@golproductions/check 3.2.11 → 3.2.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@golproductions/check",
-  "version": "3.2.11",
+  "version": "3.2.13",
   "description": "Less hallucinations. A command firewall for AI agents: validates every shell command before execution, so fabricated commands are denied before they run.",
   "bin": {
     "check": "src/index.js",

package/src/index.js

@@ -6,7 +6,7 @@ import { homedir, platform, arch } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 
-const VERSION = "3.2.11";
+const VERSION = "3.2.13";
 const BINARY_VERSION = "3.0.0";
 const API = "https://triage.golproductions.com/preflight";
 const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";
@@ -692,7 +692,11 @@ function out(f, ok, reason) {
     process.stdout.write(JSON.stringify({ decision: "deny", reason }));
     process.exit(2);
   }
-  const r = { cursor: { permission: "deny", user_message: reason, agent_message: reason }, claude: { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } } };
+  // The reason is for the AGENT only: it reads the shell's words, fixes the
+  // command, and moves on. The user never sees the stumble, just clean flow.
+  // (Claude Code's permissionDecisionReason and Cursor's agent_message feed
+  // the model; user_message would put the error on the user's screen.)
+  const r = { cursor: { permission: "deny", agent_message: reason }, claude: { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } } };
   process.stdout.write(JSON.stringify(r[f] || r.claude));
   process.exit(0);
 }
@@ -802,19 +806,34 @@ function bashPath() {
   return null;
 }
 
+// When the shell refuses a name, keep its own words. The reason shown on a
+// deny must come from the interpreter that would have run the command, not
+// from us: deterministic (same machine, same words) and never argued with.
+// Normalized as "<name>: <the shell's phrase>", pure string ops.
+function shellWhy(raw, name) {
+  if (!raw) return null;
+  const line = raw.split(/\r?\n/).find(l => l.includes(name));
+  if (!line) return null;
+  let tail = line.slice(line.indexOf(name) + name.length);
+  tail = tail.replace(/^['"\s:]+/, "").replace(/\s+$/, "");
+  return tail ? name + ": " + tail : null;
+}
+
 function shellKnows(name, cwd, shell) {
   try {
     if (shell === "powershell") {
       const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command",
-        "if (Get-Command $env:CHECK_PROBE -ErrorAction SilentlyContinue) { exit 0 }; exit 1"],
-        { cwd, timeout: 4000, stdio: "ignore", env: { ...process.env, CHECK_PROBE: name } });
-      return r.error ? null : r.status === 0;
+        "try { $null = Get-Command $env:CHECK_PROBE -ErrorAction Stop; exit 0 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }"],
+        { cwd, timeout: 4000, encoding: "utf8", env: { ...process.env, CHECK_PROBE: name } });
+      if (r.error) return null;
+      return { known: r.status === 0, why: r.status === 0 ? null : shellWhy(r.stderr, name) };
     }
     const bash = bashPath();
     if (!bash) return null;
-    const r = spawnSync(bash, ["-c", 'type -- "$1" >/dev/null 2>&1', "check", name],
-      { cwd, timeout: 4000, stdio: "ignore" });
-    return r.error ? null : r.status === 0;
+    const r = spawnSync(bash, ["-c", 'type -- "$1"', "check", name],
+      { cwd, timeout: 4000, encoding: "utf8" });
+    if (r.error) return null;
+    return { known: r.status === 0, why: r.status === 0 ? null : shellWhy(r.stderr, name) };
   } catch { return null; }
 }
 
@@ -822,7 +841,7 @@ function shellKnows(name, cwd, shell) {
 // word proven resolvable, false = at least one proven unresolvable, null =
 // cannot be determined without executing (subshells, expansions) — abstain,
 // never guess.
-function allBinariesExist(command, cwd, shell) {
+function allBinariesExist(command, cwd, shell, misses) {
   try {
     let bases = segmentBases(command);
     if (shell !== "powershell") bases = bases.filter(b => !SHELL_BUILTINS.has(b));
@@ -830,9 +849,12 @@ function allBinariesExist(command, cwd, shell) {
     if (bases.some(b => /[(){}$`]/.test(b))) return null;
     let verdict = true;
     for (const b of bases) {
-      const known = shellKnows(b, cwd, shell);
-      if (known === null) return null;
-      if (known === false) verdict = false;
+      const probe = shellKnows(b, cwd, shell);
+      if (probe === null) return null;
+      if (probe.known === false) {
+        verdict = false;
+        if (misses) misses.push(probe.why || b + ": not found");
+      }
     }
     return verdict;
   } catch { return null; }
@@ -868,7 +890,17 @@ async function main() {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 5000);
     // Ask the same interpreter that will run the command.
-    const exists = allBinariesExist(c, p.cwd, p.tool_name === "PowerShell" ? "powershell" : "bash");
+    const misses = [];
+    const exists = allBinariesExist(c, p.cwd, p.tool_name === "PowerShell" ? "powershell" : "bash", misses);
+    // LOCAL FAST DENY: the shell just proved a command word does not resolve.
+    // The verdict is already decided; a server round trip would only repeat
+    // it slower and burn a check. No network, no charge, the shell's words,
+    // and the whole answer in the time the probe took. The server still owns
+    // every verdict the shell cannot see (URLs, flags, packages, syntax).
+    if (exists === false && misses.length) {
+      out(f, false, "denied by the shell that would run it. " + misses.join("; "));
+      return;
+    }
     // Send only what the verdict needs. No transcript paths, no usernames
     // beyond what cwd itself carries — the check is about the command.
     const body = { command: c, cwd: p.cwd || process.cwd(), platform: f, channel: "npm", tool_name: p.tool_name, v: VERSION };
@@ -914,7 +946,13 @@ async function main() {
     }
 
     if (d.verdict === "runnable") { out(f, true); }
-    else { out(f, false, d.reason || "denied — address the issue before continuing"); }
+    else {
+      // Prefer the shell's own words: when the interpreter that would run
+      // this command already said why it can't, that sentence is the reason.
+      // Server reason covers everything the shell can't see (URLs, syntax).
+      const local = misses.length ? "denied by the shell that would run it. " + misses.join("; ") : null;
+      out(f, false, local || d.reason || "denied. Address the issue before continuing.");
+    }
   } catch {
     // Network failure or timeout: fail OPEN. An unreachable validation
     // service must never block the user's work (Terms, section 5).