@zaly/agent 0.0.3

package/dist/tools-DW1dbcCz.mjs

@@ -0,0 +1,695 @@
+import { safeStringify } from "@zaly/shared";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+//#region ../../node_modules/.bun/shell-quote@1.9.0/node_modules/shell-quote/quote.js
+var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/** @import { ControlOperator } from './parse' */
+	/** @type {ControlOperator['op'][]} */
+	var OPS = [
+		"||",
+		"&&",
+		";;",
+		"|&",
+		"<(",
+		"<<<",
+		">>",
+		">&",
+		"<&",
+		"&",
+		";",
+		"(",
+		")",
+		"|",
+		"<",
+		">"
+	];
+	var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+	var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+	/** @type {import('./quote')} */
+	module.exports = function quote(xs) {
+		return xs.map(function(s) {
+			if (s === "") return "''";
+			if (s && typeof s === "object") {
+				if ("op" in s && s.op === "glob") {
+					if (typeof s.pattern !== "string") throw new TypeError("glob token requires a string `pattern`");
+					if (LINE_TERMINATORS.test(s.pattern)) throw new TypeError("glob `pattern` must not contain line terminators");
+					return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
+				}
+				if ("op" in s && typeof s.op === "string") {
+					if (OPS.indexOf(s.op) < 0) throw new TypeError("invalid `op` value: " + JSON.stringify(s.op));
+					return s.op.replace(/[\s\S]/g, "\\$&");
+				}
+				if ("comment" in s && typeof s.comment === "string") {
+					if (LINE_TERMINATORS.test(s.comment)) throw new TypeError("`comment` must not contain line terminators");
+					return "#" + s.comment;
+				}
+				throw new TypeError("unrecognized object token shape");
+			}
+			if (/["\s\\]/.test(s) && !/'/.test(s)) return "'" + s.replace(/(['])/g, "\\$1") + "'";
+			if (/["'\s]/.test(s)) return "\"" + s.replace(/(["\\$`!])/g, "\\$1") + "\"";
+			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
+		}).join(" ");
+	};
+}));
+//#endregion
+//#region ../../node_modules/.bun/shell-quote@1.9.0/node_modules/shell-quote/parse.js
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* @import {
+	* 	ControlOperator,
+	* 	Env,
+	* 	GlobPattern,
+	* 	ParseEntry,
+	* } from './parse' */
+	var CONTROL = "(?:" + [
+		"\\|\\|",
+		"\\&\\&",
+		";;",
+		"\\|\\&",
+		"\\<\\(",
+		"\\<\\<\\<",
+		">>",
+		">\\&",
+		"<\\&",
+		"[&;()|<>]"
+	].join("|") + ")";
+	var controlRE = new RegExp("^" + CONTROL + "$");
+	var META = "|&;()<> \\t";
+	var SINGLE_QUOTE = "\"((\\\\\"|[^\"])*?)\"";
+	var DOUBLE_QUOTE = "'((\\\\'|[^'])*?)'";
+	var hash = /^#$/;
+	var SQ = "'";
+	var DQ = "\"";
+	var DS = "$";
+	var TOKEN = "";
+	var mult = 4294967296;
+	for (var i = 0; i < 4; i++) TOKEN += (mult * Math.random()).toString(16);
+	var startsWithToken = new RegExp("^" + TOKEN);
+	/**
+	* @param {string} s
+	* @param {RegExp} r
+	*/
+	function matchAll(s, r) {
+		var origIndex = r.lastIndex;
+		var matches = [];
+		var matchObj;
+		while (matchObj = r.exec(s)) {
+			matches[matches.length] = matchObj;
+			if (r.lastIndex === matchObj.index) r.lastIndex += 1;
+		}
+		r.lastIndex = origIndex;
+		return matches;
+	}
+	/**
+	* @param {Env} env
+	* @param {string} pre
+	* @param {string} key
+	*/
+	function getVar(env, pre, key) {
+		var r = typeof env === "function" ? env(key) : env[key];
+		if (typeof r === "undefined" && key != "") r = "";
+		else if (typeof r === "undefined") r = "$";
+		if (typeof r === "object") return pre + TOKEN + JSON.stringify(r) + TOKEN;
+		return pre + r;
+	}
+	/**
+	* @param {string} string
+	* @param {Env} [env]
+	* @param {{ escape?: string }} [opts]
+	* @returns {ParseEntry[]}
+	*/
+	function parseInternal(string, env, opts) {
+		if (!opts) opts = {};
+		var BS = opts.escape || "\\";
+		var BAREWORD = "(\\" + BS + "['\"" + META + "]|[^\\s'\"" + META + "])+";
+		var matches = matchAll(string, new RegExp(["(" + CONTROL + ")", "(" + BAREWORD + "|" + SINGLE_QUOTE + "|" + DOUBLE_QUOTE + ")+"].join("|"), "g"));
+		if (matches.length === 0) return [];
+		if (!env) env = {};
+		var commented = false;
+		return matches.map(function(match) {
+			var s = match[0];
+			if (!s || commented) return;
+			if (controlRE.test(s)) return { op: s };
+			/** @type {string | boolean} */
+			var quote = false;
+			var esc = false;
+			var out = "";
+			var isGlob = false;
+			/** @type {number} */
+			var i;
+			function parseEnvVar() {
+				i += 1;
+				/** @type {number | RegExpMatchArray | null} */
+				var varend;
+				/** @type {string} */
+				var varname;
+				var char = s.charAt(i);
+				if (char === "{") {
+					i += 1;
+					if (s.charAt(i) === "}") throw new Error("Bad substitution: " + s.slice(i - 2, i + 1));
+					varend = s.indexOf("}", i);
+					if (varend < 0) throw new Error("Bad substitution: " + s.slice(i));
+					varname = s.slice(i, varend);
+					i = varend;
+				} else if (/[*@#?$!_-]/.test(char)) {
+					varname = char;
+					i += 1;
+				} else {
+					var slicedFromI = s.slice(i);
+					varend = slicedFromI.match(/[^\w\d_]/);
+					if (!varend) {
+						varname = slicedFromI;
+						i = s.length;
+					} else {
+						varname = slicedFromI.slice(0, varend.index);
+						i += varend.index - 1;
+					}
+				}
+				return getVar(env, "", varname);
+			}
+			for (i = 0; i < s.length; i++) {
+				var c = s.charAt(i);
+				isGlob = isGlob || !quote && (c === "*" || c === "?");
+				if (esc) {
+					out += c;
+					esc = false;
+				} else if (quote) if (c === quote) quote = false;
+				else if (quote == SQ) out += c;
+				else if (c === BS) {
+					i += 1;
+					c = s.charAt(i);
+					if (c === DQ || c === BS || c === DS) out += c;
+					else out += BS + c;
+				} else if (c === DS) out += parseEnvVar();
+				else out += c;
+				else if (c === DQ || c === SQ) quote = c;
+				else if (controlRE.test(c)) return { op: s };
+				else if (hash.test(c)) {
+					commented = true;
+					var commentObj = { comment: string.slice(match.index + i + 1) };
+					if (out.length) return [out, commentObj];
+					return [commentObj];
+				} else if (c === BS) esc = true;
+				else if (c === DS) out += parseEnvVar();
+				else out += c;
+			}
+			if (isGlob) return {
+				op: "glob",
+				pattern: out
+			};
+			return out;
+		}).reduce(function(prev, arg) {
+			if (typeof arg === "undefined") return prev;
+			/** @type {ParseEntry[]} */ [].concat(arg).forEach(function(entry) {
+				prev[prev.length] = entry;
+			});
+			return prev;
+		}, []);
+	}
+	/** @type {import('./parse')} */
+	module.exports = function parse(s, env, opts) {
+		var mapped = parseInternal(s, env, opts);
+		if (typeof env !== "function") return mapped;
+		return mapped.reduce(function(acc, s) {
+			if (typeof s === "object") {
+				acc[acc.length] = s;
+				return acc;
+			}
+			var xs = s.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
+			if (xs.length === 1) {
+				acc[acc.length] = xs[0];
+				return acc;
+			}
+			xs.filter(Boolean).forEach(function(x) {
+				acc[acc.length] = startsWithToken.test(x) ? JSON.parse(x.split(TOKEN)[1]) : x;
+			});
+			return acc;
+		}, []);
+	};
+}));
+//#endregion
+//#region src/utils/bash/parser.ts
+var import_shell_quote = (/* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.quote = require_quote();
+	exports.parse = require_parse();
+})))();
+/** Targets a redirect can write to without filesystem implications.
+*  Anything else is treated as a file write and goes through fileWrite
+*  policy. */
+const SAFE_REDIRECT_TARGETS = /* @__PURE__ */ new Set([
+	"/dev/null",
+	"/dev/stderr",
+	"/dev/stdout"
+]);
+/** A redirect target like `&1`, `&2`, `&-` — duplicates an existing fd,
+*  no filesystem effect. */
+function isFdRedirect(target) {
+	return /^&(?:\d+|-)$/.test(target);
+}
+const COMMAND_SEPS = /* @__PURE__ */ new Set([
+	"|",
+	"&&",
+	"||",
+	";"
+]);
+const REDIRECT_OPS = /* @__PURE__ */ new Set([
+	">",
+	">>",
+	"<",
+	">&",
+	"<&"
+]);
+const DYN_SENTINEL = "";
+/** Parse a bash command line. Returns segments with a flag for
+*  unsupported constructs that force "ask" downstream. Heredocs,
+*  subshells, command substitution, and backticks all surface as
+*  `hasCommandSubst: true` (the umbrella "we can't reason about this"
+*  signal) rather than parse failures, so the policy can still decide. */
+function parseBash(input) {
+	if (/<<-?\s*['"]?\w+/.test(input)) return {
+		ok: false,
+		reason: "heredoc not supported"
+	};
+	const hasBackticks = hasUnquotedBacktick(input);
+	let rawTokens;
+	try {
+		rawTokens = (0, import_shell_quote.parse)(input, (e) => e === "" ? void 0 : `${DYN_SENTINEL}\${${e}}`);
+	} catch (error) {
+		return {
+			ok: false,
+			reason: `tokenize: ${error.message}`
+		};
+	}
+	const flat = flattenParens(rawTokens);
+	const hasCommandSubst = hasBackticks || flat.hasCommandSubst;
+	const segmentTokens = [[]];
+	for (const t of flat.tokens) {
+		if (typeof t === "object" && "comment" in t) continue;
+		if (typeof t === "object" && "op" in t && COMMAND_SEPS.has(t.op)) {
+			if (segmentTokens.at(-1).length > 0) segmentTokens.push([]);
+			continue;
+		}
+		segmentTokens.at(-1).push(t);
+	}
+	if (segmentTokens.at(-1).length === 0) segmentTokens.pop();
+	const segments = [];
+	for (const segToks of segmentTokens) {
+		const seg = parseSegment(segToks);
+		if (!seg.ok) return seg;
+		if (seg.segment) segments.push({
+			...seg.segment,
+			hasCommandSubst
+		});
+	}
+	if (segments.length === 0) return {
+		ok: false,
+		reason: "empty input"
+	};
+	return {
+		ok: true,
+		segments
+	};
+}
+function parseSegment(tokens) {
+	let args = [];
+	let reads = [];
+	let writes = [];
+	const dyn = /* @__PURE__ */ new Set();
+	for (let i = 0; i < tokens.length; i++) {
+		const t = tokens[i];
+		if (typeof t === "string") {
+			if (/^\d+$/.test(t)) {
+				const next = tokens[i + 1];
+				if (typeof next === "object" && "op" in next && REDIRECT_OPS.has(next.op)) continue;
+			}
+			args.push(t);
+			continue;
+		}
+		if ("comment" in t) continue;
+		if ("pattern" in t) {
+			args.push(t.pattern);
+			dyn.add(t.pattern);
+			continue;
+		}
+		if (!("op" in t)) return {
+			ok: false,
+			reason: `unsupported token: ${safeStringify(t)}`
+		};
+		if (REDIRECT_OPS.has(t.op)) {
+			const next = tokens[i + 1];
+			if (typeof next !== "string") return {
+				ok: false,
+				reason: `redirect target missing after ${t.op}`
+			};
+			i++;
+			if (t.op === ">" || t.op === ">>") {
+				if (SAFE_REDIRECT_TARGETS.has(next) || isFdRedirect(next)) continue;
+				writes.push({
+					mode: t.op === ">>" ? "append" : "trunc",
+					path: next
+				});
+			} else if (t.op === "<") {
+				if (SAFE_REDIRECT_TARGETS.has(next) || isFdRedirect(next)) continue;
+				reads.push(next);
+			}
+			continue;
+		}
+		return {
+			ok: false,
+			reason: `unsupported op: ${t.op}`
+		};
+	}
+	const dynPath = (p) => {
+		if (!p.includes(DYN_SENTINEL)) return p;
+		p = p.replaceAll(DYN_SENTINEL, "");
+		dyn.add(p);
+		return p;
+	};
+	args = args.map((a) => dynPath(a));
+	writes = writes.map((w) => ({
+		...w,
+		path: dynPath(w.path)
+	}));
+	reads = reads.map(dynPath);
+	const unwrapped = unwrapWrappers(args);
+	if (unwrapped.length === 0) return {
+		ok: true,
+		segment: void 0
+	};
+	return {
+		ok: true,
+		segment: {
+			args: unwrapped.slice(1),
+			cmd: unwrapped[0],
+			dyn,
+			reads,
+			writes
+		}
+	};
+}
+/** Commands that wrap another command — they're transparent for
+*  permission purposes, since the security-relevant action is whatever
+*  they run. `sudo` is intentionally absent: it changes the effective
+*  user and must always be flagged. */
+const WRAPPERS = {
+	command: {},
+	ionice: { valueFlags: /* @__PURE__ */ new Set([
+		"-c",
+		"-n",
+		"-p",
+		"-P",
+		"-u"
+	]) },
+	nice: { valueFlags: /* @__PURE__ */ new Set(["-n", "--adjustment"]) },
+	nohup: {},
+	time: {}
+};
+/** Detect backticks outside single-quoted regions. Single quotes in
+*  bash can't be escaped from within, so the toggle is a simple state
+*  flip on every `'`. Double quotes do not suppress backtick
+*  substitution and are ignored here. */
+function hasUnquotedBacktick(input) {
+	let inSingle = false;
+	for (const c of input) {
+		if (c === "'") {
+			inSingle = !inSingle;
+			continue;
+		}
+		if (c === "`" && !inSingle) return true;
+	}
+	return false;
+}
+/** Strip leading wrapper-command prefixes from an arg list. Repeats
+*  while the head is a wrapper (so `time nice -n 5 cmd` → `cmd`).
+*  Wrapper-flags (and their values, where applicable) are consumed
+*  along with the wrapper itself. */
+function unwrapWrappers(args) {
+	let current = args;
+	while (current.length > 0) {
+		const spec = WRAPPERS[current[0]];
+		if (!spec) break;
+		const valueFlags = spec.valueFlags ?? /* @__PURE__ */ new Set();
+		let i = 1;
+		while (i < current.length && current[i].startsWith("-")) {
+			const flag = current[i];
+			i++;
+			if (valueFlags.has(flag) && i < current.length) i++;
+		}
+		current = current.slice(i);
+	}
+	return current;
+}
+/** Walk a token list and resolve paren constructs:
+*  - Plain `(subshell)` → tokens inlined with `;` boundaries on each
+*    side, so the contents become independent segments evaluated by
+*    the same policy. The subshell's own scope (cwd changes etc.) is
+*    irrelevant to permissions — each command is checked individually.
+*  - `$(...)` (command substitution) → stripped entirely, with the
+*    `hasCommandSubst` flag raised. The dynamic value can't be
+*    statically reasoned about. Detected by the leading `$` token
+*    that shell-quote emits before the `(`.
+*
+*  Recurses into subshell contents to handle nesting and to catch
+*  `$(...)` constructs nested inside subshells. */
+function flattenParens(tokens) {
+	const out = [];
+	let hasCommandSubst = false;
+	let i = 0;
+	while (i < tokens.length) {
+		const t = tokens[i];
+		if (typeof t === "object" && "op" in t && t.op === "(") {
+			const isSubst = out.at(-1) === "$";
+			if (isSubst) out.pop();
+			let depth = 1;
+			let j = i + 1;
+			while (j < tokens.length && depth > 0) {
+				const tj = tokens[j];
+				if (typeof tj === "object" && "op" in tj) {
+					if (tj.op === "(") depth++;
+					else if (tj.op === ")") depth--;
+				}
+				if (depth > 0) j++;
+			}
+			const inner = tokens.slice(i + 1, j);
+			if (isSubst) hasCommandSubst = true;
+			else {
+				const sub = flattenParens(inner);
+				if (sub.hasCommandSubst) hasCommandSubst = true;
+				out.push({ op: ";" }, ...sub.tokens, { op: ";" });
+			}
+			i = j + 1;
+			continue;
+		}
+		if (typeof t === "object" && "op" in t && t.op === ")") {
+			i++;
+			continue;
+		}
+		out.push(t);
+		i++;
+	}
+	return {
+		hasCommandSubst,
+		tokens: out
+	};
+}
+//#endregion
+//#region src/utils/bash/tools.ts
+/** All bare positional args (no leading dash). Default for many
+*  read-only utilities. */
+function positionals(args) {
+	return args.filter((a) => !a.startsWith("-") && a !== "");
+}
+/** All positionals after the first one (e.g. `grep PATTERN file...`). */
+function positionalsAfterFirst(args) {
+	const out = [];
+	let seenFirst = false;
+	for (const a of args) {
+		if (a.startsWith("-") || a === "") continue;
+		if (!seenFirst) {
+			seenFirst = true;
+			continue;
+		}
+		out.push(a);
+	}
+	return out;
+}
+/** Flags whose value is the *next* arg, not part of the script. */
+const SED_VALUE_FLAGS = /* @__PURE__ */ new Set([
+	"-e",
+	"--expression",
+	"-f",
+	"--file"
+]);
+/** Walk sed args, returning [scripts, positionalsAfterScript]. The
+*  "script" is everything passed via `-e` plus the first bare arg
+*  (the implicit script when no `-e` is given). Positionals after
+*  that are input files. */
+function sedSplit(args) {
+	const scripts = [];
+	const files = [];
+	let needsImplicitScript = !args.some((a) => a === "-e" || a === "--expression" || a === "-f" || a === "--file");
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a.startsWith("-")) {
+			if (SED_VALUE_FLAGS.has(a) && i + 1 < args.length) {
+				if (a === "-e" || a === "--expression") scripts.push(args[i + 1]);
+				i++;
+			}
+			continue;
+		}
+		if (needsImplicitScript) {
+			scripts.push(a);
+			needsImplicitScript = false;
+			continue;
+		}
+		files.push(a);
+	}
+	return {
+		files,
+		scripts
+	};
+}
+const SED_INPLACE = /* @__PURE__ */ new Set(["-i", "--in-place"]);
+function sedReads(args) {
+	return sedSplit(args).files;
+}
+function sedWrites(args) {
+	return args.some((a) => SED_INPLACE.has(a) || a.startsWith("-i.")) ? sedSplit(args).files : [];
+}
+function sedUnsafe(args) {
+	for (const script of sedSplit(args).scripts) if (/(?:^|;|\n)\s*[wWrR]\s+\S/.test(script)) return true;
+	return false;
+}
+function awkReads(args) {
+	let sawScript = false;
+	let usingFFlag = false;
+	const files = [];
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a === "-f" || a === "--file") {
+			if (i + 1 < args.length) files.push(args[i + 1]);
+			i++;
+			sawScript = true;
+			usingFFlag = true;
+			continue;
+		}
+		if (a.startsWith("-")) {
+			if (a === "-v" || a === "-F") i++;
+			continue;
+		}
+		if (!sawScript) {
+			sawScript = true;
+			continue;
+		}
+		files.push(a);
+	}
+	return usingFFlag ? files : files;
+}
+function awkUnsafe(args) {
+	let sawScript = false;
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a === "-f" || a === "--file" || a === "-v" || a === "-F") {
+			i++;
+			continue;
+		}
+		if (a.startsWith("-")) continue;
+		if (!sawScript) {
+			sawScript = true;
+			if (/[>|]/.test(a)) return true;
+		}
+	}
+	return false;
+}
+function findReads(args) {
+	const out = [];
+	for (const a of args) {
+		if (a.startsWith("-")) break;
+		out.push(a);
+	}
+	return out.length > 0 ? out : ["."];
+}
+function findUnsafe(args) {
+	return args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir" || a === "-ok" || a === "-okdir");
+}
+const dynamicExec = () => true;
+const TOOLS = {
+	".": { unsafe: dynamicExec },
+	awk: {
+		reads: awkReads,
+		unsafe: awkUnsafe
+	},
+	basename: {},
+	cat: { reads: positionals },
+	cd: {},
+	cut: { reads: positionals },
+	diff: { reads: positionals },
+	dirname: {},
+	echo: {},
+	eval: { unsafe: dynamicExec },
+	exec: { unsafe: dynamicExec },
+	file: { reads: positionals },
+	find: {
+		reads: findReads,
+		unsafe: findUnsafe
+	},
+	grep: { reads: positionalsAfterFirst },
+	head: { reads: positionals },
+	hexdump: { reads: positionals },
+	less: { reads: positionals },
+	ls: { reads: positionals },
+	more: { reads: positionals },
+	od: { reads: positionals },
+	printf: {},
+	pwd: {},
+	readlink: { reads: positionals },
+	realpath: { reads: positionals },
+	rg: { reads: positionalsAfterFirst },
+	sed: {
+		reads: sedReads,
+		unsafe: sedUnsafe,
+		writes: sedWrites
+	},
+	sort: { reads: positionals },
+	source: { unsafe: dynamicExec },
+	stat: { reads: positionals },
+	tail: { reads: positionals },
+	tree: { reads: positionals },
+	uniq: { reads: positionals },
+	wc: { reads: positionals },
+	xxd: { reads: positionals }
+};
+//#endregion
+export { __toESM as a, __exportAll as i, parseBash as n, __commonJSMin as r, TOOLS as t };
+
+//# sourceMappingURL=tools-DW1dbcCz.mjs.map