prae-cli 0.10.0 → 0.10.2

package/lib/evaluate-DhoGQw0Z.js

@@ -1,521 +0,0 @@
-//#region ../kernel/src/command.ts
-/** Wrappers whose first operand is the program actually being run. */
-const WRAPPERS = new Set([
-	"sudo",
-	"command",
-	"env",
-	"nohup",
-	"time",
-	"xargs"
-]);
-/** Wrapper options that consume the next token, so it is not the program. */
-const OPTION_WITH_VALUE = new Set([
-	"-u",
-	"-g",
-	"-p",
-	"-h",
-	"-C",
-	"-r",
-	"-t",
-	"-U",
-	"-I",
-	"-n",
-	"-P",
-	"-L",
-	"-s"
-]);
-const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
-/**
-* Split a line into pipeline segments of words, one scan, quote-aware.
-*
-* Splitting on `|` before parsing quotes is the classic mistake — it turns
-* `echo "a | b"` into two segments — so quoting and separators are read
-* together.
-*/
-function scan(command) {
-	const parts = [];
-	let tokens = [];
-	let current = "";
-	let quote;
-	const endToken = () => {
-		if (current !== "") tokens.push(current);
-		current = "";
-	};
-	const endSegment = () => {
-		endToken();
-		if (tokens.length > 0) parts.push(tokens);
-		tokens = [];
-	};
-	for (let at = 0; at < command.length; at += 1) {
-		const ch = command[at];
-		if (quote !== void 0) {
-			if (ch === quote) quote = void 0;
-			else current += ch;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			continue;
-		}
-		if (ch === ";") {
-			endSegment();
-			continue;
-		}
-		if (ch === "|" || ch === "&") {
-			endSegment();
-			if (command[at + 1] === ch) at += 1;
-			continue;
-		}
-		if (/\s/.test(ch)) {
-			endToken();
-			continue;
-		}
-		current += ch;
-	}
-	endSegment();
-	return parts;
-}
-/** Decompose a command line into pipeline segments. */
-function segments(command) {
-	const found = [];
-	for (const tokens of scan(command)) {
-		let at = 0;
-		const wrappers = [];
-		while (at < tokens.length) {
-			const token = tokens[at];
-			if (ASSIGNMENT.test(token)) {
-				at += 1;
-				continue;
-			}
-			const word = (token.split("/").pop() ?? token).toLowerCase();
-			if (WRAPPERS.has(word)) {
-				wrappers.push(word);
-				at += 1;
-				while (at < tokens.length) {
-					const option = tokens[at];
-					if (!option.startsWith("-")) break;
-					at += OPTION_WITH_VALUE.has(option) ? 2 : 1;
-				}
-				continue;
-			}
-			break;
-		}
-		const name = tokens[at];
-		if (name === void 0) {
-			const last = wrappers.at(-1);
-			if (last !== void 0) found.push({
-				name: last,
-				tokens: [],
-				wrappers
-			});
-			continue;
-		}
-		found.push({
-			name: (name.split("/").pop() ?? name).toLowerCase(),
-			tokens: tokens.slice(at + 1),
-			wrappers
-		});
-	}
-	return found;
-}
-/** `git*` matches `git`, `github`; bare strings match exactly. */
-function matches$1(pattern, value) {
-	if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
-	return value === pattern;
-}
-/**
-* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
-* shape of download-and-execute however the two ends are spelled.
-*/
-function globMatches(pattern, value) {
-	const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-	return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
-}
-/**
-* Every wanted token holds in a segment: a plain pattern must match some
-* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
-* force-delete, not a rehearsal of one.
-*/
-function tokensHold(wanted, tokens) {
-	return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
-}
-const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
-/**
-* Judge one command line against one matcher. Every present field must hold.
-*/
-function commandMatches(match, command) {
-	const parts = segments(command);
-	if (parts.length === 0) return false;
-	const names = list(match.name);
-	const args = list(match.token);
-	const anyArgs = list(match.anyToken);
-	const pipes = list(match.pipedTo);
-	const shapes = list(match.pipeline);
-	const argsHold = (segment) => tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
-	if (names.length > 0) {
-		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
-		if (hit.length === 0) return false;
-		if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
-	} else if (args.length > 0 || anyArgs.length > 0) {
-		if (!parts.some(argsHold)) return false;
-	}
-	if (pipes.length > 0) {
-		if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
-	}
-	if (shapes.length > 0) {
-		const signature = parts.map((segment) => segment.name).join("|");
-		if (!shapes.some((pattern) => globMatches(pattern, signature))) return false;
-	}
-	return true;
-}
-
-//#endregion
-//#region ../kernel/src/path.ts
-/**
-* Path normalization and glob containment, with no filesystem access.
-*
-* The contract, stated here because getting it wrong is how path policies
-* become theatre: **this module compares strings.** It resolves `.` and `..`
-* lexically so that `./src/../../etc/passwd` cannot pose as a workspace path,
-* but it cannot see a symlink. A link inside an allowed directory pointing out
-* of it will pass every check here.
-*
-* That is not a gap to paper over in the matcher — it is a gap the caller
-* closes by resolving before it asks. `dsh-overlay-check` learned this the
-* hard way during the plugin-store gate review: lexical containment accepted a
-* symlink escape cleanly, and the fix was to resolve both the path and its
-* nearest existing ancestor before deciding. Adapters that can touch the
-* filesystem must resolve first and pass the resolved path in.
-*/
-/** Split a path into segments, resolving `.` and `..` lexically. */
-function normalize(path) {
-	const absolute = path.startsWith("/");
-	const out = [];
-	let escaped = false;
-	for (const raw of path.split(/[/\\]+/)) {
-		if (raw === "" || raw === ".") continue;
-		if (raw === "..") {
-			if (out.length > 0) out.pop();
-			else escaped = true;
-			continue;
-		}
-		out.push(raw);
-	}
-	return {
-		segments: out,
-		absolute,
-		escaped
-	};
-}
-/** Turn one glob segment into an anchored regular expression. */
-function segmentPattern(segment) {
-	const body = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
-	return /* @__PURE__ */ new RegExp(`^${body}$`);
-}
-/**
-* Wildcard segment matching, where `**` spans zero or more segments.
-*
-* Two-pointer with backtracking rather than a recursive walk: the pattern
-* comes from a policy pack and the path from a tool call, and a catastrophic
-* backtrack in the hot path of every call would be a denial of service handed
-* to whoever writes the pack.
-*/
-function matchSegments(path, pattern) {
-	let i = 0;
-	let j = 0;
-	let starPattern = -1;
-	let starPath = 0;
-	while (i < path.length) {
-		const segment = j < pattern.length ? pattern[j] : void 0;
-		const here = path[i];
-		if (segment === "**") {
-			starPattern = j;
-			starPath = i;
-			j += 1;
-			continue;
-		}
-		if (segment !== void 0 && here !== void 0 && segmentPattern(segment).test(here)) {
-			i += 1;
-			j += 1;
-			continue;
-		}
-		if (starPattern >= 0) {
-			starPath += 1;
-			i = starPath;
-			j = starPattern + 1;
-			continue;
-		}
-		return false;
-	}
-	while (j < pattern.length && pattern[j] === "**") j += 1;
-	return j === pattern.length;
-}
-/**
-* Is `path` contained by `glob`?
-*
-* A glob naming a directory contains everything under it: `./src` and
-* `./src/**` both match `src/app/main.ts`. Writing the shorter form is the
-* common intent, and treating it as "this exact directory entry only" is a
-* trap that silently grants the whole subtree past the rule.
-*/
-function within(path, glob) {
-	const target = normalize(path);
-	if (target.escaped) return false;
-	const trimmed = glob.trim();
-	if (!(trimmed === "**" || trimmed.startsWith("**/")) && target.absolute !== trimmed.startsWith("/")) return false;
-	const pattern = normalize(glob);
-	if (matchSegments(target.segments, pattern.segments)) return true;
-	return matchSegments(target.segments, [...pattern.segments, "**"]);
-}
-/** Is `path` inside any of these globs? */
-function withinAny(path, globs) {
-	return globs.some((glob) => within(path, glob));
-}
-/**
-* An absolute path under `cwd`, rewritten as the workspace-relative path a
-* pack's `./` globs speak about; anything else comes back as written.
-*
-* A model is free to name a workspace file by its absolute path — the first
-* real agent run through the gate did exactly that for its first three
-* reads — and a scope rule written as `outside: ["./src/**"]` must decide
-* that file by where it is, not by how it was spelled. The anchoring in
-* {@link within} is right to keep `/etc/hosts` out of `./**`; this is the
-* other half, applied by an adapter that knows the session's directory.
-* A path that climbs out of `cwd` with `..` stays absolute, so it stays
-* outside.
-*/
-function relativeTo(path, cwd) {
-	const target = normalize(path);
-	const base = normalize(cwd);
-	if (!target.absolute || !base.absolute || target.escaped) return path;
-	if (base.segments.length > target.segments.length) return path;
-	if (!base.segments.every((s, i) => s === target.segments[i])) return path;
-	const rest = target.segments.slice(base.segments.length);
-	return rest.length === 0 ? "." : `./${rest.join("/")}`;
-}
-/**
-* The host of a URL, or undefined when it is not a URL we can read.
-*
-* Unparseable input returns undefined, and callers treat that as "no host" —
-* which for a `notIn` rule means the rule matches. Failing toward the rule is
-* the only safe direction: a string we cannot parse is exactly the shape an
-* evasion attempt takes.
-*/
-function hostOf(url) {
-	try {
-		return new URL(url).hostname.toLowerCase();
-	} catch {
-		return;
-	}
-}
-/**
-* Host list membership, where a leading dot means "this domain or below".
-*
-* `example.com` matches only that host. `.example.com` also matches
-* `api.example.com`, and deliberately still matches `example.com` itself —
-* an operator writing the suffix form means the organisation, not a rule that
-* covers every subdomain except the one they first thought of.
-*/
-function hostIn(host, list$1) {
-	return list$1.some((entry) => {
-		const want = entry.toLowerCase();
-		if (want.startsWith(".")) return host === want.slice(1) || host.endsWith(want);
-		return host === want;
-	});
-}
-/**
-* Argument names that conventionally carry a filesystem path, in the order
-* they are tried when a path rule names none.
-*
-* A path rule used to default to the single argument spelled `path`. DeepSeek
-* Harness's own `read`, `write` and `edit` tools pass `file_path`, so every
-* shipped path rule without an explicit `arg` — including the baseline's
-* "deny read ./.env" — matched nothing on the very harness it was written
-* for, while the ledger dutifully recorded every allowed read. A rule that
-* silently never fires is the worst way for policy to be wrong; defaulting
-* to the conventional set is the same call the dsh adapter already made for
-* path resolution, now made once, here, for matching too.
-*/
-const PATH_ARGS = [
-	"path",
-	"file_path",
-	"filePath",
-	"target",
-	"directory",
-	"cwd",
-	"file",
-	"dest",
-	"destination",
-	"source"
-];
-/** The first conventional path argument present, as a string, or undefined. */
-function pathArgOf(args, explicit) {
-	if (explicit !== void 0) {
-		const v = args[explicit];
-		return typeof v === "string" ? v : void 0;
-	}
-	for (const key of PATH_ARGS) {
-		const v = args[key];
-		if (typeof v === "string") return v;
-	}
-}
-
-//#endregion
-//#region ../kernel/src/rule.ts
-/**
-* Strength ordering, used when several rules match one call.
-*
-* Higher wins. This is the property that makes a pack safe to extend: adding a
-* rule can raise the strength of a decision and never lower it, so an operator
-* appending to a pack can never accidentally widen what an agent may do.
-*/
-const STRENGTH = {
-	allow: 0,
-	warn: 1,
-	correct: 2,
-	ask: 3,
-	deny: 4
-};
-
-//#endregion
-//#region ../kernel/src/evaluate.ts
-function listed(value, want) {
-	if (want === void 0) return true;
-	if (value === void 0) return false;
-	return typeof want === "string" ? value === want : want.includes(value);
-}
-function argMatches(match, args) {
-	const has = Object.hasOwn(args, match.name);
-	if (match.present !== void 0 && match.present !== has) return false;
-	if (!has) return match.above === void 0 && match.below === void 0 && match.equals === void 0 && match.oneOf === void 0;
-	const value = args[match.name];
-	if (match.above !== void 0) {
-		if (typeof value !== "number" || !(value > match.above)) return false;
-	}
-	if (match.below !== void 0) {
-		if (typeof value !== "number" || !(value < match.below)) return false;
-	}
-	if (match.equals !== void 0 && value !== match.equals) return false;
-	if (match.oneOf !== void 0) {
-		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return false;
-		if (!match.oneOf.includes(value)) return false;
-	}
-	return true;
-}
-function matches(when, facts) {
-	if (!listed(facts.tool, when.tool)) return false;
-	if (!listed(facts.capability, when.capability)) return false;
-	if (!listed(facts.plugin, when.plugin)) return false;
-	if (!listed(facts.agent, when.agent)) return false;
-	if (when.command !== void 0) {
-		const raw = facts.args.command ?? facts.args.cmd ?? facts.args.script;
-		if (typeof raw !== "string") return false;
-		if (!commandMatches(when.command, raw)) return false;
-	}
-	if (when.path !== void 0) {
-		const raw = pathArgOf(facts.args, when.path.arg);
-		if (typeof raw !== "string") return false;
-		if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
-		if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;
-	}
-	if (when.host !== void 0) {
-		const raw = facts.args[when.host.arg ?? "url"];
-		if (typeof raw !== "string") return false;
-		const host = hostOf(raw);
-		if (host === void 0) return when.host.notIn !== void 0;
-		if (when.host.in !== void 0 && !hostIn(host, when.host.in)) return false;
-		if (when.host.notIn !== void 0 && hostIn(host, when.host.notIn)) return false;
-	}
-	if (when.arg !== void 0) {
-		for (const one of when.arg) if (!argMatches(one, facts.args)) return false;
-	}
-	if (when.count !== void 0) {
-		const key = facts.capability;
-		if (key === void 0) return false;
-		if (!((facts.counts?.[key] ?? 0) > when.count.above)) return false;
-	}
-	if (when.secrets !== void 0) {
-		const floor = when.secrets.minConfidence ?? 0;
-		const wanted = when.secrets.types;
-		if ((facts.secrets ?? []).filter((finding) => finding.confidence >= floor && (wanted === void 0 || wanted.includes(finding.type))).length < (when.secrets.atLeast ?? 1)) return false;
-	}
-	return true;
-}
-function step(rule, effect) {
-	return {
-		rule: rule.id,
-		...rule.title === void 0 ? {} : { title: rule.title },
-		effect: effect.kind,
-		because: effect.because
-	};
-}
-/**
-* Decide one call against one pack.
-*
-* Every matching rule lands in the trace; the strongest effect decides. Ties
-* go to the first rule in pack order, so a pack reads top-down the way its
-* author wrote it.
-*
-* `correct` is the effect the rest of this ecosystem does not have. A rival
-* guardrail can allow a call or refuse it; a rule here can also rewrite an
-* argument and let it through, recording what it changed. Refusing is not
-* always the safe option — an agent denied mid-task retries, and the retry is
-* rarely safer than the clamp would have been.
-*/
-function evaluate(pack, facts) {
-	const hits = [];
-	for (const rule of pack.rules) if (matches(rule.when, facts)) hits.push({
-		rule,
-		effect: rule.effect
-	});
-	if (hits.length === 0) return {
-		kind: "allow",
-		trace: [],
-		evaluated: pack.rules.length
-	};
-	hits.sort((a, b) => STRENGTH[b.effect.kind] - STRENGTH[a.effect.kind]);
-	const trace = hits.map((hit) => step(hit.rule, hit.effect));
-	const evaluated = pack.rules.length;
-	const strongest = hits[0];
-	if (strongest === void 0) return {
-		kind: "allow",
-		trace: [],
-		evaluated
-	};
-	const winner = strongest.effect.kind;
-	if (winner === "deny" || winner === "ask") return {
-		kind: winner,
-		rule: strongest.rule.id,
-		reason: strongest.effect.because,
-		trace,
-		evaluated
-	};
-	if (winner === "correct") {
-		const args = { ...facts.args };
-		for (const hit of hits) if (hit.effect.kind === "correct") Object.assign(args, hit.effect.set);
-		return {
-			kind: "correct",
-			rule: strongest.rule.id,
-			reason: strongest.effect.because,
-			args,
-			trace,
-			evaluated
-		};
-	}
-	const allowed = hits.find((hit) => hit.effect.kind === "allow");
-	if (allowed !== void 0) return {
-		kind: "allow",
-		rule: allowed.rule.id,
-		reason: allowed.effect.because,
-		trace,
-		evaluated
-	};
-	return {
-		kind: "allow",
-		trace,
-		evaluated
-	};
-}
-
-//#endregion
-export { withinAny as a, relativeTo as i, PATH_ARGS as n, segments as o, hostOf as r, evaluate as t };

package/lib/frameworks-BgZHGKiH.js

@@ -1,118 +0,0 @@
-//#region ../kernel/src/frameworks.ts
-const FRAMEWORKS = {
-	"owasp-llm-top-10-2026": {
-		name: "OWASP Top 10 for LLM Applications — 2026",
-		short: "OWASP LLM 2026",
-		controls: {
-			LLM01: {
-				name: "Prompt Injection",
-				summary: "Instructions in a prompt or in retrieved content alter what the model does."
-			},
-			LLM02: {
-				name: "Sensitive Information Disclosure",
-				summary: "Credentials, personal data or proprietary content reach the model or its output."
-			},
-			LLM03: {
-				name: "Excessive Agency",
-				summary: "The model can take actions, or holds permissions, beyond what its task needs."
-			},
-			LLM04: {
-				name: "Supply Chain",
-				summary: "A compromised model, dataset, plugin or dependency enters the application."
-			},
-			LLM05: {
-				name: "Data and Model Poisoning",
-				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-			},
-			LLM06: {
-				name: "Unbounded Consumption",
-				summary: "The application permits resource use without a limit, exhausting budget or service."
-			},
-			LLM07: {
-				name: "Misinformation",
-				summary: "The model produces false or misleading content that is acted on as if true."
-			},
-			LLM08: {
-				name: "Hidden Context Exposure",
-				summary: "System prompts, hidden instructions or internal context are revealed."
-			},
-			LLM09: {
-				name: "Vector and Embedding Weaknesses",
-				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-			},
-			LLM10: {
-				name: "Improper Output Handling",
-				summary: "Model output is passed to downstream systems without validation."
-			}
-		}
-	},
-	"owasp-agentic-top-10-2026": {
-		name: "OWASP Top 10 for Agentic Applications — 2026",
-		short: "OWASP Agentic 2026",
-		controls: {
-			ASI01: {
-				name: "Agent Goal Hijack",
-				summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
-			},
-			ASI02: {
-				name: "Tool Misuse and Exploitation",
-				summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
-			},
-			ASI03: {
-				name: "Identity and Privilege Abuse",
-				summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
-			},
-			ASI04: {
-				name: "Agentic Supply Chain",
-				summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
-			},
-			ASI05: {
-				name: "Unexpected Code Execution",
-				summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
-			},
-			ASI06: {
-				name: "Memory and Context Poisoning",
-				summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
-			},
-			ASI07: {
-				name: "Insecure Inter-Agent Communication",
-				summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
-			},
-			ASI08: {
-				name: "Cascading Failures",
-				summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
-			},
-			ASI09: {
-				name: "Human-Agent Trust Exploitation",
-				summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
-			},
-			ASI10: {
-				name: "Rogue Agents",
-				summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
-			}
-		}
-	}
-};
-/**
-* Every framework control a rule cites, resolved to names.
-*
-* A pack that parsed cites only ids the registry knows, so the lookups here
-* cannot miss; the fallbacks exist for a `Rule` built by hand in code.
-*/
-function cite(rule) {
-	const out = [];
-	for (const [framework, controls] of Object.entries(rule.frameworks ?? {})) {
-		const known = FRAMEWORKS[framework];
-		for (const control of controls) out.push({
-			framework,
-			frameworkName: known?.name ?? framework,
-			frameworkShort: known?.short ?? framework,
-			control,
-			controlName: known?.controls[control]?.name ?? control
-		});
-	}
-	return out;
-}
-
-//#endregion
-export { cite as n, FRAMEWORKS as t };