@golproductions/check 3.2.5 → 3.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@golproductions/check",
-  "version": "3.2.5",
+  "version": "3.2.7",
   "description": "The anti-hallucination layer for AI coding agents. Stops hallucinated commands, packages, and URLs before they run.",
   "bin": {
     "check": "src/index.js",

package/src/index.js

@@ -6,7 +6,7 @@ import { homedir, platform, arch } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 
-const VERSION = "3.2.5";
+const VERSION = "3.2.7";
 const BINARY_VERSION = "3.0.0";
 const API = "https://triage.golproductions.com/preflight";
 const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";
@@ -744,19 +744,36 @@ const SHELL_BUILTINS = new Set([
   "done", "case", "esac", "in", "function", "select", "{", "}", "!",
 ]);
 
+// Quote-aware: "./spaced name.sh" is ONE token, and connectors inside
+// quotes are literal text, not separators.
 function segmentBases(command) {
+  const segs = [[]];
+  let cur = "", q = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (q) { if (ch === q) q = null; else cur += ch; continue; }
+    if (ch === '"' || ch === "'") { q = ch; continue; }
+    if (ch === "|" || ch === "&" || ch === ";" || ch === "\n") {
+      if (cur) { segs[segs.length - 1].push(cur); cur = ""; }
+      if (segs[segs.length - 1].length) segs.push([]);
+      if ((ch === "|" || ch === "&") && command[i + 1] === ch) i++;
+      continue;
+    }
+    if (/\s/.test(ch)) { if (cur) { segs[segs.length - 1].push(cur); cur = ""; } continue; }
+    cur += ch;
+  }
+  if (cur) segs[segs.length - 1].push(cur);
+
   const bases = [];
-  for (const seg of command.split(/\|\||&&|[|;\n]/)) {
-    const words = seg.trim().split(/\s+/).filter(Boolean);
+  for (const words of segs) {
     let base = null;
     for (const w of words) {
-      const bare = w.replace(/^["']+|["']+$/g, "");
-      if (!bare) continue;
-      if (PREFIX_WORDS.has(bare)) continue;
-      if (/^[\d.]+[smhd]?$/.test(bare)) continue;
-      if (bare.includes("=") && !bare.startsWith("-")) continue;
-      if (bare.startsWith("-")) continue;
-      base = bare;
+      if (!w) continue;
+      if (PREFIX_WORDS.has(w)) continue;
+      if (/^[\d.]+[smhd]?$/.test(w)) continue;
+      if (w.includes("=") && !w.startsWith("-")) continue;
+      if (w.startsWith("-")) continue;
+      base = w;
       break;
     }
     if (base) bases.push(base);
@@ -768,6 +785,23 @@ function segmentBases(command) {
 // on itself: builtins, keywords, functions, and PATH binaries all answer
 // through the exact resolution the shell will use at launch. A model of the
 // shell can drift from the shell; the shell cannot drift from itself.
+// On Windows, bare "bash" is a trap: PATH can resolve to WSL's
+// System32\bash.exe — a different operating system with a different
+// filesystem. The command will actually run in Git Bash, so the probe
+// must ask Git Bash, located explicitly. If it cannot be located,
+// abstain — never let the wrong interpreter answer for the right one.
+function bashPath() {
+  if (platform() !== "win32") return "bash";
+  const candidates = [
+    process.env.CLAUDE_CODE_GIT_BASH_PATH,
+    "C:/Program Files/Git/bin/bash.exe",
+    "C:/Program Files/Git/usr/bin/bash.exe",
+    "C:/Program Files (x86)/Git/bin/bash.exe",
+  ].filter(Boolean);
+  for (const c of candidates) { try { if (existsSync(c)) return c; } catch {} }
+  return null;
+}
+
 function shellKnows(name, cwd, shell) {
   try {
     if (shell === "powershell") {
@@ -776,7 +810,9 @@ function shellKnows(name, cwd, shell) {
         { cwd, timeout: 4000, stdio: "ignore", env: { ...process.env, CHECK_PROBE: name } });
       return r.error ? null : r.status === 0;
     }
-    const r = spawnSync("bash", ["-c", 'type -- "$1" >/dev/null 2>&1', "check", name],
+    const bash = bashPath();
+    if (!bash) return null;
+    const r = spawnSync(bash, ["-c", 'type -- "$1" >/dev/null 2>&1', "check", name],
       { cwd, timeout: 4000, stdio: "ignore" });
     return r.error ? null : r.status === 0;
   } catch { return null; }