amont-agent 2.37.0

A guard that inspects a shell command before Claude Code runs it
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

//! Shell analysis: what a command may and must do, and why we think so.
//!
//! Four layers, each with one job:
//!
//! | layer | module | job |
//! |---|---|---|
//! | frontend | [`frontend`] | source → crate-owned [`ir`], spans on every node |
//! | semantics | [`interp`], [`state`], [`domain`] | abstract interpretation: state, control flow, execution counts |
//! | command models | [`models`] | a network client's arguments → its explicit transfers |
//! | policy | `rules::request_fanout` | whether the result warrants advice |
//!
//! Everything here is pure: the dialect is an input, and nothing reads the
//! world. The contract — inputs, assumptions, the supported subset, and what
//! `Unknown` and `Incomplete` mean — is in `docs/analysis.md`.

pub mod domain;
pub mod effects;
pub mod frontend;
pub mod interp;
pub mod ir;
pub mod limits;
pub mod models;
pub mod state;

use crate::rules::Dialect;
use effects::Effects;
use frontend::ParseError;
pub use interp::{Incomplete, ASSUMPTIONS};

/// What the analysis established about one command.
#[derive(Debug, Clone)]
pub struct Analysis {
    pub effects: Effects,
    /// The `pipefail` state in effect at each multi-command pipeline, by the
    /// pipeline's span in the source.
    pub pipelines: Vec<(ir::Span, state::Tri)>,
    /// Set when the analysis stopped short — a resource limit, or text the
    /// frontend could not parse. Nothing after `span` is known.
    pub incomplete: Option<Incomplete>,
}

impl Analysis {
    /// The `pipefail` state in effect for the innermost pipeline whose span
    /// contains byte offset `at`. `Tri::Maybe` when no pipeline there was
    /// analysed (unreachable, or the analysis stopped short): only `Tri::Yes`
    /// is ever grounds to stay silent.
    pub fn pipefail_at(&self, at: usize) -> state::Tri {
        self.pipelines
            .iter()
            .filter(|(span, _)| span.start <= at && at < span.end)
            .min_by_key(|(span, _)| span.end - span.start)
            .map_or(state::Tri::Maybe, |(_, t)| *t)
    }
}

/// Analyse `src` as run by `dialect`.
pub fn analyze(src: &str, dialect: Dialect) -> Analysis {
    match frontend::parse(src) {
        Ok(cmd) => {
            let out = interp::run(&cmd, src, dialect);
            Analysis {
                effects: out.effects,
                pipelines: out.pipelines,
                incomplete: out.incomplete,
            }
        }
        Err(e) => {
            let (span, why) = match e {
                ParseError::Syntax { why, span } => (span, why),
                ParseError::Limit(x) => (0..src.len(), x.describe()),
            };
            Analysis {
                effects: Effects {
                    contributions: Vec::new(),
                    unknown: vec![(span.clone(), why)],
                },
                pipelines: Vec::new(),
                incomplete: Some(Incomplete { span, why }),
            }
        }
    }
}