prae-cli 0.7.0 → 0.7.1

package/lib/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import "./evaluate-CkYySl7T.js";
+import "./evaluate-wMPkjcIC.js";
 import "./views-UODslKwu.js";
-import { t as main } from "./cli-chtNj_el.js";
+import { t as main } from "./cli-mahLCjoD.js";
 import "./src-Ciggx9ja.js";
 
 //#region src/bin.ts

package/lib/{cli-chtNj_el.js → cli-mahLCjoD.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
 import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-UODslKwu.js";
 import { f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, r as verifyEntries, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
 import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
@@ -72,9 +72,11 @@ function readCommandMatch(check$1, path, value) {
 	check$1.keys(path, value, [
 		"name",
 		"token",
-		"pipedTo"
+		"anyToken",
+		"pipedTo",
+		"pipeline"
 	]);
-	if (value.name === void 0 && value.token === void 0 && value.pipedTo === void 0) check$1.fail(path, "expected `name`, `token` or `pipedTo`; a command matcher with none matches nothing");
+	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check$1.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
 	const out = {};
 	if (value.token !== void 0) {
 		const tokens = check$1.names(`${path}.token`, value.token);
@@ -84,10 +86,18 @@ function readCommandMatch(check$1, path, value) {
 		const names = check$1.names(`${path}.name`, value.name);
 		if (names !== void 0) out.name = names;
 	}
+	if (value.anyToken !== void 0) {
+		const tokens = check$1.names(`${path}.anyToken`, value.anyToken);
+		if (tokens !== void 0) out.anyToken = tokens;
+	}
 	if (value.pipedTo !== void 0) {
 		const pipes = check$1.names(`${path}.pipedTo`, value.pipedTo);
 		if (pipes !== void 0) out.pipedTo = pipes;
 	}
+	if (value.pipeline !== void 0) {
+		const shapes = check$1.names(`${path}.pipeline`, value.pipeline);
+		if (shapes !== void 0) out.pipeline = shapes;
+	}
 	return out;
 }
 function readPathMatch(check$1, path, value) {
@@ -1300,7 +1310,7 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-Bq0DNPPR.js");
+	const { serveMcp } = await import("./mcp-DDcejhwQ.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
@@ -1435,7 +1445,7 @@ async function test(suitePath, packOverride, asJson) {
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-04ubUcSb.js");
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-DOaCKD1t.js");
 	const suite = parseSuite(parsed);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);

package/lib/{evaluate-CkYySl7T.js → evaluate-wMPkjcIC.js}

@@ -123,6 +123,22 @@ function matches$1(pattern, value) {
 	if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
 	return value === pattern;
 }
+/**
+* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
+* shape of download-and-execute however the two ends are spelled.
+*/
+function globMatches(pattern, value) {
+	const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
+}
+/**
+* Every wanted token holds in a segment: a plain pattern must match some
+* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
+* force-delete, not a rehearsal of one.
+*/
+function tokensHold(wanted, tokens) {
+	return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
+}
 const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
 /**
 * Judge one command line against one matcher. Every present field must hold.
@@ -132,17 +148,24 @@ function commandMatches(match, command) {
 	if (parts.length === 0) return false;
 	const names = list(match.name);
 	const args = list(match.token);
+	const anyArgs = list(match.anyToken);
 	const pipes = list(match.pipedTo);
+	const shapes = list(match.pipeline);
+	const argsHold = (segment) => tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
 	if (names.length > 0) {
 		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 		if (hit.length === 0) return false;
-		if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-	} else if (args.length > 0) {
-		if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+		if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
+	} else if (args.length > 0 || anyArgs.length > 0) {
+		if (!parts.some(argsHold)) return false;
 	}
 	if (pipes.length > 0) {
 		if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
 	}
+	if (shapes.length > 0) {
+		const signature = parts.map((segment) => segment.name).join("|");
+		if (!shapes.some((pattern) => globMatches(pattern, signature))) return false;
+	}
 	return true;
 }
 

package/lib/index.js

@@ -1,6 +1,6 @@
-import "./evaluate-CkYySl7T.js";
+import "./evaluate-wMPkjcIC.js";
 import "./views-UODslKwu.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-chtNj_el.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-mahLCjoD.js";
 import "./src-Ciggx9ja.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{mcp-Bq0DNPPR.js → mcp-DDcejhwQ.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
 import { a as scan, n as MAX_SCAN_BYTES } from "./src-Br1tGPtS.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";

package/lib/playground.js

@@ -126,6 +126,22 @@
 		if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
 		return value === pattern;
 	}
+	/**
+	* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
+	* shape of download-and-execute however the two ends are spelled.
+	*/
+	function globMatches(pattern, value) {
+		const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+		return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
+	}
+	/**
+	* Every wanted token holds in a segment: a plain pattern must match some
+	* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
+	* force-delete, not a rehearsal of one.
+	*/
+	function tokensHold(wanted, tokens) {
+		return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
+	}
 	const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
 	/**
 	* Judge one command line against one matcher. Every present field must hold.
@@ -135,17 +151,24 @@
 		if (parts.length === 0) return false;
 		const names = list(match.name);
 		const args = list(match.token);
+		const anyArgs = list(match.anyToken);
 		const pipes = list(match.pipedTo);
+		const shapes = list(match.pipeline);
+		const argsHold = (segment) => tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
 		if (names.length > 0) {
 			const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 			if (hit.length === 0) return false;
-			if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-		} else if (args.length > 0) {
-			if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+			if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
+		} else if (args.length > 0 || anyArgs.length > 0) {
+			if (!parts.some(argsHold)) return false;
 		}
 		if (pipes.length > 0) {
 			if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
 		}
+		if (shapes.length > 0) {
+			const signature = parts.map((segment) => segment.name).join("|");
+			if (!shapes.some((pattern) => globMatches(pattern, signature))) return false;
+		}
 		return true;
 	}
 
@@ -580,9 +603,11 @@
 		check.keys(path, value, [
 			"name",
 			"token",
-			"pipedTo"
+			"anyToken",
+			"pipedTo",
+			"pipeline"
 		]);
-		if (value.name === void 0 && value.token === void 0 && value.pipedTo === void 0) check.fail(path, "expected `name`, `token` or `pipedTo`; a command matcher with none matches nothing");
+		if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
 		const out = {};
 		if (value.token !== void 0) {
 			const tokens = check.names(`${path}.token`, value.token);
@@ -592,10 +617,18 @@
 			const names = check.names(`${path}.name`, value.name);
 			if (names !== void 0) out.name = names;
 		}
+		if (value.anyToken !== void 0) {
+			const tokens = check.names(`${path}.anyToken`, value.anyToken);
+			if (tokens !== void 0) out.anyToken = tokens;
+		}
 		if (value.pipedTo !== void 0) {
 			const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
 			if (pipes !== void 0) out.pipedTo = pipes;
 		}
+		if (value.pipeline !== void 0) {
+			const shapes = check.names(`${path}.pipeline`, value.pipeline);
+			if (shapes !== void 0) out.pipeline = shapes;
+		}
 		return out;
 	}
 	function readPathMatch(check, path, value) {

package/lib/prae-baseline.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "prae-baseline",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "rules": [
     {
       "id": "BASE-001",
@@ -15,33 +15,65 @@
       "effect": {
         "kind": "deny",
         "because": "piping a download into an interpreter runs code nobody has read"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-002",
       "title": "Recursive force-delete is held",
-      "when": { "command": { "name": ["rm", "shred"], "token": "-rf" } },
+      "when": {
+        "command": {
+          "name": ["rm", "shred"],
+          "anyToken": ["-rf", "-fr", "-Rf", "-fR", "-r", "-R"],
+          "token": ["!--dry-run"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "a recursive force-delete is not reversible and needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-003",
       "title": "Privilege escalation is held",
-      "when": { "command": { "name": ["su", "doas", "pkexec"] } },
+      "when": {
+        "command": {
+          "name": ["su", "doas", "pkexec"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "escalating privileges needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-004",
       "title": "Filesystem-wide destruction is refused",
-      "when": { "command": { "name": ["mkfs*", "dd", "diskutil", "fdisk"] } },
+      "when": {
+        "command": {
+          "name": ["mkfs*", "diskutil", "fdisk", "dd"],
+          "token": [
+            "!of=/dev/null",
+            "!of=/dev/zero",
+            "!of=/dev/stdout",
+            "!of=/dev/stderr"
+          ]
+        }
+      },
       "effect": {
         "kind": "deny",
         "because": "block-device and filesystem tools are not granted to agents"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
@@ -64,24 +96,43 @@
       "effect": {
         "kind": "deny",
         "because": "secrets and credential stores are out of scope for agents"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
       }
     },
     {
       "id": "BASE-006",
       "title": "Writes outside the workspace are held",
-      "when": { "capability": "fs:write", "path": { "outside": ["./**"] } },
+      "when": {
+        "capability": "fs:write",
+        "path": {
+          "outside": ["./**"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "writing outside the working tree needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-007",
       "title": "Force-push is held",
-      "when": { "command": { "name": "git", "token": "--force*" } },
+      "when": {
+        "command": {
+          "name": "git",
+          "token": "--force*"
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "rewriting shared history needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
@@ -96,6 +147,9 @@
       "effect": {
         "kind": "ask",
         "because": "publishing is outward-facing and needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     }
   ]

package/lib/{test-run-04ubUcSb.js → test-run-DOaCKD1t.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
 
 //#region src/test-run.ts
 /** The path argument a scenario's call carries, if any. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -40,12 +40,12 @@
     "tsdown": "^0.15.6",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
-    "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",
+    "@prae/controls": "0.1.0",
     "@prae/tokens": "0.1.0"
   },
   "scripts": {