@kaynooo/env-tools 0.7.1 → 0.7.3

package/dist/ev.js

@@ -789,13 +789,52 @@ var {Glob } = globalThis.Bun;
 var SESSION_FILES = new Glob("*.json");
 var ACCOUNT_DIRS = new Glob("*/sessions");
 // package.json
-var version = "0.7.1";
+var version = "0.7.3";
 
 // src/commands/audit.ts
 import { stat as stat4 } from "fs/promises";
 import { relative, resolve } from "path";
 import process7 from "process";
 
+// ../kit/src/shell.ts
+var SEPARATORS = new Set([`
+`, ";", "|"]);
+var PLAIN_BREAKERS = new Set(["<", ">", "(", ")", "&", "|"]);
+var GLOB_CHARS = new Set(["*", "?", "["]);
+var COMMENT_PREFIXES = new Set([";", "&", "|", "(", ")"]);
+var SAFE_WORD = /^[\w@%+=:,./-]+$/;
+var DOUBLE_QUOTED_ESCAPES = new Set(["$", "`", '"', "\\"]);
+var KEYWORDS = new Set(["then", "do", "else", "if", "elif", "while", "until", "!", "{", "}"]);
+var SHELLS = new Set(["sh", "bash", "zsh", "dash", "ash", "ksh"]);
+var COMMAND_STRING_PROGRAMS = new Set([...SHELLS, "su", "runuser"]);
+var SHELL_VALUE_OPTIONS = new Set(["-o", "-O", "--rcfile", "--init-file"]);
+var PRINTERS = new Set(["echo", "printf"]);
+var FIND_EXEC = new Set(["-exec", "-execdir", "-ok", "-okdir"]);
+function wrapper(short = "", long = [], operands = 0) {
+  return { short, long, operands };
+}
+var WRAPPERS = new Map([
+  ["command", wrapper()],
+  ["builtin", wrapper()],
+  ["nohup", wrapper()],
+  ["setsid", wrapper()],
+  ["busybox", wrapper()],
+  ["exec", wrapper("a")],
+  ["time", wrapper("fo", ["--format", "--output"])],
+  ["env", wrapper("uCS", ["--unset", "--chdir", "--split-string", "--argv0"])],
+  ["sudo", wrapper("ughpCTrtUDR", ["--user", "--group", "--host", "--prompt", "--close-from", "--command-timeout", "--role", "--type", "--other-user", "--chdir", "--chroot"])],
+  ["doas", wrapper("uC")],
+  ["timeout", wrapper("sk", ["--signal", "--kill-after"], 1)],
+  ["nice", wrapper("n", ["--adjustment"])],
+  ["ionice", wrapper("cnpPu", ["--class", "--classdata", "--pid", "--pgid", "--uid"])],
+  ["stdbuf", wrapper("ioe", ["--input", "--output", "--error"])],
+  ["chroot", wrapper("", ["--userspec", "--groups"], 1)],
+  ["xargs", wrapper("IndsEaPL", ["--max-args", "--max-procs", "--max-chars", "--delimiter", "--arg-file", "--eof", "--max-lines", "--process-slot-var"])]
+]);
+function shellQuote(word) {
+  return SAFE_WORD.test(word) && !word.startsWith("=") ? word : `'${word.replaceAll("'", "'\\''")}'`;
+}
+
 // src/audit.ts
 import { readdir as readdir2, stat as stat2 } from "fs/promises";
 import { dirname as dirname2, join as join2 } from "path";
@@ -1517,7 +1556,6 @@ var options = {
   json: jsonOption("the findings and the folders it could not read"),
   fix: { type: "boolean", description: "move inline compose secrets into a .env and shut other accounts out" }
 };
-var SHELL_SAFE = /^[\w./-]+$/;
 var MAX_UNREAD_LISTED = 3;
 var CHECKS = {
   same: "docker compose config resolves the same",
@@ -1532,9 +1570,6 @@ async function isFolder(path) {
     return false;
   }
 }
-function quoted2(path) {
-  return SHELL_SAFE.test(path) ? path : `'${path.replaceAll("'", "'\\''")}'`;
-}
 function shown(path) {
   return path.startsWith(`${process7.cwd()}/`) ? relative(process7.cwd(), path) : path;
 }
@@ -1553,9 +1588,9 @@ async function fixAll(exposed, json) {
       ...fix === undefined || fix.moved.length === 0 ? [] : [`moved ${fix.moved.join(", ")} into ${shown(fix.env)}`],
       ...fix?.left.map(({ key, why }) => `left ${key} in place: ${why}`) ?? [],
       ...fix?.check === undefined ? [] : [CHECKS[fix.check]],
-      ...open.map((file) => `another account owns ${file === path ? "it" : shown(file)}, so it stays readable: sudo chmod go-rwx ${quoted2(shown(file))}`),
+      ...open.map((file) => `another account owns ${file === path ? "it" : shown(file)}, so it stays readable: sudo chmod go-rwx ${shellQuote(shown(file))}`),
       ...readable && !open.includes(path) ? ["now unreadable by other accounts"] : [],
-      ...tracked ? [`tracked by git: git rm --cached ${quoted2(shown(path))}, then ignore it`] : []
+      ...tracked ? [`tracked by git: git rm --cached ${shellQuote(shown(path))}, then ignore it`] : []
     ];
     console.log(`${shown(path)}
   ${lines.join(`
@@ -1597,8 +1632,8 @@ async function audit2(args) {
     const sudo = uid !== undefined && uid !== 0 && (await stat4(path)).uid !== uid ? "sudo " : "";
     const problems = [
       ...secrets === undefined ? [] : [`writes out ${secrets.join(", ")}: ev audit --fix moves the values into a .env beside it`],
-      ...readable ? [group === true ? `readable by its group or an ACL: ${sudo}chmod go-rwx ${quoted2(shown(path))}` : `readable by any account: ${sudo}chmod o-rwx ${quoted2(shown(path))}`] : [],
-      ...tracked ? [`tracked by git: git rm --cached ${quoted2(shown(path))}, then ignore it`] : []
+      ...readable ? [group === true ? `readable by its group or an ACL: ${sudo}chmod go-rwx ${shellQuote(shown(path))}` : `readable by any account: ${sudo}chmod o-rwx ${shellQuote(shown(path))}`] : [],
+      ...tracked ? [`tracked by git: git rm --cached ${shellQuote(shown(path))}, then ignore it`] : []
     ];
     console.log(`${shown(path)}
   ${problems.join(`

package/dist/redact.js

@@ -789,7 +789,7 @@ var {Glob } = globalThis.Bun;
 var SESSION_FILES = new Glob("*.json");
 var ACCOUNT_DIRS = new Glob("*/sessions");
 // package.json
-var version = "0.7.1";
+var version = "0.7.3";
 
 // src/files.ts
 import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kaynooo/env-tools",
   "type": "module",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "ev lists and edits .env files with secrets masked, redact masks secrets in any piped output.",
   "author": "Kaynooo <contact@kaynooo.fr>",
   "license": "MIT",