pi-codex-auto-review 0.1.3 → 0.2.0

package/dist/policy/index.js

@@ -1,84 +1,160 @@
-import { readFile, stat } from 'node:fs/promises';
-import { basename, dirname, join, resolve } from 'node:path';
-import { homedir, tmpdir } from 'node:os';
-import { fileURLToPath } from 'node:url';
-import { createProfile, decision, digest, immutable, GuardError, EMPTY_DELTA, TOOL_NAMES } from '../contracts.js';
-import { canonicalPath, isWithin, resolveToolPath } from './paths.js';
-import { analyzeShell, matchesPrefix } from './shell.js';
-import { reviewPolicy } from '../review/policy.js';
-import { matchesDomain, isNetworkHost, isDomainPattern, normalizeHost } from './domains.js';
-import { evaluateRules, ruleCommands, matchesRule } from './rules.js';
-export { canonicalPath, isWithin, analyzeShell, matchesPrefix, resolveToolPath };
+import { readFile, stat } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createProfile, decision, digest, EMPTY_DELTA, GuardError, immutable, TOOL_NAMES, } from "../contracts.js";
+import { reviewPolicy } from "../review/policy.js";
+import { isDomainPattern, isNetworkHost, matchesDomain, normalizeHost, } from "./domains.js";
+import { canonicalPath, isWithin, resolveToolPath } from "./paths.js";
+import { evaluateRules, matchesRule, ruleCommands, } from "./rules.js";
+import { analyzeShell, matchesPrefix } from "./shell.js";
+export { analyzeShell, canonicalPath, isWithin, matchesPrefix, resolveToolPath, };
 export const DEFAULT_SETTINGS = immutable({
-    mode: 'workspace-write', commandRules: [], allowedDomains: [], reviewTimeoutMs: 20_000, approvalTimeoutMs: 60_000, executionTimeoutSeconds: 120, trustedTools: [],
-    approvalPolicy: 'on-request', approvalsReviewer: 'auto_review', reviewModel: null, reviewPolicy: null,
-    reviewMaxRounds: 4, reviewMaxOutputTokens: 2048, reviewContextChars: 60000,
-    ruleFiles: [], writableRoots: [], excludeSlashTmp: false, excludeTmpdir: false,
-    projectDocMaxBytes: 32768, projectDocFallbackFilenames: [], projectRootMarkers: null,
+    mode: "workspace-write",
+    commandRules: [],
+    allowedDomains: [],
+    reviewTimeoutMs: 20_000,
+    approvalTimeoutMs: 60_000,
+    executionTimeoutSeconds: 120,
+    trustedTools: [],
+    approvalPolicy: "on-request",
+    approvalsReviewer: "auto_review",
+    reviewModel: null,
+    reviewPolicy: null,
+    reviewMaxRounds: 4,
+    reviewMaxOutputTokens: 2048,
+    reviewContextChars: 60000,
+    ruleFiles: [],
+    writableRoots: [],
+    excludeSlashTmp: false,
+    excludeTmpdir: false,
+    projectDocMaxBytes: 32768,
+    projectDocFallbackFilenames: [],
+    projectRootMarkers: null,
 });
 export function validateSettings(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new GuardError('INVALID_SETTINGS', 'Settings must be an object');
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new GuardError("INVALID_SETTINGS", "Settings must be an object");
     const raw = value;
     for (const key of Object.keys(raw))
         if (!Object.hasOwn(DEFAULT_SETTINGS, key))
-            throw new GuardError('INVALID_SETTINGS', `Unknown setting: ${key}`);
+            throw new GuardError("INVALID_SETTINGS", `Unknown setting: ${key}`);
     const settings = { ...DEFAULT_SETTINGS, ...raw };
-    if (!['read-only', 'workspace-write'].includes(settings.mode))
-        throw new GuardError('INVALID_SETTINGS', 'Unknown mode');
-    for (const key of ['reviewTimeoutMs', 'approvalTimeoutMs', 'executionTimeoutSeconds'])
+    if (!["read-only", "workspace-write"].includes(settings.mode))
+        throw new GuardError("INVALID_SETTINGS", "Unknown mode");
+    for (const key of [
+        "reviewTimeoutMs",
+        "approvalTimeoutMs",
+        "executionTimeoutSeconds",
+    ])
         if (!Number.isFinite(settings[key]) || settings[key] <= 0)
-            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
-    if (!Array.isArray(settings.allowedDomains) || settings.allowedDomains.some(x => !isDomainPattern(x)))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid domains');
-    if (!Array.isArray(settings.trustedTools) || settings.trustedTools.some(x => typeof x !== 'string' || !x))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid trusted tools');
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    if (!Array.isArray(settings.allowedDomains) ||
+        settings.allowedDomains.some((x) => !isDomainPattern(x)))
+        throw new GuardError("INVALID_SETTINGS", "Invalid domains");
+    if (!Array.isArray(settings.trustedTools) ||
+        settings.trustedTools.some((x) => typeof x !== "string" || !x))
+        throw new GuardError("INVALID_SETTINGS", "Invalid trusted tools");
     const approval = settings.approvalPolicy;
-    if (approval !== 'on-request' && approval !== 'never' && (!approval || typeof approval !== 'object' || Array.isArray(approval) || Object.keys(approval).some(key => !['sandbox', 'rules', 'mcp_elicitations'].includes(key)) || typeof approval.sandbox !== 'boolean' || typeof approval.rules !== 'boolean' || approval.mcp_elicitations !== undefined && typeof approval.mcp_elicitations !== 'boolean'))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid approval policy');
-    if (!['auto_review', 'user'].includes(settings.approvalsReviewer))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid approvals reviewer');
-    if (settings.reviewModel !== null && (!settings.reviewModel || typeof settings.reviewModel !== 'object' || Array.isArray(settings.reviewModel) || Object.keys(settings.reviewModel).some(key => !['provider', 'id'].includes(key)) || ![settings.reviewModel.provider, settings.reviewModel.id].every(value => typeof value === 'string' && value.trim().length > 0 && !/[\0\r\n]/.test(value))))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid review model');
-    if (settings.reviewPolicy !== null && (typeof settings.reviewPolicy !== 'string' || !settings.reviewPolicy.trim() || settings.reviewPolicy.length > 100000))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid reviewer policy');
-    for (const [key, maximum] of [['reviewMaxRounds', 16], ['reviewMaxOutputTokens', 16384], ['reviewContextChars', 500000]])
-        if (!Number.isInteger(settings[key]) || settings[key] < 1 || settings[key] > maximum)
-            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
-    for (const key of ['ruleFiles', 'writableRoots'])
-        if (!Array.isArray(settings[key]) || settings[key].some(value => typeof value !== 'string' || !value || value.includes('\0')))
-            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
-    for (const key of ['excludeSlashTmp', 'excludeTmpdir'])
-        if (typeof settings[key] !== 'boolean')
-            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
-    if (!Number.isSafeInteger(settings.projectDocMaxBytes) || settings.projectDocMaxBytes < 0 || settings.projectDocMaxBytes > 1000000)
-        throw new GuardError('INVALID_SETTINGS', 'Invalid project document byte budget');
-    for (const values of [settings.projectDocFallbackFilenames, settings.projectRootMarkers ?? []])
-        if (!Array.isArray(values) || values.some(value => typeof value !== 'string'))
-            throw new GuardError('INVALID_SETTINGS', 'Invalid context discovery filenames');
+    if (approval !== "on-request" &&
+        approval !== "never" &&
+        (!approval ||
+            typeof approval !== "object" ||
+            Array.isArray(approval) ||
+            Object.keys(approval).some((key) => !["sandbox", "rules", "mcp_elicitations"].includes(key)) ||
+            typeof approval.sandbox !== "boolean" ||
+            typeof approval.rules !== "boolean" ||
+            (approval.mcp_elicitations !== undefined &&
+                typeof approval.mcp_elicitations !== "boolean")))
+        throw new GuardError("INVALID_SETTINGS", "Invalid approval policy");
+    if (!["auto_review", "user"].includes(settings.approvalsReviewer))
+        throw new GuardError("INVALID_SETTINGS", "Invalid approvals reviewer");
+    if (settings.reviewModel !== null &&
+        (!settings.reviewModel ||
+            typeof settings.reviewModel !== "object" ||
+            Array.isArray(settings.reviewModel) ||
+            Object.keys(settings.reviewModel).some((key) => !["provider", "id"].includes(key)) ||
+            ![settings.reviewModel.provider, settings.reviewModel.id].every((value) => typeof value === "string" &&
+                value.trim().length > 0 &&
+                !/[\0\r\n]/.test(value))))
+        throw new GuardError("INVALID_SETTINGS", "Invalid review model");
+    if (settings.reviewPolicy !== null &&
+        (typeof settings.reviewPolicy !== "string" ||
+            !settings.reviewPolicy.trim() ||
+            settings.reviewPolicy.length > 100000))
+        throw new GuardError("INVALID_SETTINGS", "Invalid reviewer policy");
+    for (const [key, maximum] of [
+        ["reviewMaxRounds", 16],
+        ["reviewMaxOutputTokens", 16384],
+        ["reviewContextChars", 500000],
+    ])
+        if (!Number.isInteger(settings[key]) ||
+            settings[key] < 1 ||
+            settings[key] > maximum)
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    for (const key of ["ruleFiles", "writableRoots"])
+        if (!Array.isArray(settings[key]) ||
+            settings[key].some((value) => typeof value !== "string" || !value || value.includes("\0")))
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    for (const key of ["excludeSlashTmp", "excludeTmpdir"])
+        if (typeof settings[key] !== "boolean")
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    if (!Number.isSafeInteger(settings.projectDocMaxBytes) ||
+        settings.projectDocMaxBytes < 0 ||
+        settings.projectDocMaxBytes > 1000000)
+        throw new GuardError("INVALID_SETTINGS", "Invalid project document byte budget");
+    for (const values of [
+        settings.projectDocFallbackFilenames,
+        settings.projectRootMarkers ?? [],
+    ])
+        if (!Array.isArray(values) ||
+            values.some((value) => typeof value !== "string"))
+            throw new GuardError("INVALID_SETTINGS", "Invalid context discovery filenames");
     if (!Array.isArray(settings.commandRules))
-        throw new GuardError('INVALID_SETTINGS', 'Invalid command rules');
+        throw new GuardError("INVALID_SETTINGS", "Invalid command rules");
     for (const rule of settings.commandRules) {
-        if (!rule || !['allow', 'ask', 'deny'].includes(rule.decision) || !Array.isArray(rule.prefix) || !rule.prefix.length || rule.prefix.some((x) => typeof x !== 'string' || !x || /[\0\n]/.test(x)))
-            throw new GuardError('INVALID_SETTINGS', 'Invalid command rule');
-        if (Object.keys(rule).some(k => !['prefix', 'decision'].includes(k)))
-            throw new GuardError('INVALID_SETTINGS', 'Unknown command rule field');
+        if (!rule ||
+            !["allow", "ask", "deny"].includes(rule.decision) ||
+            !Array.isArray(rule.prefix) ||
+            !rule.prefix.length ||
+            rule.prefix.some((x) => typeof x !== "string" || !x || /[\0\n]/.test(x)))
+            throw new GuardError("INVALID_SETTINGS", "Invalid command rule");
+        if (Object.keys(rule).some((k) => !["prefix", "decision"].includes(k)))
+            throw new GuardError("INVALID_SETTINGS", "Unknown command rule field");
     }
     return immutable(JSON.parse(JSON.stringify(settings)));
 }
 export async function loadSettings(path) {
     try {
-        return validateSettings(JSON.parse(await readFile(path, 'utf8')));
+        return validateSettings(JSON.parse(await readFile(path, "utf8")));
     }
     catch (error) {
-        throw new GuardError('INVALID_SETTINGS', 'Permission settings could not be loaded', { cause: error });
+        throw new GuardError("INVALID_SETTINGS", "Permission settings could not be loaded", { cause: error });
     }
 }
 export async function defaultProfile(cwd, settings, controlPaths = [], trustedExtensionPaths = []) {
     const workspace = await canonicalPath(cwd, cwd), home = homedir();
-    const hardRead = [join(home, '.ssh'), join(home, '.aws'), join(home, '.codex'), join(home, '.pi', 'agent'), ...controlPaths, ...settings.ruleFiles];
-    const hardWrite = [...hardRead, join(workspace, '.pi', 'guard'), fileURLToPath(new URL('../', import.meta.url))];
-    const roots = [...new Set(await Promise.all([workspace, ...settings.writableRoots, ...(!settings.excludeSlashTmp ? ['/tmp'] : []), ...(!settings.excludeTmpdir ? [tmpdir()] : [])].map(path => canonicalPath(path, cwd))))];
+    const hardRead = [
+        join(home, ".ssh"),
+        join(home, ".aws"),
+        join(home, ".codex"),
+        join(home, ".pi", "agent"),
+        ...controlPaths,
+        ...settings.ruleFiles,
+    ];
+    const hardWrite = [
+        ...hardRead,
+        join(workspace, ".pi", "guard"),
+        fileURLToPath(new URL("../", import.meta.url)),
+    ];
+    const roots = [
+        ...new Set(await Promise.all([
+            workspace,
+            ...settings.writableRoots,
+            ...(!settings.excludeSlashTmp ? ["/tmp"] : []),
+            ...(!settings.excludeTmpdir ? [tmpdir()] : []),
+        ].map((path) => canonicalPath(path, cwd)))),
+    ];
     const readOnlyPaths = [];
     for (const input of trustedExtensionPaths) {
         const path = await canonicalPath(input, cwd);
@@ -86,34 +162,43 @@ export async function defaultProfile(cwd, settings, controlPaths = [], trustedEx
         hardWrite.push((await stat(path)).isDirectory() ? path : dirname(path));
     }
     for (const root of roots) {
-        const git = join(root, '.git');
+        const git = join(root, ".git");
         readOnlyPaths.push(await canonicalPath(git, cwd));
         try {
             if ((await stat(git)).isFile()) {
-                const pointer = /^gitdir:\s*(.+)\s*$/m.exec(await readFile(git, 'utf8'));
-                if (pointer)
+                const pointer = /^gitdir:\s*(.+)\s*$/m.exec(await readFile(git, "utf8"));
+                if (pointer?.[1])
                     readOnlyPaths.push(await canonicalPath(resolve(root, pointer[1]), cwd));
             }
         }
         catch (error) {
-            if (error.code !== 'ENOENT')
+            if (error.code !== "ENOENT")
                 throw error;
         }
-        for (const name of ['.agents', '.codex']) {
+        for (const name of [".agents", ".codex"]) {
             const path = join(root, name);
             try {
                 if ((await stat(path)).isDirectory())
                     readOnlyPaths.push(await canonicalPath(path, cwd));
             }
             catch (error) {
-                if (error.code !== 'ENOENT')
+                if (error.code !== "ENOENT")
                     throw error;
             }
         }
-        readOnlyPaths.push(await canonicalPath(join(root, '.pi'), cwd));
-        hardWrite.push(...['mcp.json', 'settings.json', 'extensions', 'guard'].map(name => join(root, '.pi', name)));
+        readOnlyPaths.push(await canonicalPath(join(root, ".pi"), cwd));
+        hardWrite.push(...["mcp.json", "settings.json", "extensions", "guard"].map((name) => join(root, ".pi", name)));
     }
-    return createProfile({ mode: settings.mode, readRoots: ['/'], writeRoots: settings.mode === 'workspace-write' ? roots : [], denyRead: await Promise.all(hardRead.map(p => canonicalPath(p, cwd))), denyWrite: await Promise.all(hardWrite.map(p => canonicalPath(p, cwd))), readOnlyPaths, allowedDomains: [...settings.allowedDomains], deniedDomains: [] });
+    return createProfile({
+        mode: settings.mode,
+        readRoots: ["/"],
+        writeRoots: settings.mode === "workspace-write" ? roots : [],
+        denyRead: await Promise.all(hardRead.map((p) => canonicalPath(p, cwd))),
+        denyWrite: await Promise.all(hardWrite.map((p) => canonicalPath(p, cwd))),
+        readOnlyPaths,
+        allowedDomains: [...settings.allowedDomains],
+        deniedDomains: [],
+    });
 }
 export class PolicyEngine {
     settings;
@@ -123,155 +208,313 @@ export class PolicyEngine {
     compiledRules;
     matchCache = new Map();
     effectiveProfile;
-    get profile() { return this.effectiveProfile; }
-    get revision() { return digest({ settings: this.settings, profile: this.profile, rules: this.rules, ruleSources: this.ruleSources, compiledRules: this.compiledRules ?? null, reviewPolicyDigest: reviewPolicy(this.settings.reviewPolicy).digest }); }
+    get profile() {
+        return this.effectiveProfile;
+    }
+    get revision() {
+        return digest({
+            settings: this.settings,
+            profile: this.profile,
+            rules: this.rules,
+            ruleSources: this.ruleSources,
+            compiledRules: this.compiledRules ?? null,
+            reviewPolicyDigest: reviewPolicy(this.settings.reviewPolicy).digest,
+        });
+    }
     constructor(settings, profile) {
         this.settings = settings;
         this.effectiveProfile = profile;
-        this.rules = settings.commandRules.map(rule => ({ pattern: rule.prefix, decision: rule.decision === 'ask' ? 'prompt' : rule.decision === 'deny' ? 'forbidden' : 'allow' }));
+        this.rules = settings.commandRules.map((rule) => ({
+            pattern: rule.prefix,
+            decision: rule.decision === "ask"
+                ? "prompt"
+                : rule.decision === "deny"
+                    ? "forbidden"
+                    : "allow",
+        }));
         this.isInitialized = settings.ruleFiles.length === 0;
     }
     async initialize(cwd = process.cwd()) {
         if (this.isInitialized)
             return;
-        this.ruleSources = immutable(await Promise.all(this.settings.ruleFiles.map(async (path) => ({ name: resolve(cwd, path), source: await readFile(resolve(cwd, path), 'utf8') }))));
+        this.ruleSources = immutable(await Promise.all(this.settings.ruleFiles.map(async (path) => ({
+            name: resolve(cwd, path),
+            source: await readFile(resolve(cwd, path), "utf8"),
+        }))));
         this.compiledRules = await evaluateRules(this.ruleSources);
         const allowed = this.compiledRules.allowedDomains, denied = this.compiledRules.deniedDomains;
-        this.effectiveProfile = createProfile({ ...this.profile, allowedDomains: [...new Set([...this.profile.allowedDomains.filter(host => !denied.includes(host)), ...allowed])], deniedDomains: [...new Set([...this.profile.deniedDomains, ...denied])] });
+        this.effectiveProfile = createProfile({
+            ...this.profile,
+            allowedDomains: [
+                ...new Set([
+                    ...this.profile.allowedDomains.filter((host) => !denied.includes(host)),
+                    ...allowed,
+                ]),
+            ],
+            deniedDomains: [
+                ...new Set([...this.profile.deniedDomains, ...denied]),
+            ],
+        });
         this.isInitialized = true;
     }
     async evaluate(action, signal) {
         if (!this.isInitialized)
-            return decision(action, 'deny', 'Command rules have not been loaded', EMPTY_DELTA, true);
-        if (action.policyRevision !== this.revision || action.permissionDigest !== digest(this.profile))
-            return decision(action, 'deny', 'Stale policy or permission profile', EMPTY_DELTA, true);
+            return decision(action, "deny", "Command rules have not been loaded", EMPTY_DELTA, true);
+        if (action.policyRevision !== this.revision ||
+            action.permissionDigest !== digest(this.profile))
+            return decision(action, "deny", "Stale policy or permission profile", EMPTY_DELTA, true);
         if (!TOOL_NAMES.includes(action.tool))
-            return decision(action, 'ask', 'Unknown tool: annotations do not establish permission');
-        if (action.tool === 'bash')
+            return decision(action, "ask", "Unknown tool: annotations do not establish permission");
+        if (action.tool === "bash")
             return this.shellDecision(action, signal);
         const input = action.args.path ?? action.cwd;
-        if (typeof input !== 'string')
-            return decision(action, 'deny', 'Invalid path input', EMPTY_DELTA, true);
-        const target = await canonicalPath(await resolveToolPath(input, action.cwd, action.tool === 'read'), action.cwd);
+        if (typeof input !== "string")
+            return decision(action, "deny", "Invalid path input", EMPTY_DELTA, true);
+        const target = await canonicalPath(await resolveToolPath(input, action.cwd, action.tool === "read"), action.cwd);
         const profile = await this.resolvedProfile(action.cwd);
-        const isWrite = action.tool === 'write' || action.tool === 'edit';
-        if (profile.denyRead.some(p => isWithin(target, p)) || (isWrite && profile.denyWrite.some(p => isWithin(target, p))))
-            return decision(action, 'deny', 'Protected path', EMPTY_DELTA, true);
-        const canRead = profile.readRoots.some(p => isWithin(target, p));
-        const canWrite = !isWrite || profile.writeRoots.some(p => isWithin(target, p)) && !(profile.readOnlyPaths ?? []).some(p => isWithin(target, p));
+        const isWrite = action.tool === "write" || action.tool === "edit";
+        if (profile.denyRead.some((p) => isWithin(target, p)) ||
+            (isWrite && profile.denyWrite.some((p) => isWithin(target, p))))
+            return decision(action, "deny", "Protected path", EMPTY_DELTA, true);
+        const canRead = profile.readRoots.some((p) => isWithin(target, p));
+        const canWrite = !isWrite ||
+            (profile.writeRoots.some((p) => isWithin(target, p)) &&
+                !(profile.readOnlyPaths ?? []).some((p) => isWithin(target, p)));
         if (canRead && canWrite)
-            return decision(action, 'allow', 'Within current filesystem permissions');
-        return decision(action, 'ask', 'Action outside the ordinary approval scope', { readPaths: canRead ? [] : [target], writePaths: canWrite ? [] : [target], domains: [] });
+            return decision(action, "allow", "Within current filesystem permissions");
+        return decision(action, "ask", "Action outside the ordinary approval scope", {
+            readPaths: canRead ? [] : [target],
+            writePaths: canWrite ? [] : [target],
+            domains: [],
+        });
     }
     async shellDecision(action, signal) {
         const profile = await this.resolvedProfile(action.cwd);
         const command = action.args.command;
-        if (typeof command !== 'string')
-            return decision(action, 'deny', 'Invalid command input', EMPTY_DELTA, true);
+        if (typeof command !== "string")
+            return decision(action, "deny", "Invalid command input", EMPTY_DELTA, true);
         const analysis = analyzeShell(command);
         let shouldAsk = !analysis.isSupported;
         const delta = { readPaths: [], writePaths: [], domains: [] };
-        const commandGroups = ruleCommands(command, typeof action.args.shellPath === 'string' ? action.args.shellPath : '/bin/bash');
+        const commandGroups = ruleCommands(command, typeof action.args.shellPath === "string"
+            ? action.args.shellPath
+            : "/bin/bash");
         const key = digest(commandGroups);
         let compiledMatches = this.matchCache.get(key);
         if (!compiledMatches && this.ruleSources.length) {
             compiledMatches = (await evaluateRules(this.ruleSources, commandGroups, signal)).matches;
-            if (this.matchCache.size >= 256)
-                this.matchCache.delete(this.matchCache.keys().next().value);
+            if (this.matchCache.size >= 256) {
+                const oldestKey = this.matchCache.keys().next().value;
+                if (oldestKey !== undefined)
+                    this.matchCache.delete(oldestKey);
+            }
             this.matchCache.set(key, compiledMatches);
         }
-        const matches = commandGroups.map((argv, index) => [...this.rules.filter(rule => matchesRule(argv, rule)), ...(compiledMatches?.[index] ?? [])]);
-        const forbidden = matches.flat().find(rule => rule.decision === 'forbidden');
+        const matches = commandGroups.map((argv, index) => [
+            ...this.rules.filter((rule) => matchesRule(argv, rule)),
+            ...(compiledMatches?.[index] ?? []),
+        ]);
+        const forbidden = matches
+            .flat()
+            .find((rule) => rule.decision === "forbidden");
         if (forbidden)
-            return decision(action, 'deny', forbidden.justification ?? 'Command forbidden by trusted rule', EMPTY_DELTA, true);
-        const prompted = matches.flat().find(rule => rule.decision === 'prompt');
-        const isRuleAllowed = !prompted && matches.length > 0 && matches.every(group => group.some(rule => rule.decision === 'allow'));
+            return decision(action, "deny", forbidden.justification ?? "Command forbidden by trusted rule", EMPTY_DELTA, true);
+        const prompted = matches
+            .flat()
+            .find((rule) => rule.decision === "prompt");
+        const isRuleAllowed = !prompted &&
+            matches.length > 0 &&
+            matches.every((group) => group.some((rule) => rule.decision === "allow"));
         if (prompted)
             shouldAsk = true;
-        if (action.args.sandbox_permissions !== undefined && !['use_default', 'require_escalated'].includes(String(action.args.sandbox_permissions)))
-            return decision(action, 'deny', 'Invalid sandbox permission request', EMPTY_DELTA, true);
+        if (action.args.sandbox_permissions !== undefined &&
+            !["use_default", "require_escalated"].includes(String(action.args.sandbox_permissions)))
+            return decision(action, "deny", "Invalid sandbox permission request", EMPTY_DELTA, true);
         const explicit = action.args.additional_permissions;
         if (explicit !== undefined) {
-            if (!explicit || typeof explicit !== 'object' || Array.isArray(explicit) || Object.keys(explicit).some(key => !['readPaths', 'writePaths', 'domains'].includes(key)))
-                return decision(action, 'deny', 'Invalid additional permissions', EMPTY_DELTA, true);
-            for (const key of ['readPaths', 'writePaths', 'domains']) {
+            if (!explicit ||
+                typeof explicit !== "object" ||
+                Array.isArray(explicit) ||
+                Object.keys(explicit).some((key) => !["readPaths", "writePaths", "domains"].includes(key)))
+                return decision(action, "deny", "Invalid additional permissions", EMPTY_DELTA, true);
+            for (const key of ["readPaths", "writePaths", "domains"]) {
                 const values = explicit[key] ?? [];
-                if (!Array.isArray(values) || values.some(value => typeof value !== 'string' || !value || value.includes('\0')))
-                    return decision(action, 'deny', 'Invalid permission list', EMPTY_DELTA, true);
+                if (!Array.isArray(values) ||
+                    values.some((value) => typeof value !== "string" ||
+                        !value ||
+                        value.includes("\0")))
+                    return decision(action, "deny", "Invalid permission list", EMPTY_DELTA, true);
                 delta[key].push(...values);
             }
             shouldAsk = true;
         }
         for (const item of analysis.commands) {
-            const executable = basename(item.argv[0]);
-            const isSafeRead = ['pwd', 'echo', 'printf', 'ls', 'cat', 'head', 'tail', 'wc', 'rg', 'grep', 'find', 'stat', 'true', 'false'].includes(executable);
-            if (!isSafeRead && !['touch', 'mkdir', 'rmdir', 'rm', 'truncate', 'tee', 'chmod', 'chown', 'cp', 'mv', 'git', 'curl', 'wget'].includes(executable))
+            const executable = basename(item.argv[0] ?? "");
+            const isSafeRead = [
+                "pwd",
+                "echo",
+                "printf",
+                "ls",
+                "cat",
+                "head",
+                "tail",
+                "wc",
+                "rg",
+                "grep",
+                "find",
+                "stat",
+                "true",
+                "false",
+            ].includes(executable);
+            if (!isSafeRead &&
+                ![
+                    "touch",
+                    "mkdir",
+                    "rmdir",
+                    "rm",
+                    "truncate",
+                    "tee",
+                    "chmod",
+                    "chown",
+                    "cp",
+                    "mv",
+                    "git",
+                    "curl",
+                    "wget",
+                ].includes(executable))
                 shouldAsk = true;
-            const operands = item.argv.slice(1).filter(arg => !arg.startsWith('-'));
+            const operands = item.argv
+                .slice(1)
+                .filter((arg) => !arg.startsWith("-"));
             const reads = [...item.reads], writes = [...item.writes];
             if (analysis.isSupported) {
-                if (isSafeRead && !['echo', 'printf', 'true', 'false', 'pwd'].includes(executable))
+                if (isSafeRead &&
+                    !["echo", "printf", "true", "false", "pwd"].includes(executable))
                     reads.push(...operands);
-                if (['touch', 'mkdir', 'rmdir', 'rm', 'truncate', 'tee', 'chmod', 'chown'].includes(executable))
+                if ([
+                    "touch",
+                    "mkdir",
+                    "rmdir",
+                    "rm",
+                    "truncate",
+                    "tee",
+                    "chmod",
+                    "chown",
+                ].includes(executable))
                     writes.push(...operands);
-                if (['cp', 'mv'].includes(executable)) {
+                if (["cp", "mv"].includes(executable)) {
                     reads.push(...operands.slice(0, -1));
                     writes.push(...operands.slice(-1));
-                    if (executable === 'mv')
+                    if (executable === "mv")
                         writes.push(...operands.slice(0, -1));
                 }
-                if (executable === 'git' && !['status', 'diff', 'log', 'show', 'ls-files', 'rev-parse'].includes(item.argv[1] ?? ''))
-                    writes.push(...(profile.readOnlyPaths ?? []).filter(path => path === join(action.cwd, '.git') || path.includes('/.git/')));
+                if (executable === "git" &&
+                    ![
+                        "status",
+                        "diff",
+                        "log",
+                        "show",
+                        "ls-files",
+                        "rev-parse",
+                    ].includes(item.argv[1] ?? ""))
+                    writes.push(...(profile.readOnlyPaths ?? []).filter((path) => path === join(action.cwd, ".git") ||
+                        path.includes("/.git/")));
             }
             for (const path of writes) {
                 const target = await canonicalPath(path, action.cwd);
-                if ([...profile.denyRead, ...profile.denyWrite].some(root => isWithin(target, root)))
-                    return decision(action, 'deny', 'Command writes a protected path', EMPTY_DELTA, true);
-                if (!profile.writeRoots.some(root => isWithin(target, root)) || (profile.readOnlyPaths ?? []).some(root => isWithin(target, root))) {
+                if ([...profile.denyRead, ...profile.denyWrite].some((root) => isWithin(target, root)))
+                    return decision(action, "deny", "Command writes a protected path", EMPTY_DELTA, true);
+                if (!profile.writeRoots.some((root) => isWithin(target, root)) ||
+                    (profile.readOnlyPaths ?? []).some((root) => isWithin(target, root))) {
                     shouldAsk = true;
                     delta.writePaths.push(target);
                 }
             }
             for (const path of reads) {
                 const target = await canonicalPath(path, action.cwd);
-                if (profile.denyRead.some(root => isWithin(target, root)))
-                    return decision(action, 'deny', 'Command reads a protected path', EMPTY_DELTA, true);
-                if (!profile.readRoots.some(root => isWithin(target, root))) {
+                if (profile.denyRead.some((root) => isWithin(target, root)))
+                    return decision(action, "deny", "Command reads a protected path", EMPTY_DELTA, true);
+                if (!profile.readRoots.some((root) => isWithin(target, root))) {
                     shouldAsk = true;
                     delta.readPaths.push(target);
                 }
             }
-            if (analysis.isSupported && ['curl', 'wget'].includes(executable)) {
-                const urls = item.argv.slice(1).filter(arg => /^https?:\/\//.test(arg));
+            if (analysis.isSupported && ["curl", "wget"].includes(executable)) {
+                const urls = item.argv
+                    .slice(1)
+                    .filter((arg) => /^https?:\/\//.test(arg));
+                // A destination hidden in a config file or a schemeless URL still needs review.
+                const hasIndirectDestination = item.argv
+                    .slice(1)
+                    .some((arg) => executable === "curl"
+                    ? /^(?:--config(?:=|$)|-K)/.test(arg)
+                    : /^(?:--input-file(?:=|$)|-i)/.test(arg));
+                if (!urls.length || hasIndirectDestination)
+                    shouldAsk = true;
                 for (const text of urls) {
                     const domain = normalizeHost(new URL(text).hostname);
-                    if (profile.deniedDomains.some(pattern => matchesDomain(domain, pattern)))
-                        return decision(action, 'deny', 'Network domain denied', EMPTY_DELTA, true);
-                    if (!profile.allowedDomains.some(pattern => matchesDomain(domain, pattern))) {
+                    if (profile.deniedDomains.some((pattern) => matchesDomain(domain, pattern)))
+                        return decision(action, "deny", "Network domain denied", EMPTY_DELTA, true);
+                    if (!profile.allowedDomains.some((pattern) => matchesDomain(domain, pattern))) {
                         delta.domains.push(domain);
                         shouldAsk = true;
                     }
                 }
             }
         }
-        for (const key of ['readPaths', 'writePaths'])
-            delta[key] = [...new Set(await Promise.all(delta[key].map(path => canonicalPath(path, action.cwd))))];
-        if (delta.readPaths.some(path => profile.denyRead.some(root => isWithin(path, root))) || delta.writePaths.some(path => [...profile.denyRead, ...profile.denyWrite].some(root => isWithin(path, root))) || delta.domains.some(host => !isNetworkHost(host) || profile.deniedDomains.some(pattern => matchesDomain(host, pattern))))
-            return decision(action, 'deny', 'Requested permissions target an absolute deny', EMPTY_DELTA, true);
-        const boundDelta = { ...delta, domains: [...new Set(delta.domains.map(normalizeHost))] };
+        for (const key of ["readPaths", "writePaths"])
+            delta[key] = [
+                ...new Set(await Promise.all(delta[key].map((path) => canonicalPath(path, action.cwd)))),
+            ];
+        if (delta.readPaths.some((path) => profile.denyRead.some((root) => isWithin(path, root))) ||
+            delta.writePaths.some((path) => [...profile.denyRead, ...profile.denyWrite].some((root) => isWithin(path, root))) ||
+            delta.domains.some((host) => !isNetworkHost(host) ||
+                profile.deniedDomains.some((pattern) => matchesDomain(host, pattern))))
+            return decision(action, "deny", "Requested permissions target an absolute deny", EMPTY_DELTA, true);
+        const boundDelta = {
+            ...delta,
+            domains: [...new Set(delta.domains.map(normalizeHost))],
+        };
         if (isRuleAllowed)
-            return immutable({ ...decision(action, 'allow', 'Trusted prefix rule authorizes this command', boundDelta), authority: { kind: 'command-rule', actionDigest: action.digest, ruleDigest: digest(matches) } });
-        const isFullRequest = action.args.sandbox_permissions === 'require_escalated' && explicit === undefined;
-        shouldAsk ||= action.args.sandbox_permissions === 'require_escalated';
-        const reason = prompted?.justification ?? (shouldAsk ? 'Command requires approval review' : 'Within the ordinary approval scope');
-        return immutable({ ...decision(action, shouldAsk ? 'ask' : 'allow', reason, boundDelta), approvalCategory: prompted ? 'rules' : 'sandbox', ...(isFullRequest ? { authority: { kind: 'reviewed-command', actionDigest: action.digest } } : {}) });
+            return immutable({
+                ...decision(action, "allow", "Trusted prefix rule authorizes this command", boundDelta),
+                authority: {
+                    kind: "command-rule",
+                    actionDigest: action.digest,
+                    ruleDigest: digest(matches),
+                },
+            });
+        const isFullRequest = action.args.sandbox_permissions === "require_escalated" &&
+            explicit === undefined;
+        shouldAsk ||= action.args.sandbox_permissions === "require_escalated";
+        const reason = prompted?.justification ??
+            (shouldAsk
+                ? "Command requires approval review"
+                : "Within the ordinary approval scope");
+        return immutable({
+            ...decision(action, shouldAsk ? "ask" : "allow", reason, boundDelta),
+            approvalCategory: prompted ? "rules" : "sandbox",
+            ...(isFullRequest
+                ? {
+                    authority: {
+                        kind: "reviewed-command",
+                        actionDigest: action.digest,
+                    },
+                }
+                : {}),
+        });
     }
     async resolvedProfile(cwd) {
         const result = { ...this.profile };
-        for (const key of ['readRoots', 'writeRoots', 'denyRead', 'denyWrite'])
-            result[key] = await Promise.all(this.profile[key].map(path => canonicalPath(path, cwd)));
+        for (const key of [
+            "readRoots",
+            "writeRoots",
+            "denyRead",
+            "denyWrite",
+        ])
+            result[key] = await Promise.all(this.profile[key].map((path) => canonicalPath(path, cwd)));
         if (this.profile.readOnlyPaths)
-            result.readOnlyPaths = await Promise.all(this.profile.readOnlyPaths.map(path => canonicalPath(path, cwd)));
+            result.readOnlyPaths = await Promise.all(this.profile.readOnlyPaths.map((path) => canonicalPath(path, cwd)));
         return result;
     }
 }