@north-light/crouter 0.3.302 → 0.3.303

package/dist/core/shell-segments.js

@@ -0,0 +1,169 @@
+// shell-segments.ts — best-effort shell text reading, shared by everything in
+// crtr that has to reason about a command string it did not execute: the doc
+// substrate's `command`/`pre-command` surface matching and the bash valve's
+// refusals. Pure text in, structure out; no execution, no expansion.
+//
+// This is deliberately NOT a shell parser. Subshells, backticks, process
+// substitution, and path-prefixed binaries stay unhandled. Every caller must
+// treat a miss as "this text did not obviously do X", never as "this text
+// cannot do X".
+/** Split a command into shell segments on unquoted `;`, newline, `&&`, `||`,
+ *  `|`, and a single `&`. Subshell parentheses and backticks are left inside
+ *  their segment. Heredoc bodies are a separate pre-read concern (see
+ *  `stripHeredocs`). */
+export function splitCommandSegments(command) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    let escaped = false;
+    const finish = (background = false) => {
+        segments.push({ text: current, background });
+        current = '';
+    };
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (escaped) {
+            current += ch;
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\' && quote !== "'") {
+            current += ch;
+            escaped = true;
+            continue;
+        }
+        if (quote !== null) {
+            current += ch;
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            current += ch;
+            quote = ch;
+            continue;
+        }
+        if (ch === '\n' || ch === ';') {
+            finish();
+            continue;
+        }
+        if ((ch === '&' || ch === '|') && command[i + 1] === ch) {
+            finish();
+            i += 1;
+            continue;
+        }
+        if (ch === '|') {
+            finish();
+            continue;
+        }
+        if (ch === '&') {
+            finish(true);
+            continue;
+        }
+        current += ch;
+    }
+    finish();
+    return segments;
+}
+/** Tokenize one segment into shell words, marking quoted spans opaque. */
+export function tokenizeCommandSegment(segment) {
+    const tokens = [];
+    let text = '';
+    let opaque = false;
+    let started = false;
+    let quote = null;
+    let escaped = false;
+    const finish = () => {
+        if (started)
+            tokens.push({ text, opaque });
+        text = '';
+        opaque = false;
+        started = false;
+    };
+    for (let i = 0; i < segment.length; i += 1) {
+        const ch = segment[i];
+        if (escaped) {
+            text += ch;
+            started = true;
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\' && quote !== "'") {
+            escaped = true;
+            started = true;
+            continue;
+        }
+        if (quote !== null) {
+            started = true;
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                text += ch;
+            }
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            opaque = true;
+            started = true;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            finish();
+            continue;
+        }
+        text += ch;
+        started = true;
+    }
+    if (escaped)
+        text += '\\';
+    finish();
+    return tokens;
+}
+/** Every non-empty command segment, paired with its raw text. */
+export function commandSegments(command) {
+    return splitCommandSegments(command)
+        .map(({ text, background }) => {
+        const tokens = tokenizeCommandSegment(text);
+        let first = 0;
+        while (first < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[first].text))
+            first += 1;
+        return { text: text.trim(), assignments: tokens.slice(0, first).map((t) => t.text), tokens: tokens.slice(first), background };
+    })
+        .filter((segment) => segment.assignments.length > 0 || segment.tokens.length > 0);
+}
+const HEREDOC_OPEN = /<<(-?)\s*(["']?)([A-Za-z_][A-Za-z0-9_]*)\2/g;
+/** Remove heredoc BODIES (the stdin data between `<<DELIM` and its closing
+ *  `DELIM` line) from a command before it is read. The opening line is kept —
+ *  `crtr push final <<'EOF'` is still a real `push final` invocation — but the
+ *  body lines, which are data fed on stdin and never executed as commands, are
+ *  dropped. Without this, a doc-writing command whose body merely MENTIONS a
+ *  matched invocation would have its whole call held or refused. */
+export function stripHeredocs(command) {
+    const lines = command.split('\n');
+    const out = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        out.push(line);
+        i += 1;
+        // Every heredoc opened on this line, left to right; their bodies stack and
+        // are consumed in that order.
+        const delims = [];
+        HEREDOC_OPEN.lastIndex = 0;
+        let m;
+        while ((m = HEREDOC_OPEN.exec(line)) !== null)
+            delims.push({ name: m[3], dash: m[1] === '-' });
+        for (const d of delims) {
+            while (i < lines.length) {
+                // `<<-` strips leading TABS from the body and the closing delimiter.
+                const probe = d.dash ? lines[i].replace(/^\t+/, '') : lines[i];
+                i += 1;
+                if (probe === d.name)
+                    break; // closing delimiter line — drop it, stop
+            }
+        }
+    }
+    return out.join('\n');
+}

package/dist/core/substrate/surface-match.d.ts

@@ -20,15 +20,6 @@ export declare function matchesReadEntry(entry: SurfaceEntry, doc: Pick<Substrat
 export declare function matchesMemoryReadEntry(entry: SurfaceEntry, routingAnchor: string, subject: NodeConfigSubject | null, name: string): boolean;
 /** Does a `command` entry fit the executed command string? */
 export declare function matchesCommandEntry(entry: SurfaceEntry, subject: NodeConfigSubject | null, command: string): boolean;
-/** Remove heredoc BODIES (the stdin data between `<<DELIM` and its closing
- *  `DELIM` line) from a command before it is matched. The opening line is kept
- *  — `crtr push final <<'EOF'` is still a real `push final` invocation — but the
- *  body lines, which are data fed on stdin and never executed as commands, are
- *  dropped. Without this a doc-writing command whose body merely MENTIONS a
- *  matched invocation would have its whole call held. Post-execution `command`
- *  delivery does not need this (a spurious late injection costs a paragraph);
- *  a `pre-command` block costs the agent a turn, so it does. */
-export declare function stripHeredocs(command: string): string;
 /** Does a `pre-command` entry fit a command that is ABOUT to run? The same
  *  glob machinery `command` uses — one matcher, one semantics — applied to the
  *  command with its heredoc bodies stripped. Subshell parentheses, backticks,

package/dist/core/substrate/surface-match.js

@@ -10,6 +10,7 @@
 // container (its owning repo dir for `read`, its canonical routing anchor for
 // `memory-read`).
 import { basename, isAbsolute, matchesGlob, relative, sep } from 'node:path';
+import { commandSegments, stripHeredocs } from '../shell-segments.js';
 import { CRTR_DIR_NAME } from '../../types.js';
 import { realpathOrSelf } from '../fs-utils.js';
 import { evalCondition } from '../predicate.js';
@@ -102,129 +103,6 @@ export function matchesMemoryReadEntry(entry, routingAnchor, subject, name) {
         return false;
     return entry.match.some((g) => memoryReadGlobMatches(g, routingAnchor, name));
 }
-/** Split a command into shell segments on unquoted `;`, newline, `&&`, `||`,
- *  and `|`. A single `&`, subshell parentheses, and backticks are left inside
- *  their segment — this is a best-effort guardrail, not a shell parser.
- *  Heredoc bodies are a separate pre-match concern (see `stripHeredocs`). */
-function splitCommandSegments(command) {
-    const segments = [];
-    let current = '';
-    let quote = null;
-    let escaped = false;
-    const finish = () => {
-        segments.push(current);
-        current = '';
-    };
-    for (let i = 0; i < command.length; i += 1) {
-        const ch = command[i];
-        if (escaped) {
-            current += ch;
-            escaped = false;
-            continue;
-        }
-        if (ch === '\\' && quote !== "'") {
-            current += ch;
-            escaped = true;
-            continue;
-        }
-        if (quote !== null) {
-            current += ch;
-            if (ch === quote)
-                quote = null;
-            continue;
-        }
-        if (ch === "'" || ch === '"') {
-            current += ch;
-            quote = ch;
-            continue;
-        }
-        if (ch === '\n' || ch === ';') {
-            finish();
-            continue;
-        }
-        if ((ch === '&' || ch === '|') && command[i + 1] === ch) {
-            finish();
-            i += 1;
-            continue;
-        }
-        if (ch === '|') {
-            finish();
-            continue;
-        }
-        current += ch;
-    }
-    finish();
-    return segments;
-}
-/** Tokenize one segment into shell words, marking quoted spans opaque. */
-function tokenizeCommandSegment(segment) {
-    const tokens = [];
-    let text = '';
-    let opaque = false;
-    let started = false;
-    let quote = null;
-    let escaped = false;
-    const finish = () => {
-        if (started)
-            tokens.push({ text, opaque });
-        text = '';
-        opaque = false;
-        started = false;
-    };
-    for (let i = 0; i < segment.length; i += 1) {
-        const ch = segment[i];
-        if (escaped) {
-            text += ch;
-            started = true;
-            escaped = false;
-            continue;
-        }
-        if (ch === '\\' && quote !== "'") {
-            escaped = true;
-            started = true;
-            continue;
-        }
-        if (quote !== null) {
-            started = true;
-            if (ch === quote) {
-                quote = null;
-            }
-            else {
-                text += ch;
-            }
-            continue;
-        }
-        if (ch === "'" || ch === '"') {
-            quote = ch;
-            opaque = true;
-            started = true;
-            continue;
-        }
-        if (/\s/.test(ch)) {
-            finish();
-            continue;
-        }
-        text += ch;
-        started = true;
-    }
-    if (escaped)
-        text += '\\';
-    finish();
-    return tokens;
-}
-/** Every non-empty command segment as its env-stripped token list: leading
- *  `VAR=value` assignments are dropped so `tokens[0]` is the executable. */
-function commandSegments(command) {
-    return splitCommandSegments(command)
-        .map(tokenizeCommandSegment)
-        .map((tokens) => {
-        let first = 0;
-        while (first < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[first].text))
-            first += 1;
-        return tokens.slice(first);
-    })
-        .filter((tokens) => tokens.length > 0);
-}
 function commandGlobPattern(glob) {
     const words = glob.trim().split(/\s+/);
     if (words.length === 1 && words[0] === '')
@@ -275,7 +153,9 @@ function commandGlobMatches(glob, command) {
     const pattern = commandGlobPattern(glob);
     if (pattern === null)
         return false;
-    return commandSegments(command).some((tokens) => segmentMatches(pattern, tokens));
+    return commandSegments(command)
+        .filter(({ tokens }) => tokens.length > 0)
+        .some(({ tokens }) => segmentMatches(pattern, tokens));
 }
 /** Does a `command` entry fit the executed command string? */
 export function matchesCommandEntry(entry, subject, command) {
@@ -283,42 +163,6 @@ export function matchesCommandEntry(entry, subject, command) {
         return false;
     return entry.match.some((g) => commandGlobMatches(g, command));
 }
-const HEREDOC_OPEN = /<<(-?)\s*(["']?)([A-Za-z_][A-Za-z0-9_]*)\2/g;
-/** Remove heredoc BODIES (the stdin data between `<<DELIM` and its closing
- *  `DELIM` line) from a command before it is matched. The opening line is kept
- *  — `crtr push final <<'EOF'` is still a real `push final` invocation — but the
- *  body lines, which are data fed on stdin and never executed as commands, are
- *  dropped. Without this a doc-writing command whose body merely MENTIONS a
- *  matched invocation would have its whole call held. Post-execution `command`
- *  delivery does not need this (a spurious late injection costs a paragraph);
- *  a `pre-command` block costs the agent a turn, so it does. */
-export function stripHeredocs(command) {
-    const lines = command.split('\n');
-    const out = [];
-    let i = 0;
-    while (i < lines.length) {
-        const line = lines[i];
-        out.push(line);
-        i += 1;
-        // Every heredoc opened on this line, left to right; their bodies stack and
-        // are consumed in that order.
-        const delims = [];
-        HEREDOC_OPEN.lastIndex = 0;
-        let m;
-        while ((m = HEREDOC_OPEN.exec(line)) !== null)
-            delims.push({ name: m[3], dash: m[1] === '-' });
-        for (const d of delims) {
-            while (i < lines.length) {
-                // `<<-` strips leading TABS from the body and the closing delimiter.
-                const probe = d.dash ? lines[i].replace(/^\t+/, '') : lines[i];
-                i += 1;
-                if (probe === d.name)
-                    break; // closing delimiter line — drop it, stop
-            }
-        }
-    }
-    return out.join('\n');
-}
 /** Does a `pre-command` entry fit a command that is ABOUT to run? The same
  *  glob machinery `command` uses — one matcher, one semantics — applied to the
  *  command with its heredoc bodies stripped. Subshell parentheses, backticks,

package/dist/pi-extensions/canvas-bash-valve.d.ts

@@ -1,8 +1,5 @@
 import { createBashToolDefinition, type BashOperations } from '@earendil-works/pi-coding-agent';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-/** Seconds a leading `sleep ...` will block for, or null when the command does
- *  not open with a sleep (or its duration isn't statically knowable). */
-export declare function leadingSleepSeconds(command: string): number | null;
 /** The valve's BashOperations backend. Each tool execution closes over its own
  * `takePurpose` and its own preview-result path, so concurrent calls cannot
  * exchange labels or result mirrors. The purpose is consumed even when the

package/dist/pi-extensions/canvas-bash-valve.js

@@ -31,6 +31,7 @@ import { homedir } from 'node:os';
 import { dirname } from 'node:path';
 import { performance } from 'node:perf_hooks';
 import { backgroundBashJob, bashJobPaths, formatBashElapsed, newBashJobId, normalizeBashJobPurpose, readBashNiceness, writeJobDeadlineMs } from '../core/bash-jobs.js';
+import { bashCommandRefusal } from '../core/bash-guard.js';
 import { readConfig } from '../core/config.js';
 import { PREVIEW_RESULT_PATH_ENV, previewResultPath } from '../core/preview-result-path.js';
 import { resolveAdmittedHostCommand } from '../core/runtime/spawn-env.js';
@@ -164,39 +165,6 @@ function readExitCode(path) {
         return null;
     }
 }
-// Long-sleep guard. A command that opens with `sleep <long>` is a node burning
-// a live window to wait on a clock — the runtime already has waiting primitives
-// that cost nothing (`crtr cron` for a scheduled wake, `crtr node wait deadline`
-// for an inbox-vs-deadline race). Anything over 10s is refused before it runs.
-const MAX_INLINE_SLEEP_SECONDS = 10;
-const SLEEP_UNIT_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
-/** Seconds a leading `sleep ...` will block for, or null when the command does
- *  not open with a sleep (or its duration isn't statically knowable). */
-export function leadingSleepSeconds(command) {
-    const match = /^\s*sleep(\s+[^;&|\n]+)/.exec(command);
-    if (!match)
-        return null;
-    // `sleep 1 2m 3` sums its operands.
-    let total = 0;
-    for (const operand of match[1].trim().split(/\s+/)) {
-        const parsed = /^([0-9]*\.?[0-9]+)([smhd]?)$/.exec(operand);
-        if (!parsed)
-            return null; // variable/expansion/flag — not statically knowable
-        total += Number(parsed[1]) * SLEEP_UNIT_SECONDS[parsed[2] || 's'];
-    }
-    return total;
-}
-function longSleepRefusal(command) {
-    const seconds = leadingSleepSeconds(command);
-    if (seconds === null || seconds <= MAX_INLINE_SLEEP_SECONDS)
-        return null;
-    return (`Refused: this command starts by sleeping ${seconds}s, over the ${MAX_INLINE_SLEEP_SECONDS}s inline limit.\n` +
-        `Holding a live window on a clock is never how you wait here. Instead:\n` +
-        `  - schedule the wake and end your turn: crtr cron -h (one-shot at a time, or recurring)\n` +
-        `  - race an inbox message against a deadline: crtr node wait deadline -h\n` +
-        `  - waiting on a child, a reply from the user, or any spine event: just stop — the runtime wakes you.\n` +
-        `If you truly need a short pause inline, sleep ${MAX_INLINE_SLEEP_SECONDS}s or less.`);
-}
 /** A node can legitimately remove its own merged worktree. Never recreate that
  *  path: it would look like a valid checkout but no longer be one. Run later
  *  commands from a durable directory instead, and make the changed semantics
@@ -228,7 +196,7 @@ export function createValveOperations(nodeId, contextDir, takePurpose = () => nu
                     reject(new Error('aborted'));
                     return;
                 }
-                const refusal = longSleepRefusal(command);
+                const refusal = bashCommandRefusal(command, cwd);
                 if (refusal !== null) {
                     reject(new Error(refusal));
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.302",
+  "version": "0.3.303",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.302",
+  "version": "0.3.303",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.302",
+      "version": "0.3.303",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -5206,17 +5206,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/crouter-api",
-      "version": "0.3.302",
+      "version": "0.3.303",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/crouter-env-docker",
-      "version": "0.3.302",
+      "version": "0.3.303",
       "license": "UNLICENSED"
     },
     "packages/crouter-sdk": {
       "name": "@north-light/crouter-sdk",
-      "version": "0.3.302",
+      "version": "0.3.303",
       "license": "UNLICENSED",
       "dependencies": {
         "@north-light/crouter-api": "^0.3.295"