audit-tools 0.32.44 → 0.32.45

package/scripts/shared/install-host-assets.mjs

@@ -0,0 +1,188 @@
+// Shared postinstall driver for the audit-code and remediate-code host-asset
+// deployers (scripts/audit/postinstall.mjs, scripts/remediate/postinstall.mjs).
+//
+// This is a plain .mjs module: both postinstalls run at `npm install` time,
+// before `tsc` has produced dist/, so this file must never import from dist/
+// or from src/**/*.ts. It owns only the mechanical bits that are byte-identical
+// across the two tools (I/O primitives, the install-list loop, the OpenCode
+// global-config install wrapper, the Antigravity plugin block, and the final
+// summary line). Each tool keeps its own permission constants and OpenCode
+// config-merge functions locally — those differ in exact merge behavior
+// between audit-code and remediate-code and must not be forced into parity.
+import { dirname, join } from "node:path";
+import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+
+/**
+ * Read a source file that is required for the install to proceed at all
+ * (e.g. the prompt/skill markdown). Missing source is reported as a skip
+ * (exitCode reset to 0, not a failure) rather than thrown.
+ */
+export function readRequiredSource(path, label, toolName) {
+  if (!existsSync(path)) {
+    console.warn(`${toolName}: ${label} source not found at ${path} - skipping global command install`);
+    process.exitCode = 0;
+    return null;
+  }
+  return readFileSync(path);
+}
+
+/** Read a source file whose absence only skips one optional install step. */
+export function readOptionalSource(path, label, toolName) {
+  if (!existsSync(path)) {
+    console.warn(`${toolName}: ${label} source not found at ${path} - skipping optional install`);
+    return null;
+  }
+  return readFileSync(path);
+}
+
+/**
+ * Write a generated file, creating parent directories as needed.
+ * Returns "installed" on first write, "updated" on subsequent writes.
+ */
+export function writeGeneratedFile(path, content) {
+  const action = existsSync(path) ? "updated" : "installed";
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content);
+  return action;
+}
+
+/** Coerce an unknown value to a plain object (non-array). */
+export function objectValue(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+/** Strip YAML frontmatter from a text file, returning only the body. */
+export function splitFrontmatter(text) {
+  const normalized = text.replace(/\r\n/g, "\n");
+  const match = normalized.match(/^---\n[\s\S]*?\n---\n?/u);
+  return { body: match ? normalized.slice(match[0].length) : normalized };
+}
+
+/** Read-merge-write a JSON file. Returns "installed" or "updated". */
+export function installMergedJson(path, buildMerged) {
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : null;
+  const merged = buildMerged(existing);
+  const action = existing ? "updated" : "installed";
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(merged, null, 2) + "\n", "utf8");
+  return action;
+}
+
+/**
+ * The scoped OpenCode permission merge helpers are single-sourced in
+ * audit-tools/shared (global top-level scope vs. per-agent scope). Resolve
+ * them best-effort: on a fresh workspace checkout the shared dist may not be
+ * built yet, in which case the caller skips OpenCode config deployment with a
+ * warning instead of failing the whole install.
+ */
+export async function resolveSharedOpenCodePermissions() {
+  try {
+    const shared = await import("audit-tools/shared");
+    if (
+      typeof shared.mergeOpenCodeAgentPermissionRule === "function" &&
+      typeof shared.mergeOpenCodeGlobalPermissionRule === "function" &&
+      typeof shared.migrateOpenCodeGlobalExternalDirectory === "function" &&
+      typeof shared.withoutOpenCodeWildcard === "function"
+    ) {
+      return shared;
+    }
+  } catch {
+    // Leave null; the caller reports the skip.
+  }
+  return null;
+}
+
+/**
+ * Install a flat list of `{ label, path, sourcePath, content }` entries,
+ * logging one line per success and a manual-recovery block per failure.
+ * Mutates `counts.succeeded` / `counts.failed`.
+ */
+export function runInstalls(toolName, installs, counts) {
+  for (const install of installs) {
+    try {
+      const action = writeGeneratedFile(install.path, install.content);
+      console.log(`${toolName}: ${action} global ${install.label} at ${install.path}`);
+      counts.succeeded++;
+    } catch (err) {
+      console.warn(`${toolName}: could not install global ${install.label} (${err.message})`);
+      console.warn(`  To install manually, copy from:`);
+      console.warn(`    ${install.sourcePath}`);
+      console.warn(`  to:`);
+      console.warn(`    ${install.path}`);
+      counts.failed++;
+    }
+  }
+}
+
+/**
+ * Install the merged global OpenCode config, or report the skip when the
+ * shared permission helpers aren't built yet. Mutates `counts`.
+ *
+ * `label` names the artifact in log lines (e.g. "OpenCode config" for
+ * audit-code, "OpenCode command" for remediate-code — the two tools have
+ * historically worded this differently). `manualInstructions`, if given, is
+ * an array of extra warn lines printed on failure only.
+ */
+export function installOpenCodeGlobalConfig(
+  { toolName, path, sharedOpenCodePermissions, buildMerged, label, manualInstructions },
+  counts,
+) {
+  if (!sharedOpenCodePermissions) {
+    // Expected when audit-tools/shared isn't built yet — notably during `npm ci`
+    // in CI, where postinstall runs before the shared build step. This is a SKIP,
+    // not a failure: counting it would trip the `failed > 0` exit-1 guard. Genuine
+    // OpenCode write errors are still counted as failures.
+    console.warn(
+      `${toolName}: audit-tools/shared is unavailable (build the shared workspace first); skipping OpenCode config deployment`,
+    );
+    return;
+  }
+  try {
+    const action = installMergedJson(path, buildMerged);
+    console.log(`${toolName}: ${action} global ${label} in ${path}`);
+    counts.succeeded++;
+  } catch (err) {
+    console.warn(`${toolName}: could not install global ${label} (${err.message})`);
+    for (const line of manualInstructions ?? []) console.warn(line);
+    counts.failed++;
+  }
+}
+
+/**
+ * Install the Antigravity (Gemini IDE / Antigravity Hub) global plugin:
+ * a `plugin.json` manifest plus a copy of the tool's SKILL.md. Mutates
+ * `counts`; both writes count as a single succeeded/failed step, matching
+ * the tools' pre-extraction behavior.
+ */
+export function installAntigravityPlugin(
+  { toolName, homeDir, pluginName, pluginVersion, skillSource },
+  counts,
+) {
+  const antigravityPluginDir = join(homeDir, ".gemini", "config", "plugins", pluginName);
+  const antigravityPluginJsonPath = join(antigravityPluginDir, "plugin.json");
+  const antigravityPluginSkillPath = join(antigravityPluginDir, "skills", "SKILL.md");
+  try {
+    const pluginJsonAction = writeGeneratedFile(
+      antigravityPluginJsonPath,
+      Buffer.from(JSON.stringify({ name: pluginName, version: pluginVersion }, null, 2) + "\n"),
+    );
+    console.log(`${toolName}: ${pluginJsonAction} Antigravity plugin manifest at ${antigravityPluginJsonPath}`);
+
+    const skillAction = writeGeneratedFile(antigravityPluginSkillPath, skillSource);
+    console.log(`${toolName}: ${skillAction} Antigravity plugin skill at ${antigravityPluginSkillPath}`);
+    counts.succeeded++;
+  } catch (err) {
+    console.warn(`${toolName}: could not install Antigravity plugin (${err.message})`);
+    counts.failed++;
+  }
+}
+
+/** Log the final summary line and set a non-zero exit code on any failure. */
+export function finishPostinstall(toolName, counts, startTime) {
+  console.log(
+    `${toolName}: postinstall complete — ${counts.succeeded} succeeded, ${counts.failed} failed (${Date.now() - startTime}ms)`,
+  );
+  if (counts.failed > 0) {
+    process.exitCode = 1;
+  }
+}

package/wrapper/audit-code-wrapper-lib.mjs

@@ -64,14 +64,37 @@ function selfInvocationEnv() {
   };
 }
 
+// Byte-mirrors `quoteForCmd` in src/shared/tooling/exec.ts (see that file's
+// doc comment for the full CVE-2024-27980 rationale: cmd.exe's own line-scan
+// recognizes `& | < > ^` even inside a double-quoted region, so quote-doubling
+// alone is not enough for the `.cmd`/`.bat` shim-wrapping path below; `%`
+// cannot be neutralized this way at all, so it throws instead). This copy
+// exists only because the wrapper runs pre-dist (bootstrap constraint) and
+// cannot import the shared TS source — pinned byte-equal to the shared
+// implementation by tests/shared/wrapper-quote-parity.test.mjs so the two
+// copies cannot drift.
+const CMD_ARGV_METACHARS = /[&|<>^]/u;
+
 function quoteForCmd(arg) {
   if (arg.length === 0) return '""';
-  if (!/[\s"]/u.test(arg)) return arg;
-  return `"${arg.replace(/"/g, '""')}"`;
+  if (arg.includes('%')) {
+    throw new Error(
+      `quoteForCmd: refusing to quote an argument containing "%" for a ` +
+        `.cmd/.bat shim invocation through cmd.exe — cmd.exe's ` +
+        `percent-expansion cannot be reliably neutralized by caret-escaping ` +
+        `(see CVE-2024-27980 and its documented residual gap). Argument: ` +
+        `${JSON.stringify(arg)}`,
+    );
+  }
+  const needsQuoting = /[\s"]/u.test(arg);
+  const needsMetaEscape = CMD_ARGV_METACHARS.test(arg);
+  if (!needsQuoting && !needsMetaEscape) return arg;
+  const quoted = needsQuoting ? `"${arg.replace(/"/g, '""')}"` : arg;
+  return needsMetaEscape ? quoted.replace(/([&|<>^])/g, '^$1') : quoted;
 }
 
-function resolveSpawn(command, args) {
-  if (!(process.platform === 'win32' && /\.(cmd|bat)$/i.test(command))) {
+function resolveSpawn(command, args, platform = process.platform) {
+  if (!(platform === 'win32' && /\.(cmd|bat)$/i.test(command))) {
     return { command, args };
   }
 
@@ -81,6 +104,11 @@ function resolveSpawn(command, args) {
   };
 }
 
+// Exported for tests/shared/wrapper-quote-parity.test.mjs only (behavioral
+// drift guard against src/shared/tooling/exec.ts) — not part of the wrapper's
+// CLI surface.
+export { quoteForCmd, resolveSpawn };
+
 function run(command, args, options = {}) {
   return new Promise((resolvePromise, rejectPromise) => {
     const resolved = resolveSpawn(command, args);

package/wrapper/audit-code-wrapper-opencode.mjs

@@ -24,8 +24,6 @@ export const OPENCODE_AUDIT_EDIT_PERMISSION = {
   '.audit-tools/**': 'allow',
 };
 
-export const OPENCODE_AUDIT_EXTERNAL_DIRECTORY_PERMISSION = { '*': 'allow' };
-
 // Subcommands allowed for both the global bin and the dev wrapper.
 // Adding or removing a subcommand here applies to both invocation forms.
 const AUDIT_CODE_ALLOWED_SUBCOMMANDS = [
@@ -42,8 +40,10 @@ const AUDIT_CODE_WRAPPER_EXTRA_SUBCOMMANDS = ['worker-run*'];
 const AUDIT_CODE_DENIED_SUBCOMMANDS = ['synthesize*', 'cleanup*', 'requeue*', 'ingest-results*'];
 
 function buildAuditBashPermissions() {
-  /** @type {Record<string, 'allow' | 'deny'>} */
-  const perm = { '*': 'allow' };
+  // Hardened default (parity with the remediator): the wildcard is 'ask', with
+  // the audit-code invocations enumerated explicitly below.
+  /** @type {Record<string, 'allow' | 'ask' | 'deny'>} */
+  const perm = { '*': 'ask' };
   // Deny rules for every form of invocation (bin, dist, wrapper).
   for (const sub of AUDIT_CODE_DENIED_SUBCOMMANDS) {
     perm[`audit-code ${sub}`] = 'deny';
@@ -70,20 +70,11 @@ function buildAuditBashPermissions() {
 
 export const OPENCODE_AUDIT_BASH_PERMISSION = buildAuditBashPermissions();
 
-function externalDirectoryPattern(path) {
-  return `${path.replace(/\\/g, '/').replace(/\/+$/u, '')}/**`;
-}
-
-function renderOpenCodeExternalDirectoryPermission() {
-  return { '*': 'allow' };
-}
-
 export function renderOpenCodePermissionConfig() {
   return {
     read: 'allow',
     glob: 'allow',
     grep: 'allow',
-    external_directory: renderOpenCodeExternalDirectoryPermission(),
     edit: { ...OPENCODE_AUDIT_EDIT_PERMISSION },
     bash: { ...OPENCODE_AUDIT_BASH_PERMISSION },
   };
@@ -127,12 +118,17 @@ export function assertOpenCodeAuditPermissionConfig(permissionConfig, label) {
       throw new Error(`OpenCode ${label}.${tool} must be allow. Run "audit-code install --host opencode".`);
     }
   }
+  // Hardened shape: no external_directory allow-all (the tool no longer seeds
+  // the key at all; a leftover broad rule means a stale pre-hardening deploy).
   const externalDirectory = permissionConfig?.external_directory;
-  if (!externalDirectory || typeof externalDirectory !== 'object' || Array.isArray(externalDirectory)) {
-    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "audit-code install --host opencode".`);
-  }
-  if (externalDirectory['*'] !== 'allow') {
-    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "audit-code install --host opencode".`);
+  if (
+    externalDirectory === 'allow' ||
+    (externalDirectory &&
+      typeof externalDirectory === 'object' &&
+      !Array.isArray(externalDirectory) &&
+      externalDirectory['*'] === 'allow')
+  ) {
+    throw new Error(`OpenCode ${label}.external_directory must not allow-all (hardened default seeds no external_directory rule). Run "audit-code install --host opencode".`);
   }
   const edit = permissionConfig?.edit;
   const bash = permissionConfig?.bash;
@@ -147,6 +143,10 @@ export function assertOpenCodeAuditPermissionConfig(permissionConfig, label) {
   if (!bash || typeof bash !== 'object' || Array.isArray(bash)) {
     throw new Error(`OpenCode ${label}.bash must allow audit-code commands. Run "audit-code install --host opencode".`);
   }
+  // Hardened shape: the bash wildcard is "ask" (broad "allow" was retired).
+  if (bash['*'] !== 'ask') {
+    throw new Error(`OpenCode ${label}.bash must set "*" to "ask" (hardened default; broad "allow" was retired). Run "audit-code install --host opencode".`);
+  }
   for (const pattern of [
     'audit-code',
     'audit-code ensure*',
@@ -184,30 +184,46 @@ export function assertOpenCodeAuditPermissionConfig(permissionConfig, label) {
   }
 }
 
+// A pre-hardening deploy wrote bash['*']='allow' (the historically managed
+// broad value). Migrate exactly that value away so the generated 'ask' seed
+// wins on regeneration; any other user-authored wildcard survives untouched.
+function withoutManagedBroadBashWildcard(rule) {
+  const existing = objectValue(rule);
+  if (existing['*'] !== 'allow') {
+    return rule;
+  }
+  return withoutOpenCodeWildcard(existing);
+}
+
 function mergePermissionBlock(existingPermission, generatedPermission) {
   const existing = objectValue(existingPermission);
-  return {
+  const merged = {
     ...generatedPermission,
     ...existing,
     read: generatedPermission.read,
     glob: generatedPermission.glob,
     grep: generatedPermission.grep,
-    external_directory: mergeOpenCodeAgentPermissionRule(
-      existing.external_directory,
-      generatedPermission.external_directory,
-      OPENCODE_AUDIT_EXTERNAL_DIRECTORY_PERMISSION,
-    ),
     edit: mergeOpenCodeAgentPermissionRule(
       existing.edit,
       generatedPermission.edit,
       withoutOpenCodeWildcard(OPENCODE_AUDIT_EDIT_PERMISSION),
     ),
     bash: mergeOpenCodeAgentPermissionRule(
-      existing.bash,
+      withoutManagedBroadBashWildcard(existing.bash),
       generatedPermission.bash,
       withoutOpenCodeWildcard(OPENCODE_AUDIT_BASH_PERMISSION),
     ),
   };
+  // Hardened default: no external_directory rule is seeded. A leftover
+  // historically managed allow-all is migrated away; any non-matching
+  // user-authored value is preserved untouched.
+  const externalDirectory = migrateOpenCodeGlobalExternalDirectory(existing.external_directory);
+  if (externalDirectory === undefined) {
+    delete merged.external_directory;
+  } else {
+    merged.external_directory = externalDirectory;
+  }
+  return merged;
 }
 
 // Collect every agent's bash rule set from a merged agent map (in stable,

package/wrapper/remediate-code-wrapper-opencode.mjs

@@ -3,6 +3,7 @@
 // buildMergedOpenCodeProjectConfig throws a clear error in that case.
 let mergeOpenCodeAgentPermissionRule;
 let withoutOpenCodeWildcard;
+let migrateOpenCodeGlobalExternalDirectory;
 let composeOpenCodeBashCeiling;
 export let sharedOpenCodePermissions = false;
 
@@ -10,6 +11,7 @@ try {
   const shared = await import('audit-tools/shared');
   mergeOpenCodeAgentPermissionRule = shared.mergeOpenCodeAgentPermissionRule;
   withoutOpenCodeWildcard = shared.withoutOpenCodeWildcard;
+  migrateOpenCodeGlobalExternalDirectory = shared.migrateOpenCodeGlobalExternalDirectory;
   composeOpenCodeBashCeiling = shared.composeOpenCodeBashCeiling;
   sharedOpenCodePermissions = true;
 } catch {
@@ -22,8 +24,6 @@ export const OPENCODE_REMEDIATE_EDIT_PERMISSION = {
   '.audit-tools/**': 'allow',
 };
 
-export const OPENCODE_REMEDIATE_EXTERNAL_DIRECTORY_PERMISSION = { '*': 'allow' };
-
 // Subcommands allowed for both the global bin and the dev wrapper.
 // Adding or removing a subcommand here applies to both invocation forms.
 const REMEDIATE_CODE_ALLOWED_SUBCOMMANDS = [
@@ -36,8 +36,10 @@ const REMEDIATE_CODE_ALLOWED_SUBCOMMANDS = [
 ];
 
 function buildRemediateBashPermissions() {
-  /** @type {Record<string, 'allow' | 'deny'>} */
-  const perm = { '*': 'allow' };
+  // Hardened default: the wildcard is 'ask', with the remediate-code
+  // invocations enumerated explicitly below.
+  /** @type {Record<string, 'allow' | 'ask' | 'deny'>} */
+  const perm = { '*': 'ask' };
   // Allow rules: bare bin and each subcommand for both the global bin and wrapper.
   perm['remediate-code'] = 'allow';
   for (const sub of REMEDIATE_CODE_ALLOWED_SUBCOMMANDS) {
@@ -55,16 +57,11 @@ function buildRemediateBashPermissions() {
 
 export const OPENCODE_REMEDIATE_BASH_PERMISSION = buildRemediateBashPermissions();
 
-function renderOpenCodeExternalDirectoryPermission() {
-  return { '*': 'allow' };
-}
-
 export function renderOpenCodePermissionConfig() {
   return {
     read: 'allow',
     glob: 'allow',
     grep: 'allow',
-    external_directory: renderOpenCodeExternalDirectoryPermission(),
     edit: { ...OPENCODE_REMEDIATE_EDIT_PERMISSION },
     bash: { ...OPENCODE_REMEDIATE_BASH_PERMISSION },
   };
@@ -108,12 +105,17 @@ export function assertOpenCodeRemediatePermissionConfig(permissionConfig, label)
       throw new Error(`OpenCode ${label}.${tool} must be allow. Run "remediate-code install --host opencode".`);
     }
   }
+  // Hardened shape: no external_directory allow-all (the tool no longer seeds
+  // the key at all; a leftover broad rule means a stale pre-hardening deploy).
   const externalDirectory = permissionConfig?.external_directory;
-  if (!externalDirectory || typeof externalDirectory !== 'object' || Array.isArray(externalDirectory)) {
-    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "remediate-code install --host opencode".`);
-  }
-  if (externalDirectory['*'] !== 'allow') {
-    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "remediate-code install --host opencode".`);
+  if (
+    externalDirectory === 'allow' ||
+    (externalDirectory &&
+      typeof externalDirectory === 'object' &&
+      !Array.isArray(externalDirectory) &&
+      externalDirectory['*'] === 'allow')
+  ) {
+    throw new Error(`OpenCode ${label}.external_directory must not allow-all (hardened default seeds no external_directory rule). Run "remediate-code install --host opencode".`);
   }
   const edit = permissionConfig?.edit;
   const bash = permissionConfig?.bash;
@@ -128,6 +130,10 @@ export function assertOpenCodeRemediatePermissionConfig(permissionConfig, label)
   if (!bash || typeof bash !== 'object' || Array.isArray(bash)) {
     throw new Error(`OpenCode ${label}.bash must allow remediate-code commands. Run "remediate-code install --host opencode".`);
   }
+  // Hardened shape: the bash wildcard is "ask" (broad "allow" was retired).
+  if (bash['*'] !== 'ask') {
+    throw new Error(`OpenCode ${label}.bash must set "*" to "ask" (hardened default; broad "allow" was retired). Run "remediate-code install --host opencode".`);
+  }
   for (const pattern of [
     'remediate-code',
     'remediate-code ensure*',
@@ -146,30 +152,46 @@ export function assertOpenCodeRemediatePermissionConfig(permissionConfig, label)
   }
 }
 
+// A pre-hardening deploy wrote bash['*']='allow' (the historically managed
+// broad value). Migrate exactly that value away so the generated 'ask' seed
+// wins on regeneration; any other user-authored wildcard survives untouched.
+function withoutManagedBroadBashWildcard(rule) {
+  const existing = objectValue(rule);
+  if (existing['*'] !== 'allow') {
+    return rule;
+  }
+  return withoutOpenCodeWildcard(existing);
+}
+
 function mergePermissionBlock(existingPermission, generatedPermission) {
   const existing = objectValue(existingPermission);
-  return {
+  const merged = {
     ...generatedPermission,
     ...existing,
     read: generatedPermission.read,
     glob: generatedPermission.glob,
     grep: generatedPermission.grep,
-    external_directory: mergeOpenCodeAgentPermissionRule(
-      existing.external_directory,
-      generatedPermission.external_directory,
-      OPENCODE_REMEDIATE_EXTERNAL_DIRECTORY_PERMISSION,
-    ),
     edit: mergeOpenCodeAgentPermissionRule(
       existing.edit,
       generatedPermission.edit,
       withoutOpenCodeWildcard(OPENCODE_REMEDIATE_EDIT_PERMISSION),
     ),
     bash: mergeOpenCodeAgentPermissionRule(
-      existing.bash,
+      withoutManagedBroadBashWildcard(existing.bash),
       generatedPermission.bash,
       withoutOpenCodeWildcard(OPENCODE_REMEDIATE_BASH_PERMISSION),
     ),
   };
+  // Hardened default: no external_directory rule is seeded. A leftover
+  // historically managed allow-all is migrated away; any non-matching
+  // user-authored value is preserved untouched.
+  const externalDirectory = migrateOpenCodeGlobalExternalDirectory(existing.external_directory);
+  if (externalDirectory === undefined) {
+    delete merged.external_directory;
+  } else {
+    merged.external_directory = externalDirectory;
+  }
+  return merged;
 }
 
 // Collect every agent's bash rule set from a merged agent map (in stable,

package/dist/remediate/utils/commands.d.ts

@@ -1,17 +0,0 @@
-import { spawnSync, type SpawnSyncOptions } from "node:child_process";
-import { quoteForCmd, platformCommand, type RunTrackedOptions, type RunTrackedResult } from "audit-tools/shared";
-type SpawnResult = ReturnType<typeof spawnSync>;
-export { quoteForCmd, platformCommand };
-/**
- * Run a command synchronously by argv. Delegates to the shared `runTracked`,
- * which applies the single Windows `.cmd`/`.bat` wrapping implementation and
- * never uses `shell: true`.
- */
-export declare function runCommand(command: string, args: string[], options?: RunTrackedOptions): RunTrackedResult;
-/**
- * Run a stored command *string* (e.g. a configured `test_command`) through the
- * platform shell. argv-based callers should use `runCommand`/`runTracked`;
- * this exists only for opaque single-string commands that need shell parsing.
- */
-export declare function runShellCommand(command: string, options?: SpawnSyncOptions): SpawnResult;
-//# sourceMappingURL=commands.d.ts.map

package/dist/remediate/utils/commands.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/remediate/utils/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAKhD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAElB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,WAAW,CAQb"}

package/dist/remediate/utils/commands.js

@@ -1,29 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { runTracked, quoteForCmd, platformCommand, } from "audit-tools/shared";
-// The Windows wrapping/quoting logic now lives in `audit-tools/shared`
-// (tooling/exec.ts) so the auditor and remediator share one implementation.
-// These re-exports preserve the import surface callers (and tests) rely on.
-export { quoteForCmd, platformCommand };
-/**
- * Run a command synchronously by argv. Delegates to the shared `runTracked`,
- * which applies the single Windows `.cmd`/`.bat` wrapping implementation and
- * never uses `shell: true`.
- */
-export function runCommand(command, args, options = {}) {
-    return runTracked([command, ...args], options);
-}
-/**
- * Run a stored command *string* (e.g. a configured `test_command`) through the
- * platform shell. argv-based callers should use `runCommand`/`runTracked`;
- * this exists only for opaque single-string commands that need shell parsing.
- */
-export function runShellCommand(command, options = {}) {
-    return spawnSync(command, {
-        ...options,
-        shell: true,
-        // Default-hide the console window a windowless parent would pop on win32;
-        // an explicit caller value still wins.
-        windowsHide: options.windowsHide ?? true,
-    });
-}
-//# sourceMappingURL=commands.js.map

package/dist/remediate/utils/commands.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/remediate/utils/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAI5B,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,IAAc,EACd,UAA6B,EAAE;IAE/B,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,UAA4B,EAAE;IAE9B,OAAO,SAAS,CAAC,OAAO,EAAE;QACxB,GAAG,OAAO;QACV,KAAK,EAAE,IAAI;QACX,0EAA0E;QAC1E,uCAAuC;QACvC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;KACzC,CAAC,CAAC;AACL,CAAC"}