@wrongstack/plugins 0.308.1 → 0.308.2

package/dist/index.js

@@ -14270,14 +14270,19 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
-  if (/(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
+  if (/(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
     stripped
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -14494,6 +14499,27 @@ ${remainingCommand}`;
   if (heredoc !== null) maskBody(heredoc.bodyStart, lines.length, heredoc.quoted);
   return lines.join("");
 }
+function stripSubshellClosers(raw) {
+  let result = raw.trimEnd();
+  while (result.endsWith(")")) {
+    if (quoteIsEscaped(result, result.length - 1)) break;
+    let quote = null;
+    let depth = 0;
+    for (let index = 0; index < result.length - 1; index += 1) {
+      const char = result[index];
+      if (isQuoteBoundary(result, index, quote)) {
+        quote = quote === char ? null : char === "'" ? "'" : '"';
+        continue;
+      }
+      if (quote !== null) continue;
+      if (char === "(" && !quoteIsEscaped(result, index)) depth += 1;
+      else if (char === ")" && !quoteIsEscaped(result, index)) depth -= 1;
+    }
+    if (depth > 0) break;
+    result = result.slice(0, -1).trimEnd();
+  }
+  return result;
+}
 function destructiveTargets(command) {
   return destructiveTargetsAtDepth(command, 0);
 }
@@ -14540,20 +14566,26 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
     m = destructive.exec(normalizedCommand);
   }
-  const copy = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)/gi;
+  const copy = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let c = copy.exec(normalizedCommand);
   while (c !== null) {
     if (tokenIsQuoted(c, c[1] ?? "")) {
       c = copy.exec(normalizedCommand);
       continue;
     }
-    const tokens = shellTokens(c[2] ?? "");
+    const tokens = shellTokens(stripSubshellClosers(c[2] ?? ""));
     let destination;
     for (let index = 0; index < tokens.length; index += 1) {
       const token = tokens[index];
@@ -14570,23 +14602,32 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)/gi;
+  const tee = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)/gi;
+  const dd = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {
       const outputMatch = /(?:^|\s)of=("[^"]*"|'[^']*'|[^\s]+)/i.exec(d[2] ?? "");
-      const output = outputMatch?.[1]?.replace(/^['"]|['"]$/g, "");
+      const output = outputMatch?.[1] ? stripSubshellClosers(outputMatch[1]).replace(/^['"]|['"]$/g, "") : void 0;
       if (output) targets.push(output);
     }
     d = dd.exec(normalizedCommand);
   }
-  const overwrite = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)/gi;
+  const overwrite = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let o = overwrite.exec(normalizedCommand);
   while (o !== null) {
     const rawArgs = o[2] ?? "";
@@ -14604,7 +14645,10 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     o = overwrite.exec(normalizedCommand);
   }
-  const xargsPipeline = /\b(?:echo|printf)\s+([^|]+)\|\s*xargs(?:\s+-[^\s]+)*\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b/gi;
+  const xargsPipeline = new RegExp(
+    String.raw`\b(?:echo|printf)\s+([^|]+)\|\s*xargs${XARGS_OPTIONS}\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b`,
+    "gi"
+  );
   let x = xargsPipeline.exec(normalizedCommand);
   while (x !== null) {
     if (!tokenIsQuoted(x, "xargs")) targets.push(...shellArgs(x[1] ?? ""));
@@ -14721,7 +14765,7 @@ function destructiveTargetsAtDepth(command, depth) {
         targets.push(gitTarget("."));
     }
   }
-  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
+  const findDelete = /(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:[\s;})]|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
   let f = findDelete.exec(normalizedCommand);
   while (f !== null) {
     const tokens = shellTokens(f[1] ?? "");
@@ -15154,10 +15198,19 @@ var plugin39 = {
       const ti = input.toolInput ?? {};
       const command = typeof ti["command"] === "string" ? ti["command"] : "";
       const commandArgs = Array.isArray(ti["args"]) ? ti["args"].filter((arg) => typeof arg === "string") : [];
-      const commandForInspection = [
-        command,
-        ...commandArgs.map((arg) => /^[\w./:@%+=,-]+$/.test(arg) ? arg : JSON.stringify(arg))
-      ].join(" ");
+      const serializeArgForInspection = (arg) => {
+        if (/^[\w./:@%+=,-]+$/.test(arg)) return arg;
+        const assignment = /^([A-Za-z_]\w*)=(.+)$/.exec(arg);
+        const key = assignment?.[1];
+        const value = assignment?.[2];
+        if (key !== void 0 && value !== void 0) {
+          return `${key}="${value.replaceAll('"', "")}"`;
+        }
+        return JSON.stringify(arg);
+      };
+      const commandForInspection = [command, ...commandArgs.map(serializeArgForInspection)].join(
+        " "
+      );
       if (command && executesShell({
         toolName: input.toolName,
         toolInput: ti,

package/dist/path-guard.js

@@ -562,14 +562,19 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
-  if (/(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
+  if (/(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
     stripped
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -786,6 +791,27 @@ ${remainingCommand}`;
   if (heredoc !== null) maskBody(heredoc.bodyStart, lines.length, heredoc.quoted);
   return lines.join("");
 }
+function stripSubshellClosers(raw) {
+  let result = raw.trimEnd();
+  while (result.endsWith(")")) {
+    if (quoteIsEscaped(result, result.length - 1)) break;
+    let quote = null;
+    let depth = 0;
+    for (let index = 0; index < result.length - 1; index += 1) {
+      const char = result[index];
+      if (isQuoteBoundary(result, index, quote)) {
+        quote = quote === char ? null : char === "'" ? "'" : '"';
+        continue;
+      }
+      if (quote !== null) continue;
+      if (char === "(" && !quoteIsEscaped(result, index)) depth += 1;
+      else if (char === ")" && !quoteIsEscaped(result, index)) depth -= 1;
+    }
+    if (depth > 0) break;
+    result = result.slice(0, -1).trimEnd();
+  }
+  return result;
+}
 function destructiveTargets(command) {
   return destructiveTargetsAtDepth(command, 0);
 }
@@ -832,20 +858,26 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
     m = destructive.exec(normalizedCommand);
   }
-  const copy = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)/gi;
+  const copy = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let c = copy.exec(normalizedCommand);
   while (c !== null) {
     if (tokenIsQuoted(c, c[1] ?? "")) {
       c = copy.exec(normalizedCommand);
       continue;
     }
-    const tokens = shellTokens(c[2] ?? "");
+    const tokens = shellTokens(stripSubshellClosers(c[2] ?? ""));
     let destination;
     for (let index = 0; index < tokens.length; index += 1) {
       const token = tokens[index];
@@ -862,23 +894,32 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)/gi;
+  const tee = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)/gi;
+  const dd = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {
       const outputMatch = /(?:^|\s)of=("[^"]*"|'[^']*'|[^\s]+)/i.exec(d[2] ?? "");
-      const output = outputMatch?.[1]?.replace(/^['"]|['"]$/g, "");
+      const output = outputMatch?.[1] ? stripSubshellClosers(outputMatch[1]).replace(/^['"]|['"]$/g, "") : void 0;
       if (output) targets.push(output);
     }
     d = dd.exec(normalizedCommand);
   }
-  const overwrite = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)/gi;
+  const overwrite = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let o = overwrite.exec(normalizedCommand);
   while (o !== null) {
     const rawArgs = o[2] ?? "";
@@ -896,7 +937,10 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     o = overwrite.exec(normalizedCommand);
   }
-  const xargsPipeline = /\b(?:echo|printf)\s+([^|]+)\|\s*xargs(?:\s+-[^\s]+)*\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b/gi;
+  const xargsPipeline = new RegExp(
+    String.raw`\b(?:echo|printf)\s+([^|]+)\|\s*xargs${XARGS_OPTIONS}\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b`,
+    "gi"
+  );
   let x = xargsPipeline.exec(normalizedCommand);
   while (x !== null) {
     if (!tokenIsQuoted(x, "xargs")) targets.push(...shellArgs(x[1] ?? ""));
@@ -1013,7 +1057,7 @@ function destructiveTargetsAtDepth(command, depth) {
         targets.push(gitTarget("."));
     }
   }
-  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
+  const findDelete = /(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:[\s;})]|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
   let f = findDelete.exec(normalizedCommand);
   while (f !== null) {
     const tokens = shellTokens(f[1] ?? "");
@@ -1471,10 +1515,19 @@ var plugin = {
       const ti = input.toolInput ?? {};
       const command = typeof ti["command"] === "string" ? ti["command"] : "";
       const commandArgs = Array.isArray(ti["args"]) ? ti["args"].filter((arg) => typeof arg === "string") : [];
-      const commandForInspection = [
-        command,
-        ...commandArgs.map((arg) => /^[\w./:@%+=,-]+$/.test(arg) ? arg : JSON.stringify(arg))
-      ].join(" ");
+      const serializeArgForInspection = (arg) => {
+        if (/^[\w./:@%+=,-]+$/.test(arg)) return arg;
+        const assignment = /^([A-Za-z_]\w*)=(.+)$/.exec(arg);
+        const key = assignment?.[1];
+        const value = assignment?.[2];
+        if (key !== void 0 && value !== void 0) {
+          return `${key}="${value.replaceAll('"', "")}"`;
+        }
+        return JSON.stringify(arg);
+      };
+      const commandForInspection = [command, ...commandArgs.map(serializeArgForInspection)].join(
+        " "
+      );
       if (command && executesShell({
         toolName: input.toolName,
         toolInput: ti,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.308.1",
+  "version": "0.308.2",
   "description": "Official WrongStack collection of focused plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -303,8 +303,8 @@
     "vitest": "^4.1.10"
   },
   "dependencies": {
-    "@wrongstack/core": "0.308.1",
-    "@wrongstack/tools": "0.308.1"
+    "@wrongstack/core": "0.308.2",
+    "@wrongstack/tools": "0.308.2"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",