@thegitai/cli 1.0.0-preview.3 → 1.0.0-preview.31

package/dist/src/api/models.js

@@ -1,7 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { getClientStateDir } from '../client-state.js';
-import { REQUEST_TIMEOUT_MS, ServerApiError, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, retryTransient, } from './http.js';
+import { REQUEST_TIMEOUT_MS, ServerApiError, createTraceContext, failureCode, failureMessage, normalizeServerUrl, readJsonResponse, retryTransient, } from './http.js';
 function sanitizeModelInfo(raw) {
     if (!raw || typeof raw !== 'object') {
         return null;
@@ -58,12 +58,21 @@ export function selectCacheForServer(cached, serverUrl) {
 export function writeCachedServerModels(cache, env = process.env) {
     const filePath = getModelsCachePath(env);
     mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-    writeFileSync(filePath, `${JSON.stringify(cache, null, 2)}\n`, {
-        encoding: 'utf8',
-        mode: 0o600,
-    });
+    const tempPath = `${filePath}.${process.pid}.tmp`;
+    try {
+        writeFileSync(tempPath, `${JSON.stringify(cache, null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+        renameSync(tempPath, filePath);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
 }
-export async function fetchServerModels({ config, fetchImpl = globalThis.fetch, }) {
+export async function fetchServerModels({ config, fetchImpl = globalThis.fetch, budget = {}, }) {
+    const { timeoutMs = REQUEST_TIMEOUT_MS, ...ladder } = budget;
     return retryTransient(async () => {
         const trace = createTraceContext();
         const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/models`, {
@@ -71,11 +80,11 @@ export async function fetchServerModels({ config, fetchImpl = globalThis.fetch,
                 authorization: `Bearer ${config.token}`,
                 ...trace.headers,
             },
-            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            signal: AbortSignal.timeout(timeoutMs),
         });
         const data = (await readJsonResponse(response));
         if (!response.ok) {
-            throw new ServerApiError(failureMessage(data, response.status), response.status, trace.traceId);
+            throw new ServerApiError(failureMessage(data, response.status), response.status, trace.traceId, failureCode(data));
         }
         const models = Array.isArray(data?.models)
             ? data.models.map(sanitizeModelInfo).filter(Boolean)
@@ -84,7 +93,7 @@ export async function fetchServerModels({ config, fetchImpl = globalThis.fetch,
             throw new Error('Server returned an invalid model list.');
         }
         return { models };
-    });
+    }, ladder);
 }
 export function selectServerModel({ requestedModelId, cached, serverModels, }) {
     const supportedIds = new Set(serverModels.models.map((model) => model.id));

package/dist/src/background-jobs.js

@@ -1,6 +1,6 @@
 import chalk from './colors.js';
 import { spawn } from 'child_process';
-import { buildCommandEnv, commandUsesSudo, sanitizeCommandText, terminateChild, } from './executor.js';
+import { buildCommandEnv, commandUsesSudo, resolveCommandShell, sanitizeCommandText, terminateChild, } from './executor.js';
 import { isTuiMode } from './runtime-mode.js';
 import { redactConnectionStringCredentials } from './secret-preview.js';
 const MAX_RUNNING_JOBS = 8;
@@ -196,7 +196,7 @@ export async function startBackgroundJob(command, cwd, { startupWaitMs, sessionI
     const id = `bg_${++jobCounter}`;
     const child = spawn(command, {
         cwd,
-        shell: true,
+        shell: resolveCommandShell(),
         detached: process.platform !== 'win32',
         stdio: ['pipe', 'pipe', 'pipe'],
         env: buildCommandEnv(cwd),

package/dist/src/cli-args.js

@@ -1,9 +1,24 @@
 export const AUTH_COMMANDS = new Set(['login', 'whoami', 'logout']);
+function hasPromptWordsAfter(args) {
+    for (let i = 1; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--session' || arg === '--resume') {
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        return true;
+    }
+    return false;
+}
 export function parseArgs(argv) {
     const args = argv.slice(2);
     const firstArg = args[0];
-    const command = firstArg && AUTH_COMMANDS.has(firstArg) ? firstArg : null;
-    const commandArgs = command ? args.slice(1) : [];
+    const command = firstArg && AUTH_COMMANDS.has(firstArg) &&
+        (firstArg !== 'login' || !hasPromptWordsAfter(args))
+        ? firstArg
+        : null;
     let autoYes = false;
     let help = false;
     let version = false;
@@ -12,7 +27,7 @@ export function parseArgs(argv) {
     let listSessions = false;
     let unknownOption = null;
     const promptParts = [];
-    for (let i = 0; i < args.length; i++) {
+    for (let i = command ? 1 : 0; i < args.length; i++) {
         const arg = args[i];
         if (arg === '--yes' || arg === '-y') {
             autoYes = true;
@@ -39,7 +54,7 @@ export function parseArgs(argv) {
             usage = true;
             continue;
         }
-        if (command === null && unknownOption === null && /^-/.test(arg)) {
+        if (unknownOption === null && /^-/.test(arg)) {
             unknownOption = arg;
             continue;
         }
@@ -47,7 +62,6 @@ export function parseArgs(argv) {
     }
     return {
         command,
-        commandArgs,
         autoYes,
         help,
         version,

package/dist/src/core/clipboard.js

@@ -1,15 +1,7 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
-const MAX_IMAGE_SIZE_BYTES = 10 * 1024 * 1024;
-const MIME_BY_EXT = {
-    '.png': 'image/png',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.gif': 'image/gif',
-    '.webp': 'image/webp',
-};
-const SUPPORTED_MIME_TYPES = new Set(Object.values(MIME_BY_EXT));
+import { MAX_IMAGE_SIZE_BYTES, SUPPORTED_IMAGE_MIME_TYPES as SUPPORTED_MIME_TYPES, sniffImageMimeType, } from './image-limits.js';
 export class ClipboardError extends Error {
     code;
     constructor(message, code) {
@@ -273,11 +265,13 @@ export function loadImageFromFile(filePath) {
     if (stat.size > MAX_IMAGE_SIZE_BYTES) {
         throw new ClipboardError(`Image file exceeds 10MB limit (${(stat.size / 1024 / 1024).toFixed(1)}MB): ${resolved}`, 'READ_FAILED');
     }
-    const ext = path.extname(resolved).toLowerCase();
-    const mimeType = MIME_BY_EXT[ext];
+    const buf = readFileSync(resolved);
+    const mimeType = sniffImageMimeType(buf);
     if (!mimeType) {
-        throw new ClipboardError(`Unsupported image format "${ext}". Supported: PNG, JPEG, GIF, WebP.`, 'READ_FAILED');
+        const ext = path.extname(resolved).toLowerCase();
+        throw new ClipboardError(ext
+            ? `"${path.basename(resolved)}" is named ${ext} but its contents are not a supported image. Supported: PNG, JPEG, GIF, WebP.`
+            : `Not a supported image file: ${resolved}. Supported: PNG, JPEG, GIF, WebP.`, 'READ_FAILED');
     }
-    const buf = readFileSync(resolved);
     return { base64Data: buf.toString('base64'), mimeType };
 }

package/dist/src/core/image-limits.js

@@ -0,0 +1,56 @@
+export const MAX_IMAGES_PER_MESSAGE = 5;
+export const MAX_IMAGE_SIZE_BYTES = 10 * 1024 * 1024;
+export const MAX_TOTAL_IMAGE_BYTES_PER_MESSAGE = 20 * 1024 * 1024;
+export function approximateBase64DecodedBytes(base64) {
+    const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
+    return Math.max(0, Math.floor((base64.length * 3) / 4) - padding);
+}
+export function totalAttachmentBytes(attachments) {
+    return attachments.reduce((sum, attachment) => sum + approximateBase64DecodedBytes(attachment.base64Data), 0);
+}
+export const SUPPORTED_IMAGE_MIME_TYPES = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/gif',
+    'image/webp',
+]);
+export const IMAGE_MIME_BY_EXT = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+};
+export const IMAGE_EXT_BY_MIME = {
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+};
+export function isSupportedImageMimeType(mime) {
+    return SUPPORTED_IMAGE_MIME_TYPES.has(mime);
+}
+export function sniffImageMimeType(bytes) {
+    if (bytes.length < 12)
+        return null;
+    if (bytes[0] === 0x89 &&
+        bytes[1] === 0x50 &&
+        bytes[2] === 0x4e &&
+        bytes[3] === 0x47) {
+        return 'image/png';
+    }
+    if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return 'image/jpeg';
+    }
+    if (bytes.subarray(0, 3).toString('latin1') === 'GIF') {
+        return 'image/gif';
+    }
+    if (bytes.subarray(0, 4).toString('latin1') === 'RIFF' &&
+        bytes.subarray(8, 12).toString('latin1') === 'WEBP') {
+        return 'image/webp';
+    }
+    return null;
+}
+export function imageExtensionForMime(mime) {
+    return IMAGE_EXT_BY_MIME[mime] ?? '.png';
+}

package/dist/src/core/image-path-extractor.js

@@ -1,7 +1,9 @@
-import { existsSync, statSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loadImageFromFile } from './clipboard.js';
+import { MAX_IMAGES_PER_MESSAGE, MAX_IMAGE_SIZE_BYTES, MAX_TOTAL_IMAGE_BYTES_PER_MESSAGE, approximateBase64DecodedBytes, sniffImageMimeType, totalAttachmentBytes, } from './image-limits.js';
+import { tryCacheAttachmentBytes } from './session-image-store.js';
 const EXT = '(?:png|jpe?g|gif|webp)';
 const BARE_CHAR = "[^\\s\"'<>,:;!?()\\[\\]{}]";
 const BARE_PATH = `(?:[A-Za-z]:[\\\\/])?(?:\\\\ |${BARE_CHAR})+\\.${EXT}`;
@@ -110,13 +112,67 @@ function detectImagePaths(input, cwd) {
     }
     return rawsByPath;
 }
+const EXTENSIONLESS_CANDIDATE = new RegExp(`"([^"]*[\\\\/][^"]*)"` +
+    `|'([^']*[\\\\/][^']*)'` +
+    `|((?:[A-Za-z]:[\\\\/])?(?:\\\\ |${BARE_CHAR})*[\\\\/](?:\\\\ |${BARE_CHAR})+)`, 'g');
+function sniffFileHeader(resolvedPath) {
+    let fd = null;
+    try {
+        const stat = statSync(resolvedPath, { throwIfNoEntry: false });
+        if (!stat?.isFile() || stat.size > MAX_IMAGE_SIZE_BYTES)
+            return null;
+        fd = openSync(resolvedPath, 'r');
+        const header = Buffer.alloc(12);
+        const read = readSync(fd, header, 0, 12, 0);
+        return read === 12 ? header : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+            }
+        }
+    }
+}
+function detectExtensionlessImagePaths(input, cwd, alreadyDetected) {
+    const found = new Map();
+    const regex = new RegExp(EXTENSIONLESS_CANDIDATE.source, EXTENSIONLESS_CANDIDATE.flags);
+    let match;
+    while ((match = regex.exec(input)) !== null) {
+        const raw = match[0];
+        const inner = (match[1] ?? match[2] ?? match[3] ?? '').replace(/\\ /g, ' ');
+        if (!inner || inner.includes('://'))
+            continue;
+        if (/\.(?:png|jpe?g|gif|webp)$/i.test(inner))
+            continue;
+        const resolvedPath = path.isAbsolute(inner)
+            ? inner
+            : path.resolve(cwd, inner);
+        if (alreadyDetected.has(resolvedPath) || found.has(resolvedPath))
+            continue;
+        const header = sniffFileHeader(resolvedPath);
+        if (!header || !sniffImageMimeType(header))
+            continue;
+        found.set(resolvedPath, [raw]);
+    }
+    return found;
+}
 export function autoAttachImages(input, cwd, existing = []) {
-    const max = 2;
+    const max = MAX_IMAGES_PER_MESSAGE;
     const rawsByPath = detectImagePaths(input, cwd);
+    for (const [resolvedPath, rawForms] of detectExtensionlessImagePaths(input, cwd, new Set(rawsByPath.keys()))) {
+        rawsByPath.set(resolvedPath, rawForms);
+    }
     let sanitizedInput = input;
     const attachments = [];
     const errors = [];
     const maxExistingIndex = existing.reduce((highest, a) => Math.max(highest, a.index ?? 0), 0);
+    let budgetUsed = totalAttachmentBytes(existing);
     for (const [resolvedPath, rawForms] of rawsByPath) {
         if (existing.length + attachments.length >= max)
             break;
@@ -124,13 +180,24 @@ export function autoAttachImages(input, cwd, existing = []) {
             continue;
         try {
             const loaded = loadImageFromFile(resolvedPath);
-            const idx = maxExistingIndex + attachments.length + 1;
+            const bytes = approximateBase64DecodedBytes(loaded.base64Data);
+            if (budgetUsed + bytes > MAX_TOTAL_IMAGE_BYTES_PER_MESSAGE) {
+                errors.push(`${path.basename(resolvedPath)} was not attached: it would put this message over the ${Math.round(MAX_TOTAL_IMAGE_BYTES_PER_MESSAGE / 1024 / 1024)}MB combined image limit.`);
+                continue;
+            }
+            budgetUsed += bytes;
+            const cached = tryCacheAttachmentBytes({
+                base64Data: loaded.base64Data,
+                mimeType: loaded.mimeType,
+            });
+            const idx = cached?.index ?? maxExistingIndex + attachments.length + 1;
             attachments.push({
                 index: idx,
                 mimeType: loaded.mimeType,
                 base64Data: loaded.base64Data,
                 source: 'file',
                 filePath: resolvedPath,
+                ...(cached ? { cachePath: cached.cachePath } : {}),
             });
             for (const raw of rawForms) {
                 sanitizedInput = sanitizedInput.replace(raw, `[Image #${idx}]`);

package/dist/src/core/session-image-store.js

@@ -0,0 +1,199 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { getClientStateDir } from '../client-state.js';
+import { MAX_IMAGE_SIZE_BYTES, imageExtensionForMime, isSupportedImageMimeType, sniffImageMimeType, } from './image-limits.js';
+const IMAGE_FILE_MODE = 0o600;
+const IMAGE_DIR_MODE = 0o700;
+export const SESSION_IMAGE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+let activeSessionId = null;
+export function setImageStoreSession(sessionId) {
+    activeSessionId = String(sessionId ?? '').trim() || null;
+    contentIndex.clear();
+}
+const contentIndex = new Map();
+function imageContentKey(base64Data) {
+    return createHash('sha256').update(base64Data).digest('hex');
+}
+function rememberStoredImage(base64Data, cachePath) {
+    contentIndex.set(imageContentKey(base64Data), cachePath);
+}
+export function findStoredImageByContent(base64Data) {
+    const cachePath = contentIndex.get(imageContentKey(base64Data));
+    if (!cachePath)
+        return undefined;
+    if (!existsSync(cachePath)) {
+        contentIndex.delete(imageContentKey(base64Data));
+        return undefined;
+    }
+    return cachePath;
+}
+export function getImageStoreSession() {
+    return activeSessionId;
+}
+function safeSessionDirName(sessionId) {
+    const normalized = String(sessionId ?? '').trim();
+    if (!/^[a-zA-Z0-9_-]+$/.test(normalized)) {
+        throw new Error(`Invalid session id "${sessionId}".`);
+    }
+    return normalized;
+}
+export function getSessionImageBaseDir(env = process.env) {
+    return path.join(getClientStateDir(env), 'sessions', 'images');
+}
+export function getSessionImageDir(sessionId, env = process.env) {
+    return path.join(getSessionImageBaseDir(env), safeSessionDirName(sessionId));
+}
+function nextImageNumber(dir) {
+    if (!existsSync(dir))
+        return 1;
+    let highest = 0;
+    for (const name of readdirSync(dir)) {
+        const parsed = Number.parseInt(path.basename(name, path.extname(name)), 10);
+        if (Number.isInteger(parsed) && parsed > highest)
+            highest = parsed;
+    }
+    return highest + 1;
+}
+function ensureSessionImageDir(sessionId, env) {
+    const dir = getSessionImageDir(sessionId, env);
+    mkdirSync(dir, { recursive: true, mode: IMAGE_DIR_MODE });
+    return dir;
+}
+export function storeSessionImageBytes({ sessionId, base64Data, mimeType, env = process.env, }) {
+    const dir = ensureSessionImageDir(sessionId, env);
+    const index = nextImageNumber(dir);
+    const cachePath = path.join(dir, `${index}${imageExtensionForMime(mimeType)}`);
+    writeFileSync(cachePath, Buffer.from(base64Data, 'base64'), {
+        mode: IMAGE_FILE_MODE,
+    });
+    rememberStoredImage(base64Data, cachePath);
+    return { cachePath, mimeType, base64Data, index };
+}
+export function tryCacheAttachmentBytes({ base64Data, mimeType, env = process.env, }) {
+    if (!activeSessionId)
+        return undefined;
+    try {
+        const stored = storeSessionImageBytes({
+            sessionId: activeSessionId,
+            base64Data,
+            mimeType,
+            env,
+        });
+        return { cachePath: stored.cachePath, index: stored.index };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isSessionStorePath(candidate, env = process.env) {
+    if (!activeSessionId)
+        return false;
+    const dir = getSessionImageDir(activeSessionId, env);
+    const resolved = path.resolve(candidate);
+    return (resolved.startsWith(dir + path.sep) && path.dirname(resolved) === dir);
+}
+export function readSessionImageByIndex(index, env = process.env) {
+    if (!activeSessionId || !Number.isInteger(index) || index < 1)
+        return null;
+    const dir = getSessionImageDir(activeSessionId, env);
+    if (!existsSync(dir))
+        return null;
+    try {
+        for (const name of readdirSync(dir)) {
+            if (Number.parseInt(path.basename(name, path.extname(name)), 10) === index) {
+                return readSessionImage(path.join(dir, name));
+            }
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+export class SessionImageError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'SessionImageError';
+    }
+}
+export function storeSessionImageFromPath({ sessionId, sourcePath, env = process.env, }) {
+    const resolved = path.resolve(sourcePath);
+    if (!existsSync(resolved) || !statSync(resolved).isFile()) {
+        throw new SessionImageError(`Image file not found: ${resolved}`, 'NOT_FOUND');
+    }
+    const size = statSync(resolved).size;
+    if (size > MAX_IMAGE_SIZE_BYTES) {
+        throw new SessionImageError(`Image file exceeds ${Math.round(MAX_IMAGE_SIZE_BYTES / 1024 / 1024)}MB limit (${(size / 1024 / 1024).toFixed(1)}MB): ${resolved}`, 'TOO_LARGE');
+    }
+    const bytes = readFileSync(resolved);
+    const sniffed = sniffImageMimeType(bytes);
+    if (!sniffed || !isSupportedImageMimeType(sniffed)) {
+        throw new SessionImageError(`Not a supported image file: ${resolved}. Supported: PNG, JPEG, GIF, WebP.`, 'UNSUPPORTED');
+    }
+    const dir = ensureSessionImageDir(sessionId, env);
+    const index = nextImageNumber(dir);
+    const cachePath = path.join(dir, `${index}${imageExtensionForMime(sniffed)}`);
+    writeFileSync(cachePath, bytes, { mode: IMAGE_FILE_MODE });
+    const base64Data = bytes.toString('base64');
+    rememberStoredImage(base64Data, cachePath);
+    return { cachePath, mimeType: sniffed, base64Data, index };
+}
+export function readSessionImage(cachePath) {
+    try {
+        if (!existsSync(cachePath))
+            return null;
+        const bytes = readFileSync(cachePath);
+        const sniffed = sniffImageMimeType(bytes);
+        if (!sniffed)
+            return null;
+        const parsed = Number.parseInt(path.basename(cachePath, path.extname(cachePath)), 10);
+        const base64Data = bytes.toString('base64');
+        rememberStoredImage(base64Data, cachePath);
+        return {
+            cachePath,
+            mimeType: sniffed,
+            base64Data,
+            index: Number.isInteger(parsed) ? parsed : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function pruneSessionImages(sessionId, env = process.env) {
+    try {
+        rmSync(getSessionImageDir(sessionId, env), { recursive: true, force: true });
+    }
+    catch {
+    }
+}
+export function sweepOrphanSessionImages({ activeSessionIds, maxAgeMs = SESSION_IMAGE_MAX_AGE_MS, env = process.env, now = Date.now(), }) {
+    const baseDir = getSessionImageBaseDir(env);
+    if (!existsSync(baseDir))
+        return 0;
+    let removed = 0;
+    let entries;
+    try {
+        entries = readdirSync(baseDir);
+    }
+    catch {
+        return 0;
+    }
+    for (const entry of entries) {
+        if (activeSessionIds.has(entry))
+            continue;
+        const dir = path.join(baseDir, entry);
+        try {
+            if (now - statSync(dir).mtimeMs < maxAgeMs)
+                continue;
+            rmSync(dir, { recursive: true, force: true });
+            removed += 1;
+        }
+        catch {
+        }
+    }
+    return removed;
+}

package/dist/src/executor.js

@@ -1,6 +1,6 @@
 import chalk from './colors.js';
 import { execFileSync, spawn } from 'child_process';
-import { existsSync, statSync } from 'fs';
+import { accessSync, constants as fsConstants, existsSync, statSync } from 'fs';
 import { createRequire } from 'node:module';
 import os from 'os';
 import path from 'path';
@@ -596,7 +596,7 @@ export function commandUsesSudo(command) {
 }
 export function sudoPromptFromTail(text) {
     const tail = text.slice(-1000).replace(/\x1b\[[0-9;?]*[A-Za-z]/g, '');
-    const match = tail.match(/(?:\[sudo\][^\r\n]*password[^\r\n]*: ?|sudo[^\r\n]*password[^\r\n]*: ?|password[^\r\n]*: ?)$/i);
+    const match = tail.match(/(?:\[sudo\][^\r\n]*password[^\r\n]*: ?|\[?sudo[^\r\n]*password[^\r\n]*: ?|password[^\r\n]*: ?)$/i);
     return match?.[0] ?? null;
 }
 function isSudoPromptLine(text) {
@@ -637,6 +637,28 @@ export function buildCommandEnv(cwd) {
         THEGITAI_SCRATCH_DIR: ensureSessionScratchDir(),
     };
 }
+let cachedCommandShell;
+function findBashPath() {
+    const fromPath = (process.env.PATH ?? '')
+        .split(path.delimiter)
+        .filter(Boolean)
+        .map((dir) => path.join(dir, 'bash'));
+    for (const candidate of [...fromPath, '/bin/bash', '/usr/bin/bash']) {
+        try {
+            accessSync(candidate, fsConstants.X_OK);
+            return candidate;
+        }
+        catch { }
+    }
+    return null;
+}
+export function resolveCommandShell() {
+    if (cachedCommandShell !== undefined)
+        return cachedCommandShell;
+    cachedCommandShell =
+        process.platform === 'win32' ? true : (findBashPath() ?? true);
+    return cachedCommandShell;
+}
 function sanitizePtyOutput(command, output, cwd, secrets) {
     return sanitizeCommandText(command, stripSudoPromptText(redactSecrets(output, secrets)), cwd);
 }
@@ -822,7 +844,7 @@ export async function runCommand(command, cwd, { requestSudoPassword, timeout, }
         let killTimer = null;
         const child = spawn(command, {
             cwd,
-            shell: true,
+            shell: resolveCommandShell(),
             detached: process.platform !== 'win32',
             stdio: ['pipe', 'pipe', 'pipe'],
             env: buildCommandEnv(cwd),