@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/node-action.js

@@ -0,0 +1,278 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeNodeAction = executeNodeAction;
+exports.inputEnvName = inputEnvName;
+exports.runPreIf = runPreIf;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const path = __importStar(require("path"));
+const logger_1 = require("../utils/logger");
+const expression_1 = require("./expression");
+const container_runtime_1 = require("./container-runtime");
+const runner_env_1 = require("./runner-env");
+const job_runtime_1 = require("./job-runtime");
+const job_container_1 = require("./job-container");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * Execute a JavaScript action (`runs.using: node*`): `pre` (if any) and
+ * `main` now, with `post` queued on the job runtime to run at job end.
+ * Scripts run with the CLI's own Node binary, in the workspace, with the
+ * runner's default env, the caller's env, `INPUT_*`, `STATE_*` and the
+ * file-command variables. Note: GitHub runs every `pre` at job start;
+ * here it runs immediately before its own `main`.
+ */
+async function executeNodeAction(action, actionPath, step, actionInputs, callerCtx, options, runtime, startTime, phase = 'main') {
+    if (phase === 'main') {
+        logger_1.logger.info(`Executing JavaScript action: ${action.name} (${action.runs.using})`);
+    }
+    const { main, pre, post } = action.runs;
+    if (!main) {
+        return {
+            step,
+            success: false,
+            error: 'No main script specified for JavaScript action',
+            duration: Date.now() - startTime
+        };
+    }
+    const actionDir = path.dirname(actionPath);
+    const inputEnv = {};
+    for (const [key, value] of Object.entries(actionInputs)) {
+        inputEnv[inputEnvName(key)] = value;
+    }
+    // In a job container, run the action there with the image's own `node`,
+    // from a copy of the action in the mounted exchange dir.
+    const container = runtime.container;
+    let containerActionDir;
+    if (container) {
+        if (container.node === undefined) {
+            const probe = await container.runtime.exec(container.id, {
+                command: `command -v node && printf '%s\\n' "$PATH"`
+            });
+            const [nodePath, basePath] = probe.stdout.trim().split('\n');
+            container.node =
+                probe.success && nodePath
+                    ? { path: nodePath.trim(), basePath: (basePath || '').trim() }
+                    : null;
+        }
+        if (!container.node) {
+            const error = `JavaScript action "${step.uses}" needs \`node\` in the job container image (${container.image}). Use an image that includes Node.js (e.g. --container-image node:20, a runner-images mapping, or ${job_container_1.DEFAULT_CONTAINER_IMAGE}), or run on the host with --container-runtime host.`;
+            logger_1.logger.error(error);
+            return { step, success: false, error, duration: Date.now() - startTime };
+        }
+        containerActionDir = (0, job_runtime_1.actionDirInContainer)(container, actionDir);
+    }
+    let state = {};
+    let output = '';
+    const limit = (0, job_runtime_1.effectiveTimeout)(runtime, options.containerTimeoutMs);
+    /** Run one script (pre/main/post) on the host or in the job container. */
+    const invokeScript = async (script, files, containerDir, stateEnv) => {
+        if (container?.node && containerActionDir && containerDir) {
+            // Exec node directly (no shell), so hyphenated INPUT_* names survive.
+            const scriptPath = path.posix.join(containerActionDir, script);
+            const result = await container.runtime.exec(container.id, {
+                args: [container.node.path, scriptPath],
+                workingDir: container_runtime_1.CONTAINER_WORKDIR,
+                env: {
+                    ...(0, job_runtime_1.containerRunnerEnv)(runtime),
+                    ...runtime.actionEnv,
+                    ...callerCtx.env,
+                    ...inputEnv,
+                    ...stateEnv,
+                    GITHUB_ACTION_PATH: containerActionDir,
+                    PATH: [...runtime.path, container.node.basePath]
+                        .filter(Boolean)
+                        .join(':'),
+                    ...(0, job_runtime_1.fileCommandEnv)(files, containerDir),
+                    SECURECI_STEP: path.basename(files.dir)
+                },
+                timeoutMs: limit.ms
+            });
+            if (result.timedOut) {
+                await (0, job_runtime_1.killStepProcesses)(container, path.basename(files.dir));
+            }
+            return {
+                success: result.success,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                error: result.success
+                    ? undefined
+                    : result.timedOut
+                        ? limit.message
+                        : `node exited with code ${result.exitCode}`
+            };
+        }
+        try {
+            const { stdout, stderr } = await execFileAsync(process.execPath, [path.join(actionDir, script)], {
+                cwd: process.cwd(),
+                maxBuffer: 64 * 1024 * 1024,
+                timeout: limit.ms,
+                killSignal: 'SIGKILL',
+                env: {
+                    ...(0, runner_env_1.hostBaseEnv)(),
+                    ...runtime.runnerEnv,
+                    ...runtime.actionEnv,
+                    ...callerCtx.env,
+                    ...inputEnv,
+                    ...stateEnv,
+                    GITHUB_ACTION_PATH: actionDir,
+                    PATH: (0, runner_env_1.prependPath)(runtime.path, callerCtx.env.PATH ?? process.env.PATH),
+                    ...(0, job_runtime_1.fileCommandEnv)(files)
+                }
+            });
+            return { success: true, stdout, stderr };
+        }
+        catch (execError) {
+            const error = execError;
+            return {
+                success: false,
+                stdout: error.stdout || '',
+                stderr: error.stderr || '',
+                error: error.killed && limit.ms ? limit.message : error.message
+            };
+        }
+    };
+    const runScript = async (script) => {
+        const { files, containerDir } = container
+            ? (0, job_runtime_1.createContainerStepFiles)(container)
+            : { files: (0, runner_env_1.createStepFiles)(), containerDir: undefined };
+        const stateEnv = {};
+        for (const [key, value] of Object.entries(state)) {
+            stateEnv[`STATE_${key}`] = value;
+        }
+        try {
+            const result = await invokeScript(script, files, containerDir, stateEnv);
+            output += result.stdout;
+            const { outputs, state: savedState } = (0, job_runtime_1.finishStepOutput)(result.stdout, files, runtime);
+            state = { ...state, ...savedState };
+            if (result.success) {
+                if (result.stderr) {
+                    logger_1.logger.warn(result.stderr.trim());
+                }
+                return { success: true, outputs };
+            }
+            logger_1.logger.error(`JavaScript action failed: ${result.error}`);
+            if (result.stderr) {
+                logger_1.logger.error(result.stderr.trim());
+            }
+            return { success: false, outputs, error: result.error };
+        }
+        finally {
+            (0, runner_env_1.cleanupStepFiles)(files);
+        }
+    };
+    // `pre` already ran at job start (see runPreSteps): continue from its state.
+    const preState = runtime.preState.get(step);
+    if (phase === 'pre' && pre) {
+        const preStep = { name: `Pre ${step.name || step.uses}` };
+        const preResult = await runScript(pre);
+        runtime.preState.set(step, state);
+        return {
+            step: preStep,
+            success: preResult.success,
+            error: preResult.error,
+            output,
+            duration: Date.now() - startTime
+        };
+    }
+    if (preState) {
+        state = { ...preState };
+    }
+    else if (pre && runPreIf(action, step, callerCtx)) {
+        const preResult = await runScript(pre);
+        if (!preResult.success) {
+            return {
+                step,
+                success: false,
+                error: preResult.error,
+                output,
+                duration: Date.now() - startTime
+            };
+        }
+    }
+    if (post) {
+        const postStep = {
+            name: `Post ${step.name || step.uses}`,
+            uses: step.uses
+        };
+        runtime.postSteps.push({
+            step: postStep,
+            condition: action.runs['post-if'] ?? 'always()',
+            run: async () => {
+                const postStartTime = Date.now();
+                output = '';
+                const postResult = await runScript(post);
+                return {
+                    step: postStep,
+                    success: postResult.success,
+                    error: postResult.error,
+                    output,
+                    outputs: postResult.outputs,
+                    duration: Date.now() - postStartTime
+                };
+            }
+        });
+    }
+    const mainResult = await runScript(main);
+    return {
+        step,
+        success: mainResult.success,
+        error: mainResult.error,
+        output,
+        outputs: mainResult.outputs,
+        duration: Date.now() - startTime
+    };
+}
+/**
+ * The env var an action input is exposed as. Matches the runner and
+ * `@actions/core`'s getInput(): spaces become `_`, hyphens are kept
+ * (`who-to-greet` -> `INPUT_WHO-TO-GREET`).
+ */
+function inputEnvName(name) {
+    return `INPUT_${name.replace(/ /g, '_').toUpperCase()}`;
+}
+/**
+ * Whether a JavaScript action's `pre` should run (`pre-if`, default
+ * always()). Throws a step error if `pre-if` can't be evaluated.
+ */
+function runPreIf(action, step, ctx) {
+    try {
+        return (0, expression_1.evaluateCondition)(action.runs['pre-if'] ?? 'always()', ctx);
+    }
+    catch (error) {
+        throw new Error((0, expression_1.ifEvaluationError)(`step 'Pre ${step.name || step.uses}'`, error));
+    }
+}
+//# sourceMappingURL=node-action.js.map

package/dist/runner/runner-env.js

@@ -0,0 +1,303 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeyValueFile = parseKeyValueFile;
+exports.createStepFiles = createStepFiles;
+exports.readStepFiles = readStepFiles;
+exports.cleanupStepFiles = cleanupStepFiles;
+exports.processWorkflowCommands = processWorkflowCommands;
+exports.buildRunnerEnv = buildRunnerEnv;
+exports.prependPath = prependPath;
+exports.hostBaseEnv = hostBaseEnv;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Parse a runner "file command" file (`$GITHUB_OUTPUT`, `$GITHUB_ENV`,
+ * `$GITHUB_STATE`), supporting both the simple `name=value` form and the
+ * multiline heredoc form: `name<<DELIMITER` ... `DELIMITER`.
+ */
+function parseKeyValueFile(filePath) {
+    const values = {};
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        return values;
+    }
+    const lines = content.split(/\r?\n/);
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (!line) {
+            i++;
+            continue;
+        }
+        const heredocMatch = line.match(/^([^=<]+)<<(.+)$/);
+        if (heredocMatch) {
+            const [, name, delimiter] = heredocMatch;
+            const valueLines = [];
+            i++;
+            while (i < lines.length && lines[i] !== delimiter) {
+                valueLines.push(lines[i]);
+                i++;
+            }
+            values[name.trim()] = valueLines.join('\n');
+            i++; // Skip the closing delimiter line
+            continue;
+        }
+        const eqIndex = line.indexOf('=');
+        if (eqIndex > -1) {
+            values[line.slice(0, eqIndex).trim()] = line.slice(eqIndex + 1);
+        }
+        i++;
+    }
+    return values;
+}
+/**
+ * Create empty `GITHUB_OUTPUT` / `GITHUB_ENV` / `GITHUB_PATH` /
+ * `GITHUB_STATE` / `GITHUB_STEP_SUMMARY` files for one step, in `dir` (e.g.
+ * a container exchange dir) or a fresh temp directory.
+ */
+function createStepFiles(dir) {
+    const baseDir = dir ?? fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-step-'));
+    const files = {
+        dir: baseDir,
+        output: path.join(baseDir, 'output'),
+        env: path.join(baseDir, 'env'),
+        path: path.join(baseDir, 'path'),
+        state: path.join(baseDir, 'state'),
+        summary: path.join(baseDir, 'summary')
+    };
+    for (const file of [
+        files.output,
+        files.env,
+        files.path,
+        files.state,
+        files.summary
+    ]) {
+        fs.writeFileSync(file, '');
+    }
+    return files;
+}
+function readStepFiles(files) {
+    let pathLines = [];
+    try {
+        pathLines = fs
+            .readFileSync(files.path, 'utf-8')
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter(Boolean);
+    }
+    catch {
+        // Missing file: no PATH additions
+    }
+    return {
+        outputs: parseKeyValueFile(files.output),
+        env: parseKeyValueFile(files.env),
+        path: pathLines,
+        state: parseKeyValueFile(files.state),
+        summary: (() => {
+            try {
+                return fs.readFileSync(files.summary, 'utf-8');
+            }
+            catch {
+                return '';
+            }
+        })()
+    };
+}
+function cleanupStepFiles(files) {
+    fs.rmSync(files.dir, { recursive: true, force: true });
+}
+function unescapeData(value) {
+    return value
+        .replace(/%0D/gi, '\r')
+        .replace(/%0A/gi, '\n')
+        .replace(/%25/g, '%');
+}
+function unescapeProperty(value) {
+    return unescapeData(value).replace(/%3A/gi, ':').replace(/%2C/gi, ',');
+}
+function parseProperties(raw) {
+    const props = {};
+    for (const pair of (raw || '').split(',')) {
+        const eq = pair.indexOf('=');
+        if (eq > 0) {
+            props[pair.slice(0, eq).trim()] = unescapeProperty(pair.slice(eq + 1));
+        }
+    }
+    return props;
+}
+/**
+ * Interpret GitHub Actions workflow commands (`::add-mask::`,
+ * `::set-output`, `::save-state`, `::warning::`, `::group::`, ...) written
+ * to a step's stdout, in both the `::cmd::` and legacy `##[cmd]` syntax.
+ * Problem matchers and `::echo::` have no local effect and are hidden;
+ * nothing is interpreted between `::stop-commands::<token>` and
+ * `::<token>::`. Unknown commands are left in the text.
+ * https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
+ */
+function processWorkflowCommands(stdout) {
+    const result = {
+        text: '',
+        masks: [],
+        outputs: {},
+        state: {},
+        annotations: []
+    };
+    const kept = [];
+    let stopToken;
+    for (const line of stdout.split(/\r?\n/)) {
+        if (stopToken !== undefined) {
+            if (line === `::${stopToken}::`)
+                stopToken = undefined;
+            else
+                kept.push(line);
+            continue;
+        }
+        const match = line.match(/^::([a-zA-Z-]+)(?:\s+([^:]*))?::(.*)$/) ??
+            line.match(/^##\[([a-zA-Z-]+)(?:\s+([^\]]*))?\](.*)$/);
+        if (!match) {
+            kept.push(line);
+            continue;
+        }
+        const [, command, rawProps, rawData] = match;
+        const data = unescapeData(rawData);
+        const props = parseProperties(rawProps);
+        switch (command) {
+            case 'add-mask':
+                if (data)
+                    result.masks.push(data);
+                break;
+            case 'set-output':
+                if (props.name)
+                    result.outputs[props.name] = data;
+                break;
+            case 'save-state':
+                if (props.name)
+                    result.state[props.name] = data;
+                break;
+            case 'warning':
+            case 'error':
+            case 'notice':
+            case 'debug':
+            case 'group':
+                result.annotations.push({ level: command, message: data });
+                break;
+            case 'stop-commands':
+                if (data)
+                    stopToken = data;
+                break;
+            case 'endgroup':
+            case 'add-matcher':
+            case 'remove-matcher':
+            case 'echo':
+                break;
+            default:
+                kept.push(line);
+        }
+    }
+    result.text = kept.join('\n');
+    return result;
+}
+/** A context value as an env var string ('' when unset). */
+function text(value) {
+    return value === undefined || value === null ? '' : String(value);
+}
+function runnerOs() {
+    switch (process.platform) {
+        case 'darwin':
+            return 'macOS';
+        case 'win32':
+            return 'Windows';
+        default:
+            return 'Linux';
+    }
+}
+/**
+ * The default environment variables GitHub's runner exports to every step,
+ * derived from the (local, best-effort) `github` context.
+ * https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
+ */
+function buildRunnerEnv(github, options) {
+    const env = {
+        CI: 'true',
+        GITHUB_ACTIONS: 'true',
+        GITHUB_WORKFLOW: text(github.workflow),
+        GITHUB_JOB: text(github.job),
+        GITHUB_SHA: text(github.sha),
+        GITHUB_REF: text(github.ref),
+        GITHUB_REF_NAME: text(github.ref_name),
+        GITHUB_EVENT_NAME: text(github.event_name),
+        GITHUB_ACTOR: text(github.actor),
+        GITHUB_REPOSITORY: text(github.repository),
+        GITHUB_REPOSITORY_OWNER: text(github.repository_owner),
+        GITHUB_RUN_ID: text(github.run_id),
+        GITHUB_RUN_NUMBER: text(github.run_number),
+        GITHUB_RUN_ATTEMPT: text(github.run_attempt),
+        GITHUB_SERVER_URL: text(github.server_url),
+        GITHUB_API_URL: text(github.api_url),
+        GITHUB_WORKSPACE: options.workspace,
+        GITHUB_EVENT_PATH: options.eventPath,
+        RUNNER_OS: runnerOs(),
+        RUNNER_TEMP: options.tempDir,
+        RUNNER_TOOL_CACHE: options.toolCache
+    };
+    return env;
+}
+/** Prepend `$GITHUB_PATH` additions (most recent first) to a PATH value. */
+function prependPath(additions, basePath) {
+    return [...additions, ...(basePath ? [basePath] : [])].join(path.delimiter);
+}
+/**
+ * Host variables that `run:` steps and actions on the host still get: what
+ * tools need to work (PATH, HOME, locale, temp dirs, proxy and CA settings,
+ * the container client's config, and Windows system variables). Everything
+ * else in the user's shell (tokens, cloud credentials...) stays out; pass
+ * what a workflow needs with `--env`.
+ */
+const HOST_ENV_ALLOWLIST = /^(PATH|HOME|USER|LOGNAME|SHELL|TERM|TZ|LANG|LANGUAGE|LC_[A-Z_]+|TMPDIR|TEMP|TMP|(HTTPS?|FTP|ALL|NO)_PROXY|SSL_CERT_(FILE|DIR)|NODE_EXTRA_CA_CERTS|REQUESTS_CA_BUNDLE|CURL_CA_BUNDLE|DOCKER_(HOST|CONTEXT|CONFIG|CERT_PATH|TLS_VERIFY)|XDG_RUNTIME_DIR|SYSTEMROOT|SYSTEMDRIVE|WINDIR|COMSPEC|PATHEXT|USERPROFILE|APPDATA|LOCALAPPDATA|PROGRAMDATA|PROGRAMFILES(\(X86\))?|COMMONPROGRAMFILES(\(X86\))?)$/i;
+/** The allowlisted part of the host environment (see HOST_ENV_ALLOWLIST). */
+function hostBaseEnv(env = process.env) {
+    const base = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value !== undefined && HOST_ENV_ALLOWLIST.test(key))
+            base[key] = value;
+    }
+    return base;
+}
+//# sourceMappingURL=runner-env.js.map

package/dist/runner/shell.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * `shell:` handling for `run:` steps, mirroring the GitHub runner: the
+ * script is written to a file and passed as `{0}` to a command template.
+ * https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveShell = resolveShell;
+exports.shellCommandLine = shellCommandLine;
+exports.splitArgs = splitArgs;
+const BASH = 'bash --noprofile --norc -eo pipefail {0}';
+const SH = 'sh -e {0}';
+const KNOWN_SHELLS = {
+    bash: { template: BASH, extension: '.sh' },
+    sh: { template: SH, extension: '.sh' },
+    python: { template: 'python {0}', extension: '.py' },
+    pwsh: { template: `pwsh -command ". '{0}'"`, extension: '.ps1' },
+    powershell: {
+        template: `powershell -command ". '{0}'"`,
+        extension: '.ps1'
+    },
+    cmd: {
+        template: '%ComSpec% /D /E:ON /V:OFF /S /C "CALL "{0}""',
+        extension: '.cmd'
+    }
+};
+/**
+ * Resolve a step's `shell:` (after `defaults.run.shell`) to a command
+ * template. With no shell, GitHub uses bash with `-eo pipefail`, or
+ * `sh -e` where bash isn't installed.
+ */
+function resolveShell(shell, options) {
+    if (!shell) {
+        return options.bashAvailable ? KNOWN_SHELLS.bash : KNOWN_SHELLS.sh;
+    }
+    const known = KNOWN_SHELLS[shell];
+    if (known)
+        return known;
+    if (shell.includes('{0}'))
+        return { template: shell, extension: '' };
+    return { template: `${shell} {0}`, extension: '' };
+}
+/**
+ * Build the command line for a template and script path. `{0}` is replaced
+ * with a single-quoted path, unless the template already quotes it.
+ */
+function shellCommandLine(template, scriptPath) {
+    if (/'\{0\}'|"\{0\}"/.test(template)) {
+        return template.replace('{0}', scriptPath);
+    }
+    const quoted = `'${scriptPath.replace(/'/g, "'\\''")}'`;
+    return template.replace('{0}', quoted);
+}
+/**
+ * Split an argument string (`with.args`, `services.<id>.options`) into
+ * argv, honouring simple quoting.
+ */
+function splitArgs(args) {
+    return (args.match(/"[^"]*"|'[^']*'|\S+/g) || []).map((arg) => /^(["']).*\1$/.test(arg) ? arg.slice(1, -1) : arg);
+}
+//# sourceMappingURL=shell.js.map