pi-codex-auto-review 0.1.3 → 0.2.0

package/dist/policy/rules.d.ts

@@ -1,35 +1,8 @@
-export interface PrefixRule {
-    readonly pattern: readonly (string | readonly string[])[];
-    readonly decision: 'allow' | 'prompt' | 'forbidden';
-    readonly justification?: string;
-}
+import type { CompiledRules, PrefixRule, RuleSource } from "./rule-types.js";
+export type { CompiledRules, PrefixRule, RuleMatch, RuleSource, } from "./rule-types.js";
+export { CODEX_EXECPOLICY_REVISION } from "./rule-types.js";
 export declare function matchesRule(argv: readonly string[], rule: PrefixRule): boolean;
-export declare const CODEX_EXECPOLICY_REVISION = "a956835d020762cb2b570053af06f643a11c0ecc";
-export interface RuleSource {
-    readonly name: string;
-    readonly source: string;
-}
-export interface RuleMatch {
-    readonly decision: PrefixRule['decision'];
-    readonly justification?: string | null;
-    readonly matchedPrefix: readonly string[];
-    readonly resolvedProgram?: string | null;
-}
-export interface CompiledRules {
-    readonly revision: string;
-    readonly rules: readonly PrefixRule[];
-    readonly matches: readonly (readonly RuleMatch[])[];
-    readonly allowedDomains: readonly string[];
-    readonly deniedDomains: readonly string[];
-    readonly networkRules: readonly {
-        host: string;
-        protocol: string;
-        decision: PrefixRule['decision'];
-        justification?: string | null;
-    }[];
-    readonly hostExecutables: Readonly<Record<string, readonly string[]>>;
-}
-/** Compatibility reader; parsing and example validation run in Codex's actual Starlark engine. */
+/** Preserve the synchronous API and its deadline without running rules on the host event loop. */
 export declare function parseRules(source: string): readonly PrefixRule[];
 export declare function evaluateRules(sources: readonly RuleSource[], commands?: readonly (readonly string[])[], signal?: AbortSignal): Promise<CompiledRules>;
 /** Advanced scripts are matched as the real outer shell invocation, never as a safe inner prefix. */

package/dist/policy/rules.js

@@ -1,59 +1,147 @@
-import { basename } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { execFile, spawnSync } from 'node:child_process';
-import { promisify } from 'node:util';
-import { GuardError, immutable } from '../contracts.js';
-import { analyzeShell } from './shell.js';
+import { spawnSync } from "node:child_process";
+import { basename } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+import { GuardError, immutable } from "../contracts.js";
+import { evaluateRuleSources } from "./rule-engine.js";
+import { analyzeShell } from "./shell.js";
+export { CODEX_EXECPOLICY_REVISION } from "./rule-types.js";
 export function matchesRule(argv, rule) {
-    return rule.pattern.length <= argv.length && rule.pattern.every((part, index) => typeof part === 'string' ? part === argv[index] : part.includes(argv[index]));
+    return (rule.pattern.length <= argv.length &&
+        rule.pattern.every((part, index) => {
+            const argument = argv[index];
+            return typeof part === "string"
+                ? part === argument
+                : argument !== undefined && part.includes(argument);
+        }));
 }
-export const CODEX_EXECPOLICY_REVISION = 'a956835d020762cb2b570053af06f643a11c0ecc';
 const MAX_BYTES = 8 * 1024 * 1024;
-const helper = fileURLToPath(new URL(`../native/${process.platform}-${process.arch}/pi-guard-execpolicy${process.platform === 'win32' ? '.exe' : ''}`, import.meta.url));
-const helperEnvironment = process.platform === 'win32' ? { SystemRoot: process.env.SystemRoot } : {};
-const execute = promisify(execFile);
+function isScalarString(value) {
+    if (typeof value !== "string")
+        return false;
+    for (const char of value) {
+        const point = char.codePointAt(0) ?? 0;
+        if (point >= 0xd800 && point <= 0xdfff)
+            return false;
+    }
+    return true;
+}
 function request(sources, commands) {
     const input = JSON.stringify({ sources, commands });
     if (Buffer.byteLength(input) > MAX_BYTES)
-        throw new GuardError('INVALID_RULES', 'Rule request exceeds the supported size');
+        throw new GuardError("INVALID_RULES", "Rule request exceeds the supported size");
+    const data = JSON.parse(input);
+    if (!Array.isArray(data.sources) ||
+        !Array.isArray(data.commands) ||
+        data.sources.some((source) => source === null ||
+            typeof source !== "object" ||
+            !isScalarString(source.name) ||
+            !isScalarString(source.source) ||
+            Object.keys(source).some((key) => key !== "name" && key !== "source")) ||
+        data.commands.some((command) => !Array.isArray(command) ||
+            command.some((argument) => !isScalarString(argument)))) {
+        throw new GuardError("INVALID_RULES", "Invalid rule request schema");
+    }
     return input;
 }
-function decode(stdout) {
-    const result = JSON.parse(stdout);
-    if (result.revision !== CODEX_EXECPOLICY_REVISION || !Array.isArray(result.rules) || !Array.isArray(result.matches) || !Array.isArray(result.allowedDomains) || !Array.isArray(result.deniedDomains))
-        throw new GuardError('INVALID_RULES', 'Unexpected Codex rule engine response');
-    return immutable(result);
-}
-/** Compatibility reader; parsing and example validation run in Codex's actual Starlark engine. */
+/** Preserve the synchronous API and its deadline without running rules on the host event loop. */
 export function parseRules(source) {
-    const result = spawnSync(helper, [], { input: request([{ name: 'inline.rules', source }], []), encoding: 'utf8', timeout: 10000, killSignal: 'SIGKILL', maxBuffer: MAX_BYTES, env: helperEnvironment });
-    if (result.error || result.status !== 0)
-        throw new GuardError('INVALID_RULES', `Codex rule engine failed: ${result.stderr?.slice(0, 4000) || result.error?.message || result.signal}`, { cause: result.error });
-    return decode(result.stdout).rules;
+    const sources = [{ name: "inline.rules", source }];
+    const input = request(sources, []);
+    try {
+        const result = spawnSync(process.execPath, [
+            "--max-old-space-size=64",
+            fileURLToPath(new URL("./rules-sync.js", import.meta.url)),
+        ], {
+            input,
+            encoding: "utf8",
+            timeout: 10000,
+            killSignal: "SIGKILL",
+            maxBuffer: MAX_BYTES,
+            env: process.platform === "win32"
+                ? { SystemRoot: process.env.SystemRoot }
+                : {},
+        });
+        if (result.error || result.status !== 0)
+            throw (result.error ??
+                new Error(result.stderr.slice(0, 4000) ||
+                    "Rule process exited without a result"));
+        return immutable(JSON.parse(result.stdout).rules);
+    }
+    catch (error) {
+        throw new GuardError("INVALID_RULES", `Codex-compatible rule engine failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
 }
 export async function evaluateRules(sources, commands = [], signal) {
-    const input = request(sources, commands);
+    const data = JSON.parse(request(sources, commands));
     try {
-        const running = execute(helper, [], { encoding: 'utf8', timeout: 10000, killSignal: 'SIGKILL', maxBuffer: MAX_BYTES, env: helperEnvironment, signal });
-        running.child.stdin?.end(input);
-        // A failed spawn can close stdin before its queued input has been delivered.
-        running.child.stdin?.on('error', () => { });
-        return decode((await running).stdout);
+        signal?.throwIfAborted();
+        if (!data.sources.length)
+            return immutable(evaluateRuleSources([], data.commands));
+        const result = await new Promise((resolve, reject) => {
+            const worker = new Worker(new URL("./rules-worker.js", import.meta.url), {
+                workerData: data,
+                execArgv: [],
+                env: process.platform === "win32"
+                    ? { SystemRoot: process.env.SystemRoot }
+                    : {},
+                resourceLimits: {
+                    maxOldGenerationSizeMb: 64,
+                    stackSizeMb: 4,
+                },
+            });
+            let isSettled = false;
+            const finish = (error, value) => {
+                if (isSettled)
+                    return;
+                isSettled = true;
+                clearTimeout(timer);
+                signal?.removeEventListener("abort", abort);
+                worker.removeAllListeners();
+                void worker.terminate();
+                if (error)
+                    reject(error);
+                else if (value)
+                    resolve(value);
+                else
+                    reject(new Error("Rule worker produced no result"));
+            };
+            const abort = () => finish(new Error("Rule evaluation cancelled", {
+                cause: signal?.reason,
+            }));
+            const timer = setTimeout(() => finish(new Error("Rule evaluation timed out")), 10000);
+            worker.once("message", (message) => finish(message.error ? new Error(message.error) : undefined, message.result));
+            worker.once("error", (error) => finish(error));
+            worker.once("exit", (code) => finish(new Error(`Rule worker exited without a result (${code})`)));
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted)
+                abort();
+        });
+        return immutable(result);
     }
     catch (error) {
-        throw new GuardError('INVALID_RULES', 'Codex rule engine could not evaluate the trusted rules', { cause: error });
+        throw new GuardError("INVALID_RULES", "Codex-compatible rule engine could not evaluate the trusted rules", { cause: error });
     }
 }
 /** Advanced scripts are matched as the real outer shell invocation, never as a safe inner prefix. */
-export function ruleCommands(command, shellPath = '/bin/bash', depth = 0) {
+export function ruleCommands(command, shellPath = "/bin/bash", depth = 0) {
     const parsed = analyzeShell(command);
-    if (!parsed.isSupported || parsed.commands.some(item => item.reads.length || item.writes.length) || depth > 4)
-        return [[shellPath, '-c', command]];
-    return parsed.commands.flatMap(item => {
-        if (['bash', 'sh', 'zsh', 'dash'].includes(basename(item.argv[0])) && item.argv.length === 3 && ['-c', '-lc'].includes(item.argv[1])) {
-            const inner = analyzeShell(item.argv[2]);
-            if (inner.isSupported && inner.commands.every(part => !part.reads.length && !part.writes.length))
-                return ruleCommands(item.argv[2], item.argv[0], depth + 1);
+    if (!parsed.isSupported ||
+        parsed.commands.some((item) => item.reads.length || item.writes.length) ||
+        depth > 4)
+        return [[shellPath, "-c", command]];
+    return parsed.commands.flatMap((item) => {
+        const [program, flag, script] = item.argv;
+        if (program !== undefined &&
+            ["bash", "sh", "zsh", "dash"].includes(basename(program)) &&
+            item.argv.length === 3 &&
+            flag !== undefined &&
+            ["-c", "-lc"].includes(flag) &&
+            script !== undefined) {
+            const inner = analyzeShell(script);
+            if (inner.isSupported &&
+                inner.commands.every((part) => !part.reads.length && !part.writes.length))
+                return ruleCommands(script, program, depth + 1);
         }
         return [item.argv];
     });

package/dist/policy/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/policy/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO1C,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,IAAgB;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;AAClK,CAAC;AACD,MAAM,CAAC,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAYpF,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,uBAAuB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACzK,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACpC,SAAS,OAAO,CAAC,OAA8B,EAAE,QAAwC;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAE,QAAQ,EAAC,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;IAC3H,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;IACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,yBAAyB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACrR,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AACD,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAC,CAAC,CAAC;IACpM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,6BAA6B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,EAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAC,CAAC,CAAC;IAC9M,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA8B,EAAE,WAA2C,EAAE,EAAE,MAAoB;IACrI,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAC,CAAC,CAAC;QACrJ,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,6EAA6E;QAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wDAAwD,EAAE,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,CAAC;IAAC,CAAC;AACtI,CAAC;AACD,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,SAAS,GAAG,WAAW,EAAE,KAAK,GAAG,CAAC;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnJ,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACpC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACvI,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/policy/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,MAAM,UAAU,WAAW,CACvB,IAAuB,EACvB,IAAgB;IAEhB,OAAO,CACH,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,OAAO,IAAI,KAAK,QAAQ;gBAC3B,CAAC,CAAC,IAAI,KAAK,QAAQ;gBACnB,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC,CAAC,CACL,CAAC;AACN,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClC,SAAS,cAAc,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,OAAO,CACZ,OAA8B,EAC9B,QAAwC;IAExC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS;QACpC,MAAM,IAAI,UAAU,CAChB,eAAe,EACf,yCAAyC,CAC5C,CAAC;IACN,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4C,CAAC;IAC1E,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CACb,CAAC,MAAM,EAAE,EAAE,CACP,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;YAC5B,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,CAC9C,CACR;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAC5D,EACH,CAAC;QACC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,MAAc;IACrC,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CACpB,OAAO,CAAC,QAAQ,EAChB;YACI,yBAAyB;YACzB,aAAa,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7D,EACD;YACI,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,SAAS;YACpB,GAAG,EACC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBACxB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE;gBACxC,CAAC,CAAC,EAAE;SACf,CACJ,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YACnC,MAAM,CACF,MAAM,CAAC,KAAK;gBACZ,IAAI,KAAK,CACL,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;oBACxB,sCAAsC,CAC7C,CACJ,CAAC;QACN,OAAO,SAAS,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAmB,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAChB,eAAe,EACf,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAChG,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,OAA8B,EAC9B,WAA2C,EAAE,EAC7C,MAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAGjD,CAAC;IACF,IAAI,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YACpB,OAAO,SAAS,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,MAAM,GAAG,IAAI,MAAM,CACrB,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAC7C;gBACI,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,EAAE;gBACZ,GAAG,EACC,OAAO,CAAC,QAAQ,KAAK,OAAO;oBACxB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE;oBACxC,CAAC,CAAC,EAAE;gBACZ,cAAc,EAAE;oBACZ,sBAAsB,EAAE,EAAE;oBAC1B,WAAW,EAAE,CAAC;iBACjB;aACJ,CACJ,CAAC;YACF,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAqB,EAAE,EAAE;gBACpD,IAAI,SAAS;oBAAE,OAAO;gBACtB,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC5C,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxB,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;qBACpB,IAAI,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;;oBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,GAAG,EAAE,CACf,MAAM,CACF,IAAI,KAAK,CAAC,2BAA2B,EAAE;gBACnC,KAAK,EAAE,MAAM,EAAE,MAAM;aACxB,CAAC,CACL,CAAC;YACN,MAAM,KAAK,GAAG,UAAU,CACpB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,EACpD,KAAK,CACR,CAAC;YACF,MAAM,CAAC,IAAI,CACP,SAAS,EACT,CAAC,OAAmD,EAAE,EAAE,CACpD,MAAM,CACF,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EACpD,OAAO,CAAC,MAAM,CACjB,CACR,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,MAAM,CACF,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAC7D,CACJ,CAAC;YACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,OAAO;gBAAE,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAChB,eAAe,EACf,mEAAmE,EACnE,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;AACL,CAAC;AACD,qGAAqG;AACrG,MAAM,UAAU,YAAY,CACxB,OAAe,EACf,SAAS,GAAG,WAAW,EACvB,KAAK,GAAG,CAAC;IAET,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IACI,CAAC,MAAM,CAAC,WAAW;QACnB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAChB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CACpD;QACD,KAAK,GAAG,CAAC;QAET,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1C,IACI,OAAO,KAAK,SAAS;YACrB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACtB,IAAI,KAAK,SAAS;YAClB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5B,MAAM,KAAK,SAAS,EACtB,CAAC;YACC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACnC,IACI,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAChB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CACtD;gBAED,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/policy/shell.js

@@ -1,52 +1,61 @@
-import { GuardError } from '../contracts.js';
+import { GuardError } from "../contracts.js";
 /** A bounded literal grammar. Expansion/interpreters cannot borrow permission from their first word. */
 export function analyzeShell(command) {
-    if (typeof command !== 'string' || !command.trim() || command.includes('\0'))
-        throw new GuardError('INVALID_COMMAND', 'Invalid shell command');
+    if (typeof command !== "string" ||
+        !command.trim() ||
+        command.includes("\0"))
+        throw new GuardError("INVALID_COMMAND", "Invalid shell command");
     if (command.length > 100_000)
-        return { commands: [], isSupported: false, reason: 'Command too long for literal analysis' };
+        return {
+            commands: [],
+            isSupported: false,
+            reason: "Command too long for literal analysis",
+        };
     const commands = [];
-    let argv = [], writes = [], reads = [], word = '', hasWord = false, quote = '', redirect = '';
+    let argv = [], writes = [], reads = [], word = "", hasWord = false, quote = "", redirect = "";
     let isSupported = true, reason;
-    const unsupported = (text) => { isSupported = false; reason ??= text; };
+    const unsupported = (text) => {
+        isSupported = false;
+        reason ??= text;
+    };
     const finishWord = () => {
         if (!hasWord)
             return;
-        if (redirect === '>')
+        if (redirect === ">")
             writes.push(word);
-        else if (redirect === '<')
+        else if (redirect === "<")
             reads.push(word);
         else
             argv.push(word);
-        word = '';
+        word = "";
         hasWord = false;
-        redirect = '';
+        redirect = "";
     };
     const finishCommand = () => {
         finishWord();
         if (redirect)
-            unsupported('Missing redirection target');
+            unsupported("Missing redirection target");
         if (argv.length)
             commands.push({ argv, writes, reads });
         else if (writes.length || reads.length)
-            unsupported('Redirection without literal command');
+            unsupported("Redirection without literal command");
         argv = [];
         writes = [];
         reads = [];
-        redirect = '';
+        redirect = "";
     };
     for (let i = 0; i < command.length; i++) {
-        const ch = command[i];
+        const ch = command.charAt(i);
         if (quote === "'") {
             if (ch === "'")
-                quote = '';
+                quote = "";
             else
                 word += ch;
             continue;
         }
-        if (ch === '\\' && quote !== "'") {
+        if (ch === "\\" && quote !== "'") {
             if (i + 1 >= command.length)
-                unsupported('Trailing escape');
+                unsupported("Trailing escape");
             else {
                 word += command[++i];
                 hasWord = true;
@@ -54,7 +63,7 @@ export function analyzeShell(command) {
             continue;
         }
         if (ch === '"') {
-            quote = quote === '"' ? '' : '"';
+            quote = quote === '"' ? "" : '"';
             hasWord = true;
             continue;
         }
@@ -63,60 +72,80 @@ export function analyzeShell(command) {
             hasWord = true;
             continue;
         }
-        if (ch === '$' || ch === '`')
-            unsupported('Shell expansion requires review');
+        if (ch === "$" || ch === "`")
+            unsupported("Shell expansion requires review");
         if (quote) {
             word += ch;
             continue;
         }
-        if ('(){}*?~'.includes(ch))
-            unsupported('Non-literal shell syntax requires review');
-        if (ch === '#' && !hasWord) {
-            unsupported('Comments require review');
+        if ("(){}*?~".includes(ch))
+            unsupported("Non-literal shell syntax requires review");
+        if (ch === "#" && !hasWord) {
+            unsupported("Comments require review");
             break;
         }
-        if (/\s/.test(ch) && ch !== '\n') {
+        if (/\s/.test(ch) && ch !== "\n") {
             finishWord();
             continue;
         }
-        if (ch === ';' || ch === '|' || ch === '&' || ch === '\n') {
+        if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
             finishCommand();
-            if (command[i + 1] === ch && '|&'.includes(ch))
+            if (command[i + 1] === ch && "|&".includes(ch))
                 i++;
-            else if (ch === '&')
-                unsupported('Background execution requires review');
+            else if (ch === "&")
+                unsupported("Background execution requires review");
             continue;
         }
-        if (ch === '>' || ch === '<') {
+        if (ch === ">" || ch === "<") {
             if (hasWord && /^\d+$/.test(word)) {
-                word = '';
+                word = "";
                 hasWord = false;
             }
             finishWord();
             redirect = ch;
             if (command[i + 1] === ch) {
                 i++;
-                if (ch === '<')
-                    unsupported('Here-documents require review');
+                if (ch === "<")
+                    unsupported("Here-documents require review");
             }
-            if (command[i + 1] === '&')
-                unsupported('Descriptor redirection requires review');
+            if (command[i + 1] === "&")
+                unsupported("Descriptor redirection requires review");
             continue;
         }
         word += ch;
         hasWord = true;
     }
     if (quote)
-        unsupported('Unclosed quote');
+        unsupported("Unclosed quote");
     finishCommand();
     if (!commands.length)
-        unsupported('No literal command');
-    if (commands.some(c => c.argv.some(a => /^\w+=/.test(a))))
-        unsupported('Environment assignments require review');
+        unsupported("No literal command");
+    if (commands.some((c) => c.argv.some((a) => /^\w+=/.test(a))))
+        unsupported("Environment assignments require review");
     return { commands, isSupported, ...(reason ? { reason } : {}) };
 }
 export function matchesPrefix(argv, prefix) {
-    return prefix.length > 0 && prefix.length <= argv.length && prefix.every((arg, i) => argv[i] === arg);
+    return (prefix.length > 0 &&
+        prefix.length <= argv.length &&
+        prefix.every((arg, i) => argv[i] === arg));
 }
-export const INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'fish', 'dash', 'node', 'python', 'python3', 'perl', 'ruby', 'env', 'eval', 'source', 'exec', 'xargs', 'sudo', 'osascript']);
+export const INTERPRETERS = new Set([
+    "bash",
+    "sh",
+    "zsh",
+    "fish",
+    "dash",
+    "node",
+    "python",
+    "python3",
+    "perl",
+    "ruby",
+    "env",
+    "eval",
+    "source",
+    "exec",
+    "xargs",
+    "sudo",
+    "osascript",
+]);
 //# sourceMappingURL=shell.js.map

package/dist/policy/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/policy/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI7C,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAC/I,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC3H,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,IAAI,GAAa,EAAE,EAAE,MAAM,GAAa,EAAE,EAAE,KAAK,GAAa,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,GAAG,KAAK,EAAE,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,CAAC;IAC5H,IAAI,WAAW,GAAG,IAAI,EAAE,MAA0B,CAAC;IACnD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,QAAQ,KAAK,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACnC,IAAI,QAAQ,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,KAAK,CAAC;QAAC,QAAQ,GAAG,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,QAAQ;YAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;aACnD,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;YAAE,WAAW,CAAC,qCAAqC,CAAC,CAAC;QAC3F,IAAI,GAAG,EAAE,CAAC;QAAC,MAAM,GAAG,EAAE,CAAC;QAAC,KAAK,GAAG,EAAE,CAAC;QAAC,QAAQ,GAAG,EAAE,CAAC;IACpD,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAAC,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,EAAE,CAAC;;gBAAM,IAAI,IAAI,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7E,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM;gBAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;iBACvD,CAAC;gBAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/E,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,KAAK,GAAG,GAAG,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACpE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,WAAW,CAAC,iCAAiC,CAAC,CAAC;QAC7E,IAAI,KAAK,EAAE,CAAC;YAAC,IAAI,IAAI,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACpC,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,WAAW,CAAC,0CAA0C,CAAC,CAAC;QACpF,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7D,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC1D,aAAa,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,CAAC,EAAE,CAAC;iBAC/C,IAAI,EAAE,KAAK,GAAG;gBAAE,WAAW,CAAC,sCAAsC,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;YAAC,CAAC;YAClE,UAAU,EAAE,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,EAAE,KAAK,GAAG;oBAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC;YAAC,CAAC;YACjG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,WAAW,CAAC,wCAAwC,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK;QAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACzC,aAAa,EAAE,CAAC;IAChB,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,WAAW,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,WAAW,CAAC,wCAAwC,CAAC,CAAC;IACjH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,MAAyB;IAC9E,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACxG,CAAC;AACD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/policy/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAY7C,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,OAAe;IACxC,IACI,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,OAAO,CAAC,IAAI,EAAE;QACf,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEtB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;QACxB,OAAO;YACH,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,uCAAuC;SAClD,CAAC;IACN,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,IAAI,GAAa,EAAE,EACnB,MAAM,GAAa,EAAE,EACrB,KAAK,GAAa,EAAE,EACpB,IAAI,GAAG,EAAE,EACT,OAAO,GAAG,KAAK,EACf,KAAK,GAAG,EAAE,EACV,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,WAAW,GAAG,IAAI,EAClB,MAA0B,CAAC;IAC/B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,WAAW,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,IAAI,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,EAAE;QACpB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,QAAQ,KAAK,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACnC,IAAI,QAAQ,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,GAAG,EAAE,CAAC;QACV,OAAO,GAAG,KAAK,CAAC;QAChB,QAAQ,GAAG,EAAE,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,EAAE;QACvB,UAAU,EAAE,CAAC;QACb,IAAI,QAAQ;YAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;aACnD,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;YAClC,WAAW,CAAC,qCAAqC,CAAC,CAAC;QACvD,IAAI,GAAG,EAAE,CAAC;QACV,MAAM,GAAG,EAAE,CAAC;QACZ,KAAK,GAAG,EAAE,CAAC;QACX,QAAQ,GAAG,EAAE,CAAC;IAClB,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,EAAE,CAAC;;gBACtB,IAAI,IAAI,EAAE,CAAC;YAChB,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM;gBAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;iBACvD,CAAC;gBACF,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACb,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACjC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,GAAG,GAAG,CAAC;YACZ,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YACxB,WAAW,CAAC,iCAAiC,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,IAAI,EAAE,CAAC;YACX,SAAS;QACb,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,WAAW,CAAC,0CAA0C,CAAC,CAAC;QAC5D,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,WAAW,CAAC,yBAAyB,CAAC,CAAC;YACvC,MAAM;QACV,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,UAAU,EAAE,CAAC;YACb,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxD,aAAa,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,CAAC,EAAE,CAAC;iBAC/C,IAAI,EAAE,KAAK,GAAG;gBACf,WAAW,CAAC,sCAAsC,CAAC,CAAC;YACxD,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3B,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,IAAI,GAAG,EAAE,CAAC;gBACV,OAAO,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,UAAU,EAAE,CAAC;YACb,QAAQ,GAAG,EAAE,CAAC;YACd,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC;gBACJ,IAAI,EAAE,KAAK,GAAG;oBAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBACtB,WAAW,CAAC,wCAAwC,CAAC,CAAC;YAC1D,SAAS;QACb,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;QACX,OAAO,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,KAAK;QAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACzC,aAAa,EAAE,CAAC;IAChB,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,WAAW,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,WAAW,CAAC,wCAAwC,CAAC,CAAC;IAC1D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AACD,MAAM,UAAU,aAAa,CACzB,IAAuB,EACvB,MAAyB;IAEzB,OAAO,CACH,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAC5C,CAAC;AACN,CAAC;AACD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,WAAW;CACd,CAAC,CAAC"}

package/dist/policy/starlark/builtins.d.ts

@@ -0,0 +1,6 @@
+import type { Budget } from "./lexer.js";
+import { type Callable, type Value } from "./values.js";
+export declare function bindArguments(name: string, args: Value[], keywords: Map<string, Value>, spec: (string | [string, Value])[]): Value[];
+export declare function standardGlobals(budget: Budget, mutate: (value: Value) => void): Map<string, Value>;
+export declare function attribute(value: Value, name: string, budget: Budget, mutate: (value: Value) => void): Callable;
+export declare function percentFormat(format: string, value: Value, budget: Budget): string;