prae-cli 0.1.1 → 0.2.0

package/lib/index.js

@@ -1,3 +1,4 @@
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-DGVWMDT0.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-6hDu8-nF.js";
+import "./views-BU0sOciR.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/instructions-ijuj4IP1.js

@@ -0,0 +1,133 @@
+import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-BU0sOciR.js";
+
+//#region src/console/instructions.ts
+const STYLE = `
+.stack { padding: 22px 30px 8px; }
+.layer {
+  display: grid; grid-template-columns: 92px 1fr 120px; gap: 16px;
+  padding: 12px 0; border-bottom: 1px solid var(--line-faint);
+  font-family: var(--proof); font-size: 12px; align-items: baseline;
+}
+.layer .who { letter-spacing: 0.1em; font-size: 11px; }
+.layer .who.operator { color: var(--signal-text); }
+.layer .who.project { color: var(--muted); }
+.layer .file { color: var(--ink-row); overflow-wrap: anywhere; }
+.layer .count { color: var(--muted); text-align: right; }
+
+.proposal {
+  padding: 20px 30px; border-bottom: 1px solid var(--line);
+  display: grid; grid-template-columns: 1fr 200px; gap: 24px;
+}
+.proposal h3 {
+  font-size: 16px; font-weight: 600; letter-spacing: -0.01em; margin: 0 0 10px;
+}
+.quote {
+  border-left: 2px solid var(--line-strong); padding: 6px 0 6px 14px;
+  font-family: var(--proof); font-size: 12px; color: var(--ink-row);
+  line-height: 1.7; margin: 0 0 10px;
+}
+.quote .where {
+  display: block; color: var(--muted); font-size: 11px; margin-top: 6px;
+}
+.reading { font-size: 13px; color: var(--secondary); margin: 0 0 10px; }
+.matcher {
+  font-family: var(--proof); font-size: 11.5px; color: var(--dim);
+  background: var(--sunk); padding: 8px 10px; border-radius: 2px;
+  overflow-wrap: anywhere;
+}
+.verdict-col { text-align: right; }
+.verdict-col .kind {
+  font-family: var(--proof); font-size: 20px; letter-spacing: 0.08em;
+  font-weight: 600;
+}
+.verdict-col .conf {
+  font-family: var(--proof); font-size: 10px; letter-spacing: 0.12em;
+  color: var(--muted); margin-top: 6px;
+}
+.context-only { padding: 22px 30px 30px; }
+.context-only ul {
+  margin: 10px 0 0; padding-left: 18px; font-size: 13px; line-height: 1.9;
+  color: var(--secondary); columns: 2; column-gap: 40px;
+}
+@media (max-width: 860px) {
+  .proposal { grid-template-columns: 1fr; }
+  .verdict-col { text-align: left; }
+  .context-only ul { columns: 1; }
+}
+@media print { .context-only ul { columns: 1; } }
+`;
+function renderInstructions(data, read, found) {
+	const layers = read.files.map((file) => `      <div class="layer">
+        <div class="who ${esc(file.layer)}">${esc(file.layer.toUpperCase())}</div>
+        <div class="file">${esc(file.path)}</div>
+        <div class="count">${file.sections.reduce((n, s) => n + s.statements.length, 0)} statements</div>
+      </div>`).join("\n");
+	const proposals = found.proposals.map((proposal) => `    <section class="proposal">
+      <div>
+        <h3>${esc(proposal.rule.id)} · ${esc(proposal.rule.title ?? "")}</h3>
+        <blockquote class="quote">${esc(proposal.from.text)}
+          <span class="where">${esc(proposal.from.path)}:${proposal.from.line} · ${esc(proposal.from.layer)}</span>
+        </blockquote>
+        <p class="reading">Read as: ${esc(proposal.why)}.</p>
+        <div class="matcher">${esc(JSON.stringify(proposal.rule.when))}</div>
+      </div>
+      <div class="verdict-col">
+        <div class="kind e-${esc(proposal.rule.effect.kind)}">${esc(proposal.rule.effect.kind.toUpperCase())}</div>
+        <div class="conf">${esc(proposal.confidence.toUpperCase())} CONFIDENCE</div>
+      </div>
+    </section>`).join("\n");
+	const body = `<style>${STYLE}</style>
+    <section class="stats">
+      <div class="stat"><div class="v">${read.files.length}</div><div class="k">FILES</div></div>
+      <div class="stat"><div class="v">${read.statements.length}</div><div class="k">STATEMENTS</div></div>
+      <div class="stat"><div class="v hold">${found.proposals.length}</div><div class="k">PROPOSED</div></div>
+      <div class="stat"><div class="v">${found.skipped.length}</div><div class="k">CONTEXT ONLY</div></div>
+    </section>
+
+    <section class="sect">
+      <h2>Precedence</h2>
+      <p>Least specific first. An operator file is named by the profile and
+      applies to every repository the agent is pointed at; a project file was
+      found by walking up from the work and applies only to the checkout that
+      shipped it.</p>
+    </section>
+    <div class="stack">
+${layers}
+    </div>
+
+    <section class="sect">
+      <h2>Proposed</h2>
+      <p>Nothing here is in force. Each rule is a <em>reading</em> of the
+      sentence beside it, and the only thing that turns a reading into policy
+      is a person putting it in a pack. Read every one against its sentence
+      before it enforces anything.</p>
+    </section>
+${found.proposals.length === 0 ? "    <div class=\"empty\">Nothing was proposed. On most real instruction files that is the expected result, not a failure.</div>" : proposals}
+
+    <section class="context-only">
+      <div class="k" style="font-family:var(--proof);font-size:10px;letter-spacing:0.14em;color:var(--muted)">
+        ${found.skipped.length} STATEMENTS PROPOSED NOTHING AND REMAIN CONTEXT
+      </div>
+      <p style="font-size:13px;color:var(--secondary);max-width:76ch;margin:10px 0 0">
+        Most engineering guidance is about code that gets written, not calls an
+        agent makes. These are served to the agent and sealed into the ledger;
+        they are not enforced, and pretending otherwise would be inventing
+        policy nobody wrote.
+      </p>
+      <ul>
+${found.skipped.slice(0, 40).map((statement) => `        <li>${esc(statement.text)}</li>`).join("\n")}
+      </ul>
+    </section>`;
+	return renderShell({
+		title: "Instructions",
+		nav: renderNav(navFor(data), "Instructions"),
+		head: `    <header class="head">
+      <div><h1>Instructions</h1><div class="meta">${esc(read.hash.slice(0, 16))} · ${read.files.length} files · ${found.proposals.length} proposed, unreviewed</div></div>
+      <div class="actions"><button type="button" class="btn" onclick="window.print()">Export evidence</button></div>
+    </header>`,
+		body
+	});
+}
+
+//#endregion
+export { renderInstructions };

package/lib/playground.js

@@ -1,6 +1,143 @@
 (function() {
 
 
+//#region ../kernel/src/command.ts
+/** Wrappers whose first operand is the program actually being run. */
+	const WRAPPERS = new Set([
+		"sudo",
+		"command",
+		"env",
+		"nohup",
+		"time",
+		"xargs"
+	]);
+	/** Wrapper options that consume the next token, so it is not the program. */
+	const OPTION_WITH_VALUE = new Set([
+		"-u",
+		"-g",
+		"-p",
+		"-h",
+		"-C",
+		"-r",
+		"-t",
+		"-U",
+		"-I",
+		"-n",
+		"-P",
+		"-L",
+		"-s"
+	]);
+	const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+	/**
+	* Split a line into pipeline segments of words, one scan, quote-aware.
+	*
+	* Splitting on `|` before parsing quotes is the classic mistake — it turns
+	* `echo "a | b"` into two segments — so quoting and separators are read
+	* together.
+	*/
+	function scan(command) {
+		const parts = [];
+		let tokens = [];
+		let current = "";
+		let quote;
+		const endToken = () => {
+			if (current !== "") tokens.push(current);
+			current = "";
+		};
+		const endSegment = () => {
+			endToken();
+			if (tokens.length > 0) parts.push(tokens);
+			tokens = [];
+		};
+		for (let at = 0; at < command.length; at += 1) {
+			const ch = command[at];
+			if (quote !== void 0) {
+				if (ch === quote) quote = void 0;
+				else current += ch;
+				continue;
+			}
+			if (ch === "'" || ch === "\"") {
+				quote = ch;
+				continue;
+			}
+			if (ch === ";") {
+				endSegment();
+				continue;
+			}
+			if (ch === "|" || ch === "&") {
+				endSegment();
+				if (command[at + 1] === ch) at += 1;
+				continue;
+			}
+			if (/\s/.test(ch)) {
+				endToken();
+				continue;
+			}
+			current += ch;
+		}
+		endSegment();
+		return parts;
+	}
+	/** Decompose a command line into pipeline segments. */
+	function segments(command) {
+		const found = [];
+		for (const tokens of scan(command)) {
+			let at = 0;
+			while (at < tokens.length) {
+				const token = tokens[at];
+				if (ASSIGNMENT.test(token)) {
+					at += 1;
+					continue;
+				}
+				if (WRAPPERS.has(token)) {
+					at += 1;
+					while (at < tokens.length) {
+						const option = tokens[at];
+						if (!option.startsWith("-")) break;
+						at += OPTION_WITH_VALUE.has(option) ? 2 : 1;
+					}
+					continue;
+				}
+				break;
+			}
+			const name = tokens[at];
+			if (name === void 0) continue;
+			found.push({
+				name: (name.split("/").pop() ?? name).toLowerCase(),
+				tokens: tokens.slice(at + 1)
+			});
+		}
+		return found;
+	}
+	/** `git*` matches `git`, `github`; bare strings match exactly. */
+	function matches$1(pattern, value) {
+		if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
+		return value === pattern;
+	}
+	const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
+	/**
+	* Judge one command line against one matcher. Every present field must hold.
+	*/
+	function commandMatches(match, command) {
+		const parts = segments(command);
+		if (parts.length === 0) return false;
+		const names = list(match.name);
+		const args = list(match.token);
+		const pipes = list(match.pipedTo);
+		if (names.length > 0) {
+			const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name)));
+			if (hit.length === 0) return false;
+			if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+		} else if (args.length > 0) {
+			if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+		}
+		if (pipes.length > 0) {
+			if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
+		}
+		return true;
+	}
+
+//#endregion
 //#region ../kernel/src/path.ts
 /**
 	* Path normalization and glob containment, with no filesystem access.
@@ -92,6 +229,8 @@
 	function within(path, glob) {
 		const target = normalize(path);
 		if (target.escaped) return false;
+		const trimmed = glob.trim();
+		if (!(trimmed === "**" || trimmed.startsWith("**/")) && target.absolute !== trimmed.startsWith("/")) return false;
 		const pattern = normalize(glob);
 		if (matchSegments(target.segments, pattern.segments)) return true;
 		return matchSegments(target.segments, [...pattern.segments, "**"]);
@@ -123,8 +262,8 @@
 	* an operator writing the suffix form means the organisation, not a rule that
 	* covers every subdomain except the one they first thought of.
 	*/
-	function hostIn(host, list) {
-		return list.some((entry) => {
+	function hostIn(host, list$1) {
+		return list$1.some((entry) => {
 			const want = entry.toLowerCase();
 			if (want.startsWith(".")) return host === want.slice(1) || host.endsWith(want);
 			return host === want;
@@ -177,6 +316,11 @@
 		if (!listed(facts.capability, when.capability)) return false;
 		if (!listed(facts.plugin, when.plugin)) return false;
 		if (!listed(facts.agent, when.agent)) return false;
+		if (when.command !== void 0) {
+			const raw = facts.args.command ?? facts.args.cmd ?? facts.args.script;
+			if (typeof raw !== "string") return false;
+			if (!commandMatches(when.command, raw)) return false;
+		}
 		if (when.path !== void 0) {
 			const raw = facts.args[when.path.arg ?? "path"];
 			if (typeof raw !== "string") return false;
@@ -326,6 +470,32 @@
 			return value;
 		}
 	};
+	function readCommandMatch(check, path, value) {
+		if (!isObject(value)) {
+			check.fail(path, "expected an object");
+			return;
+		}
+		check.keys(path, value, [
+			"name",
+			"token",
+			"pipedTo"
+		]);
+		if (value.name === void 0 && value.token === void 0 && value.pipedTo === void 0) check.fail(path, "expected `name`, `token` or `pipedTo`; a command matcher with none matches nothing");
+		const out = {};
+		if (value.token !== void 0) {
+			const tokens = check.names(`${path}.token`, value.token);
+			if (tokens !== void 0) out.token = tokens;
+		}
+		if (value.name !== void 0) {
+			const names = check.names(`${path}.name`, value.name);
+			if (names !== void 0) out.name = names;
+		}
+		if (value.pipedTo !== void 0) {
+			const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
+			if (pipes !== void 0) out.pipedTo = pipes;
+		}
+		return out;
+	}
 	function readPathMatch(check, path, value) {
 		if (!isObject(value)) {
 			check.fail(path, "expected an object");
@@ -369,12 +539,12 @@
 			if (arg !== void 0) out.arg = arg;
 		}
 		if (value.in !== void 0) {
-			const list = check.globs(`${path}.in`, value.in);
-			if (list !== void 0) out.in = list;
+			const list$1 = check.globs(`${path}.in`, value.in);
+			if (list$1 !== void 0) out.in = list$1;
 		}
 		if (value.notIn !== void 0) {
-			const list = check.globs(`${path}.notIn`, value.notIn);
-			if (list !== void 0) out.notIn = list;
+			const list$1 = check.globs(`${path}.notIn`, value.notIn);
+			if (list$1 !== void 0) out.notIn = list$1;
 		}
 		return out;
 	}
@@ -419,6 +589,7 @@
 			"capability",
 			"plugin",
 			"agent",
+			"command",
 			"path",
 			"host",
 			"arg",
@@ -434,6 +605,10 @@
 			const names = check.names(`${path}.${key}`, value[key]);
 			if (names !== void 0) out[key] = names;
 		}
+		if (value.command !== void 0) {
+			const match = readCommandMatch(check, `${path}.command`, value.command);
+			if (match !== void 0) out.command = match;
+		}
 		if (value.path !== void 0) {
 			const match = readPathMatch(check, `${path}.path`, value.path);
 			if (match !== void 0) out.path = match;
@@ -444,12 +619,12 @@
 		}
 		if (value.arg !== void 0) if (!Array.isArray(value.arg)) check.fail(`${path}.arg`, "expected an array of argument matchers");
 		else {
-			const list = [];
+			const list$1 = [];
 			value.arg.forEach((entry, index) => {
 				const one = readArgMatch(check, `${path}.arg[${index}]`, entry);
-				if (one !== void 0) list.push(one);
+				if (one !== void 0) list$1.push(one);
 			});
-			out.arg = list;
+			out.arg = list$1;
 		}
 		if (value.count !== void 0) if (!isObject(value.count)) check.fail(`${path}.count`, "expected an object");
 		else {

package/lib/prae-baseline.prae.json

@@ -0,0 +1,102 @@
+{
+  "prae": "0.1",
+  "pack": "prae-baseline",
+  "version": "1.0.0",
+  "rules": [
+    {
+      "id": "BASE-001",
+      "title": "No download-and-execute",
+      "when": {
+        "command": {
+          "name": ["curl", "wget", "fetch"],
+          "pipedTo": ["sh", "bash", "zsh", "python", "python3", "node"]
+        }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "piping a download into an interpreter runs code nobody has read"
+      }
+    },
+    {
+      "id": "BASE-002",
+      "title": "Recursive force-delete is held",
+      "when": { "command": { "name": ["rm", "shred"], "token": "-rf" } },
+      "effect": {
+        "kind": "ask",
+        "because": "a recursive force-delete is not reversible and needs a human"
+      }
+    },
+    {
+      "id": "BASE-003",
+      "title": "Privilege escalation is held",
+      "when": { "command": { "name": ["su", "doas", "pkexec"] } },
+      "effect": {
+        "kind": "ask",
+        "because": "escalating privileges needs a human"
+      }
+    },
+    {
+      "id": "BASE-004",
+      "title": "Filesystem-wide destruction is refused",
+      "when": { "command": { "name": ["mkfs*", "dd", "diskutil", "fdisk"] } },
+      "effect": {
+        "kind": "deny",
+        "because": "block-device and filesystem tools are not granted to agents"
+      }
+    },
+    {
+      "id": "BASE-005",
+      "title": "Shell history and credentials stay unread",
+      "when": {
+        "capability": "fs:read",
+        "path": {
+          "inside": [
+            ".env",
+            ".env.*",
+            "**/.ssh/**",
+            "**/.aws/**",
+            "**/credentials*",
+            "**/*.pem",
+            "**/*_history"
+          ]
+        }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "secrets and credential stores are out of scope for agents"
+      }
+    },
+    {
+      "id": "BASE-006",
+      "title": "Writes outside the workspace are held",
+      "when": { "capability": "fs:write", "path": { "outside": ["./**"] } },
+      "effect": {
+        "kind": "ask",
+        "because": "writing outside the working tree needs a human"
+      }
+    },
+    {
+      "id": "BASE-007",
+      "title": "Force-push is held",
+      "when": { "command": { "name": "git", "token": "--force*" } },
+      "effect": {
+        "kind": "ask",
+        "because": "rewriting shared history needs a human"
+      }
+    },
+    {
+      "id": "BASE-008",
+      "title": "Package publishes are held",
+      "when": {
+        "command": {
+          "name": ["npm", "pnpm", "yarn", "pip", "cargo", "gem"],
+          "token": "publish"
+        }
+      },
+      "effect": {
+        "kind": "ask",
+        "because": "publishing is outward-facing and needs a human"
+      }
+    }
+  ]
+}