@wrongstack/tools 0.287.0 → 0.289.0

package/dist/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../src/exec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAU7C,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA8J1E;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAO,GAAG,IAAI,CAQpI;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAkBD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAO,GAAG,IAAI,CAOjG;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAErD;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AA4GD,UAAU,SAAS;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CA0IhD,CAAC"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../src/exec.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA8J1E;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAO,GAAG,IAAI,CAQpI;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAkBD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAO,GAAG,IAAI,CAOjG;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,CAErD;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AA4GD,UAAU,SAAS;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CA0IhD,CAAC"}

package/dist/exec.js

@@ -1,5 +1,10 @@
 // src/exec.ts
 import { spawn as spawn2 } from "node:child_process";
+import {
+  emitProcessCompleted,
+  emitProcessOutput,
+  emitProcessStarted
+} from "@wrongstack/core";
 import { toErrorMessage } from "@wrongstack/core/utils/error";
 
 // src/_env.ts
@@ -439,9 +444,14 @@ import { expectDefined } from "@wrongstack/core";
 var SENSITIVE_FLAG_PATTERNS = [
   // --flag=value  or  --flag "value"  (value captured up to next space or comma)
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
-  // -f "value" style short flags
-  /(?<!\w)-t(?:\s+|\s*=\s*)[^\s,]+/,
-  /(?<!\w)-(?:p|password)(?:\s+|\s*=\s*)[^\s,]+/gi,
+  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
+  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // NOTE: synced with @wrongstack/core observability/redact-command.ts.
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
+  // Same token-start anchor; over-redaction is an accepted tradeoff for a
+  // redaction function. Synced with core copy.
+  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
@@ -459,8 +469,10 @@ function redactCommand(cmd) {
         const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
         return `${flag}[REDACTED]`;
       }
-      const flagEnd = match.match(/^--?[a-zA-Z][a-zA-Z0-9_-]*/)?.[0] ?? match;
-      return `${flagEnd}=**redacted**`;
+      if (match.startsWith("--")) {
+        return match;
+      }
+      return `${match.slice(0, 2)}[REDACTED]`;
     });
   }
   return result;
@@ -2002,12 +2014,30 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       resolve2(result);
     };
     const startedAt = Date.now();
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let telemetryCompleted = false;
+    let timedOut = false;
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });
     const resolved = resolveWin32Command(cmd);
     const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
     const spawnCmd = shim?.command ?? resolved;
     const spawnArgs = shim?.args ?? args;
+    const emitCompletedOnce = (exitCode, pid2, signal2) => {
+      if (telemetryCompleted) return;
+      telemetryCompleted = true;
+      emitProcessCompleted({
+        ...pid2 !== void 0 ? { pid: pid2 } : {},
+        exitCode,
+        ...signal2 ? { signal: signal2 } : {},
+        durationMs: Date.now() - startedAt,
+        stdoutBytes,
+        stderrBytes,
+        timedOut,
+        endedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    };
     let child;
     try {
       child = spawn2(spawnCmd, spawnArgs, {
@@ -2020,6 +2050,15 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       });
     } catch (err) {
       spool.finalize();
+      emitProcessStarted({
+        parentPid: process.pid,
+        command: redactCommand(`${cmd} ${args.join(" ")}`),
+        args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+        cwd,
+        background: false,
+        startedAt: new Date(startedAt).toISOString()
+      });
+      emitCompletedOnce(1, void 0);
       finish({
         command: cmd,
         args,
@@ -2032,6 +2071,15 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       });
       return;
     }
+    emitProcessStarted({
+      ...child.pid !== void 0 ? { pid: child.pid } : {},
+      parentPid: process.pid,
+      command: redactCommand(`${cmd} ${args.join(" ")}`),
+      args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+      cwd,
+      background: false,
+      startedAt: new Date(startedAt).toISOString()
+    });
     child.on("error", (err) => {
       const isAbort = err && err.code === "ABORT_ERR";
       const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
@@ -2040,6 +2088,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, true);
       spool.finalize();
+      emitCompletedOnce(isAbort ? 124 : 1, child.pid, isAbort ? "ABORT" : void 0);
       finish({
         command: cmd,
         args,
@@ -2059,6 +2108,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     }
     const timer = setTimeout(() => {
       killed = true;
+      timedOut = true;
       if (typeof pid === "number") registry.kill(pid);
       else child.kill("SIGTERM");
     }, timeout);
@@ -2073,11 +2123,15 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     }
     child.stdout?.on("data", (chunk) => {
       const text = chunk.toString();
+      stdoutBytes += chunk.byteLength;
+      emitProcessOutput({ pid, stream: "stdout", chunk });
       if (stdout.length < MAX_OUTPUT) stdout += text;
       spool.write(text);
     });
     child.stderr?.on("data", (chunk) => {
       const text = chunk.toString();
+      stderrBytes += chunk.byteLength;
+      emitProcessOutput({ pid, stream: "stderr", chunk });
       if (stderr.length < MAX_OUTPUT) stderr += text;
       spool.write(text);
     });
@@ -2087,6 +2141,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       if (typeof pid === "number") registry.unregister(pid);
       const durationMs = Date.now() - startedAt;
       const exitCode = killed ? 124 : code ?? 1;
+      emitCompletedOnce(exitCode, pid);
       registry.afterCall(durationMs, exitCode !== 0);
       const spooled = spool.finalize();
       finish({