prae-cli 0.5.0 → 0.5.1

package/lib/bin.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./evaluate-BilZez15.js";
-import { t as main } from "./cli-ZfwhJKRw.js";
+import "./evaluate-DMyL3qM_.js";
+import { t as main } from "./cli-DfXHsQO7.js";
 import "./src-CXU0_W1P.js";
 import "./views-DalPkBZZ.js";
 

package/lib/{cli-ZfwhJKRw.js → cli-DfXHsQO7.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-BilZez15.js";
+import { t as evaluate } from "./evaluate-DMyL3qM_.js";
 import { m as seal, t as Ledger } from "./src-CXU0_W1P.js";
 import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
 import { existsSync, readFileSync } from "node:fs";
@@ -970,7 +970,7 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-BH5I4Eyu.js");
+	const { serveMcp } = await import("./mcp-CEN48TpN.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;

package/lib/{evaluate-BilZez15.js → evaluate-DMyL3qM_.js}

@@ -266,6 +266,42 @@ function hostIn(host, list$1) {
 		return host === want;
 	});
 }
+/**
+* Argument names that conventionally carry a filesystem path, in the order
+* they are tried when a path rule names none.
+*
+* A path rule used to default to the single argument spelled `path`. DeepSeek
+* Harness's own `read`, `write` and `edit` tools pass `file_path`, so every
+* shipped path rule without an explicit `arg` — including the baseline's
+* "deny read ./.env" — matched nothing on the very harness it was written
+* for, while the ledger dutifully recorded every allowed read. A rule that
+* silently never fires is the worst way for policy to be wrong; defaulting
+* to the conventional set is the same call the dsh adapter already made for
+* path resolution, now made once, here, for matching too.
+*/
+const PATH_ARGS = [
+	"path",
+	"file_path",
+	"filePath",
+	"target",
+	"directory",
+	"cwd",
+	"file",
+	"dest",
+	"destination",
+	"source"
+];
+/** The first conventional path argument present, as a string, or undefined. */
+function pathArgOf(args, explicit) {
+	if (explicit !== void 0) {
+		const v = args[explicit];
+		return typeof v === "string" ? v : void 0;
+	}
+	for (const key of PATH_ARGS) {
+		const v = args[key];
+		if (typeof v === "string") return v;
+	}
+}
 
 //#endregion
 //#region ../kernel/src/rule.ts
@@ -319,7 +355,7 @@ function matches(when, facts) {
 		if (!commandMatches(when.command, raw)) return false;
 	}
 	if (when.path !== void 0) {
-		const raw = facts.args[when.path.arg ?? "path"];
+		const raw = pathArgOf(facts.args, when.path.arg);
 		if (typeof raw !== "string") return false;
 		if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
 		if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;

package/lib/index.js

@@ -1,5 +1,5 @@
-import "./evaluate-BilZez15.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-ZfwhJKRw.js";
+import "./evaluate-DMyL3qM_.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-DfXHsQO7.js";
 import "./src-CXU0_W1P.js";
 import "./views-DalPkBZZ.js";
 

package/lib/{mcp-BH5I4Eyu.js → mcp-CEN48TpN.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-BilZez15.js";
+import { t as evaluate } from "./evaluate-DMyL3qM_.js";
 import { a as scan, n as MAX_SCAN_BYTES } from "./src-Br1tGPtS.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";

package/lib/playground.js

@@ -269,6 +269,42 @@
 			return host === want;
 		});
 	}
+	/**
+	* Argument names that conventionally carry a filesystem path, in the order
+	* they are tried when a path rule names none.
+	*
+	* A path rule used to default to the single argument spelled `path`. DeepSeek
+	* Harness's own `read`, `write` and `edit` tools pass `file_path`, so every
+	* shipped path rule without an explicit `arg` — including the baseline's
+	* "deny read ./.env" — matched nothing on the very harness it was written
+	* for, while the ledger dutifully recorded every allowed read. A rule that
+	* silently never fires is the worst way for policy to be wrong; defaulting
+	* to the conventional set is the same call the dsh adapter already made for
+	* path resolution, now made once, here, for matching too.
+	*/
+	const PATH_ARGS = [
+		"path",
+		"file_path",
+		"filePath",
+		"target",
+		"directory",
+		"cwd",
+		"file",
+		"dest",
+		"destination",
+		"source"
+	];
+	/** The first conventional path argument present, as a string, or undefined. */
+	function pathArgOf(args, explicit) {
+		if (explicit !== void 0) {
+			const v = args[explicit];
+			return typeof v === "string" ? v : void 0;
+		}
+		for (const key of PATH_ARGS) {
+			const v = args[key];
+			if (typeof v === "string") return v;
+		}
+	}
 
 //#endregion
 //#region ../kernel/src/rule.ts
@@ -322,7 +358,7 @@
 			if (!commandMatches(when.command, raw)) return false;
 		}
 		if (when.path !== void 0) {
-			const raw = facts.args[when.path.arg ?? "path"];
+			const raw = pathArgOf(facts.args, when.path.arg);
 			if (typeof raw !== "string") return false;
 			if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
 			if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -40,8 +40,8 @@
     "tsdown": "^0.15.6",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
-    "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
+    "@prae/controls": "0.1.0",
     "@prae/inspect": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",