@quantiya/codevibe-codex-plugin 2.0.4 → 2.0.6

package/node_modules/shell-quote/parse.js

@@ -0,0 +1,261 @@
+'use strict';
+
+/**
+ * @import {
+ * 	ControlOperator,
+ * 	Env,
+ * 	GlobPattern,
+ * 	ParseEntry,
+ * } from './parse' */
+
+// '<(' is process substitution operator and
+// can be parsed the same as control operator
+var CONTROL = /** @type {const} */ ('(?:') + /** @type {const} */ ([
+	'\\|\\|',
+	'\\&\\&',
+	';;',
+	'\\|\\&',
+	'\\<\\(',
+	'\\<\\<\\<',
+	'>>',
+	'>\\&',
+	'<\\&',
+	'[&;()|<>]'
+]).join(/** @type {const} */ ('|')) + /** @type {const} */ (')');
+var controlRE = new RegExp('^' + CONTROL + '$');
+var META = /** @type {const} */ ('|&;()<> \\t');
+var SINGLE_QUOTE = /** @type {const} */ ('"((\\\\"|[^"])*?)"');
+var DOUBLE_QUOTE = /** @type {const} */ ('\'((\\\\\'|[^\'])*?)\'');
+var hash = /^#$/;
+
+var SQ = /** @type {const} */ ("'");
+var DQ = /** @type {const} */ ('"');
+var DS = /** @type {const} */ ('$');
+
+var TOKEN = '';
+var mult = /** @type {const} */ (0x100000000); // Math.pow(16, 8);
+for (var i = 0; i < 4; i++) {
+	TOKEN += (mult * Math.random()).toString(16);
+}
+var startsWithToken = new RegExp('^' + TOKEN);
+
+/**
+ * @param {string} s
+ * @param {RegExp} r
+ */
+function matchAll(s, r) {
+	var origIndex = r.lastIndex;
+
+	var matches = [];
+	var matchObj;
+
+	while ((matchObj = r.exec(s))) {
+		matches[matches.length] = matchObj;
+		if (r.lastIndex === matchObj.index) {
+			r.lastIndex += 1;
+		}
+	}
+
+	r.lastIndex = origIndex;
+
+	return matches;
+}
+
+/**
+ * @param {Env} env
+ * @param {string} pre
+ * @param {string} key
+ */
+function getVar(env, pre, key) {
+	var r = typeof env === 'function' ? env(key) : env[key];
+	if (typeof r === 'undefined' && key != '') {
+		r = '';
+	} else if (typeof r === 'undefined') {
+		r = '$';
+	}
+
+	if (typeof r === 'object') {
+		return pre + TOKEN + JSON.stringify(r) + TOKEN;
+	}
+	return pre + r;
+}
+
+/**
+ * @param {string} string
+ * @param {Env} [env]
+ * @param {{ escape?: string }} [opts]
+ * @returns {ParseEntry[]}
+ */
+function parseInternal(string, env, opts) {
+	if (!opts) {
+		opts = {};
+	}
+	var BS = opts.escape || '\\';
+	var BAREWORD = '(\\' + BS + '[\'"' + META + ']|[^\\s\'"' + META + '])+';
+
+	var chunker = new RegExp([
+		'(' + CONTROL + ')', // control chars
+		'(' + BAREWORD + '|' + SINGLE_QUOTE + '|' + DOUBLE_QUOTE + ')+'
+	].join('|'), 'g');
+
+	var matches = matchAll(string, chunker);
+
+	if (matches.length === 0) {
+		return [];
+	}
+	if (!env) {
+		env = {};
+	}
+
+	var commented = false;
+
+	return matches.map(function (match) {
+		var s = match[0];
+		if (!s || commented) {
+			return void undefined;
+		}
+		if (controlRE.test(s)) {
+			return /** @type {ControlOperator} */ ({ op: s });
+		}
+
+		// Hand-written scanner/parser for Bash quoting rules:
+		//
+		// 1. inside single quotes, all characters are printed literally.
+		// 2. inside double quotes, all characters are printed literally
+		//    except variables prefixed by '$' and backslashes followed by
+		//    either a double quote or another backslash.
+		// 3. outside of any quotes, backslashes are treated as escape
+		//    characters and not printed (unless they are themselves escaped)
+		// 4. quote context can switch mid-token if there is no whitespace
+		//     between the two quote contexts (e.g. all'one'"token" parses as
+		//     "allonetoken")
+		/** @type {string | boolean} */
+		var quote = false;
+		var esc = false;
+		var out = '';
+		var isGlob = false;
+		/** @type {number} */
+		var i;
+
+		function parseEnvVar() {
+			i += 1;
+			/** @type {number | RegExpMatchArray | null} */
+			var varend;
+			/** @type {string} */
+			var varname;
+			var char = s.charAt(i);
+
+			if (char === '{') {
+				i += 1;
+				if (s.charAt(i) === '}') {
+					throw new Error('Bad substitution: ' + s.slice(i - 2, i + 1));
+				}
+				varend = s.indexOf('}', i);
+				if (varend < 0) {
+					throw new Error('Bad substitution: ' + s.slice(i));
+				}
+				varname = s.slice(i, varend);
+				i = varend;
+			} else if ((/[*@#?$!_-]/).test(char)) {
+				varname = char;
+				i += 1;
+			} else {
+				var slicedFromI = s.slice(i);
+				varend = slicedFromI.match(/[^\w\d_]/);
+				if (!varend) {
+					varname = slicedFromI;
+					i = s.length;
+				} else {
+					varname = slicedFromI.slice(0, varend.index);
+					i += /** @type {number} */ (varend.index) - 1;
+				}
+			}
+			return getVar(/** @type {NonNullable<typeof env>} */ (env), '', varname);
+		}
+
+		for (i = 0; i < s.length; i++) {
+			var c = s.charAt(i);
+			isGlob = isGlob || (!quote && (c === '*' || c === '?'));
+			if (esc) {
+				out += c;
+				esc = false;
+			} else if (quote) {
+				if (c === quote) {
+					quote = false;
+				} else if (quote == SQ) {
+					out += c;
+				} else { // Double quote
+					if (c === BS) {
+						i += 1;
+						c = s.charAt(i);
+						if (c === DQ || c === BS || c === DS) {
+							out += c;
+						} else {
+							out += BS + c;
+						}
+					} else if (c === DS) {
+						out += parseEnvVar();
+					} else {
+						out += c;
+					}
+				}
+			} else if (c === DQ || c === SQ) {
+				quote = c;
+			} else if (controlRE.test(c)) {
+				return /** @type {ControlOperator} */ ({ op: s });
+			} else if (hash.test(c)) {
+				commented = true;
+				var commentObj = { comment: string.slice(match.index + i + 1) };
+				if (out.length) {
+					return /** @type {const} */ ([out, commentObj]);
+				}
+				return /** @type {const} */ ([commentObj]);
+			} else if (c === BS) {
+				esc = true;
+			} else if (c === DS) {
+				out += parseEnvVar();
+			} else {
+				out += c;
+			}
+		}
+
+		if (isGlob) {
+			return /** @type {GlobPattern} */ ({ op: 'glob', pattern: out });
+		}
+
+		return out;
+	}).reduce(function (prev, arg) { // finalize parsed arguments
+		if (typeof arg === 'undefined') {
+			return prev;
+		}
+		/** @type {ParseEntry[]} */ ([]).concat(arg).forEach(function (entry) {
+			prev[prev.length] = entry;
+		});
+		return prev;
+	}, /** @type {ParseEntry[]} */ ([]));
+}
+
+/** @type {import('./parse')} */
+module.exports = function parse(s, env, opts) {
+	var mapped = parseInternal(s, env, opts);
+	if (typeof env !== 'function') {
+		return mapped;
+	}
+	return mapped.reduce(function (acc, s) {
+		if (typeof s === 'object') {
+			acc[acc.length] = s;
+			return acc;
+		}
+		var xs = s.split(RegExp('(' + TOKEN + '.*?' + TOKEN + ')', 'g'));
+		if (xs.length === 1) {
+			acc[acc.length] = xs[0];
+			return acc;
+		}
+		xs.filter(Boolean).forEach(function (x) {
+			acc[acc.length] = startsWithToken.test(x)
+				? JSON.parse(x.split(TOKEN)[1])
+				: x;
+		});
+		return acc;
+	}, /** @type {ParseEntry[]} */ ([]));
+};

package/node_modules/shell-quote/quote.d.ts

@@ -0,0 +1,15 @@
+import parse = require('./parse');
+
+/**
+ * Quotes an array of tokens into a shell-safe string.
+ *
+ * Accepts strings and the object shapes that {@link parse} emits. Throws a
+ * `TypeError` for unrecognized object shapes, `op` values outside the
+ * allowlist, or `pattern`/`comment` values containing line terminators.
+ *
+ * @param args - Array of tokens to quote.
+ * @returns A shell-safe quoted string.
+ */
+declare function quote(args: readonly parse.ParseEntry[]): string;
+
+export = quote;

package/node_modules/shell-quote/quote.js

@@ -0,0 +1,65 @@
+'use strict';
+
+/** @import { ControlOperator } from './parse' */
+
+/** @type {ControlOperator['op'][]} */
+var OPS = /** @type {const} */ ([
+	'||',
+	'&&',
+	';;',
+	'|&',
+	'<(',
+	'<<<',
+	'>>',
+	'>&',
+	'<&',
+	'&',
+	';',
+	'(',
+	')',
+	'|',
+	'<',
+	'>'
+]);
+var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+
+/** @type {import('./quote')} */
+module.exports = function quote(xs) {
+	return xs.map(function (s) {
+		if (s === '') {
+			return /** @type {const} */ ('\'\'');
+		}
+		if (s && typeof s === 'object') {
+			if ('op' in s && s.op === 'glob') {
+				if (typeof s.pattern !== 'string') {
+					throw new TypeError('glob token requires a string `pattern`');
+				}
+				if (LINE_TERMINATORS.test(s.pattern)) {
+					throw new TypeError('glob `pattern` must not contain line terminators');
+				}
+				return s.pattern.replace(GLOB_SHELL_SPECIAL, '\\$&');
+			}
+			if ('op' in s && typeof s.op === 'string') {
+				if (OPS.indexOf(s.op) < 0) {
+					throw new TypeError('invalid `op` value: ' + JSON.stringify(s.op));
+				}
+				return s.op.replace(/[\s\S]/g, '\\$&');
+			}
+			if ('comment' in s && typeof s.comment === 'string') {
+				if (LINE_TERMINATORS.test(s.comment)) {
+					throw new TypeError('`comment` must not contain line terminators');
+				}
+				return '#' + s.comment;
+			}
+			throw new TypeError('unrecognized object token shape');
+		}
+		if ((/["\s\\]/).test(s) && !(/'/).test(s)) {
+			return "'" + s.replace(/(['])/g, '\\$1') + "'";
+		}
+		if ((/["'\s]/).test(s)) {
+			return '"' + s.replace(/(["\\$`!])/g, '\\$1') + '"';
+		}
+		return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, '$1\\$2');
+	}).join(' ');
+};

package/node_modules/shell-quote/security.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest major version is supported at any given time.
+
+## Reporting a Vulnerability
+
+To report a security vulnerability, please use the
+[Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure.

package/node_modules/shell-quote/test/comment.js

@@ -0,0 +1,16 @@
+'use strict';
+
+var test = require('tape');
+var parse = require('../').parse;
+
+test('comment', function (t) {
+	t.same(parse('beep#boop'), ['beep', { comment: 'boop' }]);
+	t.same(parse('beep #boop'), ['beep', { comment: 'boop' }]);
+	t.same(parse('beep # boop'), ['beep', { comment: ' boop' }]);
+	t.same(parse('beep # > boop'), ['beep', { comment: ' > boop' }]);
+	t.same(parse('beep # "> boop"'), ['beep', { comment: ' "> boop"' }]);
+	t.same(parse('beep "#"'), ['beep', '#']);
+	t.same(parse('beep #"#"#'), ['beep', { comment: '"#"#' }]);
+	t.same(parse('beep > boop # > foo'), ['beep', { op: '>' }, 'boop', { comment: ' > foo' }]);
+	t.end();
+});

package/node_modules/shell-quote/test/env.js

@@ -0,0 +1,52 @@
+'use strict';
+
+var test = require('tape');
+var parse = require('../').parse;
+
+test('expand environment variables', function (t) {
+	t.same(parse('a $XYZ c', { XYZ: 'b' }), ['a', 'b', 'c']);
+	t.same(parse('a${XYZ}c', { XYZ: 'b' }), ['abc']);
+	t.same(parse('a${XYZ}c $XYZ', { XYZ: 'b' }), ['abc', 'b']);
+	t.same(parse('"-$X-$Y-"', { X: 'a', Y: 'b' }), ['-a-b-']);
+	t.same(parse("'-$X-$Y-'", { X: 'a', Y: 'b' }), ['-$X-$Y-']);
+	t.same(parse('qrs"$zzz"wxy', { zzz: 'tuv' }), ['qrstuvwxy']);
+	t.same(parse("qrs'$zzz'wxy", { zzz: 'tuv' }), ['qrs$zzzwxy']);
+	t.same(parse('qrs${zzz}wxy'), ['qrswxy']);
+	t.same(parse('qrs$wxy $'), ['qrs', '$']);
+	t.same(parse('grep "xy$"'), ['grep', 'xy$']);
+	t.same(parse('ab$x', { x: 'c' }), ['abc']);
+	t.same(parse('ab\\$x', { x: 'c' }), ['ab$x']);
+	t.same(parse('ab${x}def', { x: 'c' }), ['abcdef']);
+	t.same(parse('ab\\${x}def', { x: 'c' }), ['ab${x}def']);
+	t.same(parse('"ab\\${x}def"', { x: 'c' }), ['ab${x}def']);
+
+	t.end();
+});
+
+test('expand environment variables within here-strings', function (t) {
+	t.same(parse('a <<< $x', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
+	t.same(parse('a <<< ${x}', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
+	t.same(parse('a <<< "$x"', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
+	t.same(parse('a <<< "${x}"', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
+
+	t.end();
+});
+
+test('environment variables with metacharacters', function (t) {
+	t.same(parse('a $XYZ c', { XYZ: '"b"' }), ['a', '"b"', 'c']);
+	t.same(parse('a $XYZ c', { XYZ: '$X', X: 5 }), ['a', '$X', 'c']);
+	t.same(parse('a"$XYZ"c', { XYZ: "'xyz'" }), ["a'xyz'c"]);
+
+	t.end();
+});
+
+test('special shell parameters', function (t) {
+	var chars = '*@#?-$!0_'.split('');
+	t.plan(chars.length);
+
+	chars.forEach(function (c) {
+		var env = {};
+		env[c] = 'xxx';
+		t.same(parse('a $' + c + ' c', env), ['a', 'xxx', 'c']);
+	});
+});

package/node_modules/shell-quote/test/env_fn.js

@@ -0,0 +1,21 @@
+'use strict';
+
+var test = require('tape');
+var parse = require('../').parse;
+
+function getEnv() {
+	return 'xxx';
+}
+
+function getEnvObj() {
+	return { op: '@@' };
+}
+
+test('functional env expansion', function (t) {
+	t.plan(4);
+
+	t.same(parse('a $XYZ c', getEnv), ['a', 'xxx', 'c']);
+	t.same(parse('a $XYZ c', getEnvObj), ['a', { op: '@@' }, 'c']);
+	t.same(parse('a${XYZ}c', getEnvObj), ['a', { op: '@@' }, 'c']);
+	t.same(parse('"a $XYZ c"', getEnvObj), ['a ', { op: '@@' }, ' c']);
+});

package/node_modules/shell-quote/test/op.js

@@ -0,0 +1,102 @@
+'use strict';
+
+var test = require('tape');
+var parse = require('../').parse;
+
+test('single operators', function (t) {
+	t.same(parse('beep | boop'), ['beep', { op: '|' }, 'boop']);
+	t.same(parse('beep|boop'), ['beep', { op: '|' }, 'boop']);
+	t.same(parse('beep \\| boop'), ['beep', '|', 'boop']);
+	t.same(parse('beep "|boop"'), ['beep', '|boop']);
+
+	t.same(parse('echo zing &'), ['echo', 'zing', { op: '&' }]);
+	t.same(parse('echo zing&'), ['echo', 'zing', { op: '&' }]);
+	t.same(parse('echo zing\\&'), ['echo', 'zing&']);
+	t.same(parse('echo "zing\\&"'), ['echo', 'zing\\&']);
+
+	t.same(parse('beep;boop'), ['beep', { op: ';' }, 'boop']);
+	t.same(parse('(beep;boop)'), [
+		{ op: '(' }, 'beep', { op: ';' }, 'boop', { op: ')' }
+	]);
+
+	t.same(parse('beep>boop'), ['beep', { op: '>' }, 'boop']);
+	t.same(parse('beep 2>boop'), ['beep', '2', { op: '>' }, 'boop']);
+	t.same(parse('beep<boop'), ['beep', { op: '<' }, 'boop']);
+
+	t.end();
+});
+
+test('double operators', function (t) {
+	t.same(parse('beep || boop'), ['beep', { op: '||' }, 'boop']);
+	t.same(parse('beep||boop'), ['beep', { op: '||' }, 'boop']);
+	t.same(parse('beep ||boop'), ['beep', { op: '||' }, 'boop']);
+	t.same(parse('beep|| boop'), ['beep', { op: '||' }, 'boop']);
+	t.same(parse('beep  ||   boop'), ['beep', { op: '||' }, 'boop']);
+
+	t.same(parse('beep && boop'), ['beep', { op: '&&' }, 'boop']);
+	t.same(
+		parse('beep && boop || byte'),
+		['beep', { op: '&&' }, 'boop', { op: '||' }, 'byte']
+	);
+	t.same(
+		parse('beep&&boop||byte'),
+		['beep', { op: '&&' }, 'boop', { op: '||' }, 'byte']
+	);
+	t.same(
+		parse('beep\\&\\&boop||byte'),
+		['beep&&boop', { op: '||' }, 'byte']
+	);
+	t.same(
+		parse('beep\\&&boop||byte'),
+		['beep&', { op: '&' }, 'boop', { op: '||' }, 'byte']
+	);
+	t.same(
+		parse('beep;;boop|&byte>>blip'),
+		['beep', { op: ';;' }, 'boop', { op: '|&' }, 'byte', { op: '>>' }, 'blip']
+	);
+
+	t.same(parse('beep 2>&1'), ['beep', '2', { op: '>&' }, '1']);
+
+	t.same(
+		parse('beep<(boop)'),
+		['beep', { op: '<(' }, 'boop', { op: ')' }]
+	);
+	t.same(
+		parse('beep<<(boop)'),
+		['beep', { op: '<' }, { op: '<(' }, 'boop', { op: ')' }]
+	);
+
+	t.end();
+});
+
+test('duplicating input file descriptors', function (t) {
+	// duplicating stdout to file descriptor 3
+	t.same(parse('beep 3<&1'), ['beep', '3', { op: '<&' }, '1']);
+
+	// duplicating stdout to file descriptor 0, i.e. stdin
+	t.same(parse('beep <&1'), ['beep', { op: '<&' }, '1']);
+
+	// closes stdin
+	t.same(parse('beep <&-'), ['beep', { op: '<&' }, '-']);
+
+	t.end();
+});
+
+test('here strings', function (t) {
+	t.same(parse('cat <<< "hello world"'), ['cat', { op: '<<<' }, 'hello world']);
+	t.same(parse('cat <<< hello'), ['cat', { op: '<<<' }, 'hello']);
+	t.same(parse('cat<<<hello'), ['cat', { op: '<<<' }, 'hello']);
+	t.same(parse('cat<<<"hello world"'), ['cat', { op: '<<<' }, 'hello world']);
+
+	t.end();
+});
+
+test('glob patterns', function (t) {
+	t.same(
+		parse('tap test/*.test.js'),
+		['tap', { op: 'glob', pattern: 'test/*.test.js' }]
+	);
+
+	t.same(parse('tap "test/*.test.js"'), ['tap', 'test/*.test.js']);
+	t.end();
+});

package/node_modules/shell-quote/test/parse.js

@@ -0,0 +1,67 @@
+'use strict';
+
+var test = require('tape');
+var parse = require('../').parse;
+
+test('parse shell commands', function (t) {
+	t.same(parse(''), [], 'parses an empty string');
+
+	t['throws'](
+		function () { parse('${}'); },
+		Error,
+		'empty substitution throws'
+	);
+	t['throws'](
+		function () { parse('${'); },
+		Error,
+		'incomplete substitution throws'
+	);
+
+	t.same(parse('a \'b\' "c"'), ['a', 'b', 'c']);
+	t.same(
+		parse('beep "boop" \'foo bar baz\' "it\'s \\"so\\" groovy"'),
+		['beep', 'boop', 'foo bar baz', 'it\'s "so" groovy']
+	);
+	t.same(parse('a b\\ c d'), ['a', 'b c', 'd']);
+	t.same(parse('\\$beep bo\\`op'), ['$beep', 'bo`op']);
+	t.same(parse('echo "foo = \\"foo\\""'), ['echo', 'foo = "foo"']);
+	t.same(parse(''), []);
+	t.same(parse(' '), []);
+	t.same(parse('\t'), []);
+	t.same(parse('a"b c d"e'), ['ab c de']);
+	t.same(parse('a\\ b"c d"\\ e f'), ['a bc d e', 'f']);
+	t.same(parse('a\\ b"c d"\\ e\'f g\' h'), ['a bc d ef g', 'h']);
+	t.same(parse("x \"bl'a\"'h'"), ['x', "bl'ah"]);
+	t.same(parse("x bl^'a^'h'", {}, { escape: '^' }), ['x', "bl'a'h"]);
+	t.same(parse('abcH def', {}, { escape: 'H' }), ['abc def']);
+
+	t.deepEqual(parse('# abc  def  ghi'), [{ comment: ' abc  def  ghi' }], 'start-of-line comment content is unparsed');
+	t.deepEqual(parse('xyz # abc  def  ghi'), ['xyz', { comment: ' abc  def  ghi' }], 'comment content is unparsed');
+
+	t.deepEqual(parse('-x "" -y'), ['-x', '', '-y'], 'empty string is preserved');
+
+	t.same(
+		parse('2;b', {}, { escape: 'd' }),
+		[{ op: '2;b' }],
+		'control char in unquoted context mid-token with regex-special escape returns op'
+	);
+
+	t.end();
+});
+
+test('parse stays linear in token count (GHSA-395f-4hp3-45gv)', function (t) {
+	// the old concat-in-reduce finalizer was O(n^2): this many tokens took
+	// ~minutes, so under the unfixed code this test hangs rather than passes
+	var n = 2e5;
+	var input = new Array(n + 1).join('x '); // avoid String#repeat for old engines
+
+	var words = parse(input);
+	t.equal(words.length, n, 'every token is returned');
+	t.equal(words[0], 'x', 'first token is correct');
+	t.equal(words[n - 1], 'x', 'last token is correct');
+
+	var withEnv = parse(input, function () { return 'v'; });
+	t.equal(withEnv.length, n, 'env-function path returns every token');
+
+	t.end();
+});