@wrongstack/tools 0.309.0 → 0.310.0

package/dist/_regex.d.ts

@@ -1,39 +1,11 @@
 /**
  * Compile a user-supplied regex with conservative bounds against ReDoS.
  *
- * Node's regex engine (V8) is backtracking-based and cannot interrupt a
- * synchronous match — a pattern like `(a+)+$` against a sufficiently long
- * line will pin a worker for seconds. The executor's outer `timeoutMs` only
- * fires between async boundaries, so a long regex eval inside a sync loop
- * is uninterruptible.
- *
- * We can't fully prevent ReDoS without an alternative engine (re2-wasm), but
- * we can sharply limit the blast radius:
- *
- *  1. Cap pattern length — practically all legitimate user patterns are
- *     under 256 characters. A 4 KB pattern is almost certainly malicious
- *     or a copy-paste accident.
- *  2. Reject patterns containing the most obvious super-linear structures.
- *     This is a coarse filter (false-positives are likely; we accept that
- *     for hostile-input contexts).
- *
- * Callers should additionally bound the *subject* length (e.g. by capping
- * line size before matching).
- */
-export interface CompileResult {
-    ok: true;
-    regex: RegExp;
-}
-export interface CompileFail {
-    ok: false;
-    reason: string;
-}
-export declare function compileUserRegex(pattern: string, flags: string): CompileResult | CompileFail;
-/**
- * Truncate a subject line to a safe length for synchronous regex eval.
- * The cap is conservative; tools that need exact-line matching against very
- * long lines should use ripgrep externally rather than the native walker.
+ * Canonical home since card #5: `@wrongstack/primitives/src/regex-guard.ts`.
+ * This module is now a re-export shim kept for its four importers
+ * (grep.ts, json.ts, logs.ts, replace.ts); `tools/tests/regex-guard-parity.test.ts`
+ * still pins the three historical entry points to identical verdicts —
+ * now trivially true, because all three resolve to the same code path.
  */
-export declare const MAX_SUBJECT_LEN: number;
-export declare function capSubject(line: string): string;
+export { type CompileFail, type CompileResult, capSubject, compileUserRegex, MAX_SUBJECT_LEN, } from '@wrongstack/primitives';
 //# sourceMappingURL=_regex.d.ts.map

package/dist/audit.js

@@ -138,12 +138,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -374,7 +374,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/bash.js

@@ -405,7 +405,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.
@@ -1826,10 +1826,10 @@ function resolvePowerShell(cmd) {
   if (lower !== "pwsh" && lower !== "powershell" && lower !== "pwsh.exe" && lower !== "powershell.exe") {
     return resolveWin32Command(cmd);
   }
-  const primary = lower.startsWith("pwsh") ? "pwsh.exe" : "powershell.exe";
-  const fallback = lower.startsWith("pwsh") ? "powershell.exe" : "pwsh.exe";
+  const primary = lower.startsWith("pwsh") ? "pwsh" : "powershell";
+  const fallback = lower.startsWith("pwsh") ? "powershell" : "pwsh";
   const resolved = resolveWin32Command(primary);
-  if (resolved !== primary) {
+  if (resolved === primary) {
     const fb = resolveWin32Command(fallback);
     return fb === fallback ? cmd : fb;
   }