@wrongstack/tools 0.309.0 → 0.310.0

package/dist/tree.js

@@ -1,7 +1,7 @@
 // src/tree.ts
 import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
-import { DEFAULT_WALK_IGNORE_DIRS, expectDefined } from "@wrongstack/core/utils";
+import { DEFAULT_WALK_IGNORE_DIRS, compileGlob, expectDefined } from "@wrongstack/core/utils";
 
 // src/_util.ts
 import * as fsp from "node:fs/promises";
@@ -143,7 +143,7 @@ var treeTool = {
     const showDirs = input.show_dirs ?? true;
     const showHidden = input.show_hidden ?? false;
     const exclude = /* @__PURE__ */ new Set([...DEFAULT_IGNORE, ...input.exclude ?? []]);
-    const filterGlob = input.glob;
+    const globRe = input.glob ? compileGlob(input.glob) : void 0;
     const maxEntries = input.max_entries ?? DEFAULT_MAX_ENTRIES;
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
     const lines = [basePath];
@@ -175,7 +175,8 @@ var treeTool = {
       showFiles,
       showDirs,
       showHidden,
-      filterGlob,
+      globRe,
+      basePath,
       lines,
       prefix: "",
       isLast: true,
@@ -222,6 +223,12 @@ var treeTool = {
     };
   }
 };
+function matchesTreeGlob(globRe, fileName, absPath, basePath) {
+  if (globRe.test(fileName)) return true;
+  const rel = path2.relative(basePath, absPath);
+  const posixRel = !rel || rel.startsWith("..") || path2.isAbsolute(rel) ? absPath.split(path2.sep).join("/") : rel.split(path2.sep).join("/");
+  return globRe.test(posixRel);
+}
 async function walkDir(dir, depth, opts) {
   opts.signal.throwIfAborted();
   if (opts.retention.truncated) return;
@@ -229,6 +236,10 @@ async function walkDir(dir, depth, opts) {
   const filtered = entries.filter((e) => {
     if (!opts.showHidden && e.name.startsWith(".")) return false;
     if (opts.exclude.has(e.name)) return false;
+    if (e.isFile() && opts.globRe) {
+      const abs = path2.join(dir, e.name);
+      if (!matchesTreeGlob(opts.globRe, e.name, abs, opts.basePath)) return false;
+    }
     return true;
   });
   let dirCount = 0;

package/dist/typecheck.js

@@ -141,12 +141,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -377,7 +377,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/win32.js

@@ -27,21 +27,21 @@ function resolvePowerShell(cmd) {
   if (lower !== "pwsh" && lower !== "powershell" && lower !== "pwsh.exe" && lower !== "powershell.exe") {
     return resolveWin32Command(cmd);
   }
-  const primary = lower.startsWith("pwsh") ? "pwsh.exe" : "powershell.exe";
-  const fallback = lower.startsWith("pwsh") ? "powershell.exe" : "pwsh.exe";
+  const primary = lower.startsWith("pwsh") ? "pwsh" : "powershell";
+  const fallback = lower.startsWith("pwsh") ? "powershell" : "pwsh";
   const resolved = resolveWin32Command(primary);
-  if (resolved !== primary) {
+  if (resolved === primary) {
     const fb = resolveWin32Command(fallback);
     return fb === fallback ? cmd : fb;
   }
   return resolved;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }