@iaforged/context-code 1.0.63 → 1.0.67

package/dist/src/utils/bash/shellQuote.js

@@ -1,253 +0,0 @@
-/**
- * Safe wrappers for shell-quote library functions that handle errors gracefully
- * These are drop-in replacements for the original functions
- */
-import { parse as shellQuoteParse, quote as shellQuoteQuote, } from 'shell-quote';
-import { logError } from '../log.js';
-import { jsonStringify } from '../slowOperations.js';
-export function tryParseShellCommand(cmd, env) {
-    try {
-        const tokens = typeof env === 'function'
-            ? shellQuoteParse(cmd, env)
-            : shellQuoteParse(cmd, env);
-        return { success: true, tokens };
-    }
-    catch (error) {
-        if (error instanceof Error) {
-            logError(error);
-        }
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Unknown parse error',
-        };
-    }
-}
-export function tryQuoteShellArgs(args) {
-    try {
-        const validated = args.map((arg, index) => {
-            if (arg === null || arg === undefined) {
-                return String(arg);
-            }
-            const type = typeof arg;
-            if (type === 'string') {
-                return arg;
-            }
-            if (type === 'number' || type === 'boolean') {
-                return String(arg);
-            }
-            if (type === 'object') {
-                throw new Error(`Cannot quote argument at index ${index}: object values are not supported`);
-            }
-            if (type === 'symbol') {
-                throw new Error(`Cannot quote argument at index ${index}: symbol values are not supported`);
-            }
-            if (type === 'function') {
-                throw new Error(`Cannot quote argument at index ${index}: function values are not supported`);
-            }
-            throw new Error(`Cannot quote argument at index ${index}: unsupported type ${type}`);
-        });
-        const quoted = shellQuoteQuote(validated);
-        return { success: true, quoted };
-    }
-    catch (error) {
-        if (error instanceof Error) {
-            logError(error);
-        }
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Unknown quote error',
-        };
-    }
-}
-/**
- * Checks if parsed tokens contain malformed entries that suggest shell-quote
- * misinterpreted the command. This happens when input contains ambiguous
- * patterns (like JSON-like strings with semicolons) that shell-quote parses
- * according to shell rules, producing token fragments.
- *
- * For example, `echo {"hi":"hi;evil"}` gets parsed with `;` as an operator,
- * producing tokens like `{hi:"hi` (unbalanced brace). Legitimate commands
- * produce complete, balanced tokens.
- *
- * Also detects unterminated quotes in the original command: shell-quote
- * silently drops an unmatched `"` or `'` and parses the rest as unquoted,
- * leaving no trace in the tokens. `echo "hi;evil | cat` (one unmatched `"`)
- * is a bash syntax error, but shell-quote yields clean tokens with `;` as
- * an operator. The token-level checks below can't catch this, so we walk
- * the original command with bash quote semantics and flag odd parity.
- *
- * Security: This prevents command injection via HackerOne #3482049 where
- * shell-quote's correct parsing of ambiguous input can be exploited.
- */
-export function hasMalformedTokens(command, parsed) {
-    // Check for unterminated quotes in the original command. shell-quote drops
-    // an unmatched quote without leaving any trace in the tokens, so this must
-    // inspect the raw string. Walk with bash semantics: backslash escapes the
-    // next char outside single-quotes; no escapes inside single-quotes.
-    let inSingle = false;
-    let inDouble = false;
-    let doubleCount = 0;
-    let singleCount = 0;
-    for (let i = 0; i < command.length; i++) {
-        const c = command[i];
-        if (c === '\\' && !inSingle) {
-            i++;
-            continue;
-        }
-        if (c === '"' && !inSingle) {
-            doubleCount++;
-            inDouble = !inDouble;
-        }
-        else if (c === "'" && !inDouble) {
-            singleCount++;
-            inSingle = !inSingle;
-        }
-    }
-    if (doubleCount % 2 !== 0 || singleCount % 2 !== 0)
-        return true;
-    for (const entry of parsed) {
-        if (typeof entry !== 'string')
-            continue;
-        // Check for unbalanced curly braces
-        const openBraces = (entry.match(/{/g) || []).length;
-        const closeBraces = (entry.match(/}/g) || []).length;
-        if (openBraces !== closeBraces)
-            return true;
-        // Check for unbalanced parentheses
-        const openParens = (entry.match(/\(/g) || []).length;
-        const closeParens = (entry.match(/\)/g) || []).length;
-        if (openParens !== closeParens)
-            return true;
-        // Check for unbalanced square brackets
-        const openBrackets = (entry.match(/\[/g) || []).length;
-        const closeBrackets = (entry.match(/\]/g) || []).length;
-        if (openBrackets !== closeBrackets)
-            return true;
-        // Check for unbalanced double quotes
-        // Count quotes that aren't escaped (preceded by backslash)
-        // A token with an odd number of unescaped quotes is malformed
-        // eslint-disable-next-line custom-rules/no-lookbehind-regex -- gated by hasCommandSeparator check at caller, runs on short per-token strings
-        const doubleQuotes = entry.match(/(?<!\\)"/g) || [];
-        if (doubleQuotes.length % 2 !== 0)
-            return true;
-        // Check for unbalanced single quotes
-        // eslint-disable-next-line custom-rules/no-lookbehind-regex -- same as above
-        const singleQuotes = entry.match(/(?<!\\)'/g) || [];
-        if (singleQuotes.length % 2 !== 0)
-            return true;
-    }
-    return false;
-}
-/**
- * Detects commands containing '\' patterns that exploit the shell-quote library's
- * incorrect handling of backslashes inside single quotes.
- *
- * In bash, single quotes preserve ALL characters literally - backslash has no
- * special meaning. So '\' is just the string \ (the quote opens, contains \,
- * and the next ' closes it). But shell-quote incorrectly treats \ as an escape
- * character inside single quotes, causing '\' to NOT close the quoted string.
- *
- * This means the pattern '\' <payload> '\' hides <payload> from security checks
- * because shell-quote thinks it's all one single-quoted string.
- */
-export function hasShellQuoteSingleQuoteBug(command) {
-    // Walk the command with correct bash single-quote semantics
-    let inSingleQuote = false;
-    let inDoubleQuote = false;
-    for (let i = 0; i < command.length; i++) {
-        const char = command[i];
-        // Handle backslash escaping outside of single quotes
-        if (char === '\\' && !inSingleQuote) {
-            // Skip the next character (it's escaped)
-            i++;
-            continue;
-        }
-        if (char === '"' && !inSingleQuote) {
-            inDoubleQuote = !inDoubleQuote;
-            continue;
-        }
-        if (char === "'" && !inDoubleQuote) {
-            inSingleQuote = !inSingleQuote;
-            // Check if we just closed a single quote and the content ends with
-            // trailing backslashes. shell-quote's chunker regex '((\\'|[^'])*?)'
-            // incorrectly treats \' as an escape sequence inside single quotes,
-            // while bash treats backslash as literal. This creates a differential
-            // where shell-quote merges tokens that bash treats as separate.
-            //
-            // Odd trailing \'s = always a bug:
-            //   '\' -> shell-quote: \' = literal ', still open. bash: \, closed.
-            //   'abc\' -> shell-quote: abc then \' = literal ', still open. bash: abc\, closed.
-            //   '\\\'  -> shell-quote: \\ + \', still open. bash: \\\, closed.
-            //
-            // Even trailing \'s = bug ONLY when a later ' exists in the command:
-            //   '\\' alone -> shell-quote backtracks, both parsers agree string closes. OK.
-            //   '\\' 'next' -> shell-quote: \' consumes the closing ', finds next ' as
-            //                   false close, merges tokens. bash: two separate tokens.
-            //
-            //   Detail: the regex alternation tries \' before [^']. For '\\', it matches
-            //   the first \ via [^'] (next char is \, not '), then the second \ via \'
-            //   (next char IS '). This consumes the closing '. The regex continues reading
-            //   until it finds another ' to close the match. If none exists, it backtracks
-            //   to [^'] for the second \ and closes correctly. If a later ' exists (e.g.,
-            //   the opener of the next single-quoted arg), no backtracking occurs and
-            //   tokens merge. See H1 report: git ls-remote 'safe\\' '--upload-pack=evil' 'repo'
-            //   shell-quote: ["git","ls-remote","safe\\\\ --upload-pack=evil repo"]
-            //   bash:        ["git","ls-remote","safe\\\\","--upload-pack=evil","repo"]
-            if (!inSingleQuote) {
-                let backslashCount = 0;
-                let j = i - 1;
-                while (j >= 0 && command[j] === '\\') {
-                    backslashCount++;
-                    j--;
-                }
-                if (backslashCount > 0 && backslashCount % 2 === 1) {
-                    return true;
-                }
-                // Even trailing backslashes: only a bug when a later ' exists that
-                // the chunker regex can use as a false closing quote. We check for
-                // ANY later ' because the regex doesn't respect bash quote state
-                // (e.g., a ' inside double quotes is also consumable).
-                if (backslashCount > 0 &&
-                    backslashCount % 2 === 0 &&
-                    command.indexOf("'", i + 1) !== -1) {
-                    return true;
-                }
-            }
-            continue;
-        }
-    }
-    return false;
-}
-export function quote(args) {
-    // First try the strict validation
-    const result = tryQuoteShellArgs([...args]);
-    if (result.success) {
-        return result.quoted;
-    }
-    // If strict validation failed, use lenient fallback
-    // This handles objects, symbols, functions, etc. by converting them to strings
-    try {
-        const stringArgs = args.map(arg => {
-            if (arg === null || arg === undefined) {
-                return String(arg);
-            }
-            const type = typeof arg;
-            if (type === 'string' || type === 'number' || type === 'boolean') {
-                return String(arg);
-            }
-            // For unsupported types, use JSON.stringify as a safe fallback
-            // This ensures we don't crash but still get a meaningful representation
-            return jsonStringify(arg);
-        });
-        return shellQuoteQuote(stringArgs);
-    }
-    catch (error) {
-        // SECURITY: Never use JSON.stringify as a fallback for shell quoting.
-        // JSON.stringify uses double quotes which don't prevent shell command execution.
-        // For example, jsonStringify(['echo', '$(whoami)']) produces "echo" "$(whoami)"
-        if (error instanceof Error) {
-            logError(error);
-        }
-        throw new Error('Failed to quote shell arguments safely');
-    }
-}

package/dist/src/utils/bash/shellQuoting.js

@@ -1,106 +0,0 @@
-import { quote } from './shellQuote.js';
-/**
- * Detects if a command contains a heredoc pattern
- * Matches patterns like: <<EOF, <<'EOF', <<"EOF", <<-EOF, <<-'EOF', <<\EOF, etc.
- */
-function containsHeredoc(command) {
-    // Match heredoc patterns: << followed by optional -, then optional quotes or backslash, then word
-    // Matches: <<EOF, <<'EOF', <<"EOF", <<-EOF, <<-'EOF', <<\EOF
-    // Check for bit-shift operators first and exclude them
-    if (/\d\s*<<\s*\d/.test(command) ||
-        /\[\[\s*\d+\s*<<\s*\d+\s*\]\]/.test(command) ||
-        /\$\(\(.*<<.*\)\)/.test(command)) {
-        return false;
-    }
-    // Now check for heredoc patterns
-    const heredocRegex = /<<-?\s*(?:(['"]?)(\w+)\1|\\(\w+))/;
-    return heredocRegex.test(command);
-}
-/**
- * Detects if a command contains multiline strings in quotes
- */
-function containsMultilineString(command) {
-    // Check for strings with actual newlines in them
-    // Handle escaped quotes by using a more sophisticated pattern
-    // Match single quotes: '...\n...' where content can include escaped quotes \'
-    // Match double quotes: "...\n..." where content can include escaped quotes \"
-    const singleQuoteMultiline = /'(?:[^'\\]|\\.)*\n(?:[^'\\]|\\.)*'/;
-    const doubleQuoteMultiline = /"(?:[^"\\]|\\.)*\n(?:[^"\\]|\\.)*"/;
-    return (singleQuoteMultiline.test(command) || doubleQuoteMultiline.test(command));
-}
-/**
- * Quotes a shell command appropriately, preserving heredocs and multiline strings
- * @param command The command to quote
- * @param addStdinRedirect Whether to add < /dev/null
- * @returns The properly quoted command
- */
-export function quoteShellCommand(command, addStdinRedirect = true) {
-    // If command contains heredoc or multiline strings, handle specially
-    // The shell-quote library incorrectly escapes ! to \! in these cases
-    if (containsHeredoc(command) || containsMultilineString(command)) {
-        // For heredocs and multiline strings, we need to quote for eval
-        // but avoid shell-quote's aggressive escaping
-        // We'll use single quotes and escape only single quotes in the command
-        const escaped = command.replace(/'/g, "'\"'\"'");
-        const quoted = `'${escaped}'`;
-        // Don't add stdin redirect for heredocs as they provide their own input
-        if (containsHeredoc(command)) {
-            return quoted;
-        }
-        // For multiline strings without heredocs, add stdin redirect if needed
-        return addStdinRedirect ? `${quoted} < /dev/null` : quoted;
-    }
-    // For regular commands, use shell-quote
-    if (addStdinRedirect) {
-        return quote([command, '<', '/dev/null']);
-    }
-    return quote([command]);
-}
-/**
- * Detects if a command already has a stdin redirect
- * Match patterns like: < file, </path/to/file, < /dev/null, etc.
- * But not <<EOF (heredoc), << (bit shift), or <(process substitution)
- */
-export function hasStdinRedirect(command) {
-    // Look for < followed by whitespace and a filename/path
-    // Negative lookahead to exclude: <<, <(
-    // Must be preceded by whitespace or command separator or start of string
-    return /(?:^|[\s;&|])<(?![<(])\s*\S+/.test(command);
-}
-/**
- * Checks if stdin redirect should be added to a command
- * @param command The command to check
- * @returns true if stdin redirect can be safely added
- */
-export function shouldAddStdinRedirect(command) {
-    // Don't add stdin redirect for heredocs as it interferes with the heredoc terminator
-    if (containsHeredoc(command)) {
-        return false;
-    }
-    // Don't add stdin redirect if command already has one
-    if (hasStdinRedirect(command)) {
-        return false;
-    }
-    // For other commands, stdin redirect is generally safe
-    return true;
-}
-/**
- * Rewrites Windows CMD-style `>nul` redirects to POSIX `/dev/null`.
- *
- * The model occasionally hallucinates Windows CMD syntax (e.g., `ls 2>nul`)
- * even though our bash shell is always POSIX (Git Bash / WSL on Windows).
- * When Git Bash sees `2>nul`, it creates a literal file named `nul` — a
- * Windows reserved device name that is extremely hard to delete and breaks
- * `git add .` and `git clone`. See anthropics/claude-code#4928.
- *
- * Matches: `>nul`, `> NUL`, `2>nul`, `&>nul`, `>>nul` (case-insensitive)
- * Does NOT match: `>null`, `>nullable`, `>nul.txt`, `cat nul.txt`
- *
- * Limitation: this regex does not parse shell quoting, so `echo ">nul"`
- * will also be rewritten. This is acceptable collateral — it's extremely
- * rare and rewriting to `/dev/null` inside a string is harmless.
- */
-const NUL_REDIRECT_REGEX = /(\d?&?>+\s*)[Nn][Uu][Ll](?=\s|$|[|&;)\n])/g;
-export function rewriteWindowsNullRedirect(command) {
-    return command.replace(NUL_REDIRECT_REGEX, '$1/dev/null');
-}

package/dist/src/utils/bash/specs/alias.js

@@ -1,11 +0,0 @@
-const alias = {
-    name: 'alias',
-    description: 'Create or list command aliases',
-    args: {
-        name: 'definition',
-        description: 'Alias definition in the form name=value',
-        isOptional: true,
-        isVariadic: true,
-    },
-};
-export default alias;

package/dist/src/utils/bash/specs/index.js

@@ -1,16 +0,0 @@
-import alias from './alias.js';
-import nohup from './nohup.js';
-import pyright from './pyright.js';
-import sleep from './sleep.js';
-import srun from './srun.js';
-import time from './time.js';
-import timeout from './timeout.js';
-export default [
-    pyright,
-    timeout,
-    sleep,
-    alias,
-    nohup,
-    time,
-    srun,
-];

package/dist/src/utils/bash/specs/nohup.js

@@ -1,10 +0,0 @@
-const nohup = {
-    name: 'nohup',
-    description: 'Run a command immune to hangups',
-    args: {
-        name: 'command',
-        description: 'Command to run with nohup',
-        isCommand: true,
-    },
-};
-export default nohup;

package/dist/src/utils/bash/specs/pyright.js

@@ -1,88 +0,0 @@
-export default {
-    name: 'pyright',
-    description: 'Type checker for Python',
-    options: [
-        { name: ['--help', '-h'], description: 'Show help message' },
-        { name: '--version', description: 'Print pyright version and exit' },
-        {
-            name: ['--watch', '-w'],
-            description: 'Continue to run and watch for changes',
-        },
-        {
-            name: ['--project', '-p'],
-            description: 'Use the configuration file at this location',
-            args: { name: 'FILE OR DIRECTORY' },
-        },
-        { name: '-', description: 'Read file or directory list from stdin' },
-        {
-            name: '--createstub',
-            description: 'Create type stub file(s) for import',
-            args: { name: 'IMPORT' },
-        },
-        {
-            name: ['--typeshedpath', '-t'],
-            description: 'Use typeshed type stubs at this location',
-            args: { name: 'DIRECTORY' },
-        },
-        {
-            name: '--verifytypes',
-            description: 'Verify completeness of types in py.typed package',
-            args: { name: 'IMPORT' },
-        },
-        {
-            name: '--ignoreexternal',
-            description: 'Ignore external imports for --verifytypes',
-        },
-        {
-            name: '--pythonpath',
-            description: 'Path to the Python interpreter',
-            args: { name: 'FILE' },
-        },
-        {
-            name: '--pythonplatform',
-            description: 'Analyze for platform',
-            args: { name: 'PLATFORM' },
-        },
-        {
-            name: '--pythonversion',
-            description: 'Analyze for Python version',
-            args: { name: 'VERSION' },
-        },
-        {
-            name: ['--venvpath', '-v'],
-            description: 'Directory that contains virtual environments',
-            args: { name: 'DIRECTORY' },
-        },
-        { name: '--outputjson', description: 'Output results in JSON format' },
-        { name: '--verbose', description: 'Emit verbose diagnostics' },
-        { name: '--stats', description: 'Print detailed performance stats' },
-        {
-            name: '--dependencies',
-            description: 'Emit import dependency information',
-        },
-        {
-            name: '--level',
-            description: 'Minimum diagnostic level',
-            args: { name: 'LEVEL' },
-        },
-        {
-            name: '--skipunannotated',
-            description: 'Skip type analysis of unannotated functions',
-        },
-        {
-            name: '--warnings',
-            description: 'Use exit code of 1 if warnings are reported',
-        },
-        {
-            name: '--threads',
-            description: 'Use up to N threads to parallelize type checking',
-            args: { name: 'N', isOptional: true },
-        },
-    ],
-    args: {
-        name: 'files',
-        description: 'Specify files or directories to analyze (overrides config file)',
-        isVariadic: true,
-        isOptional: true,
-    },
-};

package/dist/src/utils/bash/specs/sleep.js

@@ -1,10 +0,0 @@
-const sleep = {
-    name: 'sleep',
-    description: 'Delay for a specified amount of time',
-    args: {
-        name: 'duration',
-        description: 'Duration to sleep (seconds or with suffix like 5s, 2m, 1h)',
-        isOptional: false,
-    },
-};
-export default sleep;

package/dist/src/utils/bash/specs/srun.js

@@ -1,28 +0,0 @@
-const srun = {
-    name: 'srun',
-    description: 'Run a command on SLURM cluster nodes',
-    options: [
-        {
-            name: ['-n', '--ntasks'],
-            description: 'Number of tasks',
-            args: {
-                name: 'count',
-                description: 'Number of tasks to run',
-            },
-        },
-        {
-            name: ['-N', '--nodes'],
-            description: 'Number of nodes',
-            args: {
-                name: 'count',
-                description: 'Number of nodes to allocate',
-            },
-        },
-    ],
-    args: {
-        name: 'command',
-        description: 'Command to run on the cluster',
-        isCommand: true,
-    },
-};
-export default srun;

package/dist/src/utils/bash/specs/time.js

@@ -1,10 +0,0 @@
-const time = {
-    name: 'time',
-    description: 'Time a command',
-    args: {
-        name: 'command',
-        description: 'Command to time',
-        isCommand: true,
-    },
-};
-export default time;

package/dist/src/utils/bash/specs/timeout.js

@@ -1,17 +0,0 @@
-const timeout = {
-    name: 'timeout',
-    description: 'Run a command with a time limit',
-    args: [
-        {
-            name: 'duration',
-            description: 'Duration to wait before timing out (e.g., 10, 5s, 2m)',
-            isOptional: false,
-        },
-        {
-            name: 'command',
-            description: 'Command to run',
-            isCommand: true,
-        },
-    ],
-};
-export default timeout;