@coo-quack/sensitive-canary 0.6.0 → 0.8.0

package/dist/lib/shell.js

@@ -0,0 +1,436 @@
+// Shell syntax, and nothing about what any particular command means.
+//
+// Splitting a command line into segments and tokens, quote removal, heredoc
+// bodies, and the substitutions whose inner text is a command line of its own.
+// Everything here answers "what are the pieces of this command line". What a
+// piece does with its operands is bash-commands.ts.
+// The quoting rule, for the scanners that only need to step over it: a quote
+// character opens a run and its twin closes it, and a backslash escapes the next
+// character everywhere except inside single quotes, where it is literal.
+//
+// Three of them spelled that out for themselves — as `quote === '"' && ch ===
+// "\\"`, as `ch === "\\" && quote !== "'"`, and as `i += quote === "'" ? 1 : 2`.
+// They agreed, which is the point: three spellings of one rule agree until
+// someone corrects one of them.
+//
+// `tokenizeCommand` is not one of the three and keeps its own reading, because
+// it does not step over a quoted run — it builds the token's text out of it,
+// dropping the quotes, decoding `$'…'` escapes and keeping a backslash literal
+// inside single quotes. Returning a position cannot say what the text became.
+function stepQuote(s, i, quote) {
+    const ch = s[i];
+    if (ch === "\\" && quote !== "'") {
+        return { next: i + 2, quote, consumed: true };
+    }
+    if (quote !== null) {
+        return ch === quote
+            ? { next: i + 1, quote: null, consumed: true }
+            : { next: i + 1, quote, consumed: false };
+    }
+    if (ch === "'" || ch === '"') {
+        return { next: i + 1, quote: ch, consumed: true };
+    }
+    return { next: i + 1, quote: null, consumed: false };
+}
+// Variable names referenced by the command, including expansion forms that carry
+// a suffix such as `${TOKEN:-fallback}` or `${TOKEN#prefix}`.
+//
+// Every `$` that a name follows counts, rather than each expansion being matched
+// whole. Matching `${NAME…}` as a unit meant the suffix was consumed by the
+// pattern that skipped to the closing brace, and a name inside the suffix went
+// with it: `${A:-$TOKEN}` prints `$TOKEN` when `A` is unset, and named only `A`.
+// An unclosed `${NAME` now yields its name too, which errs towards scanning.
+export function extractEnvVarNames(command) {
+    const names = new Set();
+    for (const match of command.matchAll(/\$\{?([A-Za-z_][A-Za-z0-9_]*)/g)) {
+        const name = match[1];
+        if (name)
+            names.add(name);
+    }
+    return [...names];
+}
+// Split a command line into segments (at |, ;, &, &&, || and newlines) and each
+// segment into tokens with quotes removed. Redirection operators become tokens of
+// their own so that `wc -l <f` and `wc -l < f` tokenize alike. Substitutions are
+// left in place; extractSubstitutions handles them against the raw string.
+export function tokenizeCommand(command) {
+    const segments = [];
+    let tokens = [];
+    let current = "";
+    let hasCurrent = false;
+    let i = 0;
+    const endToken = () => {
+        if (hasCurrent) {
+            tokens.push({ value: current, redirect: false });
+            current = "";
+            hasCurrent = false;
+        }
+    };
+    const endSegment = () => {
+        endToken();
+        if (tokens.length > 0)
+            segments.push(tokens);
+        tokens = [];
+    };
+    while (i < command.length) {
+        const ch = command[i];
+        if (ch === "\\") {
+            const next = command[i + 1];
+            if (next !== undefined && next !== "\n") {
+                current += next;
+                hasCurrent = true;
+            }
+            i += next === undefined ? 1 : 2;
+            continue;
+        }
+        if (ch === "'" ||
+            ch === '"' ||
+            (ch === "$" && (command[i + 1] === "'" || command[i + 1] === '"'))) {
+            // $'...' (ANSI-C) and $"..." (locale) are quoting syntax: the `$` is not
+            // part of the token. Inside $'...', backslash escapes are decoded.
+            let quote = ch;
+            let ansiC = false;
+            if (ch === "$") {
+                quote = command[i + 1];
+                ansiC = quote === "'";
+                i += 2;
+            }
+            else {
+                i++;
+            }
+            hasCurrent = true;
+            while (i < command.length && command[i] !== quote) {
+                if (command[i] === "\\" && command[i + 1] !== undefined) {
+                    if (quote === '"' || ansiC) {
+                        current += ansiC
+                            ? decodeAnsiCEscape(command, i)
+                            : command[i + 1];
+                        i += ansiC ? ansiCEscapeLength(command, i) : 2;
+                        continue;
+                    }
+                    // plain single quotes keep backslashes literal
+                }
+                current += command[i];
+                i++;
+            }
+            i++; // closing quote, or end of input for an unbalanced one
+            continue;
+        }
+        if (ch === "|" || ch === ";" || ch === "&" || ch === "\n") {
+            endSegment();
+            while (i < command.length && /[|;&\n\s]/.test(command[i]))
+                i++;
+            continue;
+        }
+        // A substitution standing among the operands is one word to the command, so
+        // it is consumed whole and no token is emitted for it. Ending the segment
+        // here instead would cut the operand list in two: `cat <(echo hi) secrets`
+        // leaves `secrets` in a segment of its own, where it reads as a command name
+        // and its own reading goes unseen.
+        //
+        // The inner command is still reached: extractSubstitutions walks the raw
+        // string for these forms, and the paths are deduplicated.
+        if ((ch === "$" || ch === "<" || ch === ">") && command[i + 1] === "(") {
+            endToken();
+            i = findSubstitutionEnd(command, i + 2, ")") + 1;
+            continue;
+        }
+        // A subshell holds a command line of its own. Without this, `(cat secrets)`
+        // tokenized as `(cat` and `secrets)`, naming neither a command this hook
+        // classifies nor a path that exists, and the read went unseen.
+        if (ch === "(" || ch === ")") {
+            endSegment();
+            i++;
+            continue;
+        }
+        if (ch === "<" || ch === ">") {
+            // A file-descriptor prefix belongs to the operator, not to a token of its
+            // own, so `cmd 2>err` tokenizes like `cmd >err`. Left as a token, the `2`
+            // would read as an operand of the command — a filename, or a subcommand
+            // for whatever later decides what a command does with its operands. It
+            // names neither, so it is dropped. Only digits written against the
+            // operator count, leaving `sort 1 >out` alone.
+            if (hasCurrent && /^\d+$/.test(current)) {
+                current = "";
+                hasCurrent = false;
+            }
+            endToken();
+            let op = ch;
+            i++;
+            while (i < command.length && command[i] === ch) {
+                op += ch;
+                i++;
+            }
+            tokens.push({ value: op, redirect: true });
+            continue;
+        }
+        if (ch === " " || ch === "\t" || ch === "\r") {
+            endToken();
+            i++;
+            continue;
+        }
+        current += ch;
+        hasCurrent = true;
+        i++;
+    }
+    endSegment();
+    return segments;
+}
+// Length of the ANSI-C escape starting at `command[i]` (a backslash), so the
+// tokenizer can skip the whole sequence: \xHH is 4 chars, anything else is 2.
+function ansiCEscapeLength(command, i) {
+    return command[i + 1] === "x" &&
+        /^[0-9A-Fa-f]{2}$/.test(command.slice(i + 2, i + 4))
+        ? 4
+        : 2;
+}
+// Decode the ANSI-C escape starting at `command[i]` (a backslash). Covers the
+// escapes that appear in paths: \\, \', \", \xHH and the common letter escapes.
+function decodeAnsiCEscape(command, i) {
+    const esc = command[i + 1];
+    if (esc === "x" && /^[0-9A-Fa-f]{2}$/.test(command.slice(i + 2, i + 4))) {
+        return String.fromCharCode(Number.parseInt(command.slice(i + 2, i + 4), 16));
+    }
+    const simple = {
+        "\\": "\\",
+        "'": "'",
+        '"': '"',
+        n: "\n",
+        t: "\t",
+        r: "\r",
+        "0": "\0",
+    };
+    return simple[esc] ?? esc;
+}
+// The delimiter word starting at `line[from]`, with quote removal applied the way
+// the shell does it: `<<EOF`, `<<'EOF'`, `<<"EOF"` and `<<E"O"F` all end their
+// body at the line `EOF`. The word ends at whitespace or a shell metacharacter.
+//
+// A narrower character class (`[A-Za-z0-9_.]`) cuts the word short, and a
+// truncated delimiter never matches the real closing line: stripHeredocBodies
+// then swallows the rest of the command, so `cat > f <<EOF-1 … EOF-1` followed
+// by `cat .env` hides the read entirely.
+function readHeredocDelimiter(line, from) {
+    let delim = "";
+    let i = from;
+    while (i < line.length) {
+        const ch = line[i];
+        if (ch === "'" || ch === '"') {
+            i++;
+            while (i < line.length && line[i] !== ch) {
+                if (ch === '"' && line[i] === "\\" && line[i + 1] !== undefined) {
+                    delim += line[i + 1];
+                    i += 2;
+                    continue;
+                }
+                delim += line[i];
+                i++;
+            }
+            i++; // closing quote, or end of line for an unbalanced one
+            continue;
+        }
+        if (ch === "\\" && line[i + 1] !== undefined) {
+            delim += line[i + 1];
+            i += 2;
+            continue;
+        }
+        if (/[\s|&;()<>`]/.test(ch))
+            break;
+        delim += ch;
+        i++;
+    }
+    return { delim, next: i };
+}
+// Heredoc delimiters introduced by one command line, in order. `<<-` allows a
+// tab-indented closing delimiter; `<<<` is a herestring and is not a heredoc.
+// Matches outside quotes only, so `echo "a <<EOF b"` is not a heredoc start.
+function findHeredocDelimiters(line) {
+    const found = [];
+    let quote = null;
+    let i = 0;
+    while (i < line.length) {
+        const step = stepQuote(line, i, quote);
+        quote = step.quote;
+        if (step.consumed || quote !== null) {
+            i = step.next;
+            continue;
+        }
+        const ch = line[i];
+        if (ch === "<" && line[i + 1] === "<") {
+            let j = i + 2;
+            let allowTabs = false;
+            if (line[j] === "-") {
+                allowTabs = true;
+                j++;
+            }
+            if (line[j] === "<") {
+                i = j; // herestring
+                continue;
+            }
+            while (line[j] === " " || line[j] === "\t")
+                j++;
+            const { delim, next } = readHeredocDelimiter(line, j);
+            if (delim)
+                found.push({ delim, allowTabs });
+            i = next;
+            continue;
+        }
+        i++;
+    }
+    return found;
+}
+// Remove heredoc bodies from a command line. A body is text, not commands —
+// `cat > deploy.sh <<EOF` followed by a script that mentions `.env` reads
+// nothing, and scanning the body as shell blocks exactly that everyday case.
+// The trade-off: a heredoc that *feeds* commands to a remote shell
+// (`ssh host <<EOF\ncat /secret\nEOF`) is not caught. Written up as a
+// known limitation under "② PreToolUse hook" in the README.
+export function stripHeredocBodies(command) {
+    const lines = command.split("\n");
+    const kept = [];
+    const pending = [];
+    for (const line of lines) {
+        if (pending.length > 0) {
+            const first = pending[0];
+            const cmp = first.allowTabs ? line.replace(/^\t+/, "") : line;
+            if (cmp === first.delim)
+                pending.shift();
+            continue;
+        }
+        pending.push(...findHeredocDelimiters(line));
+        kept.push(line);
+    }
+    return kept.join("\n");
+}
+// Substitution syntaxes whose inner text is a command line in its own right.
+// Command substitution and backticks expand inside double quotes; the process
+// substitutions do not, so `echo "<(cat f)"` is a literal string.
+const SUBSTITUTIONS = [
+    { open: "$(", close: ")", expandsInDoubleQuotes: true },
+    { open: "<(", close: ")", expandsInDoubleQuotes: false },
+    { open: ">(", close: ")", expandsInDoubleQuotes: false },
+    { open: "`", close: "`", expandsInDoubleQuotes: true },
+];
+// Index of the character closing a substitution whose body starts at `from`.
+// Parentheses are counted rather than matched with a regex, because a body
+// carries parentheses of its own: `$(python3 -c "print(open('.env').read())")`
+// was cut short at the first `)` by the old `[^()]*` pattern, and the read it
+// contained was never scanned. Quotes and backslashes inside the body are
+// respected. An unbalanced substitution runs to the end of the string.
+function findSubstitutionEnd(command, from, close) {
+    let depth = 0;
+    let quote = null;
+    let i = from;
+    while (i < command.length) {
+        const step = stepQuote(command, i, quote);
+        quote = step.quote;
+        if (step.consumed || quote !== null) {
+            i = step.next;
+            continue;
+        }
+        const ch = command[i];
+        const at = i;
+        i = step.next;
+        if (close === "`") {
+            if (ch === "`")
+                return at;
+            continue;
+        }
+        if (ch === "(")
+            depth++;
+        else if (ch === ")") {
+            if (depth === 0)
+                return at;
+            depth--;
+        }
+    }
+    return command.length;
+}
+// Inner text of every outermost command substitution, process substitution and
+// backtick expression. Only the outermost ones: each is a command line in its
+// own right, so a nested substitution is reached by the caller feeding what this
+// returns back through it.
+export function extractSubstitutions(command) {
+    const found = [];
+    let quote = null;
+    let i = 0;
+    // Unlike the scanners above, this one has to look inside double quotes: a
+    // command substitution expands there. So it skips only what `stepQuote` calls
+    // consumed, and asks the quote state whether an opener counts where it stands.
+    while (i < command.length) {
+        const step = stepQuote(command, i, quote);
+        quote = step.quote;
+        if (step.consumed) {
+            i = step.next;
+            continue;
+        }
+        const opener = SUBSTITUTIONS.find((s) => command.startsWith(s.open, i) &&
+            (quote === null || (quote === '"' && s.expandsInDoubleQuotes)));
+        if (opener === undefined) {
+            i = step.next;
+            continue;
+        }
+        const bodyStart = i + opener.open.length;
+        const end = findSubstitutionEnd(command, bodyStart, opener.close);
+        found.push(command.slice(bodyStart, end));
+        i = end + 1;
+    }
+    return found;
+}
+// Shell keywords and the brace-group delimiters. They stand where a command
+// name would, so without this list a segment led by one is classified as a
+// command called `{` or `then` and its operands are never looked at:
+// `{ cat secrets; }`, `if …; then cat secrets; fi` and
+// `while cat secrets; do :; done` each read a file nothing notices. The keywords that open a condition (`if`, `while`,
+// `until`) matter as much as the ones that open a body: the command being tested
+// runs too.
+export const SHELL_KEYWORD_TOKENS = new Set([
+    "{",
+    "}",
+    "!",
+    "if",
+    "then",
+    "else",
+    "elif",
+    "fi",
+    "while",
+    "until",
+    "for",
+    "do",
+    "done",
+    "case",
+    "esac",
+    "in",
+    "select",
+]);
+// True for a token that cannot name a command: a redirection operator, a flag, a
+// `VAR=value` assignment placed before one, or a shell keyword.
+export function isNonCommandToken(token) {
+    if (token.redirect)
+        return true;
+    const { value } = token;
+    if (value.startsWith("-"))
+        return true;
+    if (SHELL_KEYWORD_TOKENS.has(value))
+        return true;
+    return /^[A-Za-z_][A-Za-z0-9_]*=/.test(value);
+}
+// Longest quoted literal inside inline code still treated as a path candidate.
+// Exported so its test reads the cap instead of copying the number.
+export const MAX_QUOTED_LITERAL_LENGTH = 4096;
+// Quoted literals inside inline program text — the ".env" in
+// `python3 -c "print(open('.env').read())"`. Literals containing line breaks or
+// tabs are skipped: those are messages and patterns, not paths. Spaces are kept,
+// so a path like `open('my secret.txt')` is still found.
+export function extractQuotedLiterals(code) {
+    const literals = [];
+    for (const match of code.matchAll(/'([^']*)'|"([^"]*)"/g)) {
+        const value = match[1] ?? match[2];
+        if (value &&
+            value.length <= MAX_QUOTED_LITERAL_LENGTH &&
+            !/[\t\r\n]/.test(value)) {
+            literals.push(value);
+        }
+    }
+    return literals;
+}

package/dist/lib/tool-inputs.js

@@ -0,0 +1,217 @@
+// Which tool calls name a file they are about to read.
+//
+// A tool's semantics are not knowable from its input, so this reads the tool's
+// name and the shape of its input object: the fields that carry a path, and the
+// names that say the tool writes rather than reads.
+// Tools that never surface the contents of a file they name. Scanning these
+// would block writing to a file that already holds a secret, which is not a leak.
+export const TOOLS_WITHOUT_FILE_OUTPUT = new Set([
+    "Write",
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+    "TodoWrite",
+    "Glob",
+    "WebFetch",
+    "WebSearch",
+    "ExitPlanMode",
+    "AskUserQuestion",
+]);
+// A tool whose name says it writes is treated like the built-in Write and Edit:
+// naming a file it does not read is not a leak. Matched on the tool name because
+// an MCP tool's semantics are not otherwise knowable from its input. For MCP
+// tools (`mcp__<server>__<tool>`) only the tool component is matched — a server
+// named "editor" or "readwrite" must not exempt every read tool it offers.
+// The verb has to be the first word of the name, not a substring of it anywhere.
+// As a substring test this would exempt reads: "update" sits inside
+// `get_updates`, and "write" inside `read_and_write_file` — a tool that returns
+// contents read as one that only writes. Word boundaries are the `_`/`-` in snake and
+// kebab names and, in camelCase, a capital that follows a lowercase letter — so
+// `write_file`, `createPage` and `WRITE_FILE` all match while `overwrite_file`
+// and `readwrite` do not.
+//
+// Erring this way costs a false block on a noun-first write tool (`file_write`),
+// which is the direction to fail in. The built-in write tools are named
+// explicitly in TOOLS_WITHOUT_FILE_OUTPUT, so `TodoWrite` and `MultiEdit` do not
+// depend on this at all.
+//
+// What the exemption assumes is that the tool returns no file contents, which is
+// not quite what its name says. `update` and `copy` are where the two come
+// apart: a tool called `update_file` or `copy_file` opens a file to do its work,
+// and one that returned the result would go unscanned. They stay, because the
+// alternative costs more — scanning them blocks writing to a file that already
+// holds a secret, which is not a leak — and the gap that leaves is written up
+// under Known Limitations in the README.
+// Exported so the tests can generate a case per verb rather than list the ones
+// someone remembered: a verb added here without a test is what let `WRITE_FILE`
+// go unexempt for a release.
+export const WRITING_TOOL_VERBS = new Set([
+    "write",
+    "create",
+    "edit",
+    "update",
+    "append",
+    "delete",
+    "remove",
+    "move",
+    "rename",
+    "mkdir",
+    "copy",
+]);
+// The first word of a tool name. Splitting on every capital broke the all-caps
+// spelling: `WRITE_FILE` came apart into single letters and its first word was
+// `W`, so a write tool was scanned as a read. A capital only starts a new word
+// when it follows a lowercase letter or a digit, which is what camelCase means;
+// a run of capitals is one word.
+function firstWord(name) {
+    const [first] = name
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean);
+    return first;
+}
+export function isWritingTool(tool) {
+    const name = tool.startsWith("mcp__")
+        ? (tool.split("__").pop() ?? tool)
+        : tool;
+    const first = firstWord(name);
+    return first !== undefined && WRITING_TOOL_VERBS.has(first.toLowerCase());
+}
+// Input field names that commonly carry a filesystem path, compared with
+// separators and case removed. Listing the spellings instead meant the same
+// field was missed under a different one: `file_path` and `filePath` were both
+// here, but `filepath` was not, and neither was `filename` or `source_path`.
+// Normalising is a rule where a list of spellings is a list of the ones someone
+// happened to think of.
+// A field name with the punctuation taken out, so `file_path`, `file-path`,
+// `filePath`, `file.path` and `file path` are one name. Both collectors here
+// share it: they had a regex each, and the one used for command fields dropped
+// only `-` and `_`, so a field called `command.line` was walked past.
+export function normalizeFieldName(key) {
+    return key.replace(/[^A-Za-z0-9]/g, "").toLowerCase();
+}
+export const PATH_FIELD_NAMES = new Set([
+    "filepath",
+    "filename",
+    "filenames",
+    "path",
+    "paths",
+    "file",
+    "files",
+    "absolutepath",
+    "notebookpath",
+    "sourcepath",
+]);
+// `file_path`, `filePath`, `FILE_PATH` and `filepath` are one name here.
+function isPathFieldName(key) {
+    return PATH_FIELD_NAMES.has(normalizeFieldName(key));
+}
+// A value that names a path whatever its field is called. The list above can
+// only hold names someone thought of, so a tool carrying its path under `target`
+// or `document` went unscanned; this is the second way in.
+//
+// It is deliberately not "any string". Collecting every string would read a
+// search pattern as a path: `grep` for the literal `.env` arrives as
+// `{ pattern: ".env" }`, `.env` exists, and the name guard would then block a
+// search for that text as though it were a read of the file. A separator is the
+// cheapest test that tells a path from a word, and the cost of using it is that
+// a bare filename under an unlisted field name is still missed.
+function looksLikePath(value) {
+    return value.includes("/");
+}
+// Whether a value is worth statting: either its field name says path, or the
+// value is shaped like one.
+function isPathCandidate(key, value) {
+    return isPathFieldName(key) || looksLikePath(value);
+}
+// Depth to which a tool's input object is searched for path-bearing fields. Two
+// levels left `{ a: { b: { c: { path } } } }` unscanned, which is not a shape a
+// tool has to be perverse to use; four costs nothing on inputs this size, and
+// the bound is here at all so a deeply nested input cannot make the hook walk
+// an arbitrary tree before a tool call.
+const MAX_PATH_FIELD_DEPTH = 4;
+// Input field names that carry something to run rather than something to read.
+// Compared with separators and case removed, the way path field names are.
+export const COMMAND_FIELD_NAMES = new Set([
+    "command",
+    "commands",
+    "cmd",
+    "script",
+    "code",
+    "shellcommand",
+    "commandline",
+]);
+// How far into a nested input a command field is looked for. The same depth the
+// path fields use, and for the same reason: a tool wraps its arguments.
+const MAX_COMMAND_FIELD_DEPTH = 4;
+export function collectPathFields(input, depth = 0) {
+    if (depth > MAX_PATH_FIELD_DEPTH)
+        return [];
+    const found = [];
+    for (const [key, value] of Object.entries(input)) {
+        if (typeof value === "string") {
+            if (isPathCandidate(key, value))
+                found.push(value);
+        }
+        else if (Array.isArray(value)) {
+            for (const item of value) {
+                if (typeof item === "string") {
+                    // An element inherits the array's field name: `{ paths: ["…"] }`.
+                    if (isPathCandidate(key, item))
+                        found.push(item);
+                }
+                else if (Array.isArray(item)) {
+                    // An array inside an array: `{ paths: [["…"]] }`. The element is not a
+                    // string and was not an object either, so it fell through and the path
+                    // in it was never looked at. Re-entered under the same key, so the
+                    // name rule still applies to what is inside.
+                    found.push(...collectPathFields({ [key]: item }, depth + 1));
+                }
+                else if (
+                // Paths also arrive as objects inside an array, e.g.
+                // `{ paths: [{ path: "…" }] }` — recurse into those elements too.
+                item !== null &&
+                    typeof item === "object") {
+                    found.push(...collectPathFields(item, depth + 1));
+                }
+            }
+        }
+        else if (value !== null && typeof value === "object") {
+            found.push(...collectPathFields(value, depth + 1));
+        }
+    }
+    return found;
+}
+// Every command an input carries, whatever shape it arrives in.
+//
+// Reading only top-level strings left two shapes through, and both reach the
+// `.env` name guard by a name with no slash in it, which the path rules do not
+// collect: an argv array (`{"command":["cat",".env"]}`) and a command nested
+// under another key (`{"args":{"command":"cat .env"}}`). Depth-limited the way
+// path fields are, for the same reason.
+//
+// Beside `collectPathFields` rather than in the hook: the two walk the same tree
+// to the same depth and differ only in which field names count, and that
+// question — along with `normalizeFieldName` and both name sets — belongs in one
+// module rather than split across two.
+export function collectCommandFields(input, depth = 0) {
+    if (depth > MAX_COMMAND_FIELD_DEPTH)
+        return [];
+    const found = [];
+    for (const [key, value] of Object.entries(input)) {
+        const named = COMMAND_FIELD_NAMES.has(normalizeFieldName(key));
+        if (named && typeof value === "string") {
+            found.push(value);
+        }
+        else if (named && Array.isArray(value)) {
+            // An argv array is one command line with the spaces taken out.
+            const argv = value.filter((v) => typeof v === "string");
+            if (argv.length > 0)
+                found.push(argv.join(" "));
+        }
+        else if (value !== null && typeof value === "object") {
+            found.push(...collectCommandFields(value, depth + 1));
+        }
+    }
+    return found;
+}