@golproductions/check 3.2.6 → 3.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@golproductions/check",
-  "version": "3.2.6",
+  "version": "3.2.7",
   "description": "The anti-hallucination layer for AI coding agents. Stops hallucinated commands, packages, and URLs before they run.",
   "bin": {
     "check": "src/index.js",

package/src/index.js

@@ -6,7 +6,7 @@ import { homedir, platform, arch } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 
-const VERSION = "3.2.6";
+const VERSION = "3.2.7";
 const BINARY_VERSION = "3.0.0";
 const API = "https://triage.golproductions.com/preflight";
 const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";
@@ -744,19 +744,36 @@ const SHELL_BUILTINS = new Set([
   "done", "case", "esac", "in", "function", "select", "{", "}", "!",
 ]);
 
+// Quote-aware: "./spaced name.sh" is ONE token, and connectors inside
+// quotes are literal text, not separators.
 function segmentBases(command) {
+  const segs = [[]];
+  let cur = "", q = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (q) { if (ch === q) q = null; else cur += ch; continue; }
+    if (ch === '"' || ch === "'") { q = ch; continue; }
+    if (ch === "|" || ch === "&" || ch === ";" || ch === "\n") {
+      if (cur) { segs[segs.length - 1].push(cur); cur = ""; }
+      if (segs[segs.length - 1].length) segs.push([]);
+      if ((ch === "|" || ch === "&") && command[i + 1] === ch) i++;
+      continue;
+    }
+    if (/\s/.test(ch)) { if (cur) { segs[segs.length - 1].push(cur); cur = ""; } continue; }
+    cur += ch;
+  }
+  if (cur) segs[segs.length - 1].push(cur);
+
   const bases = [];
-  for (const seg of command.split(/\|\||&&|[|;\n]/)) {
-    const words = seg.trim().split(/\s+/).filter(Boolean);
+  for (const words of segs) {
     let base = null;
     for (const w of words) {
-      const bare = w.replace(/^["']+|["']+$/g, "");
-      if (!bare) continue;
-      if (PREFIX_WORDS.has(bare)) continue;
-      if (/^[\d.]+[smhd]?$/.test(bare)) continue;
-      if (bare.includes("=") && !bare.startsWith("-")) continue;
-      if (bare.startsWith("-")) continue;
-      base = bare;
+      if (!w) continue;
+      if (PREFIX_WORDS.has(w)) continue;
+      if (/^[\d.]+[smhd]?$/.test(w)) continue;
+      if (w.includes("=") && !w.startsWith("-")) continue;
+      if (w.startsWith("-")) continue;
+      base = w;
       break;
     }
     if (base) bases.push(base);