@sagentlab/navarch-runtime 0.1.145 → 0.1.146

package/bin/worktree-guard-hook.cjs

@@ -431,7 +431,11 @@ const LITERAL_PATTERN_COMMANDS = new Set([...CHAINABLE_COMMANDS, "sed", "awk", "
  */
 const PROGRAM_COMMANDS = new Set(["bun", "deno", "node", "python", "python3", "tsx"]);
 
-const PROGRAM_SHELL_RE = /system|subprocess|popen|exec|spawn|child_process|shell|pty|command|\.run\b|`/i;
+const PROGRAM_SHELL_WORDS_RE = /system|subprocess|popen|exec|spawn|child_process|shell|pty|command|\.run\b/i;
+// A backtick also counts where the shell could expand it. A quoted heredoc
+// body is literal, so there a backtick is only a JavaScript template literal
+// (isProgramFileBody uses PROGRAM_SHELL_WORDS_RE alone).
+const PROGRAM_SHELL_RE = new RegExp(`${PROGRAM_SHELL_WORDS_RE.source}|\``, "i");
 
 /**
  * git and gh run aliases, hooks and extensions through a shell, so only the
@@ -442,6 +446,12 @@ const MESSAGE_SUBCOMMAND_RE =
   /^\s*(?:git\s+(?:commit|tag|notes|merge)|gh\s+(?:pr|issue|release)\s+(?:create|edit|comment|review|close))\b/;
 const MESSAGE_FLAG_RE = /\s(?:-m|--message|-t|--title|-b|--body|--notes)(?:=|\s+)$/;
 const MESSAGE_FILE_RE = /\s(?:--body-file|-F|--file)(?:=|\s)/;
+// git accepts unique long-option prefixes, so `--ed` also opens the editor.
+const EDITOR_FLAG_RE = /\s(?:-e|--ed(?:i(?:t(?:or)?)?)?)(?:[\s=]|$)/;
+// Names a git or husky hook location, where written text runs on a later git command.
+const HOOK_PATH_RE = /\.git\/|\.husky|hooks/i;
+// A git `-c` override or an alias can make a git/gh message command run text.
+const CONFIG_OVERRIDE_RE = /\s-c\s|alias/;
 
 const ASSIGNMENTS_RE = /^\s*!?\s*(?:[A-Za-z_]\w*=\S*\s+)*/;
 const LEADING_REDIRECTS_RE = /^(?:\s*\d*(?:<<?|>>?|&>>?)&?\s*[^\s;|&<>()]+)*\s*/;
@@ -468,7 +478,7 @@ function classifySegment(command, start) {
   const word = commandWordOf(rest);
   if (CHAINABLE_COMMANDS.has(word)) return "text";
   if (PROGRAM_COMMANDS.has(word)) return "active";
-  if (MESSAGE_SUBCOMMAND_RE.test(rest) && !/\s-c\s|alias/.test(command)) return "active";
+  if (MESSAGE_SUBCOMMAND_RE.test(rest) && !CONFIG_OVERRIDE_RE.test(command)) return "active";
   return "unsafe";
 }
 
@@ -488,7 +498,7 @@ function segmentText(command, start) {
  * (`--body "$(cat <<'EOF' ... )"`).
  */
 function exemptionContextIsSafe(command, segments) {
-  if (/\.git\/|\.husky|hooks/i.test(command)) return false;
+  if (HOOK_PATH_RE.test(command)) return false;
   const classes = segments.map((segment) => ({ ...segment, kind: classifySegment(command, segment.at) }));
   if (classes.some(({ kind }) => kind === "unsafe")) return false;
   const active = classes.filter(({ kind }) => kind === "active");
@@ -497,8 +507,7 @@ function exemptionContextIsSafe(command, segments) {
   const activeText = segmentText(command, active[0].at);
   if (activeText.replace(ASSIGNMENTS_RE, "") !== activeText.trimStart()) return false;
   const isMessage = MESSAGE_SUBCOMMAND_RE.test(activeText);
-  // git accepts unique long-option prefixes, so `--ed` also opens the editor.
-  if (isMessage && /\s(?:-e|--ed(?:i(?:t(?:or)?)?)?)(?:[\s=]|$)/.test(activeText)) return false;
+  if (isMessage && EDITOR_FLAG_RE.test(activeText)) return false;
   return classes.every(({ at, kind, nested }) => {
     if (kind === "empty" || kind === "active") return true;
     if (!isMessage || !nested) return false;
@@ -513,18 +522,21 @@ function isBareRootText(token) {
 }
 
 /**
- * Heredoc bodies as [{start, end, word, segment, quoted}], every simple
- * command outside them as [{at, nested}] (nested inside `$(`, a backtick or a
- * subshell), and `ok`. A small lexer tracks single and double quotes, `$(`,
- * backticks, subshells and shell comments to find each `<<` operator and its
- * body. Any construct it cannot follow (`$'`, arithmetic `((`, process
+ * Heredoc bodies as [{start, end, word, segment, quoted, at, nested}] (`at`
+ * is where the body's simple command starts), every simple command outside
+ * them as [{at, nested}] (nested inside `$(`, a backtick or a subshell),
+ * every single-quoted shell word outside double quotes and heredoc bodies as
+ * [{open, close, segmentStart}], and `ok`. A small lexer tracks single and
+ * double quotes, `$(`, backticks, subshells and shell comments to find each
+ * `<<` operator and its body. Any construct it cannot follow (`$'`, arithmetic `((`, process
  * substitution `<(`/`>(`, a delimiter with `$` or an unbalanced quote, an
  * unterminated quote, substitution or heredoc, an unbalanced `)`) returns
  * `ok: false`, so nothing is exempted on a misread.
  */
 function scanHeredocs(command) {
-  const failed = { ok: false, bodies: [], segments: [] };
+  const failed = { ok: false, bodies: [], segments: [], singleQuoted: [] };
   const bodies = [];
+  const singleQuoted = [];
   const segments = [{ at: 0, nested: false }];
   const stack = [];
   let pending = [];
@@ -562,6 +574,7 @@ function scanHeredocs(command) {
     if (ch === "'") {
       const close = command.indexOf("'", i + 1);
       if (close === -1) return failed;
+      singleQuoted.push({ open: i, close, segmentStart });
       i = close + 1;
       continue;
     }
@@ -627,6 +640,8 @@ function scanHeredocs(command) {
         quoted: /['"\\]/.test(word[0]),
         word: commandWordOf(command.slice(segmentStart, i)),
         segment: command.slice(segmentStart, lineEnd === -1 ? n : lineEnd),
+        at: segmentStart,
+        nested: stack.some((frame) => frame !== "dq"),
       });
       i = j + word[0].length;
       continue;
@@ -650,7 +665,15 @@ function scanHeredocs(command) {
           if (newline === -1) break;
         }
         if (end === -1) return failed;
-        bodies.push({ start, end, word: doc.word, segment: doc.segment, quoted: doc.quoted });
+        bodies.push({
+          start,
+          end,
+          word: doc.word,
+          segment: doc.segment,
+          quoted: doc.quoted,
+          at: doc.at,
+          nested: doc.nested,
+        });
       }
       if (i > n) i = n;
       pending = [];
@@ -660,7 +683,7 @@ function scanHeredocs(command) {
     i++;
   }
   if (stack.length > 0 || pending.length > 0) return failed;
-  return { ok: true, bodies, segments };
+  return { ok: true, bodies, segments, singleQuoted };
 }
 
 /**
@@ -674,6 +697,178 @@ function readsAsText(segment, text, isMessage) {
   return MESSAGE_SUBCOMMAND_RE.test(segment.replace(ASSIGNMENTS_RE, "")) && isMessage;
 }
 
+/** Reserved words that may precede a command word (`do jq ...`, `then gh ...`). */
+const SHELL_KEYWORDS_RE = /^\s*(?:(?:do|then|else|elif|if|while|until|time|!|\{)\s+)*/;
+
+/**
+ * True when bare root text sits inside a single-quoted jq program: a filter
+ * argument of `jq`, or the `--jq`/`-q` value of `gh`
+ * (`--jq '"\(.url|split("/")|last)"'`, `--jq '.a // "none"'`). The shell
+ * passes single-quoted text through unchanged, and jq cannot open a path or
+ * start a process from a filter, so `/`, `//` or `/*` there is jq syntax. The
+ * command word must be a bare `jq` or `gh` (not `./jq`), and the word must
+ * hold more than the token, so `jq . '/'` stays screened. Only bare root text
+ * qualifies: `jq 'include "/home/x"; .'` and every unquoted path argument
+ * stay candidates.
+ */
+function isJqProgramText(command, start, token, singleQuoted, segments) {
+  const span = singleQuoted.find(({ open, close }) => start > open && start < close);
+  if (!span) return false;
+  if (command.slice(span.open + 1, span.close).trim() === token) return false;
+  const prefix = command.slice(span.segmentStart, span.open).replace(SHELL_KEYWORDS_RE, "");
+  const rest = prefix.replace(ASSIGNMENTS_RE, "");
+  const isJq = /^jq\s/.test(rest) || (/^gh\s/.test(rest) && /\s(?:--jq|-q)(?:=|\s+)$/.test(prefix));
+  return isJq && outputStaysText(command, span.segmentStart, segments, singleQuoted);
+}
+
+/**
+ * True when the output of the simple command at `at` cannot become a shell
+ * argument: the command is top level (not inside `$(`, a backtick or a
+ * subshell), and when it pipes onward or writes a file, every later simple
+ * command is empty or a chainable text command (`gh api x --jq '...' | head`).
+ * This keeps `jq -n '"/"' | xargs rm -rf`, `rm -rf "$(jq -n '"/"')"` and
+ * `jq -n '"/"' > run.sh; sh run.sh` screened.
+ */
+function outputStaysText(command, at, segments, singleQuoted) {
+  if (isNestedSegment(at, segments)) return false;
+  if (!otherOutputStaysText(command, at, segments, singleQuoted)) return false;
+  if (!pipesAfter(command, at, segments) && !writesOutput(command, at, segments, singleQuoted)) {
+    return true;
+  }
+  return segments.every(
+    (segment) => segment.at <= at || ["empty", "text"].includes(classifySegment(command, segment.at)),
+  );
+}
+
+/**
+ * True unless another simple command redirects output to a file that some
+ * other command could then run. A redirect outside the command at `at` can
+ * still capture its output: `exec >run.sh; jq ...; sh run.sh`,
+ * `{ jq ...; } > run.sh; sh run.sh` or `for ...; do jq ...; done > run.sh`.
+ * When any command writes output, every command except the one at `at` must
+ * be empty or a chainable text command. Pass `text` with heredoc bodies
+ * blanked, so a `>` in body prose does not count.
+ */
+function otherOutputStaysText(text, at, segments, singleQuoted) {
+  const writes = segments.some(
+    (segment) => segment.at !== at && writesOutput(text, segment.at, segments, singleQuoted),
+  );
+  if (!writes) return true;
+  return segments.every(
+    (segment) => segment.at === at || ["empty", "text"].includes(classifySegment(text, segment.at)),
+  );
+}
+
+/**
+ * True when the simple command at `at` may redirect output to a file
+ * (`jq ... > run.sh`), where a later command could run it. The command runs to
+ * the next quote-aware segment start. Single-quoted words (a jq `>`
+ * comparison) and `2>/dev/null` or `2>&1` do not count; a `>` anywhere else,
+ * including inside double quotes, does.
+ */
+function writesOutput(command, at, segments, singleQuoted) {
+  const next = segments.reduce(
+    (end, segment) => (segment.at > at && segment.at < end ? segment.at : end),
+    command.length,
+  );
+  let text = command.slice(at, next);
+  for (const { open, close } of singleQuoted) {
+    if (open >= at && close < next) {
+      text = text.slice(0, open - at) + " ".repeat(close - open + 1) + text.slice(close - at + 1);
+    }
+  }
+  return />/.test(text.replace(/\d*>\s*\/dev\/null\b|\d*>&\d/g, ""));
+}
+
+/** True unless `at` starts a top-level simple command that scanHeredocs found. */
+function isNestedSegment(at, segments) {
+  const own = segments.find((segment) => segment.at === at);
+  return !own || own.nested;
+}
+
+/**
+ * True when any simple command after `at` starts at a pipe (`|` or `|&`, not
+ * `||`). The scanner's segment starts are quote-aware, so a `|` inside quotes
+ * never counts. This is broader than the pipeline of `at` on purpose: a pipe
+ * later in the command makes the caller check more, never less.
+ */
+function pipesAfter(command, at, segments) {
+  return segments.some(
+    ({ at: next }) =>
+      next > at && command[next - 1] === "|" && command[next - 2] !== "|" && command[next] !== "|",
+  );
+}
+
+/** Command text with every heredoc body blanked out. */
+function textOutsideBodies(command, bodies) {
+  let text = command;
+  for (const { start, end } of bodies) {
+    text = text.slice(0, start) + " ".repeat(end - start) + text.slice(end);
+  }
+  return text;
+}
+
+/**
+ * True when a quoted heredoc body can reach no command except its own reader,
+ * so the rest of the command does not matter: `cat <<'EOF'` prints it, and
+ * `gh pr create --body-file - <<'EOF'` or `git commit -F - <<'EOF'` sends it as
+ * a message (`git push && gh pr create --body-file - <<'EOF'`). The reader
+ * must be top level, without a leading assignment, a `>` redirect or a pipe
+ * onward, and no other command may redirect output while a non-text command
+ * runs (otherOutputStaysText). A message reader also gets no editor flag, and no `-c` or alias
+ * text may appear outside the bodies.
+ */
+function isSealedBody(command, body, outside, segments, singleQuoted) {
+  if (body.nested || isNestedSegment(body.at, segments) || pipesAfter(command, body.at, segments)) {
+    return false;
+  }
+  if (!otherOutputStaysText(outside, body.at, segments, singleQuoted)) return false;
+  // body.segment runs from the reader to the end of its line, so this also
+  // rejects a `>` that hides behind a quoted separator (`cat 'a;b' > f`).
+  if (body.segment.includes(">")) return false;
+  const text = body.segment.trimStart();
+  if (text.replace(ASSIGNMENTS_RE, "") !== text) return false;
+  if (/^cat(?:\s|$)/.test(text)) return true;
+  if (!MESSAGE_SUBCOMMAND_RE.test(text) || !MESSAGE_FILE_RE.test(text)) return false;
+  return !EDITOR_FLAG_RE.test(text) && !CONFIG_OVERRIDE_RE.test(outside);
+}
+
+/**
+ * True when a quoted heredoc body is a non-shell program written to a file and
+ * run only as that program: `cat > ./x.cjs <<'EOF' ... EOF` then
+ * `node ./x.cjs; rm ./x.cjs`. This is the same text `node - <<'EOF'` would
+ * run, so the same rule applies: the body must not name a way to start a
+ * process (PROGRAM_SHELL_WORDS_RE; a backtick in a quoted body is a template
+ * literal, not a shell substitution). The writer must be exactly `cat > FILE`
+ * with one `>` and a plain file name, at top level, without a pipe onward.
+ * Every other command must be top level and either empty, a chainable text
+ * command, `rm`, or a PROGRAM_COMMANDS interpreter, without leading
+ * assignments, whose first argument is FILE. Anything else, such as `sh FILE`,
+ * `chmod +x FILE`, `python3 -c ...` or `mv`, could run the text another way.
+ */
+function isProgramFileBody(command, body, segments) {
+  if (body.nested || PROGRAM_SHELL_WORDS_RE.test(command.slice(body.start, body.end))) return false;
+  if (isNestedSegment(body.at, segments)) return false;
+  // body.segment runs to the end of the line. The writer may be followed only
+  // by `;` or `&&`; the file-name class holds no quote, so no quoted
+  // separator can hide a pipe or a second redirect.
+  const writer = body.segment.replace(/\s*<<-?\s*\S+/, " ");
+  const redirect = /^\s*cat\s*>\s*([\w./-]+)\s*(?:$|;|&&)/.exec(writer);
+  if (!redirect || /<</.test(writer)) return false;
+  const file = redirect[1].replace(/^(?:\.\/)+/, "");
+  if (!file || file.endsWith("/")) return false;
+  const escaped = file.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+  const runsFile = new RegExp(`^(?:${[...PROGRAM_COMMANDS].join("|")})\\s+(?:\\./)*${escaped}(?:\\s|$)`);
+  return segments.every(({ at, nested }) => {
+    if (at === body.at) return true;
+    if (nested) return false;
+    const kind = classifySegment(command, at);
+    if (kind === "empty" || kind === "text") return true;
+    const text = segmentText(command, at).trimStart();
+    return /^rm(?:\s|$)/.test(text) || runsFile.test(text);
+  });
+}
+
 /**
  * True when bare root text sits in a heredoc body or quoted argument that a
  * text command, a non-shell program, or a git/gh message reads: a
@@ -682,13 +877,27 @@ function readsAsText(segment, text, isMessage) {
  * quoted argument must hold more than the token itself, so `ls "/"` stays
  * screened. An unquoted-delimiter heredoc qualifies only without `$(` or
  * backtick expansion in its body. No exemption applies unless the rest of the
- * command cannot run that text (exemptionContextIsSafe).
+ * command cannot run that text (exemptionContextIsSafe), except for a
+ * single-quoted jq program whose output stays text (isJqProgramText), and a
+ * quoted heredoc body that reaches only its reader (isSealedBody) or runs only
+ * as a program file (isProgramFileBody). The two heredoc rules look for hook
+ * locations (HOOK_PATH_RE) only outside the bodies, so body prose that
+ * mentions `hooks` stays exempt. The jq rule needs no hook check, because jq
+ * output never reaches a hook file when it reaches no other command.
  */
 function isProgramTextRootToken(command, start, token, heredocs) {
   if (!isBareRootText(token)) return false;
-  const { ok, bodies, segments } = heredocs();
-  if (!ok || !exemptionContextIsSafe(command, segments)) return false;
+  const { ok, bodies, segments, singleQuoted } = heredocs();
+  if (!ok) return false;
+  if (isJqProgramText(command, start, token, singleQuoted, segments)) return true;
   const body = bodies.find((doc) => start >= doc.start && start < doc.end);
+  const outside = body && body.quoted ? textOutsideBodies(command, bodies) : "";
+  if (outside && !HOOK_PATH_RE.test(outside)) {
+    if (isSealedBody(command, body, outside, segments, singleQuoted) || isProgramFileBody(command, body, segments)) {
+      return true;
+    }
+  }
+  if (!exemptionContextIsSafe(command, segments)) return false;
   if (body) {
     const text = command.slice(body.start, body.end);
     if (!body.quoted && /`|\$\(/.test(text)) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentlab/navarch-runtime",
-  "version": "0.1.145",
+  "version": "0.1.146",
   "description": "Navarch machine-side session manager: claims delivery tasks and runs them through local coding agents.",
   "type": "commonjs",
   "license": "MIT",