yenop 0.0.0 → 0.1.0

package/dist/core/report.js

@@ -0,0 +1,125 @@
+import { readAllReceipts, answersFor, isOutcome } from "./receipts.js";
+const APPROVE = "approve:";
+export function buildReport(config, opts = {}) {
+    const days = Math.max(1, Math.floor(opts.days ?? 7));
+    const to = new Date();
+    const from = new Date(to.getTime() - days * 24 * 3600 * 1000);
+    const everything = readAllReceipts(config.receiptsPath);
+    const answers = answersFor(everything);
+    const mine = config.tenant;
+    let rows = everything.filter((r) => !isOutcome(r));
+    if (!opts.all)
+        rows = rows.filter((r) => (typeof r.tenant === "string" ? r.tenant === mine.name : r.tenant.id === mine.id));
+    rows = rows.filter((r) => r.ts >= from.toISOString() && r.ts <= to.toISOString());
+    const report = {
+        from: from.toISOString(),
+        to: to.toISOString(),
+        days,
+        scope: opts.all ? "all" : mine.name,
+        runs: new Set(rows.map((r) => r.runId)).size,
+        actions: rows.length,
+        allow: 0,
+        ask: 0,
+        deny: 0,
+        askOutcomes: { "approved, ran": 0, "approved, failed": 0, "refused by the permission system": 0, "not run: rejected or abandoned": 0, "awaiting an answer": 0 },
+        askByRule: {},
+        denyByRule: {},
+        byRuntime: {},
+        byToolKind: {},
+        observedOnly: 0,
+    };
+    let answered = 0;
+    let allowedByPerson = 0;
+    for (const r of rows) {
+        report[r.effect]++;
+        report.byRuntime[r.runtime] = (report.byRuntime[r.runtime] ?? 0) + 1;
+        report.byToolKind[r.toolKind] = (report.byToolKind[r.toolKind] ?? 0) + 1;
+        if (r.mode === "observe" || !r.enforced)
+            report.observedOnly++;
+        if (r.effect === "ask") {
+            const a = answers.get(r.id);
+            if (a)
+                report.askOutcomes[a]++;
+            const allowed = a === "approved, ran" || a === "approved, failed";
+            const refused = a === "refused by the permission system" || a === "not run: rejected or abandoned";
+            if (allowed || refused) {
+                answered++;
+                if (allowed)
+                    allowedByPerson++;
+            }
+            for (const reason of r.reasons.filter((x) => x.startsWith(APPROVE))) {
+                const id = reason.slice(APPROVE.length);
+                const cell = (report.askByRule[id] ??= { asked: 0, allowed: 0, refused: 0 });
+                cell.asked++;
+                if (allowed)
+                    cell.allowed++;
+                if (refused)
+                    cell.refused++;
+            }
+        }
+        if (r.effect === "deny") {
+            for (const reason of r.reasons.filter((x) => !x.startsWith(APPROVE)))
+                report.denyByRule[reason] = (report.denyByRule[reason] ?? 0) + 1;
+        }
+    }
+    if (answered > 0)
+        report.askApprovalRate = allowedByPerson / answered;
+    return report;
+}
+function pct(n, of) {
+    return of === 0 ? "–" : `${((100 * n) / of).toFixed(1)}%`;
+}
+function top(o, n = 6) {
+    return Object.entries(o).sort((a, b) => b[1] - a[1]).slice(0, n);
+}
+/** The report as a person reads it. */
+export function renderReport(r) {
+    const L = [];
+    L.push(`Yenop report — last ${r.days} day${r.days === 1 ? "" : "s"}${r.scope === "all" ? ", every project" : ` for "${r.scope}"`}`);
+    L.push("");
+    if (r.actions === 0) {
+        L.push("No actions recorded in this period. Run an agent with Yenop installed, or try: yenop demo");
+        return L.join("\n");
+    }
+    L.push(`Runs      ${String(r.runs).padStart(7)}`);
+    L.push(`Actions   ${String(r.actions).padStart(7)}${r.observedOnly ? `   (${r.observedOnly} recorded in observe mode, not enforced)` : ""}`);
+    L.push("");
+    L.push(`ALLOW     ${String(r.allow).padStart(7)}   ${pct(r.allow, r.actions).padStart(6)}`);
+    L.push(`ASK       ${String(r.ask).padStart(7)}   ${pct(r.ask, r.actions).padStart(6)}`);
+    L.push(`DENY      ${String(r.deny).padStart(7)}   ${pct(r.deny, r.actions).padStart(6)}`);
+    if (r.ask > 0) {
+        L.push("");
+        L.push("What became of the asks");
+        for (const [k, v] of Object.entries(r.askOutcomes))
+            if (v)
+                L.push(`  ${k.padEnd(34)} ${String(v).padStart(5)}`);
+        if (r.askApprovalRate !== undefined) {
+            const p = r.askApprovalRate;
+            const verdict = p >= 0.9 ? "most asks were approved: the baseline may be asking too often" : p <= 0.3 ? "most asks were refused: these were real catches" : "a mix: some rules earn their asks, some may not";
+            L.push(`  approval rate ${pct(Math.round(p * 1000), 1000).padStart(6)}   ${verdict}`);
+        }
+        const rules = Object.entries(r.askByRule).sort((a, b) => b[1].asked - a[1].asked).slice(0, 8);
+        if (rules.length) {
+            L.push("");
+            L.push("Asks by rule                              asked  allowed  refused");
+            for (const [id, c] of rules)
+                L.push(`  ${id.padEnd(40)} ${String(c.asked).padStart(5)}  ${String(c.allowed).padStart(7)}  ${String(c.refused).padStart(7)}`);
+        }
+    }
+    if (r.deny > 0) {
+        L.push("");
+        L.push("Denies by rule");
+        for (const [id, n] of top(r.denyByRule))
+            L.push(`  ${id.padEnd(40)} ${String(n).padStart(5)}`);
+    }
+    L.push("");
+    L.push("By runtime");
+    for (const [k, n] of top(r.byRuntime))
+        L.push(`  ${k.padEnd(14)} ${String(n).padStart(7)}   ${pct(n, r.actions).padStart(6)}`);
+    L.push("");
+    L.push("By kind of action");
+    for (const [k, n] of top(r.byToolKind))
+        L.push(`  ${k.padEnd(14)} ${String(n).padStart(7)}   ${pct(n, r.actions).padStart(6)}`);
+    return L.join("\n");
+}
+//# sourceMappingURL=report.js.map

package/dist/core/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAe,MAAM,eAAe,CAAC;AA+BpF,MAAM,OAAO,GAAG,UAAU,CAAC;AAE3B,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,OAAyC,EAAE;IAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5H,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAElF,MAAM,MAAM,GAAW;QACrB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;QACxB,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;QACpB,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;QACnC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC5C,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,CAAC;QACR,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,kCAAkC,EAAE,CAAC,EAAE,gCAAgC,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE;QAC/J,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IAEF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC;gBAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,kBAAkB,CAAC;YAClE,MAAM,OAAO,GAAG,CAAC,KAAK,kCAAkC,IAAI,CAAC,KAAK,gCAAgC,CAAC;YACnG,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,QAAQ,EAAE,CAAC;gBACX,IAAI,OAAO;oBAAE,eAAe,EAAE,CAAC;YACjC,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,IAAI,OAAO;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC5B,IAAI,OAAO;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,CAAC,eAAe,GAAG,eAAe,GAAG,QAAQ,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,CAAS,EAAE,EAAU;IAChC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AACD,SAAS,GAAG,CAAC,CAAyB,EAAE,CAAC,GAAG,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,0CAA0C,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7I,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,IAAI,CAAC;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC;YAC5B,MAAM,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,iDAAiD,CAAC;YAC9M,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;YAC5E,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/J,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/H,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChI,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/core/shell.d.ts

@@ -0,0 +1,105 @@
+export interface SimpleCommand {
+    argv: string[];
+    /** True when this command reads its stdin from a pipe. */
+    piped: boolean;
+    redirects: {
+        op: string;
+        target: string;
+    }[];
+    /** Inner text of any subshell that appeared as a redirect target. */
+    redirectSubshells?: string[];
+}
+export interface ShellFacts {
+    /** Programs invoked, wrappers like sudo/env stripped. */
+    programs: string[];
+    /** Canonical operations, e.g. "git:push", "rm:-r", "terraform:destroy", "aws:ec2:terminate-instances". */
+    ops: string[];
+    /** Path-like arguments with ~ expanded. Heredoc bodies are never included. */
+    paths: string[];
+    /** Environment variables referenced, e.g. ["DATABASE_URL"]. */
+    envRefs: string[];
+    /** SQL statements of concern found in any argument, uppercased: "DROP TABLE", "DELETE FROM", ... */
+    sql: string[];
+    commandCount: number;
+    heredoc: boolean;
+    sudo: boolean;
+    /** A download or other program's output is piped into an interpreter. */
+    pipesToShell: boolean;
+    /** Any path matches the secret-file patterns. */
+    secretPath: boolean;
+    /** An env var whose name looks like a credential is referenced. */
+    secretEnv: boolean;
+    /** A network client is invoked (curl, wget, ssh, scp, rsync, nc, git clone/pull/push, ...). */
+    network: boolean;
+    /** Hosts named in URLs and ssh-style targets. */
+    hosts: string[];
+    /** The network use reaches beyond this machine and private ranges (or the host could not be determined). */
+    externalNetwork: boolean;
+    /** Content is pulled in from the network: curl/wget fetches, git clone/pull/fetch. */
+    download: boolean;
+    /** Reads data that should not travel: credential variables, secret files, database clients, secret managers, environment dumps. */
+    sensitiveRead: boolean;
+    /** Something that sends data out: an HTTP write, ssh/scp/rsync, git push, npm publish, docker push. */
+    outbound: boolean;
+    /** Deletes, force-pushes, destroys, drops, prunes, wipes. */
+    destructive: boolean;
+    /** Changes Yenop's own rules, mode, daemon, or hook registration. A guard the guarded party can reconfigure is no guard. */
+    controlPlane: boolean;
+    /** A scanner, exploitation framework, credential attack, or a reverse-shell pattern. Dual-use: legitimate in authorized testing. */
+    offensiveTool: boolean;
+    /**
+     * Part of what runs cannot be seen as a shell command: inline code handed to an interpreter (python -c,
+     * node -e, perl -e, ruby -e), a decoded blob piped to a shell, eval of a built string. Opaque code is judged
+     * by what it names (paths and hosts found in it) and otherwise treated as needing a person.
+     */
+    opaque: boolean;
+}
+/** Default secret-file patterns. `**` spans directories, `*` does not. A leading `!` excludes. */
+export declare const DEFAULT_SECRET_PATTERNS: string[];
+/**
+ * Path-like strings inside opaque code: anything quoted that looks like a path, plus bare tokens with a
+ * slash or a leading dot-directory. This does not understand the language; it does not need to. If the code
+ * names a protected file, that is enough to treat the file as touched. A false positive costs a question; a
+ * miss costs a bypass.
+ */
+export declare function pathsMentioned(code: string): string[];
+export declare function isControlPlanePath(p: string): boolean;
+/** Loopback, link-local, private ranges, and names that never leave the machine or the LAN. */
+export declare function isInternalHost(host: string): boolean;
+/** Convert a glob with `*`, `**`, `?` into a RegExp matched against a full path. */
+/**
+ * Every path that reaches a security check goes through this first.
+ *  - Backslashes become slashes: Windows paths must match the same patterns as everyone else's. Without this,
+ *    `D:\\proj\\.env` matched nothing and was readable (found by the first Windows CI run).
+ *  - Lower-cased: NTFS and default APFS are case-insensitive, so `.ENV` opens `.env`. Patterns are matched
+ *    case-insensitively everywhere; a file that differs only by case is never a different secret.
+ *  - A Windows drive prefix is kept (`c:/...`) so absolute-path logic still works.
+ */
+export declare function normalizePath(p: string, opts?: {
+    foldCase?: boolean;
+}): string;
+/** Where the filesystem itself ignores case, containment must too; where it does not, folding would loosen the check. */
+export declare const FS_IGNORES_CASE: boolean;
+export declare function globToRegExp(glob: string): RegExp;
+export declare function matchesSecretPattern(path: string, patterns?: string[]): boolean;
+interface Tok {
+    kind: "word" | "op" | "newline";
+    text: string;
+    /** For words: was any part quoted? Quoted words are never treated as operators. */
+    quoted: boolean;
+    /** Raw text inside $(...) or backticks found in this word, parsed as separate commands. */
+    subshells: string[];
+}
+export declare function tokenize(src: string): {
+    tokens: Tok[];
+    heredoc: boolean;
+};
+export declare function parseCommands(src: string): {
+    commands: SimpleCommand[];
+    heredoc: boolean;
+};
+export declare function analyzeShell(command: string, opts?: {
+    secretPatterns?: string[];
+    home?: string;
+}): ShellFacts;
+export {};