@phuetz/code-buddy 1.6.1 → 2.0.0

package/dist/security/powershell-parser.js

@@ -0,0 +1,198 @@
+/**
+ * PowerShell command parser backed by PowerShell's native AST.
+ *
+ * The parser script is fixed, UTF-16LE/base64 encoded and passed through
+ * `-EncodedCommand`. The untrusted command is supplied only through an
+ * environment variable, so it can never alter the parser script or its argv.
+ * Every execution or decoding failure returns an empty ParseResult with a
+ * warning; callers must treat warnings as a validation failure.
+ */
+import { spawnSync } from 'node:child_process';
+const POWERSHELL_COMMAND_ENV = '__CODEBUDDY_POWERSHELL_COMMAND__';
+const POWERSHELL_PARSE_TIMEOUT_MS = 1_000;
+const POWERSHELL_PARSE_MAX_BUFFER = 1024 * 1024;
+const POWERSHELL_PARSER_SCRIPT = Buffer.from(String.raw `
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+$commandText = $env:${POWERSHELL_COMMAND_ENV}
+
+if ([string]::IsNullOrWhiteSpace($commandText)) {
+  [PSCustomObject]@{ success = $false; commands = @(); hasRedirection = $false } |
+    ConvertTo-Json -Compress -Depth 5
+  exit 0
+}
+
+$tokens = $null
+$parseErrors = $null
+$ast = [System.Management.Automation.Language.Parser]::ParseInput(
+  $commandText,
+  [ref]$tokens,
+  [ref]$parseErrors
+)
+
+if ($parseErrors -and $parseErrors.Count -gt 0) {
+  [PSCustomObject]@{ success = $false; commands = @(); hasRedirection = $false } |
+    ConvertTo-Json -Compress -Depth 5
+  exit 0
+}
+
+$commandAsts = @($ast.FindAll({
+  param($node)
+  $node -is [System.Management.Automation.Language.CommandAst]
+}, $true))
+$commands = @()
+$hasRedirection = $false
+$hasUnresolvedCommand = $false
+
+foreach ($commandAst in $commandAsts) {
+  if ($commandAst.Redirections.Count -gt 0) {
+    $hasRedirection = $true
+  }
+
+  $name = $commandAst.GetCommandName()
+  if ([string]::IsNullOrWhiteSpace($name)) {
+    $hasUnresolvedCommand = $true
+    continue
+  }
+
+  $arguments = @()
+  for ($index = 1; $index -lt $commandAst.CommandElements.Count; $index++) {
+    $arguments += $commandAst.CommandElements[$index].Extent.Text.Trim()
+  }
+
+  $commands += [PSCustomObject]@{
+    name = $name
+    text = $commandAst.Extent.Text.Trim()
+    args = @($arguments)
+  }
+}
+
+[PSCustomObject]@{
+  success = (-not $hasUnresolvedCommand) -and $commands.Count -gt 0
+  commands = @($commands)
+  hasRedirection = $hasRedirection
+} | ConvertTo-Json -Compress -Depth 5
+`, 'utf16le').toString('base64');
+function failedParse(warning) {
+    return {
+        commands: [],
+        usedTreeSitter: false,
+        warnings: [warning],
+        hasRedirection: false,
+    };
+}
+function defaultRunner(executable, args, options) {
+    return spawnSync(executable, args, options);
+}
+function parserEnvironment(command) {
+    const env = { [POWERSHELL_COMMAND_ENV]: command };
+    const allowed = new Set(['PATH', 'PATHEXT', 'SYSTEMROOT', 'WINDIR', 'TEMP', 'TMP']);
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value !== undefined && allowed.has(key.toUpperCase())) {
+            env[key] = value;
+        }
+    }
+    return env;
+}
+function normalizePowerShellCommandName(name) {
+    const unquoted = name.trim().replace(/^(['"])(.*)\1$/, '$2');
+    const parts = unquoted.split(/[\\/]/).filter(Boolean);
+    return (parts.at(-1) ?? unquoted).replace(/\.exe$/i, '').toLowerCase();
+}
+function isNativePowerShellParseResult(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    if (candidate.success !== true ||
+        !Array.isArray(candidate.commands) ||
+        candidate.commands.length === 0 ||
+        typeof candidate.hasRedirection !== 'boolean') {
+        return false;
+    }
+    return candidate.commands.every((command) => {
+        if (!command || typeof command !== 'object')
+            return false;
+        const detail = command;
+        return (typeof detail.name === 'string' &&
+            detail.name.trim().length > 0 &&
+            typeof detail.text === 'string' &&
+            detail.text.trim().length > 0 &&
+            Array.isArray(detail.args) &&
+            detail.args.every((argument) => typeof argument === 'string'));
+    });
+}
+/**
+ * Parse a PowerShell command with the native PowerShell AST.
+ *
+ * Fail-closed contract: every failure is represented by zero commands and at
+ * least one warning. Consumers must refuse such a result.
+ */
+export function parsePowerShellCommand(input, options = {}) {
+    if (typeof input !== 'string' || !input.trim()) {
+        return failedParse('PowerShell parser received an empty command');
+    }
+    const runner = options.runner ?? defaultRunner;
+    const executables = options.executable ? [options.executable] : ['pwsh', 'powershell'];
+    for (const executable of executables) {
+        let result;
+        try {
+            result = runner(executable, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', POWERSHELL_PARSER_SCRIPT], {
+                env: parserEnvironment(input),
+                encoding: 'utf8',
+                timeout: options.timeoutMs ?? POWERSHELL_PARSE_TIMEOUT_MS,
+                maxBuffer: POWERSHELL_PARSE_MAX_BUFFER,
+                windowsHide: true,
+                shell: false,
+            });
+        }
+        catch {
+            return failedParse('PowerShell parser execution threw unexpectedly');
+        }
+        if (result.error) {
+            if (result.error.code === 'ENOENT' && executable !== executables.at(-1)) {
+                continue;
+            }
+            if (result.error.code === 'ETIMEDOUT') {
+                return failedParse('PowerShell parser timed out');
+            }
+            return failedParse(`PowerShell parser unavailable (${result.error.code ?? 'spawn error'})`);
+        }
+        if (result.signal !== null) {
+            return failedParse('PowerShell parser was terminated before completion');
+        }
+        if (result.status !== 0) {
+            return failedParse(`PowerShell parser exited with status ${result.status ?? 'unknown'}`);
+        }
+        if (String(result.stderr ?? '').trim()) {
+            return failedParse('PowerShell parser wrote to stderr');
+        }
+        const output = String(result.stdout ?? '')
+            .trim()
+            .replace(/^\uFEFF/, '');
+        let parsed;
+        try {
+            parsed = JSON.parse(output);
+        }
+        catch {
+            return failedParse('PowerShell parser returned invalid JSON');
+        }
+        if (!isNativePowerShellParseResult(parsed)) {
+            return failedParse('PowerShell parser returned an incomplete AST result');
+        }
+        const commands = parsed.commands.map((command) => ({
+            command: normalizePowerShellCommandName(command.name),
+            args: command.args,
+            raw: command.text.trim(),
+            connector: null,
+            isSubshell: false,
+        }));
+        return {
+            commands,
+            usedTreeSitter: false,
+            warnings: [],
+            hasRedirection: parsed.hasRedirection,
+        };
+    }
+    return failedParse('PowerShell parser unavailable (ENOENT)');
+}
+//# sourceMappingURL=powershell-parser.js.map

package/dist/security/remote-approval.d.ts

@@ -25,7 +25,6 @@ export declare class RemoteApprovalService extends EventEmitter {
     private pending;
     private resolvers;
     private channels;
-    private nextId;
     private defaultTimeoutMs;
     /**
      * Register a messaging channel for forwarding approvals

package/dist/security/remote-approval.js

@@ -6,6 +6,7 @@
  * Enterprise-grade remote authorization flow.
  */
 import { EventEmitter } from 'events';
+import { randomBytes } from 'crypto';
 import { logger } from '../utils/logger.js';
 // ============================================================================
 // Remote Approval Service
@@ -14,7 +15,6 @@ export class RemoteApprovalService extends EventEmitter {
     pending = new Map();
     resolvers = new Map();
     channels = new Map();
-    nextId = 1;
     defaultTimeoutMs = 120_000; // 2 minutes
     /**
      * Register a messaging channel for forwarding approvals
@@ -40,7 +40,8 @@ export class RemoteApprovalService extends EventEmitter {
      * Returns a promise that resolves to true (approved) or false (denied/expired).
      */
     async requestApproval(req) {
-        const id = `approval-${this.nextId++}`;
+        // 10 hex = 40 bits d'entropie : imprévisible pour un ID à TTL court, et tapable sur Telegram (« /approve approval-9f3c1a2b7e »)
+        const id = `approval-${randomBytes(5).toString('hex')}`;
         const timeoutMs = req.timeoutMs ?? this.defaultTimeoutMs;
         const request = {
             id,

package/dist/security/safe-binaries.d.ts

@@ -19,5 +19,17 @@ export declare class SafeBinariesChecker {
     addSafeBinary(name: string): void;
     removeSafeBinary(name: string): void;
     isCustomized(): boolean;
-    private extractFirstWord;
+    private isEntireExpressionSafe;
+    private isParsedCommandSafe;
+    /**
+     * Reject syntax that can write, spawn hidden commands, or hide additional
+     * commands from a simple command list. Quote-aware scanning avoids treating
+     * literals such as `echo "a > b"` as redirections.
+     */
+    private hasUnsafeShellSyntax;
+    private isEnvironmentQuery;
+    private isHostnameQuery;
+    private isGitQuery;
+    private stripOuterQuotes;
+    private basename;
 }

package/dist/security/safe-binaries.js

@@ -6,6 +6,7 @@
  * that cannot modify the filesystem or system state.
  */
 import { logger } from '../utils/logger.js';
+import { parseBashCommand } from './bash-parser.js';
 // ============================================================================
 // Safe Binaries List
 // ============================================================================
@@ -13,11 +14,44 @@ export const SAFE_BINARIES = [
     'ls', 'cat', 'head', 'tail', 'wc', 'grep', 'rg', 'find',
     'which', 'whoami', 'pwd', 'echo', 'date', 'uname', 'hostname',
     'env', 'printenv', 'file', 'stat', 'du', 'df', 'free', 'uptime',
-    'id', 'groups', 'locale', 'tty', 'stty', 'basename', 'dirname',
+    'id', 'groups', 'locale', 'tty', 'basename', 'dirname',
     'realpath', 'readlink', 'md5sum', 'sha256sum', 'sort', 'uniq',
-    'tr', 'cut', 'paste', 'diff', 'comm', 'tee', 'xargs', 'seq',
-    'yes', 'true', 'false', 'test', 'expr',
+    'tr', 'cut', 'paste', 'diff', 'comm', 'seq', 'true', 'false',
+    'test', 'expr',
+    'git',
+    // PowerShell read-only cmdlets
+    'Get-ChildItem', 'Get-Content', 'Select-String', 'Measure-Object',
+    'Get-Location', 'Get-Item', 'Test-Path', 'Resolve-Path', 'Get-FileHash',
 ];
+const SAFE_POWERSHELL_BINARIES = new Map(SAFE_BINARIES
+    .filter(binary => binary.includes('-'))
+    .map(binary => [binary.toLowerCase(), binary]));
+/**
+ * Options that turn an otherwise read-only command into a mutating command or
+ * an arbitrary command runner. These are deliberately matched after quote
+ * removal because quoted shell arguments still reach the binary unchanged.
+ */
+const UNSAFE_FIND_ACTIONS = new Set([
+    '-delete',
+    '-exec',
+    '-execdir',
+    '-ok',
+    '-okdir',
+    '-fls',
+    '-fprint',
+    '-fprint0',
+    '-fprintf',
+]);
+const SAFE_ENV_OPTIONS_WITH_VALUE = new Set(['-u', '--unset', '-C', '--chdir']);
+const SAFE_ENV_OPTIONS = new Set([
+    '-i',
+    '--ignore-environment',
+    '-0',
+    '--null',
+    '--debug',
+    '--help',
+    '--version',
+]);
 // ============================================================================
 // SafeBinariesChecker
 // ============================================================================
@@ -41,24 +75,13 @@ export class SafeBinariesChecker {
         const trimmed = command.trim();
         if (!trimmed)
             return false;
-        const firstWord = this.extractFirstWord(trimmed);
-        return this.safeBinaries.has(firstWord);
+        return this.isEntireExpressionSafe(trimmed);
     }
     isSafeChain(command) {
         const trimmed = command.trim();
         if (!trimmed)
             return false;
-        // Split on pipes, &&, ||, and ;
-        const parts = trimmed.split(/\s*(?:\|{1,2}|&&|;)\s*/);
-        for (const part of parts) {
-            const cleaned = part.trim();
-            if (!cleaned)
-                continue;
-            if (!this.isSafe(cleaned)) {
-                return false;
-            }
-        }
-        return true;
+        return this.isEntireExpressionSafe(trimmed);
     }
     getSafeBinaries() {
         return Array.from(this.safeBinaries).sort();
@@ -76,24 +99,209 @@ export class SafeBinariesChecker {
     isCustomized() {
         return this.customized;
     }
-    extractFirstWord(command) {
-        // Handle env var prefixes like FOO=bar cmd
-        let cmd = command;
-        while (/^\w+=\S*\s+/.test(cmd)) {
-            cmd = cmd.replace(/^\w+=\S*\s+/, '');
+    isEntireExpressionSafe(command) {
+        // The AST parser identifies every command in pipelines/chains. A lexical
+        // pre-pass covers shell constructs that the fallback parser intentionally
+        // normalizes away (notably redirects and command substitutions).
+        if (this.hasUnsafeShellSyntax(command))
+            return false;
+        const parsed = parseBashCommand(command);
+        if (parsed.warnings.length > 0 || parsed.commands.length === 0)
+            return false;
+        return parsed.commands.every(parsedCommand => this.isParsedCommandSafe(parsedCommand));
+    }
+    isParsedCommandSafe(parsedCommand) {
+        if (parsedCommand.isSubshell)
+            return false;
+        const binary = this.basename(parsedCommand.command);
+        const canonicalPowerShellBinary = SAFE_POWERSHELL_BINARIES.get(binary.toLowerCase());
+        const safeBinary = this.safeBinaries.has(binary)
+            ? binary
+            : canonicalPowerShellBinary && this.safeBinaries.has(canonicalPowerShellBinary)
+                ? canonicalPowerShellBinary
+                : null;
+        if (!safeBinary)
+            return false;
+        const args = parsedCommand.args.map(arg => this.stripOuterQuotes(arg));
+        switch (safeBinary) {
+            case 'find':
+                return !args.some(arg => UNSAFE_FIND_ACTIONS.has(arg.toLowerCase()));
+            case 'rg':
+                return !args.some(arg => {
+                    const option = arg.toLowerCase();
+                    return option === '--pre'
+                        || option.startsWith('--pre=')
+                        || option === '--hostname-bin'
+                        || option.startsWith('--hostname-bin=')
+                        // Compressed search delegates to external decompression tools.
+                        || option === '--search-zip'
+                        || option === '-z';
+                });
+            case 'sort':
+                return !args.some(arg => {
+                    const option = arg.toLowerCase();
+                    return option === '-o'
+                        || /^-o.+/.test(option)
+                        || option === '--output'
+                        || option.startsWith('--output=')
+                        || option === '--compress-program'
+                        || option.startsWith('--compress-program=');
+                });
+            case 'file':
+                return !args.some(arg => arg === '-C' || arg === '--compile');
+            case 'hostname':
+                return this.isHostnameQuery(args);
+            case 'date':
+                return !args.some(arg => arg === '-s' || arg === '--set' || arg.startsWith('--set='));
+            case 'env':
+                return this.isEnvironmentQuery(args);
+            case 'git':
+                return this.isGitQuery(args);
+            default:
+                return true;
         }
-        // Handle sudo/command prefixes
-        const prefixes = ['sudo', 'command', 'builtin'];
-        const parts = cmd.split(/\s+/);
-        // String.split always returns at least one element, so parts[0] is defined;
-        // fall back to '' to satisfy the type checker without changing behavior.
-        let firstWord = parts[0] ?? '';
-        if (prefixes.includes(firstWord) && parts.length > 1) {
-            firstWord = parts[1] ?? firstWord;
+    }
+    /**
+     * Reject syntax that can write, spawn hidden commands, or hide additional
+     * commands from a simple command list. Quote-aware scanning avoids treating
+     * literals such as `echo "a > b"` as redirections.
+     */
+    hasUnsafeShellSyntax(command) {
+        let quote = 'none';
+        let escaped = false;
+        for (let index = 0; index < command.length; index++) {
+            const char = command[index];
+            const next = command[index + 1];
+            if (escaped) {
+                if (char === '\n' || char === '\r')
+                    return true;
+                escaped = false;
+                continue;
+            }
+            if (quote === 'single') {
+                if (char === "'")
+                    quote = 'none';
+                continue;
+            }
+            if (char === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (quote === 'double') {
+                if (char === '"') {
+                    quote = 'none';
+                    continue;
+                }
+                if (char === '`' || (char === '$' && next === '('))
+                    return true;
+                continue;
+            }
+            if (char === "'") {
+                quote = 'single';
+                continue;
+            }
+            if (char === '"') {
+                quote = 'double';
+                continue;
+            }
+            if (char === '`' || (char === '$' && next === '('))
+                return true;
+            if ((char === '<' || char === '>') && next === '(')
+                return true;
+            if (char === '(' || char === ')')
+                return true;
+            // Any output redirect can create/truncate a file. Input redirects remain
+            // eligible, except heredocs/FD duplication which have richer semantics.
+            if (char === '>')
+                return true;
+            if (char === '<' && (next === '<' || next === '&'))
+                return true;
+            // The fallback AST parser does not split newlines or background jobs.
+            if (char === '\n' || char === '\r')
+                return true;
+            if (char === '&') {
+                if (next !== '&')
+                    return true;
+                index++;
+            }
+        }
+        return escaped || quote !== 'none';
+    }
+    isEnvironmentQuery(args) {
+        for (let index = 0; index < args.length; index++) {
+            const arg = args[index] ?? '';
+            if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(arg))
+                continue;
+            if (SAFE_ENV_OPTIONS.has(arg))
+                continue;
+            if (arg.startsWith('--unset=') || arg.startsWith('--chdir='))
+                continue;
+            if (SAFE_ENV_OPTIONS_WITH_VALUE.has(arg)) {
+                if (index + 1 >= args.length)
+                    return false;
+                index++;
+                continue;
+            }
+            // `env -S`/`--split-string` and the first non-option argument launch a
+            // utility, so they cannot inherit env's read-only classification.
+            return false;
         }
-        // Strip path prefix (e.g., /usr/bin/ls -> ls)
-        const basename = firstWord.split('/').pop() || firstWord;
-        return basename;
+        return true;
+    }
+    isHostnameQuery(args) {
+        const mutatingOptions = new Set(['-b', '--boot', '-F', '--file']);
+        if (args.some(arg => mutatingOptions.has(arg) || arg.startsWith('--file='))) {
+            return false;
+        }
+        // A positional hostname asks the utility to change the system hostname.
+        return args.every(arg => arg.startsWith('-'));
+    }
+    isGitQuery(args) {
+        const [subcommand, ...rest] = args;
+        if (!subcommand || subcommand.startsWith('-'))
+            return false;
+        const safe = new Set([
+            'status', 'diff', 'show', 'rev-parse', 'describe', 'ls-files',
+            'ls-tree', 'cat-file', 'blame', 'shortlog',
+        ]);
+        if (safe.has(subcommand))
+            return true;
+        if (subcommand === 'log') {
+            return !rest.some(arg => arg === '--output' || arg.startsWith('--output='));
+        }
+        if (subcommand === 'remote') {
+            return rest.length === 0 || (rest.length === 1 && rest[0] === '-v');
+        }
+        if (subcommand === 'branch') {
+            const readOnlyOptions = new Set([
+                '--list', '--show-current', '--contains', '--no-contains',
+                '--merged', '--no-merged',
+            ]);
+            return rest.length === 0 || rest.every(arg => arg.startsWith('-') && readOnlyOptions.has(arg));
+        }
+        if (subcommand === 'tag') {
+            return rest.length === 0 || rest[0] === '--list';
+        }
+        return false;
+    }
+    stripOuterQuotes(value) {
+        if (value.length >= 2) {
+            const first = value[0];
+            const last = value[value.length - 1];
+            if ((first === "'" && last === "'") || (first === '"' && last === '"')) {
+                return value.slice(1, -1);
+            }
+        }
+        return value;
+    }
+    basename(command) {
+        if (!command.includes('/') && !command.includes('\\'))
+            return command;
+        const normalized = command.replace(/\\/g, '/');
+        const trustedPrefixes = ['/bin/', '/usr/bin/', '/usr/local/bin/', '/sbin/', '/usr/sbin/'];
+        if (!trustedPrefixes.some(prefix => normalized.startsWith(prefix)))
+            return normalized;
+        return normalized.split('/').pop() || normalized;
     }
 }
 //# sourceMappingURL=safe-binaries.js.map

package/dist/security/safe-fetch.d.ts

@@ -0,0 +1,7 @@
+export interface SafeFetchOptions {
+    maxRedirects?: number;
+}
+/**
+ * Fetch an HTTP(S) resource while validating every redirect target before it is requested.
+ */
+export declare function safeFetchFollow(url: string, init?: RequestInit, options?: SafeFetchOptions): Promise<Response>;

package/dist/security/safe-fetch.js

@@ -0,0 +1,101 @@
+import { Agent } from 'undici';
+import { logger } from '../utils/logger.js';
+import { assertSafeUrl } from './ssrf-guard.js';
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+function shouldRewriteToGet(status, method) {
+    return status === 303 || ((status === 301 || status === 302) && method === 'POST');
+}
+async function assertRedirectTargetIsSafe(url) {
+    const check = await assertSafeUrl(url);
+    if (!check.safe) {
+        throw new Error(`URL blocked by SSRF guard: ${check.reason}`);
+    }
+    return check;
+}
+function createPinnedDispatcher(pinned) {
+    try {
+        return new Agent({
+            connect: {
+                lookup: (_hostname, options, callback) => {
+                    if (options.all) {
+                        callback(null, [{ address: pinned.address, family: pinned.family }]);
+                        return;
+                    }
+                    callback(null, pinned.address, pinned.family);
+                },
+            },
+        });
+    }
+    catch (err) {
+        throw new Error(`SSRF DNS pinning dispatcher is unavailable: ${err}`);
+    }
+}
+async function fetchWithOptionalPinning(url, init, pinned) {
+    if (!pinned) {
+        return fetch(url, init);
+    }
+    const dispatcher = createPinnedDispatcher(pinned);
+    try {
+        const pinnedInit = { ...init, dispatcher };
+        return await fetch(url, pinnedInit);
+    }
+    finally {
+        // Do not await graceful close here: fetch resolves when headers arrive, while
+        // close resolves after the caller consumes the response body.
+        void dispatcher.close().catch(err => {
+            logger.warn('Failed to close SSRF DNS pinning dispatcher', { url, err });
+        });
+    }
+}
+/**
+ * Fetch an HTTP(S) resource while validating every redirect target before it is requested.
+ */
+export async function safeFetchFollow(url, init = {}, options = {}) {
+    const maxRedirects = options.maxRedirects ?? 5;
+    if (!Number.isInteger(maxRedirects) || maxRedirects < 0) {
+        throw new Error('maxRedirects must be a non-negative integer');
+    }
+    let currentUrl = new URL(url).toString();
+    let currentMethod = (init.method ?? 'GET').toUpperCase();
+    let currentBody = init.body;
+    let currentHeaders = new Headers(init.headers);
+    for (let redirectCount = 0;; redirectCount += 1) {
+        const check = await assertRedirectTargetIsSafe(currentUrl);
+        const [pinnedAddress] = check.addresses ?? [];
+        const response = await fetchWithOptionalPinning(currentUrl, {
+            ...init,
+            method: currentMethod,
+            headers: currentHeaders,
+            body: currentBody,
+            redirect: 'manual',
+        }, pinnedAddress);
+        if (!REDIRECT_STATUSES.has(response.status)) {
+            return response;
+        }
+        const location = response.headers.get('location');
+        if (!location) {
+            return response;
+        }
+        // This response is not returned to a caller, so release its body explicitly.
+        // That lets the per-hop dispatcher's graceful close complete promptly.
+        await response.body?.cancel();
+        if (redirectCount >= maxRedirects) {
+            throw new Error(`Too many redirects (maximum ${maxRedirects})`);
+        }
+        const nextUrl = new URL(location, currentUrl);
+        const currentOrigin = new URL(currentUrl).origin;
+        if (nextUrl.origin !== currentOrigin) {
+            currentHeaders = new Headers(currentHeaders);
+            currentHeaders.delete('authorization');
+        }
+        if (shouldRewriteToGet(response.status, currentMethod)) {
+            currentMethod = 'GET';
+            currentBody = undefined;
+            currentHeaders = new Headers(currentHeaders);
+            currentHeaders.delete('content-length');
+            currentHeaders.delete('content-type');
+        }
+        currentUrl = nextUrl.toString();
+    }
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/security/sandbox.js

@@ -18,8 +18,8 @@ const DEFAULT_BLOCKED_PATHS = [
     '/etc/sudoers',
 ];
 const DANGEROUS_COMMANDS = [
-    'rm -rf /',
-    'rm -rf /*',
+    '\\brm\\s+-[^\\s]*r[^\\s]*f[^\\s]*\\s+/(?:\\s*)$',
+    '\\brm\\s+-[^\\s]*r[^\\s]*f[^\\s]*\\s+/\\*(?:\\s*)$',
     'dd if=',
     'mkfs',
     ':(){ :|:& };:',