copilot-operator 0.1.13 → 0.1.15

package/dist/src/exec/network.js

@@ -33,9 +33,11 @@
  * proves the server it started actually answers, and nothing comes back that the project did not
  * itself produce. Holding every health check for approval would turn an unattended run into one
  * that waits all night on its first test. The exception is narrow on purpose: every `http(s)://`
- * address in the command must be loopback, there must be at least one, and nothing else in the
- * command may look like a host — a bare `example.com` or `10.0.0.5` beside a localhost URL still
- * holds the step, because `iwr` accepts an address without a scheme.
+ * address in the command must be loopback, read the way the program will read it (the host after
+ * any `user@`, not the first word after `://`), there must be at least one, no option may send the
+ * request somewhere else, and nothing else in the command may look like a host — a bare
+ * `example.com` or `10.0.0.5` beside a localhost URL still holds the step, because `iwr` accepts an
+ * address without a scheme. Where the gate cannot read an address for certain, it is not local.
  *
  * The same text is screened whole, not command by command. That is deliberate and it is what
  * closes the obvious way round: writing `Invoke-WebRequest …` into a `.ps1` with `Set-Content` and
@@ -139,39 +141,114 @@ const FILE_EXTENSIONS = new Set([
     'png', 'jpg', 'jpeg', 'gif', 'svg', 'ico', 'webp', 'pdf', 'out', 'tmp', 'bak', 'lock',
     'exe', 'cmd', 'bat', 'dll', 'tar', 'gz', 'tgz',
 ]);
+/**
+ * The host a URL names, read from the text after its `://`, or null when it cannot be read for
+ * certain.
+ *
+ * Everything before the last `@` of an authority is userinfo, not the host: curl and
+ * Invoke-WebRequest both fetch `http://localhost:1@evil.example.com/tool.exe` from
+ * evil.example.com. Reading the host up to the first `:` called that "localhost", and the one
+ * download the hold exists for — an executable from somewhere else — went through unheld, in a
+ * check's command with nobody asked (found on 2026-10-01). So the authority is read whole, up to the
+ * first `/`, `?`, `#` or white space, and it is only this machine when it is nothing but a host and
+ * a port. An `@` anywhere in it, a `\`, a percent-encoded name, or a `$`, a backtick or a caret the
+ * shell would expand or escape at run time: the parsers disagree about each of those, or the gate
+ * cannot see what the shell will make of it, so none is read as loopback.
+ *
+ * Quotes are taken out before reading, because to the shell they are not the end of a word:
+ * `"http://localhost"@evil.example.com/` is one argument, and it is the URL with userinfo. After the
+ * host and port only an end of the argument may follow — `)`, `}`, `]`, `;`, `,`, `|`, `&`, `<`,
+ * `>` or nothing — and never another character of a name, so `localhost．evil.example.com`, whose
+ * full-width dot a URL parser turns into a plain one, is not "localhost" either.
+ */
+function urlHost(afterScheme) {
+    const authority = (/^[^\/?#\s]*/.exec(afterScheme)?.[0] ?? '').replace(/["']/g, '');
+    if (/[@\\%$`^]/.test(authority))
+        return null;
+    return /^(\[[0-9a-f:.]+\]|[a-z0-9._~-]+)(?::\d*)?(?=$|[)}\];,|&<>])/i.exec(authority)?.[1] ?? null;
+}
+/**
+ * Whether one piece of a token reads as a host or an IP address that is not this machine. A name
+ * with a known file extension (`health.json`), or a .NET namespace (`System.Net`), is not a host.
+ */
+function namesAnotherHost(bare) {
+    if (!bare)
+        return false;
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(bare))
+        return !isLoopback(bare);
+    const labels = bare.split('.');
+    if (labels.length < 2 || labels.some((l) => l === ''))
+        return false;
+    const last = labels[labels.length - 1].toLowerCase();
+    if (!/^[a-z]{2,}$/.test(last) || FILE_EXTENSIONS.has(last))
+        return false;
+    if (/^(system|microsoft|net)$/i.test(labels[0]))
+        return false;
+    return !isLoopback(bare);
+}
+/**
+ * Options that send a request somewhere its URL does not say, or take more of them from a file the
+ * line does not show: curl's `--resolve` and `--connect-to` (the URL still says `localhost`, the
+ * connection goes to the address the option names), curl's `-K`/`--config`, and wget's
+ * `-i`/`--input-file` and `-e`/`--execute`. With any of them the URLs on the line are not the whole
+ * story, so the line is not provably local. The options are matched in their own case, as the
+ * programs read them: curl's `-k` (skip the certificate check) is an ordinary flag of a local health
+ * check and `-K` is not, and PowerShell's `-ErrorAction` after a `wget` alias is not wget's `-e`.
+ *
+ * And each only after its own program in the same statement, since only that program reads it.
+ * `--config` is an ordinary flag of node servers, vite, jest, playwright and webpack, and matched
+ * anywhere on the line, `node server.js --config dev.json; Invoke-WebRequest http://localhost:3000/health`
+ * was held as if curl had been told to read a file, and refused outright as a check's command. A
+ * quote may come before the option, as in `-ArgumentList '--config','x'`, where the program still
+ * reads it.
+ */
+const REDIRECTING_OPTIONS = [
+    /\bcurl(?:\.exe)?\b[^|;\n]*[\s'"](?:--(?:resolve|connect-to|config)(?=[\s='",]|$)|-K(?![a-zA-Z]))/,
+    /\bwget2?(?:\.exe)?\b[^|;\n]*[\s'"](?:-[ie]|--(?:input-file|execute)(?=[\s='",]|$))/,
+];
 /**
  * Whether every place this command could reach is this machine. True only when it names at least
- * one `http(s)://` address, all of them loopback, and no other token that reads as a host or an IP.
+ * one `scheme://` address, every one of them a loopback host read for certain (`urlHost`), no option
+ * sends the request elsewhere, and no other token reads as a host or an IP.
  */
 export function onlyLoopbackTargets(command) {
-    const urls = [...command.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/(\[[^\]]+\]|[^\/\s:'"`;|)]+)/gi)];
-    if (urls.length === 0)
+    const schemes = [...command.matchAll(/\b[a-z][a-z0-9+.-]*:\/\//gi)];
+    if (schemes.length === 0)
         return false;
-    if (!urls.every((m) => isLoopback(m[1])))
-        return false;
-    const rest = command.replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, ' ');
-    for (const token of rest.split(/[\s'"`=,;|(){}]+/)) {
-        const bare = token.replace(/^-+/, '').replace(/[:\/].*$/, '');
-        if (!bare)
-            continue;
-        if (/^\d{1,3}(\.\d{1,3}){3}$/.test(bare) && !isLoopback(bare))
+    for (const m of schemes) {
+        const host = urlHost(command.slice(m.index + m[0].length));
+        if (host === null || !isLoopback(host))
             return false;
-        const labels = bare.split('.');
-        if (labels.length < 2 || labels.some((l) => l === ''))
-            continue;
-        const last = labels[labels.length - 1].toLowerCase();
-        if (!/^[a-z]{2,}$/.test(last))
-            continue;
-        if (FILE_EXTENSIONS.has(last))
-            continue;
-        // PowerShell member access on a variable or a type (`$r.StatusCode`, `System.Net`) is not a host.
+    }
+    if (REDIRECTING_OPTIONS.some((option) => option.test(command)))
+        return false;
+    /*
+     * The rest of the line, with each URL taken out up to where the shell ends it — white space, a
+     * quote, `;`, `|`, `&`, a bracket or a comma — so that a second command glued on after a path
+     * (`…/x;iwr('evil.example')`) is still read.
+     */
+    const rest = command.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s'"`;|&(){}<>,]*/gi, ' ');
+    for (const token of rest.split(/[\s'"`=,;|&(){}<>]+/)) {
+        // A bracketed IPv6 address anywhere in the token: a proxy (`-x [2001:db8::1]:8080`) or an address given to curl.
+        for (const v6 of token.matchAll(/\[([0-9a-f:.]*:[0-9a-f:.]*)\]/gi))
+            if (!isLoopback(v6[1]))
+                return false;
+        // PowerShell member access on a variable or a type (`$r.StatusCode`, `[System.Net.Dns]`) is not a host.
         if (token.startsWith('$') || token.startsWith('['))
             continue;
-        if (/^(system|microsoft|net)$/i.test(labels[0]))
-            continue;
-        if (isLoopback(bare))
-            continue;
-        return false;
+        /*
+         * Every piece between colons and `@`s, not only the first: `localhost:80:93.184.216.34` names an
+         * address after its second colon, `bob@evil.example` a host after its `@`, and either reroutes a
+         * request whose URL said localhost. Within a piece, only what comes before a `/` or a `\` is a
+         * candidate, as in `example.com/x`; a path's folders and its file are not hosts. Cut at `/` alone,
+         * a Windows path was not: `C:\work\Shop.Web` splits at its drive's colon into `C` and
+         * `\work\Shop.Web`, whose last label `Web` read as a top-level domain, and a localhost health
+         * check that saved its answer under a drive was held, or refused as a check's command.
+         */
+        for (const piece of token.replace(/^-+/, '').split(/[:@]+/)) {
+            if (namesAnotherHost(piece.replace(/[\/\\].*$/, '')))
+                return false;
+        }
     }
     return true;
 }

package/dist/src/exec/redaction.js

@@ -71,6 +71,26 @@ export function findSecrets(text) {
     }
     return hits;
 }
+/**
+ * One of the operator's own patterns, as a regular expression, or null when it is not one. Such a
+ * pattern is applied as a plain string instead, as it always was, so a typo in one cannot switch
+ * redaction off.
+ */
+function operatorPattern(p) {
+    try {
+        return new RegExp(p, 'gi');
+    }
+    catch {
+        return null;
+    }
+}
+/** The text with every built-in shape replaced, before the operator's own patterns are tried. */
+function withoutShapes(text) {
+    let out = text;
+    for (const s of SHAPES)
+        out = out.replace(s.pattern, s.replace);
+    return out;
+}
 /**
  * The text with every secret-shaped string replaced, then the operator's own patterns.
  *
@@ -78,16 +98,39 @@ export function findSecrets(text) {
  * plain string, as it always was, so a typo in one cannot switch redaction off.
  */
 export function redactSecrets(text, extraPatterns = []) {
-    let out = text;
-    for (const s of SHAPES)
-        out = out.replace(s.pattern, s.replace);
+    let out = withoutShapes(text);
     for (const p of extraPatterns) {
-        try {
-            out = out.replace(new RegExp(p, 'gi'), '[REDACTED]');
-        }
-        catch {
-            out = out.split(p).join('[REDACTED]');
-        }
+        const re = operatorPattern(p);
+        out = re ? out.replace(re, '[REDACTED]') : out.split(p).join('[REDACTED]');
     }
     return out;
 }
+/**
+ * What `redactSecrets` takes out of a text, by name: the built-in shapes as `findSecrets` names
+ * them, and each of the operator's own patterns under the setting it comes from.
+ *
+ * `findSecrets` alone could not see the operator's patterns, so a report whose only secret was one
+ * of theirs — a company's ticket or key format, which no built-in shape knows — was redacted without
+ * a word, and the event that tells the operator something was taken out never came. Each pattern is
+ * counted on the text as `redactSecrets` reaches it, after the shapes, so what a shape already took
+ * is not counted a second time under the operator's name.
+ */
+export function findRedactions(text, extraPatterns = []) {
+    const hits = findSecrets(text);
+    let out = withoutShapes(text);
+    for (const p of extraPatterns) {
+        const re = operatorPattern(p);
+        const count = re ? [...out.matchAll(re)].length : p ? out.split(p).length - 1 : 0;
+        if (count > 0)
+            hits.push({ name: `report.redactPatterns "${p}"`, count });
+        out = re ? out.replace(re, '[REDACTED]') : out.split(p).join('[REDACTED]');
+    }
+    return hits;
+}
+/** Several counts as one, summed by name, in the order the names were first met. */
+export function mergeRedactions(lists) {
+    const byName = new Map();
+    for (const hit of lists.flat())
+        byName.set(hit.name, (byName.get(hit.name) ?? 0) + hit.count);
+    return [...byName.entries()].map(([name, count]) => ({ name, count }));
+}

package/dist/src/exec/reportFile.js

@@ -9,7 +9,7 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { silentFailure } from '../protocol/reporter.js';
-import { findSecrets, redactSecrets } from './redaction.js';
+import { findRedactions, mergeRedactions, redactSecrets } from './redaction.js';
 /**
  * Removes terminal colour codes.
  *
@@ -119,10 +119,9 @@ export async function writeReport(results, opts) {
     const raw = results.map((r) => sectionFor(r, opts.maxOutputChars));
     // Counted before redaction so the event can say what kind of thing was taken out — the
     // operator on a work machine wants to know a token was printed, not only that it was hidden.
-    const byShape = new Map();
-    for (const hit of raw.flatMap(findSecrets))
-        byShape.set(hit.name, (byShape.get(hit.name) ?? 0) + hit.count);
-    const redactions = [...byShape.entries()].map(([name, count]) => ({ name, count }));
+    // Their own patterns are counted too: a report whose only secret matched one of them was
+    // redacted without the event ever saying so.
+    const redactions = mergeRedactions(raw.map((s) => findRedactions(s, opts.redactPatterns)));
     const sections = raw.map((s) => redact(s, opts.redactPatterns));
     const chunks = [[]];
     let size = Buffer.byteLength(header) + Buffer.byteLength(footer);

package/dist/src/exec/runner.js

@@ -23,14 +23,54 @@ import { spawn } from 'node:child_process';
 import { createWriteStream, existsSync } from 'node:fs';
 import { mkdir } from 'node:fs/promises';
 import { dirname } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
 import { effectiveShell, invocationFor, missingShellProblem, resolveShell } from './shells.js';
 import { stopTree } from './processes.js';
 import { stepEnvironment } from './stepEnv.js';
 const DEFAULT_HARD_TIMEOUT_MS = 4 * 60 * 60 * 1000;
 const DEFAULT_IDLE_TIMEOUT_MS = 15 * 60 * 1000;
+/** How often a running step says how it is doing, unless the caller asks for another pace. */
 const HEARTBEAT_EVERY_MS = 30_000;
-/** Cap on what is held in memory and echoed into the report body. */
-const MAX_CAPTURE_CHARS = 200_000;
+/**
+ * Cap on what is held in memory and echoed into the report body, per stream.
+ *
+ * Exported because whatever decides something from the captured text has to know where it stops:
+ * past it the text is not the whole output, and an answer read from it may not be the true one.
+ */
+export const MAX_CAPTURE_CHARS = 200_000;
+/**
+ * How much of a line that has not ended yet is carried over to the next chunk, so the last line a
+ * heartbeat shows is a whole line. Bounded, because a program can print a megabyte with no newline.
+ */
+const LINE_CARRIED_CHARS = 2_000;
+/** The longest delay a Node timer can hold: 2^31-1 ms, about 24.8 days. */
+const LONGEST_TIMER_MS = 2_147_483_647;
+/**
+ * A delay a timer will really wait.
+ *
+ * Node does not refuse a delay it cannot hold. Above 2^31-1 ms, Infinity included, and below 1 ms
+ * or not a number at all, it sets the timer to 1 ms and prints a warning nobody reads. For the
+ * heartbeat that is a beat every millisecond; for the hard clock it is a step killed as it starts,
+ * which is what a step allowed a month would get. So a delay too long for a timer becomes the
+ * longest one there is, and one that is not a delay at all becomes the default.
+ */
+function timerDelay(ms, fallback) {
+    if (ms === undefined || !(ms >= 1))
+        return fallback;
+    return Math.min(ms, LONGEST_TIMER_MS);
+}
+/**
+ * A piece of stderr as the log shows it: every line marked once, at its start.
+ *
+ * It used to be marked with `^` in multiline mode, which also counts a `\r` as the end of a line.
+ * On Windows each line came out as `[stderr] text\r[stderr] \n`, a piece that ended a line put a
+ * mark at its very end, ahead of whatever was written next, and a piece that went on with a line
+ * already begun put another in the middle of it. A pipe hands over pieces, not lines, so whether a
+ * piece begins a line is known only from the one before it, and the caller says.
+ */
+function markStderr(text, atLineStart) {
+    return `${atLineStart ? '[stderr] ' : ''}${text.replace(/\n(?=[^])/g, '\n[stderr] ')}`;
+}
 /**
  * The result of a step that never started because the machine has no shell for it.
  *
@@ -56,6 +96,31 @@ function unrunnable(req, problem) {
         lastOutputAgoMs: 0,
     };
 }
+/**
+ * The result of a step the operator stopped before it began.
+ *
+ * Shaped like a stop in the middle of a run, because that is what the operator asked for and what
+ * whoever reads the result has to act on, but with nothing started and nothing logged: there is no
+ * process to account for and no stream to point at. Its duration is the time runStep took to find
+ * that out, measured like any other, so that a stop which was slow to be noticed shows as slow.
+ */
+function stoppedBeforeStart(req, resolved, startedAt) {
+    return {
+        id: req.id,
+        shell: resolved.shell,
+        requestedShell: resolved.requested,
+        shellPath: resolved.path,
+        command: req.command,
+        exitCode: -3,
+        outcome: 'aborted',
+        durationMs: Date.now() - startedAt,
+        stdout: '',
+        stderr: '[runner] the command was not run: the operator stopped the run before it started\n',
+        truncated: false,
+        logPath: '',
+        lastOutputAgoMs: 0,
+    };
+}
 /**
  * The longest a step that is being stopped may take before its result is given anyway. The stop
  * itself is `taskkill /T`, a grace period, then `/F` (see `processes.ts`), which with reading the
@@ -67,10 +132,21 @@ export async function runStep(req,
 /**
  * `tracker` records the shell this step starts, which is what later lets the runner tell the
  * processes the bot started from ones the operator started by hand. See `processes.ts`.
+ *
+ * `heartbeatMs` is how often `onHeartbeat` is called while the step runs. The live log wants a
+ * beat every half minute and no more; a caller that needs to see what a beat carries during a
+ * step of a few seconds asks for a shorter one, since at the default none would come at all.
+ *
+ * `onOutput` is given every piece of output as it is decoded, all of it, including what falls
+ * past MAX_CAPTURE_CHARS and is kept on disk only. It is how a caller decides something about the
+ * whole output (an output check does) without the runner holding the whole output in memory. It
+ * is called from the stream's handler, so it has to be quick.
  */
 opts = {}) {
-    const hardTimeoutMs = req.hardTimeoutMs ?? DEFAULT_HARD_TIMEOUT_MS;
-    const idleTimeoutMs = req.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+    // Every clock goes through `timerDelay`: a delay Node cannot hold would fire after 1 ms.
+    const hardTimeoutMs = timerDelay(req.hardTimeoutMs, DEFAULT_HARD_TIMEOUT_MS);
+    const idleTimeoutMs = timerDelay(req.idleTimeoutMs, DEFAULT_IDLE_TIMEOUT_MS);
+    const heartbeatMs = timerDelay(opts.heartbeatMs, HEARTBEAT_EVERY_MS);
     const startedAt = Date.now();
     // Every path into the shell goes through here, which is what makes a step and a post-task
     // check incapable of disagreeing about which interpreter their commands were read by.
@@ -79,6 +155,18 @@ opts = {}) {
         return unrunnable(req, choice.problem);
     const resolved = choice.resolved;
     await mkdir(dirname(req.logPath), { recursive: true });
+    /*
+     * A Stop that came before the step began means the step never begins.
+     *
+     * The signal is listened to only once the process exists, and 'abort' is fired once: a signal
+     * already aborted by then — Stop pressed while the previous step was ending, or during the await
+     * just above — never fires again, and the step used to run its whole course, hours under the
+     * default ceiling, with the operator's Stop on record. It is asked here, after the last await and
+     * before anything is written or started, because from this line to the listener below everything
+     * runs in one go: no abort can arrive in between and be missed.
+     */
+    if (opts.signal?.aborted)
+        return stoppedBeforeStart(req, resolved, startedAt);
     const log = createWriteStream(req.logPath, { flags: 'a' });
     /*
      * A step log that cannot be written must never take the process down with it.
@@ -90,13 +178,19 @@ opts = {}) {
      */
     log.on('error', () => undefined);
     log.write(`# step ${req.id} shell=${resolved.shell} exe=${resolved.path} cwd=${req.cwd}\n# ${req.command}\n`);
-    const { file, args } = invocationFor(resolved, req.command, req.scriptArgs);
+    const { file, args, windowsVerbatimArguments } = invocationFor(resolved, req.command, req.scriptArgs);
     return await new Promise((resolve) => {
         let stdout = '';
         let stderr = '';
         let bytesOut = 0;
         let truncated = false;
         let lastLine = '';
+        /*
+         * The end of each stream that has no newline yet. A pipe hands over whatever is there, not
+         * whole lines, so a line can arrive in two chunks; read chunk by chunk, the last line would be
+         * the second half of it, which is text the step never printed on its own.
+         */
+        const unfinished = { out: '', err: '' };
         let lastOutputAt = Date.now();
         let settled = false;
         /** Set when the shell itself would not start, which is not a failure of the command. */
@@ -109,6 +203,9 @@ opts = {}) {
             // Named, not inherited: a step must not see the bot's own token or whatever else the
             // operator's shell holds. See `stepEnv.ts`.
             env: stepEnvironment(req.env ?? process.env, req.passEnv),
+            // True for `cmd`, whose command line `invocationFor` has already written in full: quoted again
+            // here, every double quote in a step would reach `cmd` as `\"`, which it does not understand.
+            windowsVerbatimArguments,
             windowsHide: true,
             stdio: ['ignore', 'pipe', 'pipe'],
         });
@@ -144,16 +241,43 @@ opts = {}) {
                 lastOutputAgoMs: Date.now() - lastOutputAt,
             });
         };
+        /*
+         * Each stream has a decoder of its own, which holds back the first bytes of a character that a
+         * chunk ended in the middle of until the rest arrives. A pipe cuts where it cuts, not between
+         * characters, and a chunk decoded by itself turned the two halves of a '✕' or a Cyrillic letter
+         * into two replacement characters: in the captured text, the log, the last line, and the output
+         * a check is decided on, where an output-omits would then pass on output that did contain it.
+         */
+        const decoders = { out: new StringDecoder('utf8'), err: new StringDecoder('utf8') };
         const capture = (chunk, stream) => {
-            const text = chunk.toString('utf8');
             lastOutputAt = Date.now();
             bytesOut += chunk.length;
+            take(decoders[stream].write(chunk), stream);
+        };
+        const take = (text, stream) => {
+            if (!text)
+                return;
             // Output can still arrive after the child has closed and the step has been settled: the
             // pipes flush independently of the close event. Writing then would be a write to an
             // ended stream, so the tail goes to the captured text and not to the file.
-            if (!settled)
-                log.write(stream === 'err' ? text.replace(/^/gm, '[stderr] ') : text);
-            const trimmed = text.trimEnd();
+            if (!settled) {
+                log.write(stream === 'err' ? markStderr(text, unfinished.err === '') : text);
+                /*
+                 * The caller's listener runs inside this stream handler, where a throw would be an uncaught
+                 * exception and take the API down in the middle of a run. What it was working out is the
+                 * caller's to get right; the step itself goes on either way.
+                 */
+                try {
+                    opts.onOutput?.(text, stream);
+                }
+                catch {
+                    /* the listener's fault, not the step's */
+                }
+            }
+            const joined = unfinished[stream] + text;
+            const end = joined.lastIndexOf('\n');
+            unfinished[stream] = (end >= 0 ? joined.slice(end + 1) : joined).slice(-LINE_CARRIED_CHARS);
+            const trimmed = joined.trimEnd();
             const nl = trimmed.lastIndexOf('\n');
             if (trimmed)
                 lastLine = nl >= 0 ? trimmed.slice(nl + 1) : trimmed;
@@ -195,9 +319,18 @@ opts = {}) {
                 shellProblem = missingShellProblem(resolved);
             finish('spawn-error', -2);
         });
-        // While the runner is stopping the step the process exiting is the stop working, not the step
-        // completing, so the reason recorded is the runner's.
-        child.on('close', (code) => (stopping ? finish(stopping.outcome, stopping.exitCode) : finish('completed', code ?? -1)));
+        child.on('close', (code) => {
+            // Both streams have ended, so whatever a decoder still holds is the last of its stream: the
+            // start of a character the process never finished, given as the replacement character.
+            take(decoders.out.end(), 'out');
+            take(decoders.err.end(), 'err');
+            // While the runner is stopping the step the process exiting is the stop working, not the step
+            // completing, so the reason recorded is the runner's.
+            if (stopping)
+                finish(stopping.outcome, stopping.exitCode);
+            else
+                finish('completed', code ?? -1);
+        });
         /*
          * Stops the step's whole tree — `taskkill /T`, then `/F` — and gives the result only
          * once it is down, so the next step does not start while this one still holds a port or a
@@ -236,7 +369,7 @@ opts = {}) {
                 bytesOut,
                 lastLine,
             });
-        }, HEARTBEAT_EVERY_MS);
+        }, heartbeatMs);
         const onAbort = () => {
             stop('aborted', -3, 'aborted by the user');
         };

package/dist/src/exec/shells.js

@@ -262,6 +262,19 @@ export function shellNote(inventory = detectShells(), fallback) {
  * a security review can take at face value. The cost is on a machine set to `Restricted` or
  * `AllSigned`: the `.ps1` shims that npm and its kin install are then refused, and the chat is told
  * (in the contract) to call the `.cmd` form of the tool instead.
+ *
+ * `cmd` is given its command line exactly as written, which is the other thing here that is not
+ * incidental. Left to itself, Node quotes every argument by the rules the C runtime splits a command
+ * line with, and those rules escape a double quote with a backslash. `cmd` does not split its command
+ * line by them and has no such escape, so every quote in a step reached it as `\"`: `echo "hello
+ * world"` printed the backslashes, `node -e "console.log(1+1)"` handed node a string literal that
+ * printed nothing, and a quoted path such as `"C:\Program Files\nodejs\node.exe"` was looked up with
+ * the backslashes in its name and not found. So, as Node does for itself under `shell: true`, the
+ * line is passed verbatim and wrapped in one more pair of quotes: with `/s`, `cmd` removes exactly the
+ * first and the last quote on the line, which are those two, and reads everything between them as it
+ * was written. A script is run the same way, its path quoted and each argument quoted for `cmd` by
+ * `cmdArgument`, because nothing else quotes them any more. PowerShell is not touched: it reads its
+ * arguments by the C runtime's rules, and Node's quoting is the right quoting for it.
  */
 export function invocationFor(resolved, command, scriptArgs) {
     const isScript = Array.isArray(scriptArgs);
@@ -270,15 +283,37 @@ export function invocationFor(resolved, command, scriptArgs) {
         case 'powershell': {
             const base = ['-NoProfile', '-NonInteractive'];
             return isScript
-                ? { file: resolved.path, args: [...base, '-File', command, ...(scriptArgs ?? [])] }
-                : { file: resolved.path, args: [...base, '-Command', command] };
+                ? { file: resolved.path, args: [...base, '-File', command, ...(scriptArgs ?? [])], windowsVerbatimArguments: false }
+                : { file: resolved.path, args: [...base, '-Command', command], windowsVerbatimArguments: false };
+        }
+        case 'cmd': {
+            const line = isScript ? [`"${command}"`, ...(scriptArgs ?? []).map(cmdArgument)].join(' ') : command;
+            return { file: resolved.path, args: ['/d', '/s', '/c', `"${line}"`], windowsVerbatimArguments: true };
         }
-        case 'cmd':
-            return isScript
-                ? { file: resolved.path, args: ['/d', '/c', command, ...(scriptArgs ?? [])] }
-                : { file: resolved.path, args: ['/d', '/s', '/c', command] };
     }
 }
+/**
+ * One argument to a script run in `cmd`, written so that it arrives as the one argument it is.
+ *
+ * The line is passed verbatim, so nothing quotes this on the way and it has to be done here, for the
+ * reader that is actually there. A space would make one argument two. `&`, `|`, `<` and `>` would
+ * make the rest of it a second command or a redirection, `^` would be taken as an escape and the
+ * parentheses as a group, and a quote is the only thing that makes `cmd` read any of them as text.
+ * `,`, `;` and `=` divide a batch file's arguments the way a space does. `%` quotes an argument too: `%NAME%` is expanded inside quotes as well as outside,
+ * as it is anywhere on a `cmd` line, but what it expands to then stays inside this argument.
+ *
+ * Inside the quotes, a program built on the C runtime gets back exactly what was given. The
+ * backslashes in front of a quote are doubled, which its rules ask for, and a quote is written `""`,
+ * which it reads as one quote. `\"` would not do: `cmd` counts every quote, with or without a
+ * backslash, so it would take that one as the end of the quoted text and run whatever came after it.
+ * A batch file sees an inner quote and a closing backslash doubled, which is as near as `cmd` lets
+ * anything come.
+ */
+function cmdArgument(arg) {
+    if (arg !== '' && !/[\s"&|<>^(),;=%]/.test(arg))
+        return arg;
+    return `"${arg.replace(/(\\*)"/g, '$1$1""').replace(/(\\+)$/, '$1$1')}"`;
+}
 /**
  * A shell that was found at detection time and would not start when it was wanted.
  *

package/dist/src/exec/workDir.js

@@ -12,7 +12,7 @@
  * nothing at all.
  *
  * A session already knows its project — `vcs.repoDir` says where the branches go and
- * `mirror.rootDir` where the files are — so that is where its commands run. The configured
+ * `projectDir` where the work is — so that is where its commands run. The configured
  * `execution.cwd` is the fallback for a session with no project, and this project's own
  * checkout is never a fallback: a session that would land here by default does not run, and
  * says why. Landing here on purpose — the operator pointed the session at the bot itself — is
@@ -63,11 +63,11 @@ export function isOwnCheckout(dir, own = botRootDir()) {
  */
 export function workingDirFor(session, configCwd, own = botRootDir()) {
     const repo = (session.vcs?.repoDir ?? '').trim();
-    const mirror = (session.mirror?.rootDir ?? '').trim();
+    const project = (session.projectDir ?? '').trim();
     if (repo)
         return { cwd: resolve(repo), source: 'repository', ownCheckout: isInside(repo, own) };
-    if (mirror)
-        return { cwd: resolve(mirror), source: 'mirror', ownCheckout: isInside(mirror, own) };
+    if (project)
+        return { cwd: resolve(project), source: 'project', ownCheckout: isInside(project, own) };
     if (isInside(configCwd, own)) {
         return {
             cwd: resolve(configCwd),

package/dist/src/orchestrator/derivedChecks.js

@@ -44,6 +44,7 @@ export async function validateDerivedChecks(findings, opts) {
             defaultShell: opts.defaultShell,
             tracker: opts.tracker,
             passEnv: opts.passEnv,
+            redactPatterns: opts.redactPatterns,
         });
         if (outcome.refusedBeforeRunning)
             out.blocked.push({ finding, check, outcome });