@librechat/agents 3.2.32 → 3.2.34

package/dist/cjs/tools/local/bashAst.cjs

@@ -1,129 +1,115 @@
-'use strict';
-
+//#region src/tools/local/bashAst.ts
 /**
- * Categorical-hazard checks layered on top of the existing dangerous-
- * command regex set. These match command-shape signatures that
- * claude-code's tree-sitter AST validator catches via categorical
- * deny-lists (command substitution, zsh-only privileged commands,
- * /proc/<pid>/environ access, IFS injection, etc.).
- *
- * This is *not* a real AST parser. It is a deliberately conservative
- * heuristic pass intended for the local engine's `bashAst: 'auto' |
- * 'strict'` modes; a future PR can swap in a true tree-sitter-bash
- * pass behind the same config field without changing the public API.
- *
- * `runBashAstChecks` runs on the *quote-stripped* command (so quoted
- * strings inside the script don't generate false positives) and
- * returns one finding per matched category.
- */
+* Categorical-hazard checks layered on top of the existing dangerous-
+* command regex set. These match command-shape signatures that
+* claude-code's tree-sitter AST validator catches via categorical
+* deny-lists (command substitution, zsh-only privileged commands,
+* /proc/<pid>/environ access, IFS injection, etc.).
+*
+* This is *not* a real AST parser. It is a deliberately conservative
+* heuristic pass intended for the local engine's `bashAst: 'auto' |
+* 'strict'` modes; a future PR can swap in a true tree-sitter-bash
+* pass behind the same config field without changing the public API.
+*
+* `runBashAstChecks` runs on the *quote-stripped* command (so quoted
+* strings inside the script don't generate false positives) and
+* returns one finding per matched category.
+*/
 const COMMAND_SUBSTITUTION_PATTERNS = [
-    { code: 'cmd-subst-dollar-paren', rx: /\$\(/ },
-    { code: 'cmd-subst-backtick', rx: /`[^`]*`/ },
-    { code: 'cmd-subst-process-sub', rx: /[<>]\(/ },
-    { code: 'cmd-subst-zsh-eq', rx: /(?:^|\s)=[A-Za-z_]/ },
+	{
+		code: "cmd-subst-dollar-paren",
+		rx: /\$\(/
+	},
+	{
+		code: "cmd-subst-backtick",
+		rx: /`[^`]*`/
+	},
+	{
+		code: "cmd-subst-process-sub",
+		rx: /[<>]\(/
+	},
+	{
+		code: "cmd-subst-zsh-eq",
+		rx: /(?:^|\s)=[A-Za-z_]/
+	}
 ];
 const ZSH_DANGEROUS_BUILTINS = [
-    'zmodload',
-    'emulate',
-    'sysopen',
-    'sysread',
-    'syswrite',
-    'ztcp',
-    'zsocket',
-    'zf_rm',
-    'zselect',
-];
-const STRICT_DENIED_BUILTINS = [
-    'eval',
-    'exec',
+	"zmodload",
+	"emulate",
+	"sysopen",
+	"sysread",
+	"syswrite",
+	"ztcp",
+	"zsocket",
+	"zf_rm",
+	"zselect"
 ];
+const STRICT_DENIED_BUILTINS = ["eval", "exec"];
 function rxForBuiltin(name) {
-    return new RegExp(`\\b${name}\\b`);
+	return new RegExp(`\\b${name}\\b`);
 }
 const PROC_ENVIRON_RX = /\/proc\/(?:\d+|self|\$[A-Za-z_])\/environ\b/;
 const IFS_INJECTION_RX = /\bIFS\s*=/;
 const HEX_ESCAPE_OBFUSCATION_RX = /\\x[0-9a-fA-F]{2}/;
 const SOURCE_FROM_VAR_RX = /(?:^|\s)(?:source|\.)\s+["']?\$[A-Za-z_]/;
-function runBashAstChecks(command, mode = 'off') {
-    if (mode === 'off') {
-        return [];
-    }
-    const findings = [];
-    const strict = mode === 'strict';
-    for (const { code, rx } of COMMAND_SUBSTITUTION_PATTERNS) {
-        if (rx.test(command)) {
-            findings.push({
-                code,
-                message: 'Command substitution can mask intent and exfiltrate variables; not allowed under bashAst.',
-                severity: strict ? 'deny' : 'warn',
-            });
-        }
-    }
-    for (const builtin of ZSH_DANGEROUS_BUILTINS) {
-        if (rxForBuiltin(builtin).test(command)) {
-            findings.push({
-                code: `zsh-builtin-${builtin}`,
-                message: `Zsh privileged builtin "${builtin}" is denied.`,
-                severity: 'deny',
-            });
-        }
-    }
-    if (PROC_ENVIRON_RX.test(command)) {
-        findings.push({
-            code: 'proc-environ-read',
-            message: 'Reads from /proc/<pid>/environ are denied — leaks host secrets.',
-            severity: 'deny',
-        });
-    }
-    if (IFS_INJECTION_RX.test(command)) {
-        findings.push({
-            code: 'ifs-injection',
-            message: 'Inline IFS reassignment is suspicious; review the command.',
-            severity: strict ? 'deny' : 'warn',
-        });
-    }
-    if (HEX_ESCAPE_OBFUSCATION_RX.test(command)) {
-        findings.push({
-            code: 'hex-escape',
-            message: 'Hex-escaped bytes (\\xNN) often hide intent; review the command.',
-            severity: strict ? 'deny' : 'warn',
-        });
-    }
-    if (SOURCE_FROM_VAR_RX.test(command)) {
-        findings.push({
-            code: 'source-from-variable',
-            message: 'Sourcing a script from an unbound variable is denied.',
-            severity: 'deny',
-        });
-    }
-    if (strict) {
-        for (const builtin of STRICT_DENIED_BUILTINS) {
-            if (rxForBuiltin(builtin).test(command)) {
-                findings.push({
-                    code: `strict-${builtin}`,
-                    message: `In strict mode, "${builtin}" is denied.`,
-                    severity: 'deny',
-                });
-            }
-        }
-    }
-    return findings;
+function runBashAstChecks(command, mode = "off") {
+	if (mode === "off") return [];
+	const findings = [];
+	const strict = mode === "strict";
+	for (const { code, rx } of COMMAND_SUBSTITUTION_PATTERNS) if (rx.test(command)) findings.push({
+		code,
+		message: "Command substitution can mask intent and exfiltrate variables; not allowed under bashAst.",
+		severity: strict ? "deny" : "warn"
+	});
+	for (const builtin of ZSH_DANGEROUS_BUILTINS) if (rxForBuiltin(builtin).test(command)) findings.push({
+		code: `zsh-builtin-${builtin}`,
+		message: `Zsh privileged builtin "${builtin}" is denied.`,
+		severity: "deny"
+	});
+	if (PROC_ENVIRON_RX.test(command)) findings.push({
+		code: "proc-environ-read",
+		message: "Reads from /proc/<pid>/environ are denied — leaks host secrets.",
+		severity: "deny"
+	});
+	if (IFS_INJECTION_RX.test(command)) findings.push({
+		code: "ifs-injection",
+		message: "Inline IFS reassignment is suspicious; review the command.",
+		severity: strict ? "deny" : "warn"
+	});
+	if (HEX_ESCAPE_OBFUSCATION_RX.test(command)) findings.push({
+		code: "hex-escape",
+		message: "Hex-escaped bytes (\\xNN) often hide intent; review the command.",
+		severity: strict ? "deny" : "warn"
+	});
+	if (SOURCE_FROM_VAR_RX.test(command)) findings.push({
+		code: "source-from-variable",
+		message: "Sourcing a script from an unbound variable is denied.",
+		severity: "deny"
+	});
+	if (strict) {
+		for (const builtin of STRICT_DENIED_BUILTINS) if (rxForBuiltin(builtin).test(command)) findings.push({
+			code: `strict-${builtin}`,
+			message: `In strict mode, "${builtin}" is denied.`,
+			severity: "deny"
+		});
+	}
+	return findings;
 }
 function bashAstFindingsToErrors(findings) {
-    const errors = [];
-    const warnings = [];
-    for (const f of findings) {
-        const formatted = `[bashAst:${f.code}] ${f.message}`;
-        if (f.severity === 'deny') {
-            errors.push(formatted);
-        }
-        else {
-            warnings.push(formatted);
-        }
-    }
-    return { errors, warnings };
+	const errors = [];
+	const warnings = [];
+	for (const f of findings) {
+		const formatted = `[bashAst:${f.code}] ${f.message}`;
+		if (f.severity === "deny") errors.push(formatted);
+		else warnings.push(formatted);
+	}
+	return {
+		errors,
+		warnings
+	};
 }
-
+//#endregion
 exports.bashAstFindingsToErrors = bashAstFindingsToErrors;
 exports.runBashAstChecks = runBashAstChecks;
-//# sourceMappingURL=bashAst.cjs.map
+
+//# sourceMappingURL=bashAst.cjs.map

package/dist/cjs/tools/local/bashAst.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bashAst.cjs","sources":["../../../../src/tools/local/bashAst.ts"],"sourcesContent":["import type * as t from '@/types';\n\nexport type BashAstFinding = {\n  code: string;\n  message: string;\n  severity: 'warn' | 'deny';\n};\n\n/**\n * Categorical-hazard checks layered on top of the existing dangerous-\n * command regex set. These match command-shape signatures that\n * claude-code's tree-sitter AST validator catches via categorical\n * deny-lists (command substitution, zsh-only privileged commands,\n * /proc/<pid>/environ access, IFS injection, etc.).\n *\n * This is *not* a real AST parser. It is a deliberately conservative\n * heuristic pass intended for the local engine's `bashAst: 'auto' |\n * 'strict'` modes; a future PR can swap in a true tree-sitter-bash\n * pass behind the same config field without changing the public API.\n *\n * `runBashAstChecks` runs on the *quote-stripped* command (so quoted\n * strings inside the script don't generate false positives) and\n * returns one finding per matched category.\n */\n\nconst COMMAND_SUBSTITUTION_PATTERNS: { code: string; rx: RegExp }[] = [\n  { code: 'cmd-subst-dollar-paren', rx: /\\$\\(/ },\n  { code: 'cmd-subst-backtick', rx: /`[^`]*`/ },\n  { code: 'cmd-subst-process-sub', rx: /[<>]\\(/ },\n  { code: 'cmd-subst-zsh-eq', rx: /(?:^|\\s)=[A-Za-z_]/ },\n];\n\nconst ZSH_DANGEROUS_BUILTINS = [\n  'zmodload',\n  'emulate',\n  'sysopen',\n  'sysread',\n  'syswrite',\n  'ztcp',\n  'zsocket',\n  'zf_rm',\n  'zselect',\n];\n\nconst STRICT_DENIED_BUILTINS = [\n  'eval',\n  'exec',\n];\n\nfunction rxForBuiltin(name: string): RegExp {\n  return new RegExp(`\\\\b${name}\\\\b`);\n}\n\nconst PROC_ENVIRON_RX = /\\/proc\\/(?:\\d+|self|\\$[A-Za-z_])\\/environ\\b/;\nconst IFS_INJECTION_RX = /\\bIFS\\s*=/;\nconst HEX_ESCAPE_OBFUSCATION_RX = /\\\\x[0-9a-fA-F]{2}/;\nconst SOURCE_FROM_VAR_RX = /(?:^|\\s)(?:source|\\.)\\s+[\"']?\\$[A-Za-z_]/;\n\nexport function runBashAstChecks(\n  command: string,\n  mode: t.LocalBashAstMode = 'off'\n): BashAstFinding[] {\n  if (mode === 'off') {\n    return [];\n  }\n  const findings: BashAstFinding[] = [];\n  const strict = mode === 'strict';\n\n  for (const { code, rx } of COMMAND_SUBSTITUTION_PATTERNS) {\n    if (rx.test(command)) {\n      findings.push({\n        code,\n        message:\n          'Command substitution can mask intent and exfiltrate variables; not allowed under bashAst.',\n        severity: strict ? 'deny' : 'warn',\n      });\n    }\n  }\n\n  for (const builtin of ZSH_DANGEROUS_BUILTINS) {\n    if (rxForBuiltin(builtin).test(command)) {\n      findings.push({\n        code: `zsh-builtin-${builtin}`,\n        message: `Zsh privileged builtin \"${builtin}\" is denied.`,\n        severity: 'deny',\n      });\n    }\n  }\n\n  if (PROC_ENVIRON_RX.test(command)) {\n    findings.push({\n      code: 'proc-environ-read',\n      message: 'Reads from /proc/<pid>/environ are denied — leaks host secrets.',\n      severity: 'deny',\n    });\n  }\n\n  if (IFS_INJECTION_RX.test(command)) {\n    findings.push({\n      code: 'ifs-injection',\n      message: 'Inline IFS reassignment is suspicious; review the command.',\n      severity: strict ? 'deny' : 'warn',\n    });\n  }\n\n  if (HEX_ESCAPE_OBFUSCATION_RX.test(command)) {\n    findings.push({\n      code: 'hex-escape',\n      message: 'Hex-escaped bytes (\\\\xNN) often hide intent; review the command.',\n      severity: strict ? 'deny' : 'warn',\n    });\n  }\n\n  if (SOURCE_FROM_VAR_RX.test(command)) {\n    findings.push({\n      code: 'source-from-variable',\n      message: 'Sourcing a script from an unbound variable is denied.',\n      severity: 'deny',\n    });\n  }\n\n  if (strict) {\n    for (const builtin of STRICT_DENIED_BUILTINS) {\n      if (rxForBuiltin(builtin).test(command)) {\n        findings.push({\n          code: `strict-${builtin}`,\n          message: `In strict mode, \"${builtin}\" is denied.`,\n          severity: 'deny',\n        });\n      }\n    }\n  }\n\n  return findings;\n}\n\nexport function bashAstFindingsToErrors(\n  findings: BashAstFinding[]\n): { errors: string[]; warnings: string[] } {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n  for (const f of findings) {\n    const formatted = `[bashAst:${f.code}] ${f.message}`;\n    if (f.severity === 'deny') {\n      errors.push(formatted);\n    } else {\n      warnings.push(formatted);\n    }\n  }\n  return { errors, warnings };\n}\n"],"names":[],"mappings":";;AAQA;;;;;;;;;;;;;;;AAeG;AAEH,MAAM,6BAA6B,GAAmC;AACpE,IAAA,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE;AAC9C,IAAA,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,SAAS,EAAE;AAC7C,IAAA,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,QAAQ,EAAE;AAC/C,IAAA,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,oBAAoB,EAAE;CACvD;AAED,MAAM,sBAAsB,GAAG;IAC7B,UAAU;IACV,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;CACV;AAED,MAAM,sBAAsB,GAAG;IAC7B,MAAM;IACN,MAAM;CACP;AAED,SAAS,YAAY,CAAC,IAAY,EAAA;AAChC,IAAA,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,CAAA,GAAA,CAAK,CAAC;AACpC;AAEA,MAAM,eAAe,GAAG,6CAA6C;AACrE,MAAM,gBAAgB,GAAG,WAAW;AACpC,MAAM,yBAAyB,GAAG,mBAAmB;AACrD,MAAM,kBAAkB,GAAG,0CAA0C;SAErD,gBAAgB,CAC9B,OAAe,EACf,OAA2B,KAAK,EAAA;AAEhC,IAAA,IAAI,IAAI,KAAK,KAAK,EAAE;AAClB,QAAA,OAAO,EAAE;IACX;IACA,MAAM,QAAQ,GAAqB,EAAE;AACrC,IAAA,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ;IAEhC,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,6BAA6B,EAAE;AACxD,QAAA,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;AACJ,gBAAA,OAAO,EACL,2FAA2F;gBAC7F,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;AACnC,aAAA,CAAC;QACJ;IACF;AAEA,IAAA,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE;QAC5C,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,CAAA,YAAA,EAAe,OAAO,CAAA,CAAE;gBAC9B,OAAO,EAAE,CAAA,wBAAA,EAA2B,OAAO,CAAA,YAAA,CAAc;AACzD,gBAAA,QAAQ,EAAE,MAAM;AACjB,aAAA,CAAC;QACJ;IACF;AAEA,IAAA,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACjC,QAAQ,CAAC,IAAI,CAAC;AACZ,YAAA,IAAI,EAAE,mBAAmB;AACzB,YAAA,OAAO,EAAE,iEAAiE;AAC1E,YAAA,QAAQ,EAAE,MAAM;AACjB,SAAA,CAAC;IACJ;AAEA,IAAA,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAClC,QAAQ,CAAC,IAAI,CAAC;AACZ,YAAA,IAAI,EAAE,eAAe;AACrB,YAAA,OAAO,EAAE,4DAA4D;YACrE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;AACnC,SAAA,CAAC;IACJ;AAEA,IAAA,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC3C,QAAQ,CAAC,IAAI,CAAC;AACZ,YAAA,IAAI,EAAE,YAAY;AAClB,YAAA,OAAO,EAAE,kEAAkE;YAC3E,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;AACnC,SAAA,CAAC;IACJ;AAEA,IAAA,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACpC,QAAQ,CAAC,IAAI,CAAC;AACZ,YAAA,IAAI,EAAE,sBAAsB;AAC5B,YAAA,OAAO,EAAE,uDAAuD;AAChE,YAAA,QAAQ,EAAE,MAAM;AACjB,SAAA,CAAC;IACJ;IAEA,IAAI,MAAM,EAAE;AACV,QAAA,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE;YAC5C,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACvC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAA,OAAA,EAAU,OAAO,CAAA,CAAE;oBACzB,OAAO,EAAE,CAAA,iBAAA,EAAoB,OAAO,CAAA,YAAA,CAAc;AAClD,oBAAA,QAAQ,EAAE,MAAM;AACjB,iBAAA,CAAC;YACJ;QACF;IACF;AAEA,IAAA,OAAO,QAAQ;AACjB;AAEM,SAAU,uBAAuB,CACrC,QAA0B,EAAA;IAE1B,MAAM,MAAM,GAAa,EAAE;IAC3B,MAAM,QAAQ,GAAa,EAAE;AAC7B,IAAA,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE;QACxB,MAAM,SAAS,GAAG,CAAA,SAAA,EAAY,CAAC,CAAC,IAAI,CAAA,EAAA,EAAK,CAAC,CAAC,OAAO,CAAA,CAAE;AACpD,QAAA,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,EAAE;AACzB,YAAA,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACxB;aAAO;AACL,YAAA,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAC1B;IACF;AACA,IAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;AAC7B;;;;;"}
+{"version":3,"file":"bashAst.cjs","names":[],"sources":["../../../../src/tools/local/bashAst.ts"],"sourcesContent":["import type * as t from '@/types';\n\nexport type BashAstFinding = {\n  code: string;\n  message: string;\n  severity: 'warn' | 'deny';\n};\n\n/**\n * Categorical-hazard checks layered on top of the existing dangerous-\n * command regex set. These match command-shape signatures that\n * claude-code's tree-sitter AST validator catches via categorical\n * deny-lists (command substitution, zsh-only privileged commands,\n * /proc/<pid>/environ access, IFS injection, etc.).\n *\n * This is *not* a real AST parser. It is a deliberately conservative\n * heuristic pass intended for the local engine's `bashAst: 'auto' |\n * 'strict'` modes; a future PR can swap in a true tree-sitter-bash\n * pass behind the same config field without changing the public API.\n *\n * `runBashAstChecks` runs on the *quote-stripped* command (so quoted\n * strings inside the script don't generate false positives) and\n * returns one finding per matched category.\n */\n\nconst COMMAND_SUBSTITUTION_PATTERNS: { code: string; rx: RegExp }[] = [\n  { code: 'cmd-subst-dollar-paren', rx: /\\$\\(/ },\n  { code: 'cmd-subst-backtick', rx: /`[^`]*`/ },\n  { code: 'cmd-subst-process-sub', rx: /[<>]\\(/ },\n  { code: 'cmd-subst-zsh-eq', rx: /(?:^|\\s)=[A-Za-z_]/ },\n];\n\nconst ZSH_DANGEROUS_BUILTINS = [\n  'zmodload',\n  'emulate',\n  'sysopen',\n  'sysread',\n  'syswrite',\n  'ztcp',\n  'zsocket',\n  'zf_rm',\n  'zselect',\n];\n\nconst STRICT_DENIED_BUILTINS = [\n  'eval',\n  'exec',\n];\n\nfunction rxForBuiltin(name: string): RegExp {\n  return new RegExp(`\\\\b${name}\\\\b`);\n}\n\nconst PROC_ENVIRON_RX = /\\/proc\\/(?:\\d+|self|\\$[A-Za-z_])\\/environ\\b/;\nconst IFS_INJECTION_RX = /\\bIFS\\s*=/;\nconst HEX_ESCAPE_OBFUSCATION_RX = /\\\\x[0-9a-fA-F]{2}/;\nconst SOURCE_FROM_VAR_RX = /(?:^|\\s)(?:source|\\.)\\s+[\"']?\\$[A-Za-z_]/;\n\nexport function runBashAstChecks(\n  command: string,\n  mode: t.LocalBashAstMode = 'off'\n): BashAstFinding[] {\n  if (mode === 'off') {\n    return [];\n  }\n  const findings: BashAstFinding[] = [];\n  const strict = mode === 'strict';\n\n  for (const { code, rx } of COMMAND_SUBSTITUTION_PATTERNS) {\n    if (rx.test(command)) {\n      findings.push({\n        code,\n        message:\n          'Command substitution can mask intent and exfiltrate variables; not allowed under bashAst.',\n        severity: strict ? 'deny' : 'warn',\n      });\n    }\n  }\n\n  for (const builtin of ZSH_DANGEROUS_BUILTINS) {\n    if (rxForBuiltin(builtin).test(command)) {\n      findings.push({\n        code: `zsh-builtin-${builtin}`,\n        message: `Zsh privileged builtin \"${builtin}\" is denied.`,\n        severity: 'deny',\n      });\n    }\n  }\n\n  if (PROC_ENVIRON_RX.test(command)) {\n    findings.push({\n      code: 'proc-environ-read',\n      message: 'Reads from /proc/<pid>/environ are denied — leaks host secrets.',\n      severity: 'deny',\n    });\n  }\n\n  if (IFS_INJECTION_RX.test(command)) {\n    findings.push({\n      code: 'ifs-injection',\n      message: 'Inline IFS reassignment is suspicious; review the command.',\n      severity: strict ? 'deny' : 'warn',\n    });\n  }\n\n  if (HEX_ESCAPE_OBFUSCATION_RX.test(command)) {\n    findings.push({\n      code: 'hex-escape',\n      message: 'Hex-escaped bytes (\\\\xNN) often hide intent; review the command.',\n      severity: strict ? 'deny' : 'warn',\n    });\n  }\n\n  if (SOURCE_FROM_VAR_RX.test(command)) {\n    findings.push({\n      code: 'source-from-variable',\n      message: 'Sourcing a script from an unbound variable is denied.',\n      severity: 'deny',\n    });\n  }\n\n  if (strict) {\n    for (const builtin of STRICT_DENIED_BUILTINS) {\n      if (rxForBuiltin(builtin).test(command)) {\n        findings.push({\n          code: `strict-${builtin}`,\n          message: `In strict mode, \"${builtin}\" is denied.`,\n          severity: 'deny',\n        });\n      }\n    }\n  }\n\n  return findings;\n}\n\nexport function bashAstFindingsToErrors(\n  findings: BashAstFinding[]\n): { errors: string[]; warnings: string[] } {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n  for (const f of findings) {\n    const formatted = `[bashAst:${f.code}] ${f.message}`;\n    if (f.severity === 'deny') {\n      errors.push(formatted);\n    } else {\n      warnings.push(formatted);\n    }\n  }\n  return { errors, warnings };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,MAAM,gCAAgE;CACpE;EAAE,MAAM;EAA0B,IAAI;CAAO;CAC7C;EAAE,MAAM;EAAsB,IAAI;CAAU;CAC5C;EAAE,MAAM;EAAyB,IAAI;CAAS;CAC9C;EAAE,MAAM;EAAoB,IAAI;CAAqB;AACvD;AAEA,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,yBAAyB,CAC7B,QACA,MACF;AAEA,SAAS,aAAa,MAAsB;CAC1C,OAAO,IAAI,OAAO,MAAM,KAAK,IAAI;AACnC;AAEA,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AACzB,MAAM,4BAA4B;AAClC,MAAM,qBAAqB;AAE3B,SAAgB,iBACd,SACA,OAA2B,OACT;CAClB,IAAI,SAAS,OACX,OAAO,CAAC;CAEV,MAAM,WAA6B,CAAC;CACpC,MAAM,SAAS,SAAS;CAExB,KAAK,MAAM,EAAE,MAAM,QAAQ,+BACzB,IAAI,GAAG,KAAK,OAAO,GACjB,SAAS,KAAK;EACZ;EACA,SACE;EACF,UAAU,SAAS,SAAS;CAC9B,CAAC;CAIL,KAAK,MAAM,WAAW,wBACpB,IAAI,aAAa,OAAO,CAAC,CAAC,KAAK,OAAO,GACpC,SAAS,KAAK;EACZ,MAAM,eAAe;EACrB,SAAS,2BAA2B,QAAQ;EAC5C,UAAU;CACZ,CAAC;CAIL,IAAI,gBAAgB,KAAK,OAAO,GAC9B,SAAS,KAAK;EACZ,MAAM;EACN,SAAS;EACT,UAAU;CACZ,CAAC;CAGH,IAAI,iBAAiB,KAAK,OAAO,GAC/B,SAAS,KAAK;EACZ,MAAM;EACN,SAAS;EACT,UAAU,SAAS,SAAS;CAC9B,CAAC;CAGH,IAAI,0BAA0B,KAAK,OAAO,GACxC,SAAS,KAAK;EACZ,MAAM;EACN,SAAS;EACT,UAAU,SAAS,SAAS;CAC9B,CAAC;CAGH,IAAI,mBAAmB,KAAK,OAAO,GACjC,SAAS,KAAK;EACZ,MAAM;EACN,SAAS;EACT,UAAU;CACZ,CAAC;CAGH,IAAI;OACG,MAAM,WAAW,wBACpB,IAAI,aAAa,OAAO,CAAC,CAAC,KAAK,OAAO,GACpC,SAAS,KAAK;GACZ,MAAM,UAAU;GAChB,SAAS,oBAAoB,QAAQ;GACrC,UAAU;EACZ,CAAC;CAAA;CAKP,OAAO;AACT;AAEA,SAAgB,wBACd,UAC0C;CAC1C,MAAM,SAAmB,CAAC;CAC1B,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,KAAK,UAAU;EACxB,MAAM,YAAY,YAAY,EAAE,KAAK,IAAI,EAAE;EAC3C,IAAI,EAAE,aAAa,QACjB,OAAO,KAAK,SAAS;OAErB,SAAS,KAAK,SAAS;CAE3B;CACA,OAAO;EAAE;EAAQ;CAAS;AAC5B"}

package/dist/cjs/tools/local/editStrategies.cjs

@@ -1,188 +1,145 @@
-'use strict';
-
-/**
- * Single-occurrence string-replacement strategies for `edit_file`.
- *
- * The LLM frequently emits an `oldString` whose whitespace, indentation,
- * or escape sequences are slightly off from the on-disk content. Rather
- * than failing the call (which forces a re-read + retry round-trip),
- * we walk a chain of progressively looser matchers, stopping at the
- * first one that locates exactly one match. The matched on-disk slice
- * is then literally replaced with `newString` — we never modify
- * `newString`, only the search.
- *
- * Strategies are ordered from strict to lenient so we don't accidentally
- * over-match a more specific pattern with a looser one. Inspired by
- * opencode's nine-strategy chain (sst/opencode), trimmed to the four
- * highest-yield strategies for a first cut. Add more (block-anchor +
- * Levenshtein, escape-normalized, etc.) as needed.
- */
+//#region src/tools/local/editStrategies.ts
 const exactStrategy = (source, oldString) => {
-    if (oldString === '')
-        return null;
-    const first = source.indexOf(oldString);
-    if (first === -1)
-        return null;
-    const second = source.indexOf(oldString, first + oldString.length);
-    if (second !== -1)
-        return null;
-    return { strategy: 'exact', start: first, end: first + oldString.length };
+	if (oldString === "") return null;
+	const first = source.indexOf(oldString);
+	if (first === -1) return null;
+	if (source.indexOf(oldString, first + oldString.length) !== -1) return null;
+	return {
+		strategy: "exact",
+		start: first,
+		end: first + oldString.length
+	};
 };
 /**
- * Match per-line, ignoring trailing whitespace differences. Useful for
- * the very common case where the LLM stripped trailing spaces or added
- * an extra blank.
- */
+* Match per-line, ignoring trailing whitespace differences. Useful for
+* the very common case where the LLM stripped trailing spaces or added
+* an extra blank.
+*/
 const lineTrimmedStrategy = (source, oldString) => {
-    if (oldString === '')
-        return null;
-    const sourceLines = source.split('\n');
-    const oldLines = oldString.split('\n');
-    if (oldLines.length === 0 || oldLines.length > sourceLines.length) {
-        return null;
-    }
-    let foundAt = -1;
-    for (let i = 0; i <= sourceLines.length - oldLines.length; i++) {
-        let ok = true;
-        for (let j = 0; j < oldLines.length; j++) {
-            if (sourceLines[i + j].trimEnd() !== oldLines[j].trimEnd()) {
-                ok = false;
-                break;
-            }
-        }
-        if (!ok)
-            continue;
-        if (foundAt !== -1)
-            return null; // multiple matches
-        foundAt = i;
-    }
-    if (foundAt === -1)
-        return null;
-    let start = 0;
-    for (let i = 0; i < foundAt; i++)
-        start += sourceLines[i].length + 1;
-    let end = start;
-    for (let i = 0; i < oldLines.length; i++) {
-        end += sourceLines[foundAt + i].length;
-        if (i < oldLines.length - 1)
-            end += 1;
-    }
-    return { strategy: 'line-trimmed', start, end };
+	if (oldString === "") return null;
+	const sourceLines = source.split("\n");
+	const oldLines = oldString.split("\n");
+	if (oldLines.length === 0 || oldLines.length > sourceLines.length) return null;
+	let foundAt = -1;
+	for (let i = 0; i <= sourceLines.length - oldLines.length; i++) {
+		let ok = true;
+		for (let j = 0; j < oldLines.length; j++) if (sourceLines[i + j].trimEnd() !== oldLines[j].trimEnd()) {
+			ok = false;
+			break;
+		}
+		if (!ok) continue;
+		if (foundAt !== -1) return null;
+		foundAt = i;
+	}
+	if (foundAt === -1) return null;
+	let start = 0;
+	for (let i = 0; i < foundAt; i++) start += sourceLines[i].length + 1;
+	let end = start;
+	for (let i = 0; i < oldLines.length; i++) {
+		end += sourceLines[foundAt + i].length;
+		if (i < oldLines.length - 1) end += 1;
+	}
+	return {
+		strategy: "line-trimmed",
+		start,
+		end
+	};
 };
 /**
- * Collapse all runs of whitespace to a single space and match. Catches
- * cases where the LLM normalised tabs to spaces or vice-versa.
- */
+* Collapse all runs of whitespace to a single space and match. Catches
+* cases where the LLM normalised tabs to spaces or vice-versa.
+*/
 const whitespaceNormalizedStrategy = (source, oldString) => {
-    if (oldString === '')
-        return null;
-    const norm = (s) => s.replace(/\s+/g, ' ').trim();
-    const normalizedNeedle = norm(oldString);
-    if (normalizedNeedle === '')
-        return null;
-    const sourceLines = source.split('\n');
-    const needleLines = oldString.split('\n');
-    if (needleLines.length > sourceLines.length)
-        return null;
-    let foundAt = -1;
-    for (let i = 0; i <= sourceLines.length - needleLines.length; i++) {
-        const candidate = sourceLines
-            .slice(i, i + needleLines.length)
-            .join('\n');
-        if (norm(candidate) !== normalizedNeedle)
-            continue;
-        if (foundAt !== -1)
-            return null;
-        foundAt = i;
-    }
-    if (foundAt === -1)
-        return null;
-    let start = 0;
-    for (let i = 0; i < foundAt; i++)
-        start += sourceLines[i].length + 1;
-    let end = start;
-    for (let i = 0; i < needleLines.length; i++) {
-        end += sourceLines[foundAt + i].length;
-        if (i < needleLines.length - 1)
-            end += 1;
-    }
-    return { strategy: 'whitespace-normalized', start, end };
+	if (oldString === "") return null;
+	const norm = (s) => s.replace(/\s+/g, " ").trim();
+	const normalizedNeedle = norm(oldString);
+	if (normalizedNeedle === "") return null;
+	const sourceLines = source.split("\n");
+	const needleLines = oldString.split("\n");
+	if (needleLines.length > sourceLines.length) return null;
+	let foundAt = -1;
+	for (let i = 0; i <= sourceLines.length - needleLines.length; i++) {
+		if (norm(sourceLines.slice(i, i + needleLines.length).join("\n")) !== normalizedNeedle) continue;
+		if (foundAt !== -1) return null;
+		foundAt = i;
+	}
+	if (foundAt === -1) return null;
+	let start = 0;
+	for (let i = 0; i < foundAt; i++) start += sourceLines[i].length + 1;
+	let end = start;
+	for (let i = 0; i < needleLines.length; i++) {
+		end += sourceLines[foundAt + i].length;
+		if (i < needleLines.length - 1) end += 1;
+	}
+	return {
+		strategy: "whitespace-normalized",
+		start,
+		end
+	};
 };
 /**
- * Strip the common leading-indent from each line of the needle and
- * each candidate window of the source. Catches the very common case
- * where the LLM omitted the indentation it should have copied.
- */
+* Strip the common leading-indent from each line of the needle and
+* each candidate window of the source. Catches the very common case
+* where the LLM omitted the indentation it should have copied.
+*/
 const indentationFlexibleStrategy = (source, oldString) => {
-    if (oldString === '')
-        return null;
-    const stripCommonIndent = (block) => {
-        const lines = block.split('\n');
-        let common = Number.POSITIVE_INFINITY;
-        for (const line of lines) {
-            if (line.trim() === '')
-                continue;
-            const m = /^(\s*)/.exec(line);
-            const indent = m ? m[1].length : 0;
-            if (indent < common)
-                common = indent;
-            if (common === 0)
-                break;
-        }
-        if (!Number.isFinite(common) || common === 0)
-            return block;
-        return lines
-            .map((l) => (l.length >= common ? l.slice(common) : l))
-            .join('\n');
-    };
-    const normalizedNeedle = stripCommonIndent(oldString);
-    if (normalizedNeedle === '')
-        return null;
-    const sourceLines = source.split('\n');
-    const needleLines = oldString.split('\n');
-    if (needleLines.length > sourceLines.length)
-        return null;
-    let foundAt = -1;
-    for (let i = 0; i <= sourceLines.length - needleLines.length; i++) {
-        const window = sourceLines.slice(i, i + needleLines.length).join('\n');
-        if (stripCommonIndent(window) !== normalizedNeedle)
-            continue;
-        if (foundAt !== -1)
-            return null;
-        foundAt = i;
-    }
-    if (foundAt === -1)
-        return null;
-    let start = 0;
-    for (let i = 0; i < foundAt; i++)
-        start += sourceLines[i].length + 1;
-    let end = start;
-    for (let i = 0; i < needleLines.length; i++) {
-        end += sourceLines[foundAt + i].length;
-        if (i < needleLines.length - 1)
-            end += 1;
-    }
-    return { strategy: 'indentation-flexible', start, end };
+	if (oldString === "") return null;
+	const stripCommonIndent = (block) => {
+		const lines = block.split("\n");
+		let common = Number.POSITIVE_INFINITY;
+		for (const line of lines) {
+			if (line.trim() === "") continue;
+			const m = /^(\s*)/.exec(line);
+			const indent = m ? m[1].length : 0;
+			if (indent < common) common = indent;
+			if (common === 0) break;
+		}
+		if (!Number.isFinite(common) || common === 0) return block;
+		return lines.map((l) => l.length >= common ? l.slice(common) : l).join("\n");
+	};
+	const normalizedNeedle = stripCommonIndent(oldString);
+	if (normalizedNeedle === "") return null;
+	const sourceLines = source.split("\n");
+	const needleLines = oldString.split("\n");
+	if (needleLines.length > sourceLines.length) return null;
+	let foundAt = -1;
+	for (let i = 0; i <= sourceLines.length - needleLines.length; i++) {
+		if (stripCommonIndent(sourceLines.slice(i, i + needleLines.length).join("\n")) !== normalizedNeedle) continue;
+		if (foundAt !== -1) return null;
+		foundAt = i;
+	}
+	if (foundAt === -1) return null;
+	let start = 0;
+	for (let i = 0; i < foundAt; i++) start += sourceLines[i].length + 1;
+	let end = start;
+	for (let i = 0; i < needleLines.length; i++) {
+		end += sourceLines[foundAt + i].length;
+		if (i < needleLines.length - 1) end += 1;
+	}
+	return {
+		strategy: "indentation-flexible",
+		start,
+		end
+	};
 };
 const STRATEGY_CHAIN = [
-    exactStrategy,
-    lineTrimmedStrategy,
-    whitespaceNormalizedStrategy,
-    indentationFlexibleStrategy,
+	exactStrategy,
+	lineTrimmedStrategy,
+	whitespaceNormalizedStrategy,
+	indentationFlexibleStrategy
 ];
 function locateEdit(source, oldString) {
-    for (const strategy of STRATEGY_CHAIN) {
-        const match = strategy(source, oldString);
-        if (match != null) {
-            return match;
-        }
-    }
-    return null;
+	for (const strategy of STRATEGY_CHAIN) {
+		const match = strategy(source, oldString);
+		if (match != null) return match;
+	}
+	return null;
 }
 function applyEdit(source, match, newString) {
-    return source.slice(0, match.start) + newString + source.slice(match.end);
+	return source.slice(0, match.start) + newString + source.slice(match.end);
 }
-
+//#endregion
 exports.applyEdit = applyEdit;
 exports.locateEdit = locateEdit;
-//# sourceMappingURL=editStrategies.cjs.map
+
+//# sourceMappingURL=editStrategies.cjs.map