prae-cli 0.7.0 → 0.8.0

package/lib/playground.js

@@ -126,6 +126,22 @@
 		if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
 		return value === pattern;
 	}
+	/**
+	* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
+	* shape of download-and-execute however the two ends are spelled.
+	*/
+	function globMatches(pattern, value) {
+		const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+		return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
+	}
+	/**
+	* Every wanted token holds in a segment: a plain pattern must match some
+	* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
+	* force-delete, not a rehearsal of one.
+	*/
+	function tokensHold(wanted, tokens) {
+		return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
+	}
 	const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
 	/**
 	* Judge one command line against one matcher. Every present field must hold.
@@ -135,17 +151,24 @@
 		if (parts.length === 0) return false;
 		const names = list(match.name);
 		const args = list(match.token);
+		const anyArgs = list(match.anyToken);
 		const pipes = list(match.pipedTo);
+		const shapes = list(match.pipeline);
+		const argsHold = (segment) => tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
 		if (names.length > 0) {
 			const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 			if (hit.length === 0) return false;
-			if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-		} else if (args.length > 0) {
-			if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+			if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
+		} else if (args.length > 0 || anyArgs.length > 0) {
+			if (!parts.some(argsHold)) return false;
 		}
 		if (pipes.length > 0) {
 			if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
 		}
+		if (shapes.length > 0) {
+			const signature = parts.map((segment) => segment.name).join("|");
+			if (!shapes.some((pattern) => globMatches(pattern, signature))) return false;
+		}
 		return true;
 	}
 
@@ -468,52 +491,100 @@
 
 //#endregion
 //#region ../kernel/src/frameworks.ts
-	const FRAMEWORKS = { "owasp-llm-top-10-2026": {
-		name: "OWASP Top 10 for LLM Applications — 2026",
-		short: "OWASP LLM 2026",
-		controls: {
-			LLM01: {
-				name: "Prompt Injection",
-				summary: "Instructions in a prompt or in retrieved content alter what the model does."
-			},
-			LLM02: {
-				name: "Sensitive Information Disclosure",
-				summary: "Credentials, personal data or proprietary content reach the model or its output."
-			},
-			LLM03: {
-				name: "Excessive Agency",
-				summary: "The model can take actions, or holds permissions, beyond what its task needs."
-			},
-			LLM04: {
-				name: "Supply Chain",
-				summary: "A compromised model, dataset, plugin or dependency enters the application."
-			},
-			LLM05: {
-				name: "Data and Model Poisoning",
-				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-			},
-			LLM06: {
-				name: "Unbounded Consumption",
-				summary: "The application permits resource use without a limit, exhausting budget or service."
-			},
-			LLM07: {
-				name: "Misinformation",
-				summary: "The model produces false or misleading content that is acted on as if true."
-			},
-			LLM08: {
-				name: "Hidden Context Exposure",
-				summary: "System prompts, hidden instructions or internal context are revealed."
-			},
-			LLM09: {
-				name: "Vector and Embedding Weaknesses",
-				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-			},
-			LLM10: {
-				name: "Improper Output Handling",
-				summary: "Model output is passed to downstream systems without validation."
+	const FRAMEWORKS = {
+		"owasp-llm-top-10-2026": {
+			name: "OWASP Top 10 for LLM Applications — 2026",
+			short: "OWASP LLM 2026",
+			controls: {
+				LLM01: {
+					name: "Prompt Injection",
+					summary: "Instructions in a prompt or in retrieved content alter what the model does."
+				},
+				LLM02: {
+					name: "Sensitive Information Disclosure",
+					summary: "Credentials, personal data or proprietary content reach the model or its output."
+				},
+				LLM03: {
+					name: "Excessive Agency",
+					summary: "The model can take actions, or holds permissions, beyond what its task needs."
+				},
+				LLM04: {
+					name: "Supply Chain",
+					summary: "A compromised model, dataset, plugin or dependency enters the application."
+				},
+				LLM05: {
+					name: "Data and Model Poisoning",
+					summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+				},
+				LLM06: {
+					name: "Unbounded Consumption",
+					summary: "The application permits resource use without a limit, exhausting budget or service."
+				},
+				LLM07: {
+					name: "Misinformation",
+					summary: "The model produces false or misleading content that is acted on as if true."
+				},
+				LLM08: {
+					name: "Hidden Context Exposure",
+					summary: "System prompts, hidden instructions or internal context are revealed."
+				},
+				LLM09: {
+					name: "Vector and Embedding Weaknesses",
+					summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+				},
+				LLM10: {
+					name: "Improper Output Handling",
+					summary: "Model output is passed to downstream systems without validation."
+				}
+			}
+		},
+		"owasp-agentic-top-10-2026": {
+			name: "OWASP Top 10 for Agentic Applications — 2026",
+			short: "OWASP Agentic 2026",
+			controls: {
+				ASI01: {
+					name: "Agent Goal Hijack",
+					summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+				},
+				ASI02: {
+					name: "Tool Misuse and Exploitation",
+					summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+				},
+				ASI03: {
+					name: "Identity and Privilege Abuse",
+					summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+				},
+				ASI04: {
+					name: "Agentic Supply Chain",
+					summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+				},
+				ASI05: {
+					name: "Unexpected Code Execution",
+					summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+				},
+				ASI06: {
+					name: "Memory and Context Poisoning",
+					summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+				},
+				ASI07: {
+					name: "Insecure Inter-Agent Communication",
+					summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+				},
+				ASI08: {
+					name: "Cascading Failures",
+					summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+				},
+				ASI09: {
+					name: "Human-Agent Trust Exploitation",
+					summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+				},
+				ASI10: {
+					name: "Rogue Agents",
+					summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+				}
 			}
 		}
-	} };
+	};
 
 //#endregion
 //#region ../kernel/src/pack.ts
@@ -580,9 +651,11 @@
 		check.keys(path, value, [
 			"name",
 			"token",
-			"pipedTo"
+			"anyToken",
+			"pipedTo",
+			"pipeline"
 		]);
-		if (value.name === void 0 && value.token === void 0 && value.pipedTo === void 0) check.fail(path, "expected `name`, `token` or `pipedTo`; a command matcher with none matches nothing");
+		if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
 		const out = {};
 		if (value.token !== void 0) {
 			const tokens = check.names(`${path}.token`, value.token);
@@ -592,10 +665,18 @@
 			const names = check.names(`${path}.name`, value.name);
 			if (names !== void 0) out.name = names;
 		}
+		if (value.anyToken !== void 0) {
+			const tokens = check.names(`${path}.anyToken`, value.anyToken);
+			if (tokens !== void 0) out.anyToken = tokens;
+		}
 		if (value.pipedTo !== void 0) {
 			const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
 			if (pipes !== void 0) out.pipedTo = pipes;
 		}
+		if (value.pipeline !== void 0) {
+			const shapes = check.names(`${path}.pipeline`, value.pipeline);
+			if (shapes !== void 0) out.pipeline = shapes;
+		}
 		return out;
 	}
 	function readPathMatch(check, path, value) {

package/lib/prae-baseline.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "prae-baseline",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "rules": [
     {
       "id": "BASE-001",
@@ -15,33 +15,69 @@
       "effect": {
         "kind": "deny",
         "because": "piping a download into an interpreter runs code nobody has read"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI05", "ASI02"]
       }
     },
     {
       "id": "BASE-002",
       "title": "Recursive force-delete is held",
-      "when": { "command": { "name": ["rm", "shred"], "token": "-rf" } },
+      "when": {
+        "command": {
+          "name": ["rm", "shred"],
+          "anyToken": ["-rf", "-fr", "-Rf", "-fR", "-r", "-R"],
+          "token": ["!--dry-run"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "a recursive force-delete is not reversible and needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
       "id": "BASE-003",
       "title": "Privilege escalation is held",
-      "when": { "command": { "name": ["su", "doas", "pkexec"] } },
+      "when": {
+        "command": {
+          "name": ["su", "doas", "pkexec"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "escalating privileges needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
       "id": "BASE-004",
       "title": "Filesystem-wide destruction is refused",
-      "when": { "command": { "name": ["mkfs*", "dd", "diskutil", "fdisk"] } },
+      "when": {
+        "command": {
+          "name": ["mkfs*", "diskutil", "fdisk", "dd"],
+          "token": [
+            "!of=/dev/null",
+            "!of=/dev/zero",
+            "!of=/dev/stdout",
+            "!of=/dev/stderr"
+          ]
+        }
+      },
       "effect": {
         "kind": "deny",
         "because": "block-device and filesystem tools are not granted to agents"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -64,24 +100,46 @@
       "effect": {
         "kind": "deny",
         "because": "secrets and credential stores are out of scope for agents"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
       "id": "BASE-006",
       "title": "Writes outside the workspace are held",
-      "when": { "capability": "fs:write", "path": { "outside": ["./**"] } },
+      "when": {
+        "capability": "fs:write",
+        "path": {
+          "outside": ["./**"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "writing outside the working tree needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
       "id": "BASE-007",
       "title": "Force-push is held",
-      "when": { "command": { "name": "git", "token": "--force*" } },
+      "when": {
+        "command": {
+          "name": "git",
+          "token": "--force*"
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "rewriting shared history needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -96,6 +154,10 @@
       "effect": {
         "kind": "ask",
         "because": "publishing is outward-facing and needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     }
   ]

package/lib/secret-catcher.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "secret-catcher",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "rules": [
     {
       "id": "SEC-001",
@@ -26,7 +26,8 @@
         "because": "the requested file contains a protected credential; the contents were not returned"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -43,7 +44,8 @@
         "because": "the requested file contains a private key; the contents were not returned"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -74,7 +76,8 @@
         "because": "the command ran and its output contained a protected credential; the output was withheld from the model"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     }
   ]

package/lib/{src-Vnr0fcpK.js → src-CwBEFhww.js}

@@ -1,3 +1,3 @@
-import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-Br1tGPtS.js";
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-B25SHWcz.js";
 
 export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };

package/lib/{test-run-04ubUcSb.js → test-run-XNIRHKOu.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
 
 //#region src/test-run.ts
 /** The path argument a scenario's call carries, if any. */