@wrongstack/tools 0.309.1 → 0.310.0

package/dist/exec.js

@@ -13,8 +13,8 @@ var argMatches = (args, re) => args.some((a) => re.test(a));
 var hasShortFlags = (args, letters) => {
   const seen = /* @__PURE__ */ new Set();
   for (const a of args) {
-    if (!a.startsWith("-") || a.startsWith("--")) continue;
-    for (const ch of a.replace(/^-+/, "")) seen.add(ch);
+    if (!/^-[a-zA-Z]+$/.test(a)) continue;
+    for (const ch of a.slice(1)) seen.add(ch);
   }
   return letters.split("").every((l) => seen.has(l));
 };
@@ -367,7 +367,9 @@ function detectDanger(cmd, args, bypass) {
     if (bypass?.has(rule.id)) continue;
     if (!rule.test(cmd, args)) continue;
     reasons.push(rule.reason);
-    matchedRule = rule.id;
+    if (matchedRule === void 0 || levelRank(rule.level) >= levelRank(level)) {
+      matchedRule = rule.id;
+    }
     if (levelRank(rule.level) > levelRank(level)) {
       level = rule.level;
     }

package/dist/grep.js

@@ -28,130 +28,11 @@ async function mapWithConcurrency(items, limit, fn) {
 }
 
 // src/_regex.ts
-var MAX_PATTERN_LEN = 256;
-var DANGEROUS_PATTERNS = [
-  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
-  // Adjacent quantifiers: a++ a*+
-  /[+*]{2,}/,
-  // Quantifier on alternation with length 2+
-  /\([^|)]+\|[^)]+\)[+*][+*]/,
-  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
-  /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
-];
-function hasAmbiguousQuantifiedAlternation(pattern) {
-  for (let i = 0; i < pattern.length; i++) {
-    if (pattern[i] !== "(") continue;
-    if (i > 0 && pattern[i - 1] === "\\") continue;
-    let depth = 0;
-    let inClass = false;
-    let j = i;
-    for (; j < pattern.length; j++) {
-      const ch = pattern[j];
-      if (ch === "\\") {
-        j++;
-        continue;
-      }
-      if (inClass) {
-        if (ch === "]") inClass = false;
-        continue;
-      }
-      if (ch === "[") {
-        inClass = true;
-        continue;
-      }
-      if (ch === "(") depth++;
-      else if (ch === ")") {
-        depth--;
-        if (depth === 0) break;
-      }
-    }
-    if (j >= pattern.length) return false;
-    const next = pattern[j + 1];
-    if (next !== "+" && next !== "*" && next !== "{") continue;
-    let inner = pattern.slice(i + 1, j);
-    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
-    const branches = [];
-    let current = "";
-    let d = 0;
-    let cls = false;
-    for (let k = 0; k < inner.length; k++) {
-      const ch = inner[k];
-      if (ch === "\\") {
-        current += ch + (inner[k + 1] ?? "");
-        k++;
-        continue;
-      }
-      if (cls) {
-        if (ch === "]") cls = false;
-        current += ch;
-        continue;
-      }
-      if (ch === "[") {
-        cls = true;
-        current += ch;
-        continue;
-      }
-      if (ch === "(") d++;
-      if (ch === ")") d--;
-      if (ch === "|" && d === 0) {
-        branches.push(current);
-        current = "";
-        continue;
-      }
-      current += ch;
-    }
-    branches.push(current);
-    if (branches.length < 2) continue;
-    for (let a = 0; a < branches.length; a++) {
-      for (let b = a + 1; b < branches.length; b++) {
-        const x = branches[a];
-        const y = branches[b];
-        if (x === "" || y === "") return true;
-        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
-      }
-    }
-  }
-  return false;
-}
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  if (hasAmbiguousQuantifiedAlternation(pattern)) {
-    return {
-      ok: false,
-      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
-    };
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-var MAX_SUBJECT_LEN = 64 * 1024;
-function capSubject(line) {
-  return line.length > MAX_SUBJECT_LEN ? line.slice(0, MAX_SUBJECT_LEN) : line;
-}
+import {
+  capSubject,
+  compileUserRegex,
+  MAX_SUBJECT_LEN
+} from "@wrongstack/primitives";
 
 // src/_util.ts
 import * as fsp from "node:fs/promises";