?(\\.[^/]+)?$/i,\n];\n\n/** Benign sibling files that look secret-ish but never hold credentials. */\nconst SECRET_FILE_ALLOW_PATTERNS: readonly RegExp[] = [/(^|\\/)\\.env\\.(example|sample|template|dist|defaults?)$/i];\nconst SEARCH_COMMANDS = new Set([\"grep\", \"egrep\", \"fgrep\", \"rg\"]);\nconst HOME_VARIABLE_RM_TARGETS = new Set([\"$home\", \"$\" + \"{home}\", \"$home/\", \"$\" + \"{home}/\"]);\n\nfunction verdict(risk: CommandRisk, rule: string, reason: string): CommandVerdict {\n\treturn { risk, rule, reason };\n}\n\nfunction allowVerdict(): CommandVerdict {\n\treturn verdict(\"allow\", \"command.allow\", \"No destructive or protected command pattern matched.\");\n}\n\nfunction isEnvAssignment(token: string | undefined): boolean {\n\treturn token !== undefined && /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(token);\n}\n\nfunction tokenizeShellSegment(segment: string): string[] {\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet quote: string | undefined;\n\tlet escaped = false;\n\n\tfor (const character of segment.trim()) {\n\t\tif (escaped) {\n\t\t\tcurrent += character;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (character === quote) {\n\t\t\t\tquote = undefined;\n\t\t\t} else {\n\t\t\t\tcurrent += character;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"'\" || character === '\"') {\n\t\t\tquote = character;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/\\s/.test(character)) {\n\t\t\tif (current) {\n\t\t\t\ttokens.push(current);\n\t\t\t\tcurrent = \"\";\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += character;\n\t}\n\n\tif (escaped) current += \"\\\\\";\n\tif (current) tokens.push(current);\n\treturn tokens;\n}\n\nfunction splitShellCommands(command: string): string[] {\n\tconst segments: string[] = [];\n\tlet current = \"\";\n\tlet quote: string | undefined;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst character = command[index];\n\t\tconst next = command[index + 1];\n\t\tif (escaped) {\n\t\t\tcurrent += character;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcurrent += character;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tcurrent += character;\n\t\t\tif (character === quote) quote = undefined;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"'\" || character === '\"') {\n\t\t\tquote = character;\n\t\t\tcurrent += character;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \";\" || character === \"|\" || character === \"\\n\" || character === \"\\r\") {\n\t\t\tif (current.trim()) segments.push(current.trim());\n\t\t\tcurrent = \"\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"&\") {\n\t\t\tif (current.trim()) segments.push(current.trim());\n\t\t\tcurrent = \"\";\n\t\t\tif (next === \"&\") index += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += character;\n\t}\n\n\tif (current.trim()) segments.push(current.trim());\n\treturn segments;\n}\n\nfunction skipEnvironmentPrefix(tokens: readonly string[], startIndex: number): number {\n\tlet index = startIndex;\n\twhile (isEnvAssignment(tokens[index])) index += 1;\n\tif (tokens[index]?.toLowerCase() !== \"env\") return index;\n\n\tindex += 1;\n\twhile (index < tokens.length) {\n\t\tconst token = tokens[index];\n\t\tif (isEnvAssignment(token)) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token?.startsWith(\"-\")) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tbreak;\n\t}\n\treturn index;\n}\n\nfunction optionConsumesValue(option: string, optionsWithValue: ReadonlySet<string>): boolean {\n\tif (option.includes(\"=\")) return false;\n\treturn optionsWithValue.has(option);\n}\n\nfunction skipPrivilegeOptions(tokens: readonly string[], startIndex: number, privilege: string): number {\n\tif (privilege !== \"sudo\" && privilege !== \"doas\") return startIndex;\n\n\tlet index = startIndex;\n\twhile (index < tokens.length) {\n\t\tconst token = tokens[index];\n\t\tif (!token?.startsWith(\"-\")) break;\n\t\tindex += 1;\n\t\tif (token === \"--\") break;\n\t\tif (optionConsumesValue(token, SUDO_OPTIONS_WITH_VALUE)) index += 1;\n\t}\n\treturn index;\n}\n\nfunction stripCommandPrefixes(tokens: readonly string[]): CommandPrefixResult {\n\tlet index = skipEnvironmentPrefix(tokens, 0);\n\tconst privilege = tokens[index]?.toLowerCase();\n\tif (!PRIVILEGE_COMMANDS.has(privilege ?? \"\")) {\n\t\treturn { tokens: tokens.slice(index), privilege: undefined };\n\t}\n\n\tindex += 1;\n\tindex = skipPrivilegeOptions(tokens, index, privilege ?? \"\");\n\tindex = skipEnvironmentPrefix(tokens, index);\n\treturn { tokens: tokens.slice(index), privilege };\n}\n\nfunction hasForkBomb(command: string): boolean {\n\treturn command.replace(/\\s/g, \"\").includes(\":(){:|:&};:\");\n}\n\nfunction normalizePathTarget(target: string): string {\n\treturn target.replace(/\\/+$/g, (match) => (target === match ? \"/\" : \"\")).replace(/\\/+/g, \"/\");\n}\n\nfunction classifyRmTarget(target: string): CommandVerdict | null {\n\tconst normalized = normalizePathTarget(target);\n\tif (normalized === \"/\" || normalized === \"/*\" || normalized === \"/.*\") {\n\t\treturn verdict(\"block\", \"fs.rm_rf_root\", \"Recursive forced rm targets filesystem root.\");\n\t}\n\tif (normalized === \"~\" || normalized === \"~/\" || normalized === \"~/*\" || normalized === \"~/.*\") {\n\t\treturn verdict(\"block\", \"fs.rm_rf_home\", \"Recursive forced rm targets the home directory.\");\n\t}\n\t// $HOME / ${HOME} expands to the user home directory at runtime.\n\tconst lower = normalized.toLowerCase();\n\tif (HOME_VARIABLE_RM_TARGETS.has(lower)) {\n\t\treturn verdict(\n\t\t\t\"confirm\",\n\t\t\t\"fs.rm_rf_home_var\",\n\t\t\t\"Recursive forced rm targets $HOME, which expands to the user home directory.\",\n\t\t);\n\t}\n\t// ~username targets another user home directory.\n\tif (/^~[A-Za-z0-9._-]/.test(normalized)) {\n\t\treturn verdict(\"confirm\", \"fs.rm_rf_user_home\", \"Recursive forced rm targets another user home directory.\");\n\t}\n\t// \".\" or \"./\" — current working directory (project root deletion risk).\n\tif (normalized === \".\") {\n\t\treturn verdict(\"confirm\", \"fs.rm_rf_cwd\", \"Recursive forced rm targets the current working directory.\");\n\t}\n\t// \"..\" — parent directory.\n\tif (normalized === \"..\") {\n\t\treturn verdict(\"confirm\", \"fs.rm_rf_parent\", \"Recursive forced rm targets the parent directory.\");\n\t}\n\treturn null;\n}\n\nfunction classifyRm(tokens: readonly string[]): CommandVerdict | null {\n\tlet hasRecursive = false;\n\tlet hasForce = false;\n\tlet endOfOptions = false;\n\tconst targets: string[] = [];\n\n\tfor (const token of tokens.slice(1)) {\n\t\tif (!endOfOptions && token === \"--\") {\n\t\t\tendOfOptions = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!endOfOptions && token.startsWith(\"-\") && token !== \"-\") {\n\t\t\tif (token === \"--recursive\") hasRecursive = true;\n\t\t\tif (token === \"--force\") hasForce = true;\n\t\t\tif (!token.startsWith(\"--\")) {\n\t\t\t\tconst flagCharacters = token.slice(1).split(\"\");\n\t\t\t\tif (flagCharacters.some((flag) => flag === \"r\" || flag === \"R\")) hasRecursive = true;\n\t\t\t\tif (flagCharacters.includes(\"f\")) hasForce = true;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\ttargets.push(token);\n\t}\n\n\tif (!hasRecursive || !hasForce) return null;\n\tfor (const target of targets) {\n\t\tconst targetVerdict = classifyRmTarget(target);\n\t\tif (targetVerdict) return targetVerdict;\n\t}\n\treturn null;\n}\n\nfunction isBlockDeviceOutput(token: string): boolean {\n\treturn /^of=\\/dev\\/(?:sd[a-z][a-z0-9]*|nvme[0-9a-z]+|disk(?:[0-9].*|\\/.*|$))/i.test(token);\n}\n\nfunction classifyDestructiveFilesystemCommand(command: string): CommandVerdict | null {\n\tif (hasForkBomb(command)) {\n\t\treturn verdict(\"block\", \"process.fork_bomb\", \"Shell fork bomb pattern would exhaust process resources.\");\n\t}\n\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tconst executable = tokens[0]?.toLowerCase();\n\tif (!executable) return null;\n\tif (executable === \"rm\") return classifyRm(tokens);\n\tif (executable.startsWith(\"mkfs\")) {\n\t\treturn verdict(\"block\", \"fs.mkfs\", \"Filesystem formatting commands are blocked.\");\n\t}\n\tif (executable === \"dd\" && tokens.slice(1).some(isBlockDeviceOutput)) {\n\t\treturn verdict(\"block\", \"fs.dd_block_device\", \"dd writes directly to a block-device output path.\");\n\t}\n\treturn null;\n}\n\nfunction findGitCommand(tokens: readonly string[]): { command: string; args: string[]; originalArgs: string[] } | null {\n\tif (tokens[0]?.toLowerCase() !== \"git\") return null;\n\tlet index = 1;\n\twhile (index < tokens.length && tokens[index]?.startsWith(\"-\")) {\n\t\tconst option = tokens[index];\n\t\tconst normalizedOption = option.toLowerCase();\n\t\tindex += 1;\n\t\tif (option === \"--\") break;\n\t\tif (\n\t\t\toptionConsumesValue(option, GIT_GLOBAL_OPTIONS_WITH_VALUE) ||\n\t\t\toptionConsumesValue(normalizedOption, GIT_GLOBAL_OPTIONS_WITH_VALUE)\n\t\t) {\n\t\t\tindex += 1;\n\t\t}\n\t}\n\tconst command = tokens[index]?.toLowerCase();\n\tif (!command) return null;\n\tconst originalArgs = tokens.slice(index + 1);\n\treturn {\n\t\tcommand,\n\t\targs: originalArgs.map((argument) => argument.toLowerCase()),\n\t\toriginalArgs,\n\t};\n}\n\nfunction hasGitCleanForceDirectory(args: readonly string[]): boolean {\n\tlet hasForce = false;\n\tlet hasDirectory = false;\n\tfor (const arg of args) {\n\t\tif (arg === \"--force\") hasForce = true;\n\t\tif (arg === \"-f\") hasForce = true;\n\t\tif (arg === \"-d\") hasDirectory = true;\n\t\tif (arg.startsWith(\"-\") && !arg.startsWith(\"--\")) {\n\t\t\tconst flags = arg.slice(1).split(\"\");\n\t\t\tif (flags.includes(\"f\")) hasForce = true;\n\t\t\tif (flags.includes(\"d\")) hasDirectory = true;\n\t\t}\n\t}\n\treturn hasForce && hasDirectory;\n}\n\nfunction classifyProtectedGitCommand(command: string): CommandVerdict | null {\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tconst gitCommand = findGitCommand(tokens);\n\tif (!gitCommand) return null;\n\n\tif (gitCommand.command === \"reset\" && gitCommand.args.includes(\"--hard\")) {\n\t\treturn verdict(\"confirm\", \"git.reset_hard\", \"git reset --hard can discard worktree changes.\");\n\t}\n\tif (gitCommand.command === \"restore\") {\n\t\tconst targetAll = gitCommand.originalArgs.includes(\".\") || gitCommand.originalArgs.includes(\"*\");\n\t\tconst rewritesWorktree = gitCommand.args.includes(\"--worktree\") || gitCommand.args.includes(\"--source\");\n\t\tif (targetAll || rewritesWorktree) {\n\t\t\treturn verdict(\"confirm\", \"git.restore\", \"git restore can discard or overwrite local worktree changes.\");\n\t\t}\n\t}\n\tif (gitCommand.command === \"checkout\" && gitCommand.originalArgs.includes(\".\")) {\n\t\treturn verdict(\"confirm\", \"git.checkout_dot\", \"git checkout . can overwrite local worktree changes.\");\n\t}\n\tif (gitCommand.command === \"clean\" && hasGitCleanForceDirectory(gitCommand.args)) {\n\t\treturn verdict(\"confirm\", \"git.clean_force\", \"git clean -fd can delete untracked files and directories.\");\n\t}\n\tif (gitCommand.command === \"stash\" && gitCommand.originalArgs.length === 0) {\n\t\treturn verdict(\"confirm\", \"git.stash_bare\", \"Bare git stash can hide local worktree changes.\");\n\t}\n\tif (gitCommand.command === \"commit\" && gitCommand.args.includes(\"--no-verify\")) {\n\t\treturn verdict(\"confirm\", \"git.no_verify\", \"git commit --no-verify bypasses repository verification hooks.\");\n\t}\n\tif (gitCommand.command === \"push\" && gitCommand.args.includes(\"--no-verify\")) {\n\t\treturn verdict(\"confirm\", \"git.push_no_verify\", \"git push --no-verify bypasses remote verification hooks.\");\n\t}\n\tif (\n\t\tgitCommand.command === \"push\" &&\n\t\t(gitCommand.originalArgs.includes(\"-f\") ||\n\t\t\tgitCommand.args.includes(\"--force\") ||\n\t\t\tgitCommand.args.includes(\"--force-with-lease\"))\n\t) {\n\t\treturn verdict(\"confirm\", \"git.force_push\", \"Force-pushing can rewrite remote history.\");\n\t}\n\treturn null;\n}\n\nfunction classifyPrivilegeCommand(command: string): CommandVerdict | null {\n\tconst tokens = tokenizeShellSegment(command);\n\tconst index = skipEnvironmentPrefix(tokens, 0);\n\tconst privilege = tokens[index]?.toLowerCase();\n\tif (!PRIVILEGE_COMMANDS.has(privilege ?? \"\")) return null;\n\treturn verdict(\"confirm\", `priv.${privilege}`, `${privilege} requires explicit per-command confirmation.`);\n}\n\n/**\n * Locate the inline command-string argument for a `shell -c \"<cmd>\"` invocation.\n * Returns the token index of the command string, or -1 when the shell runs a\n * script file (no inline command to classify).\n */\nfunction findShellCommandStringIndex(tokens: readonly string[]): number {\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index];\n\t\tif (!token.startsWith(\"-\")) return -1;\n\t\tif (/^-[a-z]*c$/i.test(token)) {\n\t\t\treturn index + 1 < tokens.length ? index + 1 : -1;\n\t\t}\n\t}\n\treturn -1;\n}\n\n/**\n * Locate the inline program-string argument for an interpreter invocation\n * (`python -c`, `node -e`, `perl -e`, ...). Returns the token index of the\n * program string, or -1 when the interpreter runs a script file (no inline\n * program to classify).\n */\nfunction findInterpreterInlineIndex(tokens: readonly string[], flags: readonly string[]): number {\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index];\n\t\tif (token === \"--\") return -1;\n\t\tif (!token.startsWith(\"-\")) return -1;\n\t\tif (flags.includes(token) || flags.includes(token.toLowerCase())) {\n\t\t\treturn index + 1 < tokens.length ? index + 1 : -1;\n\t\t}\n\t}\n\treturn -1;\n}\n\n/** Drop leading xargs options (and their values) to expose the wrapped command. */\nfunction stripXargsOptions(args: readonly string[]): string[] {\n\tlet index = 0;\n\twhile (index < args.length) {\n\t\tconst token = args[index];\n\t\tif (!token.startsWith(\"-\") || token === \"-\") break;\n\t\tindex += 1;\n\t\tif (token === \"--\") break;\n\t\tif (!token.includes(\"=\") && XARGS_OPTIONS_WITH_VALUE.has(token)) index += 1;\n\t}\n\treturn args.slice(index);\n}\n\n/** Extract the command tokens of a `find ... -exec <cmd> {} ;|+` clause, if present. */\nfunction extractFindExec(tokens: readonly string[]): string[] | null {\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index].toLowerCase();\n\t\tif (token === \"-exec\" || token === \"-execdir\" || token === \"-ok\" || token === \"-okdir\") {\n\t\t\tconst collected: string[] = [];\n\t\t\tfor (let inner = index + 1; inner < tokens.length; inner += 1) {\n\t\t\t\tconst piece = tokens[inner];\n\t\t\t\tif (piece === \";\" || piece === \"+\") break;\n\t\t\t\tif (piece === \"{}\") continue;\n\t\t\t\tcollected.push(piece);\n\t\t\t}\n\t\t\treturn collected.length > 0 ? collected : null;\n\t\t}\n\t}\n\treturn null;\n}\n\n/**\n * Classify the effective command hidden inside a wrapper executable so a\n * destructive or protected command cannot be smuggled past the classifier via\n * `bash -c`, `eval`, `xargs`, or `find -exec`. Returns null when the segment is\n * not a recognized wrapper.\n */\nfunction classifyWrappedCommand(command: string, depth: number): CommandVerdict | null {\n\tif (depth >= MAX_WRAP_DEPTH) return null;\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tconst executable = tokens[0]?.toLowerCase();\n\tif (!executable) return null;\n\n\tif (SHELL_WRAPPERS.has(executable)) {\n\t\tconst innerIndex = findShellCommandStringIndex(tokens);\n\t\tconst inner = innerIndex === -1 ? undefined : tokens[innerIndex];\n\t\treturn inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t}\n\tif (executable === \"eval\") {\n\t\tconst inner = tokens.slice(1).join(\" \").trim();\n\t\treturn inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t}\n\tif (executable === \"xargs\") {\n\t\tconst inner = stripXargsOptions(tokens.slice(1)).join(\" \").trim();\n\t\treturn inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t}\n\tif (executable === \"find\") {\n\t\tconst lowered = tokens.map((token) => token.toLowerCase());\n\t\tconst hasDelete = lowered.includes(\"-delete\");\n\t\tconst execTokens = extractFindExec(tokens);\n\t\tconst inner = execTokens?.join(\" \").trim();\n\t\tconst innerVerdict = inner ? classifyShellCommandInternal(inner, depth + 1) : null;\n\t\tif (hasDelete) {\n\t\t\tconst deleteVerdict = verdict(\n\t\t\t\t\"confirm\",\n\t\t\t\t\"fs.find_delete\",\n\t\t\t\t\"find -delete removes matched files and directories.\",\n\t\t\t);\n\t\t\tif (!innerVerdict || RISK_RANK[deleteVerdict.risk] > RISK_RANK[innerVerdict.risk]) {\n\t\t\t\treturn deleteVerdict;\n\t\t\t}\n\t\t}\n\t\treturn innerVerdict ?? null;\n\t}\n\tconst inlineFlags = INTERPRETER_INLINE_FLAGS[executable];\n\tif (inlineFlags) {\n\t\tconst innerIndex = findInterpreterInlineIndex(tokens, inlineFlags);\n\t\tif (innerIndex === -1) return null; // script file path — allow\n\t\tconst program = tokens[innerIndex];\n\t\tif (INLINE_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(program))) {\n\t\t\treturn verdict(\n\t\t\t\t\"confirm\",\n\t\t\t\t`interp.${executable}_inline_destructive`,\n\t\t\t\t`${executable} inline program can execute destructive shell commands.`,\n\t\t\t);\n\t\t}\n\t\treturn null;\n\t}\n\treturn null;\n}\n\nfunction isSearchPatternArgument(tokens: readonly string[], index: number): boolean {\n\tconst executable = tokens[0]?.toLowerCase();\n\treturn SEARCH_COMMANDS.has(executable ?? \"\") && tokens[index - 1] === \"--\";\n}\n\n/** Flag commands that read, copy, or transmit a credential / secret file path. */\nfunction classifySecretAccess(command: string): CommandVerdict | null {\n\tconst { tokens } = stripCommandPrefixes(tokenizeShellSegment(command));\n\tif (tokens.length === 0) return null;\n\tfor (let index = 1; index < tokens.length; index += 1) {\n\t\tconst token = tokens[index];\n\t\tif (!token || token.startsWith(\"-\")) continue;\n\t\tif (isSearchPatternArgument(tokens, index)) continue;\n\t\tif (/\\s/.test(token)) continue;\n\t\tif (SECRET_FILE_ALLOW_PATTERNS.some((pattern) => pattern.test(token))) continue;\n\t\tif (SECRET_FILE_STRICT_PATTERNS.some((pattern) => pattern.test(token))) {\n\t\t\treturn verdict(\"confirm\", \"secret.read_path\", \"Command references a credential or secret file path.\");\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction classifySingleCommand(command: string, depth: number): CommandVerdict {\n\tconst trimmed = command.trim();\n\tif (!trimmed) return allowVerdict();\n\n\tconst destructiveFilesystem = classifyDestructiveFilesystemCommand(trimmed);\n\tif (destructiveFilesystem) return destructiveFilesystem;\n\n\tconst wrapped = classifyWrappedCommand(trimmed, depth);\n\tif (wrapped && wrapped.risk === \"block\") return wrapped;\n\n\tconst protectedGit = classifyProtectedGitCommand(trimmed);\n\tif (protectedGit) return protectedGit;\n\n\tconst privilege = classifyPrivilegeCommand(trimmed);\n\tif (privilege) return privilege;\n\n\tconst secret = classifySecretAccess(trimmed);\n\tif (secret) return secret;\n\n\tif (wrapped && RISK_RANK[wrapped.risk] > RISK_RANK.allow) return wrapped;\n\n\treturn allowVerdict();\n}\n\nfunction classifyShellCommandInternal(command: string, depth: number): CommandVerdict {\n\tlet selected = classifySingleCommand(command, depth);\n\tfor (const segment of splitShellCommands(command)) {\n\t\tconst candidate = classifySingleCommand(segment, depth);\n\t\tif (RISK_RANK[candidate.risk] > RISK_RANK[selected.risk]) selected = candidate;\n\t\tif (selected.risk === \"block\") break;\n\t}\n\treturn selected;\n}\n\nexport function classifyShellCommand(command: string): CommandVerdict {\n\treturn classifyShellCommandInternal(command, 0);\n}\n\nexport function isDestructiveFilesystem(command: string): boolean {\n\treturn classifyDestructiveFilesystemCommand(command) !== null;\n}\n\nexport function isProtectedGitOperation(command: string): boolean {\n\treturn classifyProtectedGitCommand(command) !== null;\n}\n\nexport function isPrivilegeEscalation(command: string): boolean {\n\treturn classifyPrivilegeCommand(command) !== null;\n}\n"]}

package/dist/core/command-safety.js

@@ -412,14 +412,6 @@ function classifyProtectedGitCommand(command) {
     if (gitCommand.command === "stash" && gitCommand.originalArgs.length === 0) {
         return verdict("confirm", "git.stash_bare", "Bare git stash can hide local worktree changes.");
     }
-    if (gitCommand.command === "add") {
-        if (gitCommand.originalArgs.includes(".")) {
-            return verdict("confirm", "git.add_dot", "git add . can stage unrelated local changes.");
-        }
-        if (gitCommand.originalArgs.includes("-A") || gitCommand.args.includes("--all")) {
-            return verdict("confirm", "git.add_all", "git add -A can stage unrelated local changes.");
-        }
-    }
     if (gitCommand.command === "commit" && gitCommand.args.includes("--no-verify")) {
         return verdict("confirm", "git.no_verify", "git commit --no-verify bypasses repository verification hooks.");
     }