@golproductions/check 3.2.4 → 3.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@golproductions/check",
-  "version": "3.2.4",
+  "version": "3.2.5",
   "description": "The anti-hallucination layer for AI coding agents. Stops hallucinated commands, packages, and URLs before they run.",
   "bin": {
     "check": "src/index.js",

package/src/index.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { readFileSync, writeFileSync, mkdirSync, existsSync, createWriteStream, chmodSync, unlinkSync, rmSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { join } from "node:path";
 import { homedir, platform, arch } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 
-const VERSION = "3.2.1";
+const VERSION = "3.2.5";
 const BINARY_VERSION = "3.0.0";
 const API = "https://triage.golproductions.com/preflight";
 const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";
@@ -723,6 +724,84 @@ function outCreditsExhausted(f, reason) {
   process.exit(0);
 }
 
+// The machine's own PATH resolution is the ground truth for whether a
+// command exists. This is the same lookup the shell performs at launch:
+// walk PATH (plus PATHEXT on Windows), pure filesystem reads, deterministic.
+// The server honors binary_exists as proof, so real-but-unlisted tools
+// (claude, codex, aider, internal CLIs) are never falsely blocked.
+const PREFIX_WORDS = new Set(["sudo", "nohup", "nice", "time", "timeout", "env"]);
+
+// POSIX shell builtins and keywords. Frozen by spec since 1992: these are
+// provided by the shell itself, not the filesystem, and are treated as
+// present. This set is evergreen — it does not rot the way a tool list does.
+const SHELL_BUILTINS = new Set([
+  "cd", "echo", "printf", "pwd", "export", "set", "unset", "alias", "unalias",
+  "true", "false", "test", "[", "[[", "exit", "return", "break", "continue",
+  "shift", "source", ".", "eval", "exec", "trap", "wait", "jobs", "fg", "bg",
+  "read", "readonly", "local", "declare", "typeset", "let", "getopts", "hash",
+  "type", "command", "builtin", "ulimit", "umask", "times", "dirs", "pushd",
+  "popd", "for", "while", "until", "if", "then", "else", "elif", "fi", "do",
+  "done", "case", "esac", "in", "function", "select", "{", "}", "!",
+]);
+
+function segmentBases(command) {
+  const bases = [];
+  for (const seg of command.split(/\|\||&&|[|;\n]/)) {
+    const words = seg.trim().split(/\s+/).filter(Boolean);
+    let base = null;
+    for (const w of words) {
+      const bare = w.replace(/^["']+|["']+$/g, "");
+      if (!bare) continue;
+      if (PREFIX_WORDS.has(bare)) continue;
+      if (/^[\d.]+[smhd]?$/.test(bare)) continue;
+      if (bare.includes("=") && !bare.startsWith("-")) continue;
+      if (bare.startsWith("-")) continue;
+      base = bare;
+      break;
+    }
+    if (base) bases.push(base);
+  }
+  return bases;
+}
+
+// THE ROD: do not model the shell — ask it. `type` is the shell reporting
+// on itself: builtins, keywords, functions, and PATH binaries all answer
+// through the exact resolution the shell will use at launch. A model of the
+// shell can drift from the shell; the shell cannot drift from itself.
+function shellKnows(name, cwd, shell) {
+  try {
+    if (shell === "powershell") {
+      const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command",
+        "if (Get-Command $env:CHECK_PROBE -ErrorAction SilentlyContinue) { exit 0 }; exit 1"],
+        { cwd, timeout: 4000, stdio: "ignore", env: { ...process.env, CHECK_PROBE: name } });
+      return r.error ? null : r.status === 0;
+    }
+    const r = spawnSync("bash", ["-c", 'type -- "$1" >/dev/null 2>&1', "check", name],
+      { cwd, timeout: 4000, stdio: "ignore" });
+    return r.error ? null : r.status === 0;
+  } catch { return null; }
+}
+
+// Tri-state ground truth from the interpreter itself: true = every command
+// word proven resolvable, false = at least one proven unresolvable, null =
+// cannot be determined without executing (subshells, expansions) — abstain,
+// never guess.
+function allBinariesExist(command, cwd, shell) {
+  try {
+    let bases = segmentBases(command);
+    if (shell !== "powershell") bases = bases.filter(b => !SHELL_BUILTINS.has(b));
+    if (bases.length === 0) return true;
+    if (bases.some(b => /[(){}$`]/.test(b))) return null;
+    let verdict = true;
+    for (const b of bases) {
+      const known = shellKnows(b, cwd, shell);
+      if (known === null) return null;
+      if (known === false) verdict = false;
+    }
+    return verdict;
+  } catch { return null; }
+}
+
 async function main() {
   let f = "claude";
   try {
@@ -739,10 +818,16 @@ async function main() {
     if (!hookKey) { out(f, false, "check: GOL_CLIENT_ID not set. Get your key at https://golproductions.com/check"); return; }
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 5000);
+    // Ask the same interpreter that will run the command.
+    const exists = allBinariesExist(c, p.cwd, p.tool_name === "PowerShell" ? "powershell" : "bash");
+    // Send only what the verdict needs. No transcript paths, no usernames
+    // beyond what cwd itself carries — the check is about the command.
+    const body = { command: c, cwd: p.cwd || process.cwd(), platform: f, channel: "npm", tool_name: p.tool_name, v: VERSION };
+    if (exists !== null) body.binary_exists = exists;
     const res = await fetch(API, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": hookKey, "User-Agent": "c/" + VERSION },
-      body: JSON.stringify({ command: c, cwd: p.cwd || process.cwd(), platform: f, channel: "npm", tool_name: p.tool_name, transcript_path: p.transcript_path, v: VERSION }),
+      body: JSON.stringify(body),
       signal: controller.signal
     });
     clearTimeout(timer);