
    Kj                       d Z ddlmZ ddlZddlZddlZddlmZmZm	Z	m
Z
 	 ddlmZmZmZmZmZmZmZ  ed eD              Z ej,                  d      Z ej,                  d      Z ej,                  d      Z ej,                  d      Z ej,                  d      Z ej,                  d      ZddZddZddZddZ ddZ!ddZ"	 	 	 	 	 	 d dZ#y# e$ r dZdZdZd	Zd	Zd	Zdd
ZY w xY w)!zAxis 3 restricted canary - tool call classifier (canonical, PYTHONPATH-agnostic).

chair_authorization_id = CHAIR-AUTH-AXIS-3-CANARY-20260524-JJONGS-RESTRICTED-001
Pure function classifier. No I/O, no side effects, no globals mutated.
    )annotationsN)IterableMappingOptionalTuple)CREDENTIAL_PATTERNSDECISION_AUDIT_ONLYDECISION_BLOCKDECISION_WARNFORBIDDEN_PATH_GLOB_SUFFIXESFORBIDDEN_PATH_PREFIXESinitial_decision_for_category
AUDIT_ONLYWARNBLOCK c                8    | dk(  rt         S | dv rt        S t        S )Ndestructive)forbidden_pathcredential_pattern)r
   r   r	   )categorys    5/home/jay/workspace/utils/runtime_guard_classifier.pyr   r   #   s%    }$!!??  ""    c              #  F   K   | ]  }t        j                  |        y wN)recompile).0ps     r   	<genexpr>r    +   s     GaBJJqMGs   !zv(?:^|\s|;|&&|\|\|)rm\s+(?:-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*|-rf|-fr)\s+/(?:\s|$|;|&&|\|\|)zbgit\s+push\s+(?:.*\s)?--force(?:[^-]|-with-lease)?[^\n;|&]*?\s(?:origin\s+main|origin/main|main)\bzHgit\s+push\s+(?:.*\s)?-f\s+(?:.*\s)?(?:origin\s+main|origin/main|main)\bz#git\s+branch\s+-D\s+(?:.*\s)?main\bz%cokacdir(?:\s+\S+)*\s+--cron-remove\bzgit\s+reset\s+--hard\s+(\S+)c                    t         j                  |       D ]0  }|j                  d      }|dv rt        j                  d|      r0 y y)zBlock git reset --hard with explicit non-current ref.

    Conservative heuristic: allow HEAD / HEAD~N / @{u} / origin/<current> via
    classifier WARN list, only BLOCK when an explicit other branch/sha is given.
       )HEADz@{u}	ORIG_HEAD
FETCH_HEADzHEAD~\d+TF)_GIT_RESET_HARD_REfinditergroupr   	fullmatch)commandmatchrefs      r   _is_destructive_git_resetr-   =   sP     $,,W5 kk!n==<<S) r   c                    t         j                  |       ryt        j                  |       st        j                  |       ryt	        |       ryt
        j                  |       ryt        j                  |       ryy )N)zdestructive.rm_rf_rootzrm -rf / detected)zdestructive.git_push_force_mainz%git push --force origin/main detected)z'destructive.git_reset_hard_other_branchz.git reset --hard <not_current_branch> detected)z"destructive.git_branch_delete_mainzgit branch -D main detected)z destructive.cokacdir_cron_removezcokacdir --cron-remove detected)_RM_RF_ROOT_REsearch_GIT_PUSH_FORCE_MAIN_RE_GIT_PUSH_FORCE_F_MAIN_REr-   _GIT_BRANCH_DELETE_MAIN_RE_COKACDIR_CRON_REMOVE_RE)r*   s    r   _scan_destructiver5   N   ss    W%>%%g.2K2R2RSZ2[
 !)
 "((1
  &&w/
 r   c                l    | sy t         D ](  }|j                  |       }|sdd|j                   fc S  y )Nzcredential_pattern.matchzcredential pattern matched: )_CREDENTIAL_REGEXESr0   pattern)textrxms      r   _scan_credentialsr<   h   sE    ! ]IIdO.2Nrzzl0[\\] r   c                d    	 t         j                  j                  |       S # t        $ r | cY S w xY wr   )ospathabspath	Exception)r   s    r   
_norm_pathrB   r   s.    wwq!! s   ! //c                    | sy t        |       }t        D ]$  }||k(  s|j                  |dz         sdd| fc S  |j                         }t        D ]:  }|j                  d|z         s|j                  d|z         sd|z   |v s3dd| fc S  y )N/zforbidden_path.prefixzforbidden path prefix: .zforbidden_path.suffixzforbidden path suffix: )rB   r   
startswithlowerr   endswith)r?   normprefixloweredsuffixs        r   _scan_forbidden_pathrM   y   s    dD) Q6>T__Vc\:+/Fvh-OPPQ jjlG. QC&L)W-=-=cFl-KsU[|_fOf+/Fvh-OPPQ r   c              #    K   dD ]+  }|j                  |      }t        |t              s%|s(| - | dk(  rm|j                  dd      }t        |t              rJ|rG	 t        j                  |d      }|D ])  }|j                  d      s|j                  d      s&| + y y y y # t
        $ r |j	                         }Y Mw xY ww)	N)	file_pathr?   notebook_pathBashr*    T)posixrD   z~/)get
isinstancestrshlexsplitrA   rF   )	tool_name
tool_inputkeyvcmdtokensts          r   _extract_tool_pathsr`      s     5 NN3a!G FnnY+c3C%S5  <<$T(:G %( 
  %%s9   'CC/CB& 4'C
C&C?CCCc                   |i }| dk(  rD|j                  dd      }t        |t              r"t        |      }|r|\  }}t	        d      ||ddS t        | |      D ]&  }t        |      }|s|\  }}t	        d      ||ddc S  dD ]H  }|j                  |      }t        |t              s%t        |      }|s3|\  }}t	        d      ||ddc S  t        d	d
ddS )zReturn decision dict {decision, rule_id, reason, category}.

    Pure function. AUDIT_ONLY when no rule fires. tool_input may be None
    when the hook fails to parse the upstream event payload.
    rQ   r*   rR   r   )decisionrule_idreasonr   r   )content
new_stringr*   promptr   z
audit.noopzno rule fired
audit_only)	rT   rU   rV   r5   r   r`   rM   r<   r	   )	rY   rZ   r]   hitrc   rd   r   r[   r\   s	            r   classifyrj      s!    
 FnnY+c3#C(C"% =m L&$ -	  !J7 	"1%!OGV9:JK" ,	 		 > NN3a#A&C"% =>R S&$ 4	  (! 	 r   )r   rV   returnrV   )r*   rV   rk   bool)r*   rV   rk   Optional[Tuple[str, str]])r9   rV   rk   rm   )r   rV   rk   rV   )r?   rV   rk   rm   )rY   rV   rZ   zMapping[str, object]rk   zIterable[str])rY   rV   rZ   zOptional[Mapping[str, object]]rk   dict)$__doc__
__future__r   r>   r   rW   typingr   r   r   r   utils.runtime_guard_policy_mapr   r	   r
   r   r   r   r   rA   tupler7   r   r/   r1   r2   r3   r4   r&   r-   r5   r<   rB   rM   r`   rj   r   r   r   <module>rt      s5   # 	 	  5 5#  4 G3FGG  } %"**i  'BJJO  (RZZ(NO %2::&NO RZZ ?@ "4"99.9 
9}  #&MN#%  ##s   C C*)C*