@wrongstack/tools 0.309.0 → 0.310.0

package/dist/install.js

@@ -145,12 +145,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -381,7 +381,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/json.js

@@ -3,130 +3,11 @@ import * as fs from "node:fs/promises";
 import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
 
 // src/_regex.ts
-var MAX_PATTERN_LEN = 256;
-var DANGEROUS_PATTERNS = [
-  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
-  // Adjacent quantifiers: a++ a*+
-  /[+*]{2,}/,
-  // Quantifier on alternation with length 2+
-  /\([^|)]+\|[^)]+\)[+*][+*]/,
-  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
-  /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
-];
-function hasAmbiguousQuantifiedAlternation(pattern) {
-  for (let i = 0; i < pattern.length; i++) {
-    if (pattern[i] !== "(") continue;
-    if (i > 0 && pattern[i - 1] === "\\") continue;
-    let depth = 0;
-    let inClass = false;
-    let j = i;
-    for (; j < pattern.length; j++) {
-      const ch = pattern[j];
-      if (ch === "\\") {
-        j++;
-        continue;
-      }
-      if (inClass) {
-        if (ch === "]") inClass = false;
-        continue;
-      }
-      if (ch === "[") {
-        inClass = true;
-        continue;
-      }
-      if (ch === "(") depth++;
-      else if (ch === ")") {
-        depth--;
-        if (depth === 0) break;
-      }
-    }
-    if (j >= pattern.length) return false;
-    const next = pattern[j + 1];
-    if (next !== "+" && next !== "*" && next !== "{") continue;
-    let inner = pattern.slice(i + 1, j);
-    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
-    const branches = [];
-    let current = "";
-    let d = 0;
-    let cls = false;
-    for (let k = 0; k < inner.length; k++) {
-      const ch = inner[k];
-      if (ch === "\\") {
-        current += ch + (inner[k + 1] ?? "");
-        k++;
-        continue;
-      }
-      if (cls) {
-        if (ch === "]") cls = false;
-        current += ch;
-        continue;
-      }
-      if (ch === "[") {
-        cls = true;
-        current += ch;
-        continue;
-      }
-      if (ch === "(") d++;
-      if (ch === ")") d--;
-      if (ch === "|" && d === 0) {
-        branches.push(current);
-        current = "";
-        continue;
-      }
-      current += ch;
-    }
-    branches.push(current);
-    if (branches.length < 2) continue;
-    for (let a = 0; a < branches.length; a++) {
-      for (let b = a + 1; b < branches.length; b++) {
-        const x = branches[a];
-        const y = branches[b];
-        if (x === "" || y === "") return true;
-        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
-      }
-    }
-  }
-  return false;
-}
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  if (hasAmbiguousQuantifiedAlternation(pattern)) {
-    return {
-      ok: false,
-      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
-    };
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-var MAX_SUBJECT_LEN = 64 * 1024;
-function capSubject(line) {
-  return line.length > MAX_SUBJECT_LEN ? line.slice(0, MAX_SUBJECT_LEN) : line;
-}
+import {
+  capSubject,
+  compileUserRegex,
+  MAX_SUBJECT_LEN
+} from "@wrongstack/primitives";
 
 // src/_util.ts
 import * as fsp from "node:fs/promises";

package/dist/kanban.js

@@ -201,10 +201,112 @@ function taskFileToSerializedGraph(tasks, sessionId) {
   };
 }
 
+// src/session-kanban-sync.ts
+import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
+import { mutatePlan, mutateTasks } from "@wrongstack/core/storage";
+import { formatTodosForModel, resolveWstackPaths } from "@wrongstack/core/utils";
+import {
+  getDependencyReadinessIssues
+} from "@wrongstack/kanban";
+function sourceStatus(task) {
+  if (task.status === "completed") return "completed";
+  if (task.status === "in_progress") return "in_progress";
+  if (task.status === "review") return "review";
+  if (task.status === "blocked") return "blocked";
+  if (task.status === "failed") return "failed";
+  return "pending";
+}
+function todoStatus(task) {
+  const status = sourceStatus(task);
+  if (status === "completed") return "completed";
+  if (status === "review" && task.assignment?.status === "completed") return "completed";
+  if (status === "in_progress" || status === "review") return "in_progress";
+  return "pending";
+}
+async function applySessionKanbanTaskToSource(context, task, suppressedTodoMirrors2, options = {}) {
+  const originId = task.origin?.taskId;
+  const graphId = task.origin?.graphId ?? "";
+  const isTodoOrigin = task.origin?.system === "session-todo" || graphId.startsWith("todo:");
+  const targetTodo = context.todos?.find(
+    (todo) => originId !== void 0 && todo.id === originId || todo.kanbanTaskId === task.id || todo.id === task.id && !todo.promotedFromPlan && !todo.promotedFromTask
+  );
+  if (isTodoOrigin || targetTodo) {
+    const matchedId = targetTodo?.id ?? originId;
+    if (matchedId) {
+      const mappedStatus = todoStatus(task);
+      const next = options.remove ? context.todos.filter((todo) => todo.id !== matchedId) : context.todos.map(
+        (todo) => todo.id === matchedId ? {
+          ...todo,
+          content: task.title,
+          status: mappedStatus,
+          kanbanTaskId: task.id
+        } : todo
+      );
+      suppressedTodoMirrors2.add(context);
+      try {
+        context.state.replaceTodos(next);
+      } finally {
+        suppressedTodoMirrors2.delete(context);
+      }
+      return { source: "todo", todos: [...context.todos] };
+    }
+  }
+  if (!originId) return { source: null };
+  const id = context.session?.id ?? "";
+  if (task.origin?.system === "session-plan" || graphId.startsWith("plan:")) {
+    const planPath = context.meta["plan.path"];
+    if (typeof planPath !== "string" || !planPath) {
+      throw new Error(
+        "Cannot reflect this Kanban edit back to its plan source: the session has no plan.path configured. The board mutation already succeeded; the plan file is now out of sync."
+      );
+    }
+    const plan = await mutatePlan(planPath, id, (file) => ({
+      ...file,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      items: options.remove ? file.items.filter((item) => item.id !== originId) : file.items.map(
+        (item) => item.id === originId ? {
+          ...item,
+          title: task.title,
+          details: task.description,
+          status: task.status === "completed" ? "done" : task.status === "in_progress" || task.status === "review" ? "in_progress" : "open",
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        } : item
+      )
+    }));
+    return { source: "plan", plan };
+  }
+  if (task.origin?.system === "session-task" || task.origin?.system === "session" || graphId.startsWith("session:")) {
+    const taskPath = context.meta["task.path"];
+    if (typeof taskPath !== "string" || !taskPath) {
+      throw new Error(
+        "Cannot reflect this Kanban edit back to its task source: the session has no task.path configured. The board mutation already succeeded; the task file is now out of sync."
+      );
+    }
+    const tasks = await mutateTasks(taskPath, id, (file) => ({
+      ...file,
+      tasks: options.remove ? file.tasks.filter((item) => item.id !== originId) : file.tasks.map(
+        (item) => item.id === originId ? {
+          ...item,
+          title: task.title,
+          description: task.description,
+          status: sourceStatus(task),
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        } : item
+      )
+    }));
+    return { source: "task", tasks };
+  }
+  return { source: null };
+}
+
 // src/session-kanban.ts
 var SESSION_KANBAN_COLUMNS = DEFAULT_COLUMNS.map((column) => ({
   ...column
 }));
+var suppressedTodoMirrors = /* @__PURE__ */ new WeakSet();
+function applySessionKanbanTaskToSource2(context, task, options = {}) {
+  return applySessionKanbanTaskToSource(context, task, suppressedTodoMirrors, options);
+}
 
 // src/kanban-board-actions.ts
 async function handleKanbanBoardAction(projectRoot, input, ctx) {
@@ -1027,12 +1129,20 @@ function assignmentForTaskCreate(input) {
 }
 
 // src/kanban-lifecycle-actions.ts
+async function syncContextTask(ctx, task, options = {}) {
+  if (!ctx?.state || !task) return;
+  try {
+    await applySessionKanbanTaskToSource2(ctx, task, options);
+  } catch {
+  }
+}
 async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
   switch (input.action) {
     case "add_task": {
       if (!input.boardId || !input.title) return fail("add_task requires boardId and title.");
       const result = await addTask2(projectRoot, input.boardId, taskInput(input));
       if (!result) return fail("Board not found.");
+      await syncContextTask(ctx, result.task);
       return okTask(result.board, result.task, `Task added.${atomicityNudge(result.task)}`);
     }
     case "split_task": {
@@ -1177,6 +1287,7 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
         );
       }
       ctx.setCurrentKanbanTask(task.id, board.id);
+      await syncContextTask(ctx, task);
       return okTask(
         board,
         task,
@@ -1186,6 +1297,9 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
     case "update_task": {
       if (!input.boardId || !input.taskId) return fail("update_task requires boardId and taskId.");
       const board = await updateTask2(projectRoot, input.boardId, input.taskId, taskPatch(input));
+      if (board) {
+        await syncContextTask(ctx, board.tasks.find((t) => t.id === input.taskId));
+      }
       return board ? okBoard(board, "Task updated.") : fail("Task not found.");
     }
     case "transition_task": {
@@ -1225,6 +1339,9 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
       if (result && input.lifecycleStage === "done" && result.task.verificationReport) {
         recordKanbanVerificationEvidence(ctx, result.task.verificationReport);
       }
+      if (result?.task) {
+        await syncContextTask(ctx, result.task);
+      }
       return result ? okTask(result.board, result.task, `Task advanced to ${result.transition.to}.`) : fail("Board or task not found.");
     }
     case "repair_managed_projection": {
@@ -1237,6 +1354,9 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
         actor: input.author,
         comment: input.transitionComment
       });
+      if (result?.task) {
+        await syncContextTask(ctx, result.task);
+      }
       return result ? okTask(
         result.board,
         result.task,
@@ -1254,14 +1374,22 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
         input.targetColumnId,
         input.order
       );
+      if (board) {
+        await syncContextTask(ctx, board.tasks.find((t) => t.id === input.taskId));
+      }
       return board ? okBoard(board, "Task moved.") : fail("Move failed.");
     }
     case "delete_task": {
       if (!input.boardId || !input.taskId) return fail("delete_task requires boardId and taskId.");
+      const boardBefore = await getBoard4(projectRoot, input.boardId);
+      const taskToDelete = boardBefore?.tasks.find((t) => t.id === input.taskId);
       const board = await removeTask(projectRoot, input.boardId, input.taskId);
       if (board && ctx.currentKanbanTaskId === input.taskId) {
         ctx.setCurrentKanbanTask?.(void 0, ctx.currentKanbanBoardId);
       }
+      if (board && taskToDelete) {
+        await syncContextTask(ctx, taskToDelete, { remove: true });
+      }
       return board ? okBoard(board, "Task deleted.") : fail("Task not found.");
     }
     case "set_chain": {
@@ -1368,6 +1496,7 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
             issues: finalized.gate.issues.map((issue) => issue.message)
           };
           const gateMessage = finalized.gate.allowed ? `Completion gate ${finalized.gate.verdict === "skipped" ? "passed" : "passed"}; task completed.` : finalized.gate.enforcement === "strict" ? `Completion gate BLOCKED (verdict: ${finalized.gate.verdict}); task parked in review. Issues: ${gateSummary.issues.join(" | ")}` : `Completion gate failed softly (verdict: ${finalized.gate.verdict}); task completed with warnings. Issues: ${gateSummary.issues.join(" | ")}`;
+          await syncContextTask(ctx, finalized.task);
           return {
             ...okTask(finalized.board, finalized.task, `Assignment updated. ${gateMessage}`),
             gate: gateSummary
@@ -1473,6 +1602,7 @@ async function handleKanbanLifecycleAction(projectRoot, input, ctx) {
           msgParts.push(`Card advanced to ${transitionResult.transition.to}.`);
         }
         for (const w of lifecycleWarnings) msgParts.push(`Warning: ${w}`);
+        await syncContextTask(ctx, responseTask);
         return okTask(responseBoard, responseTask, msgParts.join(" "));
       }
       return okBoard(board, "Assignment updated.");

package/dist/languages/index.js

@@ -2266,12 +2266,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -2502,7 +2502,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/lint.js

@@ -138,12 +138,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -374,7 +374,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/logs.js

@@ -3,127 +3,11 @@ import { spawn } from "node:child_process";
 import { buildChildEnv } from "@wrongstack/core/utils";
 
 // src/_regex.ts
-var MAX_PATTERN_LEN = 256;
-var DANGEROUS_PATTERNS = [
-  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
-  // Adjacent quantifiers: a++ a*+
-  /[+*]{2,}/,
-  // Quantifier on alternation with length 2+
-  /\([^|)]+\|[^)]+\)[+*][+*]/,
-  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
-  /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
-];
-function hasAmbiguousQuantifiedAlternation(pattern) {
-  for (let i = 0; i < pattern.length; i++) {
-    if (pattern[i] !== "(") continue;
-    if (i > 0 && pattern[i - 1] === "\\") continue;
-    let depth = 0;
-    let inClass = false;
-    let j = i;
-    for (; j < pattern.length; j++) {
-      const ch = pattern[j];
-      if (ch === "\\") {
-        j++;
-        continue;
-      }
-      if (inClass) {
-        if (ch === "]") inClass = false;
-        continue;
-      }
-      if (ch === "[") {
-        inClass = true;
-        continue;
-      }
-      if (ch === "(") depth++;
-      else if (ch === ")") {
-        depth--;
-        if (depth === 0) break;
-      }
-    }
-    if (j >= pattern.length) return false;
-    const next = pattern[j + 1];
-    if (next !== "+" && next !== "*" && next !== "{") continue;
-    let inner = pattern.slice(i + 1, j);
-    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
-    const branches = [];
-    let current = "";
-    let d = 0;
-    let cls = false;
-    for (let k = 0; k < inner.length; k++) {
-      const ch = inner[k];
-      if (ch === "\\") {
-        current += ch + (inner[k + 1] ?? "");
-        k++;
-        continue;
-      }
-      if (cls) {
-        if (ch === "]") cls = false;
-        current += ch;
-        continue;
-      }
-      if (ch === "[") {
-        cls = true;
-        current += ch;
-        continue;
-      }
-      if (ch === "(") d++;
-      if (ch === ")") d--;
-      if (ch === "|" && d === 0) {
-        branches.push(current);
-        current = "";
-        continue;
-      }
-      current += ch;
-    }
-    branches.push(current);
-    if (branches.length < 2) continue;
-    for (let a = 0; a < branches.length; a++) {
-      for (let b = a + 1; b < branches.length; b++) {
-        const x = branches[a];
-        const y = branches[b];
-        if (x === "" || y === "") return true;
-        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
-      }
-    }
-  }
-  return false;
-}
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  if (hasAmbiguousQuantifiedAlternation(pattern)) {
-    return {
-      ok: false,
-      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
-    };
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-var MAX_SUBJECT_LEN = 64 * 1024;
+import {
+  capSubject,
+  compileUserRegex,
+  MAX_SUBJECT_LEN
+} from "@wrongstack/primitives";
 
 // src/_util.ts
 import * as fsp from "node:fs/promises";

package/dist/outdated.js

@@ -219,7 +219,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -240,7 +240,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -2759,7 +2759,7 @@ var init_redact_command = __esm({
       // redaction function. Synced with core copy.
       /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
       // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
       // every such flag in the command line is redacted, not just the first.