talos-code 0.0.1 → 0.2.0

package/dist/runtime/types.js

@@ -0,0 +1,5 @@
+export class CliRuntimeError extends Error {
+    code;
+    details;
+    constructor(code, message = code, details = {}) { super(message); this.name = 'CliRuntimeError'; this.code = code; this.details = details; }
+}

package/dist/runtime/usage-snapshot.js

@@ -0,0 +1,82 @@
+/*
+ * R5 CONTRACT (owner: lane R; stub written by the coordinator so both lanes compile). Owner decisions Q-R5-2/4/5: the one
+ * status row shows `model · ↑in ↓out · ctx used/window % · ~$cost · cmp N`. usageSnapshot turns the turn's reported usage,
+ * the context status and the model profile into those facts. Unknown stays unknown (`null`, never 0 or a guess, gate E1);
+ * `estimated` marks a figure that was estimated rather than reported; `costUsd` only with a named price source
+ * (`costSource`), `local` engines have no price. Lane S only CALLS it and draws the row (new `tui/status-bar.ts`); lane R owns
+ * the body and may not change the signature.
+ *
+ * R5a lane R — the body, built on the shapes MEASURED through the real composition (r5a-r-usage-shapes.test.ts, 2026-09-24):
+ * - `usage.updated` carries the RUN's running total, `{prompt_tokens, completion_tokens, cached_tokens, turns}`
+ *   (talosHarness.mjs `conto`, agent-service.mjs `eventoPerUsage`); it restarts at every run. That is `↑in ↓out`.
+ * - each model request's own usage arrives as the kernel's `CUSTOM consumo-fornitore` (runtime-owner-adapter.mjs:978, with the
+ *   provider, the model, the provider's `usage` and, when the provider declares one, its cost); the event adapter folds the
+ *   last one into the usage value as `lastRequest`, and the run's declared costs as `declaredCostUsd`.
+ * - the context in use is what the last request carried plus what it answered (Pi `calculateContextTokens`: `totalTokens`, or
+ *   input + output, packages/coding-agent/docs/compaction.md, 2026-09-24): reported, not estimated. When the Context Engine
+ *   has measured the prepared request (`contextStatus.measurement`), that measurement is used instead, `estimated` when its
+ *   method is the heuristic.
+ * - `percent` exists only with a window (a profile, or the engine's measurement). No window, no percent: the screen says `ctx ?`.
+ * - cost: a cost the provider declared for this run's requests is used as reported (`costSource: 'provider-reported'`);
+ *   otherwise the list price of a NAMED source (`modelPrice`: the registry's dated rows, a live model list, models.dev with
+ *   its date), cached input at the cache-read price when one is listed — an ESTIMATE, which the screen marks `~` (Q-R5-5);
+ *   otherwise null. A local engine (`isLocalProvider`) has no price: `local:true`, cost null.
+ * - `compactions`: the count lane S keeps from `context.compacted` events, passed as `state.compactions`; 0 when none.
+ * Optional additions to the frozen shape (stated in the hand-back): the input's `model?` and `state.compactions?`, and the
+ * output's `contextTokens?` (the used figure the row prints before the window).
+ */
+import { isLocalProvider, modelPrice, splitModelId } from "./model-profile.js";
+function objectValue(value) { return value && typeof value === 'object' && !Array.isArray(value) ? value : null; }
+function count(value) { return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null; }
+function first(...values) { for (const value of values) {
+    const n = count(value);
+    if (n !== null)
+        return n;
+} return null; }
+export function usageSnapshot(input) {
+    const usage = objectValue(input?.state?.usage);
+    const last = objectValue(usage?.lastRequest);
+    const inputTokens = first(usage?.prompt_tokens, usage?.promptTokens, usage?.input_tokens, usage?.inputTokens);
+    const outputTokens = first(usage?.completion_tokens, usage?.completionTokens, usage?.output_tokens, usage?.outputTokens);
+    const cachedTokens = first(usage?.cached_tokens, usage?.cachedTokens, usage?.prompt_tokens_details?.cached_tokens);
+    const turns = first(usage?.turns, usage?.giri);
+    const status = objectValue(input?.contextStatus);
+    const measurement = status?.available === true ? objectValue(status.measurement) : null;
+    const measured = measurement && measurement.stale !== true && count(measurement.inputTokens) !== null ? measurement : null;
+    let contextTokens = null;
+    let estimated = false;
+    if (measured) {
+        contextTokens = count(measured.inputTokens);
+        estimated = measured.exact !== true || measured.method === 'heuristic';
+    }
+    else if (last && count(last.inputTokens) !== null) {
+        contextTokens = count(last.inputTokens) + (count(last.outputTokens) ?? 0);
+    }
+    else if (turns === 1 && inputTokens !== null) {
+        contextTokens = inputTokens + (outputTokens ?? 0);
+    }
+    const windowTokens = count(input?.profile?.windowTokens) ?? (measured ? count(measured.windowTokens) : null);
+    const percent = contextTokens !== null && windowTokens ? Math.round((contextTokens / windowTokens) * 1000) / 10 : null;
+    const named = typeof input?.model === 'string' && input.model ? splitModelId(input.model) : null;
+    const provider = typeof last?.provider === 'string' && last.provider ? last.provider : named?.provider ?? null;
+    const model = typeof last?.model === 'string' && last.model ? last.model : named?.model ?? null;
+    const local = isLocalProvider(provider);
+    let costUsd = null;
+    let costSource = null;
+    const declared = count(usage?.declaredCostUsd);
+    if (!local && declared !== null) {
+        costUsd = declared;
+        costSource = 'provider-reported';
+    }
+    else if (!local && provider && model && inputTokens !== null && outputTokens !== null) {
+        const price = modelPrice({ provider, model });
+        if (price) {
+            const cached = Math.min(cachedTokens ?? 0, inputTokens);
+            const cacheRate = price.cacheReadPerMTok ?? price.inputPerMTok;
+            costUsd = ((inputTokens - cached) * price.inputPerMTok + cached * cacheRate + outputTokens * price.outputPerMTok) / 1_000_000;
+            costSource = price.date ? `${price.source} ${price.date}` : price.source;
+        }
+    }
+    const compactions = Math.max(0, Math.round(count(input?.state?.compactions) ?? 0));
+    return { inputTokens, outputTokens, cachedTokens, windowTokens, percent, estimated, costUsd, costSource, local, compactions, contextTokens };
+}

package/dist/security/auto-classifier.js

@@ -0,0 +1,38 @@
+import { tokenizeCommand } from "./rule-parser.js";
+const SAFE_EXACT = [['git', 'status'], ['git', 'diff'], ['git', 'log'], ['npm', 'test'], ['npm', 'run', 'test'], ['npm', 'run', 'lint'], ['npm', 'run', 'typecheck'], ['npx', 'tsc', '--noEmit'], ['rg'], ['grep'], ['ls'], ['dir']];
+/*
+ * ⭐⭐⭐ R0 lane S — owner decision 2 (2026-09-23): TALOS `auto` on a host whose shell isolation is not verified ASKS
+ * the person for every command; the classifier never auto-allows one. It is Codex's rule ("If the command is flagged
+ * as dangerous or we have no sandbox protection, we should never allow it to run without approval",
+ * codex-rs/core/src/exec_policy.rs, 2026-09-01), chosen over Claude Code's "the classifier evaluates the underlying
+ * command" (gate §0.3 D1): SAFE_EXACT includes `npm test` and `npm run *`, which run the project's own code.
+ * ⛔ Edits and reads keep the mode's semantics (amendment 3, Claude Code rule D2): only Bash changes.
+ * ⛔ Explicit allow rules and session grants are the person's own answer and are decided BEFORE the classifier
+ *   (permission-engine.ts); this rule does not touch them.
+ * ⛔ Fail-safe by construction: with no isolation source the classifier asks. Whoever builds it must pass the
+ *   session's real isolation state for SAFE_EXACT to be auto-allowed on a verified host.
+ */
+async function shellIsVerified(source) {
+    if (!source)
+        return false;
+    try {
+        const state = await source();
+        return typeof state === 'object' && state !== null && state.verified === true;
+    }
+    catch {
+        return false;
+    }
+}
+export function createLocalAutoClassifier(options = {}) { return async ({ action }) => { if (action.tool === 'Read')
+    return 'allow'; if (action.tool === 'Edit' || action.tool === 'Write')
+    return 'allow'; if (action.tool === 'Bash') {
+    const t = tokenizeCommand(action.command ?? '');
+    if (!t.length)
+        return 'ask';
+    for (const p of SAFE_EXACT) {
+        if (p.every((v, i) => t[i] === v))
+            return await shellIsVerified(options.shellIsolation) ? 'allow' : 'ask';
+    }
+    return 'ask';
+} if (action.tool === 'TalosService' && /^(?:list|read|search|status)$/iu.test(action.operation ?? ''))
+    return 'allow'; return 'ask'; }; }

package/dist/security/credential-free-environment.js

@@ -0,0 +1,54 @@
+/*
+ * ⭐⭐⭐ B1 slice 19 — THE KERNEL'S CREDENTIAL DENYLIST, COPIED INTO THE CLI AND PINNED TO THE KERNEL.
+ *
+ * ⛔⛔ NOT FOR ANYTHING THAT REACHES A COMMAND LINE. Round 1 of this slice used this rule to filter the
+ *   environment the MXC SDK serialises as `--config-base64` on the `wxc-exec.exe` command line, and
+ *   adversarial review measured 24 of 29 realistic secret-bearing names that carry no credential shape
+ *   (DATABASE_URL, SENTRY_DSN, GH_PAT, MYSQL_PWD, HTTPS_PROXY with credentials, …) decoded out of it. A
+ *   name-shape denylist cannot know what a VALUE holds. The probe now carries an allowlist
+ *   (`PROBE_ENVIRONMENT_NAMES`, `execution-backends.ts`) and a brokered command carries no environment.
+ *   Today this module has no production consumer; it stays, with its parity test, as the one CLI copy of
+ *   the kernel's rule for a child whose environment never touches a command line.
+ *
+ * ⛔ THIS IS THE KERNEL'S RULE, COPIED, NOT A SECOND OPINION. `harness-ui/src/kernel/talosHarness.mjs`
+ *   already scrubs every child it starts with `ambienteSenzaCredenziali()`: a denylist by SHAPE
+ *   (a closed list covered one key in five) with its non-secrets declared one by one. The kernel does
+ *   not export the shape or the exceptions, so they are copied letter for letter, and
+ *   `test/security/credential-free-environment.test.ts` reads the kernel source and judges a table of
+ *   names with the kernel's own `eUnaCredenziale`: a drift on either side turns it red.
+ * ⛔ A denylist and not an allowlist, for the kernel's reason: a typed `npm test` needs dozens of
+ *   variables nobody can list in advance.
+ */
+/** Named explicitly by the kernel as well as matched by shape (`CHIAVI_CREDENZIALI_DA_NASCONDERE`). */
+export const CREDENTIAL_NAMES_ALWAYS_HIDDEN = Object.freeze(['OPENROUTER_API_KEY']);
+/** The kernel's `FORMA_DI_CREDENZIALE`, byte for byte. Deliberately wide: what is not a secret is listed below. */
+export const CREDENTIAL_NAME_SHAPE = /TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|PRIVATE_KEY|_KEY$|^KEY_|APIKEY|API_KEY|ACCESS_KEY|AUTH/i;
+/**
+ * The kernel's `NON_SONO_SEGRETI`: names the shape matches by accident and that real commands need.
+ * `SSH_AUTH_SOCK` is the agent socket path (without it `git push` inside a command stops working),
+ * `GPG_AGENT_INFO` the same for signatures, `KEYBOARD_LAYOUT` and `AUTHORITY` match by chance.
+ */
+export const NOT_CREDENTIALS = new Set(['SSH_AUTH_SOCK', 'GPG_AGENT_INFO', 'KEYBOARD_LAYOUT', 'AUTHORITY']);
+/** True when a variable of this name must not enter a child process. The same verdict as the kernel's `eUnaCredenziale`. */
+export function isCredentialName(name) {
+    const key = String(name ?? '');
+    if (NOT_CREDENTIALS.has(key))
+        return false;
+    if (CREDENTIAL_NAMES_ALWAYS_HIDDEN.includes(key))
+        return true;
+    return CREDENTIAL_NAME_SHAPE.test(key);
+}
+/**
+ * A fresh object with every variable of `source` whose name is not a credential. Never the live
+ * `process.env`: a caller that later mutates the result cannot touch this process's environment, and
+ * an `undefined` value is left out rather than turned into the string "undefined".
+ */
+export function credentialFreeEnvironment(source = process.env) {
+    const clean = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined || isCredentialName(name))
+            continue;
+        clean[name] = value;
+    }
+    return clean;
+}

package/dist/security/evaluate.js

@@ -0,0 +1,243 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { commandOperands, expandHomePrefix, isReadOnlyShellCommand, isUnverifiableArgument, isWindowsStyleSwitch, parseRule, ruleProblem, tokenizeCommand } from "./rule-parser.js";
+import { segmentShellCommand } from "./shell-segmentation.js";
+// Every rule that can be read is compiled and every one that cannot is reported, in deny, ask, allow
+// order. ⛔ Nothing here decides to go on without a rule: that decision belongs to the caller, and the
+// engine's is to refuse — a skipped deny rule would silently allow what it denied.
+export function compileRuleSet(input) {
+    const rules = { deny: [], ask: [], allow: [] };
+    const invalid = [];
+    const source = (input ?? {});
+    for (const effect of ['deny', 'ask', 'allow']) {
+        const list = source[effect];
+        if (!Array.isArray(list)) {
+            invalid.push({ effect, index: null, value: list, problem: 'is not a list of rules' });
+            continue;
+        }
+        list.forEach((value, index) => { const problem = ruleProblem(value); if (problem !== null)
+            invalid.push({ effect, index, value, problem });
+        else
+            rules[effect].push(parseRule(value, effect)); });
+    }
+    return { rules, invalid };
+}
+export function compileRules(input) { const { rules, invalid } = compileRuleSet(input); const first = invalid[0]; if (first)
+    throw new Error(`PERMISSION_RULE_INVALID:${String(first.value)}`); return rules; }
+function inside(root, candidate) { const rel = path.relative(path.resolve(root), path.resolve(candidate)); return rel === '' || (!rel.startsWith(`..${path.sep}`) && rel !== '..' && !path.isAbsolute(rel)); }
+function wildcard(text, pattern) { if (pattern === '*' || pattern === '**')
+    return true; const escaped = pattern.replace(/[.+^${}()|[\]\\]/gu, '\\$&').replace(/\*\*/gu, '.*').replace(/\*/gu, '[^\\s]*'); return new RegExp(`^${escaped}$`, 'u').test(text); }
+// B1 slice 11. In a Bash pattern the verb is separated from its wildcard by a trailing `:*`, and
+// only by that. The previous form split on the FIRST colon, which a Windows absolute path supplies
+// itself: `Bash(cat C:\…\id_ed25519)` became the verb `cat C` plus the leftover `\…\id_ed25519`,
+// so a rule naming an exact path matched nothing — measured on this host, in the allow direction
+// AND in the deny direction — while `Bash(cat:*)` still read as "any argument". Anchoring the
+// separator at the end also stops a colon inside a command from being eaten: `Bash(npm run
+// test:unit)` now means that script, where before it meant the bare `npm run test`.
+const BASH_VERB_WILDCARD = /:\*$/u;
+// A pattern that names a command and not a path. These are the rules that must not be able to lift
+// the location boundary: the person said which command, never which file.
+export function patternNamesOnlyAVerb(pattern) { return pattern === '*' || pattern === '**' || BASH_VERB_WILDCARD.test(pattern); }
+function matches(rule, action, projectRoot) {
+    if (rule.tool !== action.tool)
+        return false;
+    const p = rule.pattern;
+    if (action.tool === 'Bash') {
+        const tokens = tokenizeCommand(action.command ?? '');
+        if (!tokens.length)
+            return false;
+        if (p === '*')
+            return true;
+        const head = BASH_VERB_WILDCARD.test(p) ? p.slice(0, -2) : p;
+        const expected = tokenizeCommand(head);
+        if (expected.length === 0)
+            return false;
+        if (expected.some((v, i) => tokens[i] !== v))
+            return false;
+        if (BASH_VERB_WILDCARD.test(p))
+            return true;
+        return expected.length === tokens.length;
+    }
+    if (['Read', 'Write', 'Edit'].includes(action.tool)) {
+        if (!action.resource)
+            return false;
+        const candidate = path.isAbsolute(action.resource) ? path.resolve(action.resource) : path.resolve(projectRoot, action.resource);
+        if (!inside(projectRoot, candidate) && p.startsWith('.'))
+            return false;
+        if (p === '*')
+            return true;
+        if (p === './**')
+            return inside(projectRoot, candidate);
+        const rel = path.relative(projectRoot, candidate).split(path.sep).join('/');
+        return wildcard(rel, p.replace(/^\.\//u, ''));
+    }
+    if (action.tool === 'Mcp') {
+        const target = `${action.serverId ?? ''}:${action.operation ?? ''}`;
+        return wildcard(target, p);
+    }
+    if (action.tool === 'TalosService') {
+        return wildcard(action.operation ?? '', p) || wildcard(`${action.resource ?? ''}:${action.operation ?? ''}`, p);
+    }
+    return wildcard(action.operation ?? action.resource ?? '', p);
+}
+// B1 slice 21. The writing path asks this before persisting a rule: a rule that does not match the very
+// request it was written for would be stored and do nothing, which is how a compound command's
+// `Bash(<whole command>)` never took effect.
+export function ruleMatchesAction(rule, action, projectRoot) { return matches(rule, action, projectRoot); }
+// B1 slice 10. The read-only shell allowance is location-bounded: it survives only while every
+// path-shaped argument of the segment resolves inside the project. This removes a silent
+// auto-approval. It is not containment and it is not credential protection — it constrains the
+// invocations TALOS's own tools produce, not a subprocess that opens files by itself, a path
+// computed at runtime, or an interpreter handed code on its command line.
+export const PATH_BOUNDARY_RULE = 'built-in:path-outside-project';
+// Resolve the real path, expanding links, Windows 8.3 short names and the `\\?\` prefix. The
+// JavaScript realpath expands neither (measured 2026-09-16: realpathSync('C:\\PROGRA~1') returns it
+// unchanged and throws EISDIR on a `\\?\` path, while realpathSync.native returns 'C:\Program
+// Files'). A path that does not exist yet is resolved through its longest existing ancestor, so a
+// link in the middle of it is still followed, and anything that cannot be resolved at all throws.
+function realPath(target) {
+    let current = path.resolve(target);
+    const tail = [];
+    for (let guard = 0; guard < 4096; guard += 1) {
+        try {
+            const real = fs.realpathSync.native(current);
+            return tail.length ? path.join(real, ...tail) : real;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'ENOENT' && code !== 'ENOTDIR')
+                throw error;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            throw new Error('PATH_UNRESOLVABLE');
+        tail.unshift(path.basename(current));
+        current = parent;
+    }
+    throw new Error('PATH_UNRESOLVABLE');
+}
+// Fail closed, the way the shared kernel's own control-path check does: a path that cannot be
+// resolved, a command that cannot be tokenized and a comparison that throws all ask, never allow.
+function readOnlyCommandStaysInside(command, projectRoot) {
+    const operands = commandOperands(command);
+    if (!operands)
+        return { ok: false, reason: 'read-only shell command could not be reduced to verifiable arguments' };
+    // The root is canonicalized once. Without this, a project opened through a link or under a short
+    // 8.3 name is a spelling no argument can ever be under, and every in-project read prompts.
+    let realRoot;
+    try {
+        realRoot = realPath(projectRoot);
+    }
+    catch {
+        return { ok: false, reason: 'project root could not be resolved' };
+    }
+    const lexicalRoot = path.resolve(projectRoot);
+    const outside = (operand, resolved) => ({ ok: false, reason: `read-only shell command would read outside the project: "${operand}" resolves to ${resolved}` });
+    for (const operand of operands) {
+        if (isUnverifiableArgument(operand))
+            return { ok: false, reason: `read-only shell command has an argument that cannot be statically verified: ${operand}` };
+        const lexical = path.resolve(projectRoot, expandHomePrefix(operand));
+        // An argument already outside the project lexically is answered without touching the
+        // filesystem. Only a path that looks inside needs the real one, because a link is the only way
+        // it can still escape — and this is what keeps an unreachable network path from stalling the
+        // decision for 21 seconds per operand while the OS waits on a host that will never answer.
+        if (!inside(lexicalRoot, lexical) && !inside(realRoot, lexical)) {
+            if (isWindowsStyleSwitch(operand) && !existsQuietly(lexical))
+                continue;
+            return outside(operand, lexical);
+        }
+        try {
+            const real = realPath(lexical);
+            if (!inside(realRoot, real))
+                return outside(operand, real);
+        }
+        catch {
+            return { ok: false, reason: `read-only shell command names a path that cannot be resolved: ${operand}` };
+        }
+    }
+    return { ok: true };
+}
+// A Windows switch is only treated as a switch while it names nothing. `dir /s` must not prompt and
+// must not be described as a path; `dir /Users` names a real directory and is judged as one.
+function existsQuietly(target) { try {
+    return fs.existsSync(target);
+}
+catch {
+    return true;
+} }
+function hardPathDeny(action, projectRoot) { if (!['Read', 'Write', 'Edit'].includes(action.tool) || !action.resource)
+    return null; const candidate = path.isAbsolute(action.resource) ? path.resolve(action.resource) : path.resolve(projectRoot, action.resource); if (!inside(projectRoot, candidate) && action.tool !== 'Read')
+    return { effect: 'deny', reason: 'write path is outside the authorized project' }; return null; }
+// An allow rule that names only a verb is downgraded to `ask` when the command reads outside the
+// project. It is NOT a denial: the person can still say yes in the moment. A rule that names the
+// path is obeyed, which is the whole distinction — "I meant this file" against "I meant this
+// command". Only `allow` is narrowed here; `deny` and `ask` rules pass through untouched.
+function verbOnlyAllowDowngrade(rule, action, projectRoot) {
+    if (rule.tool !== 'Bash' || action.tool !== 'Bash')
+        return null;
+    if (!patternNamesOnlyAVerb(rule.pattern))
+        return null;
+    if (!isReadOnlyShellCommand(action.command ?? ''))
+        return null;
+    const boundary = readOnlyCommandStaysInside(action.command ?? '', projectRoot);
+    if (boundary.ok)
+        return null;
+    return { effect: 'ask', rule: rule.raw, reason: `allow rule ${rule.raw} names a command and not a path, and ${boundary.reason}` };
+}
+function evaluateSingle(rules, action, projectRoot) {
+    const hard = hardPathDeny(action, projectRoot);
+    if (hard)
+        return hard;
+    for (const effect of ['deny', 'ask'])
+        for (const r of rules[effect])
+            if (matches(r, action, projectRoot))
+                return { effect, rule: r.raw, reason: `matched ${effect} rule` };
+    // ⛔ A downgrade is not a final answer. The natural shape of a configuration is a permissive base
+    // plus specific grants appended after it, so the rule that names the path is usually the LAST one
+    // — and if the first verb-only match ended the search, the very rule this slice tells a person to
+    // add would do nothing. The search continues; a rule that names the path still wins, and the
+    // first downgrade only speaks when no such rule exists. deny and ask keep first-match-wins.
+    let downgraded = null;
+    for (const r of rules.allow) {
+        if (!matches(r, action, projectRoot))
+            continue;
+        const downgrade = verbOnlyAllowDowngrade(r, action, projectRoot);
+        if (!downgrade)
+            return { effect: 'allow', rule: r.raw, reason: 'matched allow rule' };
+        downgraded ??= downgrade;
+    }
+    if (downgraded)
+        return downgraded;
+    if (action.tool === 'Read' && action.resource) {
+        const candidate = path.isAbsolute(action.resource) ? path.resolve(action.resource) : path.resolve(projectRoot, action.resource);
+        if (inside(projectRoot, candidate))
+            return { effect: 'allow', reason: 'read-only action inside project' };
+    }
+    if (action.tool === 'Bash' && isReadOnlyShellCommand(action.command ?? '')) {
+        const boundary = readOnlyCommandStaysInside(action.command ?? '', projectRoot);
+        if (boundary.ok)
+            return { effect: 'allow', reason: 'documented read-only shell command' };
+        return { effect: 'ask', rule: PATH_BOUNDARY_RULE, reason: boundary.reason };
+    }
+    return { effect: 'ask', reason: 'no rule matched' };
+}
+export function evaluateRules(rules, action, { projectRoot }) {
+    if (action.tool !== 'Bash')
+        return evaluateSingle(rules, action, projectRoot);
+    let segments;
+    try {
+        segments = segmentShellCommand(action.command ?? '');
+    }
+    catch {
+        return { effect: 'deny', reason: 'unsupported shell composition' };
+    }
+    const decisions = segments.map(segment => evaluateSingle(rules, { ...action, command: segment.command }, projectRoot));
+    for (const effect of ['deny', 'ask', 'allow']) {
+        const index = decisions.findIndex(decision => decision.effect === effect);
+        if (index >= 0) {
+            const decision = decisions[index];
+            return { ...decision, reason: segments.length > 1 ? `segment ${index + 1}: ${decision.reason}` : decision.reason };
+        }
+    }
+    return { effect: 'deny', reason: 'unsupported shell composition' };
+}