@cnwenf/occ 2.1.312 → 2.1.314

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-globalThis.MACRO={"VERSION":"2.1.312","BINARY_NAME":"occ","BUILD_TIME":"2026-08-25T20:28:13.846Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
+globalThis.MACRO={"VERSION":"2.1.314","BINARY_NAME":"occ","BUILD_TIME":"2026-08-28T00:45:59.205Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
 // @bun
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -59313,7 +59313,39 @@ function hasUnescapedEmptyParens(str) {
   }
   return false;
 }
-function validatePermissionRule(rule) {
+function isOperatorToken(token) {
+  return OPERATOR_TOKEN_RE.test(token);
+}
+function hasUnescapedStar(str) {
+  for (let i2 = 0;i2 < str.length; i2++) {
+    if (str[i2] === "*" && !isEscaped(str, i2))
+      return true;
+  }
+  return false;
+}
+function wildcardBeforeSubcommand(content) {
+  if (content.endsWith(":*"))
+    return;
+  const tokens = content.trim().split(/\s+/).filter(Boolean);
+  const first = tokens[0];
+  if (tokens.length < 3 || first === undefined || hasUnescapedStar(first)) {
+    return;
+  }
+  let sawWildcard = false;
+  for (const token of tokens.slice(1)) {
+    if (isOperatorToken(token))
+      return;
+    if (hasUnescapedStar(token)) {
+      sawWildcard = true;
+      continue;
+    }
+    if (token.startsWith("-"))
+      continue;
+    return sawWildcard ? first : undefined;
+  }
+  return;
+}
+function validatePermissionRule(rule, behavior) {
   if (!rule || rule.trim() === "") {
     return { valid: false, error: "Permission rule cannot be empty" };
   }
@@ -59397,6 +59429,18 @@ function validatePermissionRule(rule) {
         examples: ["Bash(npm:*)", "Bash(git:*)"]
       };
     }
+    if (behavior === "allow") {
+      const flaggedCommand = wildcardBeforeSubcommand(content);
+      if (flaggedCommand !== undefined) {
+        const isGit = flaggedCommand === "git";
+        const gitNote = isGit ? " For git, options such as -c and --exec-path can run arbitrary commands." : "";
+        const gitExample = isGit ? " (for example Bash(git status *))" : "";
+        return {
+          valid: true,
+          warning: `${permissionRuleValueToString(parsed)} has a wildcard before the rest of the command, so it also matches any options inserted at that position and approves them without a prompt.${gitNote} Replace that * with the exact value you mean, or only use * after the subcommand${gitExample}.`
+        };
+      }
+    }
   }
   if (isFilePatternTool(parsed.toolName) && parsed.ruleContent !== undefined) {
     const content = parsed.ruleContent;
@@ -59436,13 +59480,14 @@ function validatePermissionRule(rule) {
   }
   return { valid: true };
 }
-var PermissionRuleSchema;
+var OPERATOR_TOKEN_RE, PermissionRuleSchema;
 var init_permissionValidation = __esm(() => {
   init_v4();
   init_mcpStringUtils();
   init_permissionRuleParser();
   init_stringUtils();
   init_toolValidationConfig();
+  OPERATOR_TOKEN_RE = /^(?:[|&;<>]|\d+[<>])/;
   PermissionRuleSchema = lazySchema(() => exports_external.string().superRefine((val, ctx) => {
     const result = validatePermissionRule(val);
     if (!result.valid) {
@@ -252307,7 +252352,8 @@ var init_TaskOutput = __esm(() => {
         const tail = safeJoinLines(recent, `
 `);
         const sizeKB = Math.round(this.#totalBytes / 1024);
-        const notice = `
+        const notice = this.#disk.failing || this.#disk.lostOutput ? `
+Output truncated (${sizeKB}KB total). The full output could not all be saved to ${this.path}; that file may be missing or incomplete.` : `
 Output truncated (${sizeKB}KB total). Full output saved to: ${this.path}`;
         return tail ? tail + notice : notice.trimStart();
       }
@@ -385289,6 +385335,35 @@ function hasQuotedBracketCloserInConditional(command4) {
   }
   return false;
 }
+function hasDanglingBooleanOperator(command4) {
+  if (!command4.includes("&&") && !command4.includes("||"))
+    return false;
+  let inSingle = false;
+  let inDouble = false;
+  let lastBoolOpEnd = -1;
+  for (let i6 = 0;i6 < command4.length; i6++) {
+    const ch2 = command4[i6];
+    if (ch2 === "\\" && !inSingle) {
+      i6++;
+      continue;
+    }
+    if (ch2 === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (ch2 === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (inSingle || inDouble)
+      continue;
+    if (ch2 === "&" && command4[i6 + 1] === "&" || ch2 === "|" && command4[i6 + 1] === "|") {
+      lastBoolOpEnd = i6 + 2;
+      i6++;
+    }
+  }
+  return lastBoolOpEnd !== -1 && command4.slice(lastBoolOpEnd).trim() === "";
+}
 async function bashToolHasPermission(input, context4, getCommandSubcommandPrefixFn = getCommandSubcommandPrefix) {
   let appState = context4.getAppState();
   {
@@ -385388,6 +385463,15 @@ async function bashToolHasPermission(input, context4, getCommandSubcommandPrefix
       };
     }
   }
+  {
+    const mode = appState.toolPermissionContext.mode;
+    if (mode !== "bypassPermissions" && hasDanglingBooleanOperator(input.command)) {
+      return {
+        behavior: "ask",
+        message: "Malformed command with a dangling && or || operator requires confirmation."
+      };
+    }
+  }
   const injectionCheckDisabled = isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK);
   const shadowEnabled = feature("TREE_SITTER_BASH_SHADOW") ? getFeatureValue_CACHED_MAY_BE_STALE("tengu_birch_trellis", true) : false;
   let astRoot = injectionCheckDisabled ? null : feature("TREE_SITTER_BASH_SHADOW") && !shadowEnabled ? null : await parseCommandRaw(input.command);
@@ -635547,19 +635631,19 @@ async function initializeToolPermissionContext({
   }
   for (const rule of rulesFromDisk) {
     const ruleStr = permissionRuleValueToString(rule.ruleValue);
-    const result = validatePermissionRule(ruleStr);
+    const result = validatePermissionRule(ruleStr, rule.ruleBehavior);
     if (result.valid && result.warning) {
       warnings.push(`Permission ${rule.ruleBehavior} rule (${formatPermissionSource(rule.source)}): ${result.warning}`);
     }
   }
   for (const ruleStr of parsedAllowedToolsCli) {
-    const result = validatePermissionRule(ruleStr);
+    const result = validatePermissionRule(ruleStr, "allow");
     if (result.valid && result.warning) {
       warnings.push(`Permission allow rule (--allowed-tools): ${result.warning}`);
     }
   }
   for (const ruleStr of parsedDisallowedToolsCli) {
-    const result = validatePermissionRule(ruleStr);
+    const result = validatePermissionRule(ruleStr, "deny");
     if (result.valid && result.warning) {
       warnings.push(`Permission deny rule (--disallowed-tools): ${result.warning}`);
     }
@@ -726009,6 +726093,7 @@ __export(exports_diskOutput, {
   appendTaskOutput: () => appendTaskOutput,
   _resetTaskOutputDirForTest: () => _resetTaskOutputDirForTest,
   _clearOutputsForTest: () => _clearOutputsForTest,
+  OUTPUT_OMITTED_MARKER_FOR_TEST: () => OUTPUT_OMITTED_MARKER_FOR_TEST,
   MAX_TASK_OUTPUT_BYTES_DISPLAY: () => MAX_TASK_OUTPUT_BYTES_DISPLAY,
   MAX_TASK_OUTPUT_BYTES: () => MAX_TASK_OUTPUT_BYTES,
   DiskTaskOutput: () => DiskTaskOutput
@@ -726049,6 +726134,11 @@ class DiskTaskOutput {
   #queue = [];
   #bytesWritten = 0;
   #capped = false;
+  #unwrittenChars = 0;
+  #cancelCount = 0;
+  #failing = false;
+  #seenFailureKeys = new Set;
+  #lostOutput = false;
   #flushPromise = null;
   #flushResolve = null;
   constructor(taskId) {
@@ -726061,11 +726151,14 @@ class DiskTaskOutput {
     this.#bytesWritten += content.length;
     if (this.#bytesWritten > MAX_TASK_OUTPUT_BYTES) {
       this.#capped = true;
-      this.#queue.push(`
+      const marker = `
 [output truncated: exceeded ${MAX_TASK_OUTPUT_BYTES_DISPLAY} disk cap]
-`);
+`;
+      this.#queue.push(marker);
+      this.#unwrittenChars += marker.length;
     } else {
       this.#queue.push(content);
+      this.#unwrittenChars += content.length;
     }
     if (!this.#flushPromise) {
       this.#flushPromise = new Promise((resolve59) => {
@@ -726077,8 +726170,19 @@ class DiskTaskOutput {
   flush() {
     return this.#flushPromise ?? Promise.resolve();
   }
+  get failing() {
+    return this.#failing;
+  }
+  get lostOutput() {
+    return this.#lostOutput;
+  }
+  get unwrittenChars() {
+    return this.#unwrittenChars;
+  }
   cancel() {
+    this.#cancelCount += 1;
     this.#queue.length = 0;
+    this.#unwrittenChars = 0;
   }
   async#drainAllChunks() {
     while (true) {
@@ -726088,7 +726192,17 @@ class DiskTaskOutput {
           this.#fileHandle = await open15(this.#path, process.platform === "win32" ? "a" : fsConstants9.O_WRONLY | fsConstants9.O_APPEND | fsConstants9.O_CREAT | O_NOFOLLOW2);
         }
         while (true) {
-          await this.#writeAllChunks();
+          const cancelCount = this.#cancelCount;
+          try {
+            await this.#writeAllChunks();
+          } catch (e4) {
+            if (this.#cancelCount === cancelCount) {
+              this.#lostOutput = true;
+              this.#queue.unshift(OUTPUT_OMITTED_MARKER);
+              this.#unwrittenChars += OUTPUT_OMITTED_MARKER.length;
+            }
+            throw e4;
+          }
           if (this.#queue.length === 0) {
             break;
           }
@@ -726111,6 +726225,7 @@ class DiskTaskOutput {
   }
   #queueToBuffers() {
     const queue2 = this.#queue.splice(0, this.#queue.length);
+    this.#unwrittenChars = 0;
     let totalLength = 0;
     for (const str2 of queue2) {
       totalLength += Buffer.byteLength(str2, "utf8");
@@ -726125,13 +726240,18 @@ class DiskTaskOutput {
   async#drain() {
     try {
       await this.#drainAllChunks();
+      this.#clearFailureState();
     } catch (e4) {
-      logError2(e4);
+      if (!this.#failing) {
+        this.#failing = true;
+        logError2(new Error(`Task output drain failed (will retry once): ${e4}`));
+      }
       if (this.#queue.length > 0) {
         try {
           await this.#drainAllChunks();
+          this.#clearFailureState();
         } catch (e22) {
-          logError2(e22);
+          this.#handleFinalDrainFailure(e22);
         }
       }
     } finally {
@@ -726141,6 +726261,30 @@ class DiskTaskOutput {
       resolve59();
     }
   }
+  #clearFailureState() {
+    this.#failing = false;
+    this.#seenFailureKeys.clear();
+  }
+  #handleFinalDrainFailure(e4) {
+    const code = getErrnoCode(e4);
+    const kind = code !== undefined && DISK_EXHAUSTION_ERRNOS.has(code) ? "exhaustion" : "unexpected";
+    const failureKey = `${kind}:${code ?? "no errno"}`;
+    if (!this.#seenFailureKeys.has(failureKey)) {
+      this.#seenFailureKeys.add(failureKey);
+      if (kind === "exhaustion") {
+        logError2(new Error(`Task output drain retry failed (${code}): ${e4}`));
+      } else {
+        logError2(e4);
+      }
+    }
+    if (this.#unwrittenChars > MAX_UNWRITTEN_CHARS_BEFORE_DROP) {
+      logError2(new Error(`Task output still cannot be written (${code ?? "no errno"}); dropped ${this.#unwrittenChars} chars of unwritten output`));
+      this.#lostOutput = true;
+      this.#queue.length = 0;
+      this.#queue.push(OUTPUT_OMITTED_MARKER);
+      this.#unwrittenChars = OUTPUT_OMITTED_MARKER.length;
+    }
+  }
 }
 async function _clearOutputsForTest() {
   for (const output2 of outputs.values()) {
@@ -726159,6 +726303,14 @@ function getOrCreateOutput(taskId) {
   }
   return output2;
 }
+function logTaskOutputFailure(context8, e4) {
+  const code = getErrnoCode(e4);
+  if (code && DISK_EXHAUSTION_ERRNOS.has(code)) {
+    logError2(new Error(`${context8} failed (${code}): ${e4}`));
+  } else {
+    logError2(e4);
+  }
+}
 function appendTaskOutput(taskId, content) {
   getOrCreateOutput(taskId).append(content);
 }
@@ -726173,6 +726325,9 @@ function evictTaskOutput(taskId) {
     const output2 = outputs.get(taskId);
     if (output2) {
       await output2.flush();
+      if (output2.failing && output2.unwrittenChars > 0) {
+        logError2(new Error(`Task output writer evicted while failing; discarded ${output2.unwrittenChars} chars of unwritten output`));
+      }
       outputs.delete(taskId);
     }
   })());
@@ -726192,7 +726347,7 @@ async function getTaskOutputDelta(taskId, fromOffset, maxBytes = DEFAULT_MAX_REA
     if (code === "ENOENT") {
       return { content: "", newOffset: fromOffset };
     }
-    logError2(e4);
+    logTaskOutputFailure("getTaskOutputDelta", e4);
     return { content: "", newOffset: fromOffset };
   }
 }
@@ -726209,7 +726364,7 @@ ${content}`;
     if (code === "ENOENT") {
       return "";
     }
-    logError2(e4);
+    logTaskOutputFailure("getTaskOutput", e4);
     return "";
   }
 }
@@ -726221,7 +726376,7 @@ async function getTaskOutputSize(taskId) {
     if (code === "ENOENT") {
       return 0;
     }
-    logError2(e4);
+    logTaskOutputFailure("getTaskOutputSize", e4);
     return 0;
   }
 }
@@ -726238,7 +726393,7 @@ async function cleanupTaskOutput(taskId) {
     if (code === "ENOENT") {
       return;
     }
-    logError2(e4);
+    logTaskOutputFailure("cleanupTaskOutput", e4);
   }
 }
 function initTaskOutput(taskId) {
@@ -726268,7 +726423,9 @@ function initTaskOutputAsSymlink(taskId, targetPath) {
     }
   })());
 }
-var O_NOFOLLOW2, DEFAULT_MAX_READ_BYTES, MAX_TASK_OUTPUT_BYTES, MAX_TASK_OUTPUT_BYTES_DISPLAY = "5GB", _taskOutputDir, _pendingOps, outputs;
+var O_NOFOLLOW2, DEFAULT_MAX_READ_BYTES, MAX_TASK_OUTPUT_BYTES, MAX_TASK_OUTPUT_BYTES_DISPLAY = "5GB", MAX_UNWRITTEN_CHARS_BEFORE_DROP, OUTPUT_OMITTED_MARKER = `
+[output omitted: it could not be written to disk]
+`, OUTPUT_OMITTED_MARKER_FOR_TEST, DISK_EXHAUSTION_ERRNOS, _taskOutputDir, _pendingOps, outputs;
 var init_diskOutput = __esm(() => {
   init_state();
   init_errors();
@@ -726278,6 +726435,14 @@ var init_diskOutput = __esm(() => {
   O_NOFOLLOW2 = fsConstants9.O_NOFOLLOW ?? 0;
   DEFAULT_MAX_READ_BYTES = 8 * 1024 * 1024;
   MAX_TASK_OUTPUT_BYTES = 5 * 1024 * 1024 * 1024;
+  MAX_UNWRITTEN_CHARS_BEFORE_DROP = 16 * 1024 * 1024;
+  OUTPUT_OMITTED_MARKER_FOR_TEST = OUTPUT_OMITTED_MARKER;
+  DISK_EXHAUSTION_ERRNOS = new Set([
+    "ENOSPC",
+    "EDQUOT",
+    "ENFILE",
+    "EMFILE"
+  ]);
   _pendingOps = new Set;
   outputs = new Map;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cnwenf/occ",
-  "version": "2.1.312",
+  "version": "2.1.314",
   "license": "MIT",
   "type": "module",
   "bin": {