infraweaver 0.3.7 → 0.3.9

package/src/modes/update-dependencies.ts

@@ -5,20 +5,20 @@ export function updateDependenciesMode(t: ToolRef): Mode {
   return {
     name: "UpdateDependencies",
     description:
-      "Upgrade outdated or unpinned Terraform provider and module versions to current, supported pins, then PROVE the bump is safe — config-preserving bumps via the equivalence check (same resource set + arguments), behaviour-affecting major bumps via a reviewed plan delta (or shipped `proposed — unproven`). One scoped PR per provider/module.",
+      "Upgrade outdated or unpinned Terraform provider and module versions to current, supported pins, then PROVE the bump is safe — config-preserving bumps via the equivalence check (same resource set + arguments), behaviour-affecting major bumps via a reviewed plan delta (or shipped proposed — unproven). One scoped PR per provider/module.",
     prompt: `### Checklist
 
 This mode turns the version-currency ADVISORY into action: it bumps stale/unpinned provider + module versions and PROVES the bump is safe before a human sees it, reusing the Refactor proof machinery. A pin bump that needs no code change is behaviour-preserving (proven by \`${t("terraform_equivalence_check")}\`); a major bump that changes resource shape ALTERS behaviour and is proven by a reviewed plan delta (or shipped \`proposed — unproven\`) — never a false equivalence claim.
 
 1. **task list**: create your task list for this run as your first action.
 
-2. **detect**: call \`${t("terraform_version_currency")}\` — it returns provider/module pins that are outdated or unpinned, each with the current constraint, the latest version, and how many majors behind it is.
+2. **detect**: call \`${t("terraform_version_currency")}\` — it returns provider/module pins that are outdated or unpinned, each with the current constraint, the latest version, how many majors behind it is, and \`latest_in_major\` — the newest release in the major it already sits on.
 
-3. **pick scope — ONE provider or module per PR**: take the most impactful safe upgrade first (a security-relevant provider bump, or pinning an unpinned pin to an exact constraint). **Targeted directive override:** if YOUR TASK names a specific provider/module, act only on it. Unless the task asks for more, open **at most one PR this run**; list deferred upgrades in the final report (never skip silently).
+3. **pick scope — ONE provider or module per PR**: take the most impactful safe upgrade first (a security-relevant provider bump, or pinning an unpinned pin to an exact constraint). A row with \`latest_in_major\` has an upgrade that crosses no major — take that one when the major is not allowed (\`allow_major_upgrade\`), rather than reporting that nothing could be done. **Targeted directive override:** if YOUR TASK names a specific provider/module, act only on it. Unless the task asks for more, open **at most one PR this run**; list deferred upgrades in the final report (never skip silently).
 
 4. **classify the bump (this decides the proof)**:
-   - **config-preserving** — a version-constraint change only (a patch/minor bump, or pinning a floating version) with NO change to any resource or argument. This is behaviour-preserving: prove it with \`${t("terraform_equivalence_check")}\` exactly as Refactor does — it must return \`equivalent: true\` (same resource set, identical arguments, validate + fmt clean). The push hard-fails an unproven one.
-   - **behaviour-affecting** — a major bump that requires resource/argument changes (renamed args, new required blocks, changed defaults). Equivalence is FALSE and must never be claimed. Make the minimal code changes the new major requires — use \`${t("terraform_validate")}\`'s \`providers\` majors and \`${t("terraform_provider_schema")}\` to get the new argument shape — then prove via the reviewed-plan path in step 6.
+   - **config-preserving** — a PROVIDER version-constraint change only (a patch/minor bump, or pinning a floating version) with NO change to any resource or argument. This is behaviour-preserving: prove it with \`${t("terraform_equivalence_check")}\` exactly as Refactor does — it must return \`equivalent: true\` (same resource set, identical arguments, validate + fmt clean). The push hard-fails an unproven one.
+   - **behaviour-affecting** — a major bump that requires resource/argument changes (renamed args, new required blocks, changed defaults), AND every registry MODULE version change, patch included: the module's resources are its code, which the bump replaces outside this tree, so \`${t("terraform_equivalence_check")}\` cannot see what changed and will not claim it. Equivalence is FALSE and must never be claimed. Make the minimal code changes the new major requires — use \`${t("terraform_validate")}\`'s \`providers\` majors and \`${t("terraform_provider_schema")}\` to get the new argument shape — then prove via the reviewed-plan path in step 6.
 
 4b. **for a provider MAJOR bump, call \`${t("terraform_provider_upgrade")}\` BEFORE editing.** It returns the codified breaking changes for that exact major boundary, each with the file it is in. Three things in its output decide what you do next, and none of them can be inferred from the diff:
    - \`needs_human: true\` — the transform MOVES STATE (a removed resource type, or a rename the vendor marks manual), forces replacement, or needs the VALUE changed and not just the name. Never apply one autonomously: put it in its own PR, label it \`needs-human\` (\`${t("add_labels")}\`), and name the affected resources in the body. Read \`needs_human_reason\` — the three causes need different PR bodies.
@@ -30,7 +30,7 @@ This mode turns the version-currency ADVISORY into action: it bumps stale/unpinn
 
 6. **prove safety**:
    - config-preserving → \`${t("terraform_equivalence_check")}\` is the proof (\`equivalent: true\`).
-   - behaviour-affecting → call \`${t("terraform_plan")}\` when cloud credentials are present and attach the **reviewed plan delta** as the proof; treat \`has_destroy_or_replace\`/\`stateful_destructive\` exactly as Remediate (a stateful destroy/replace is hard-blocked at push unless \`allow_replace\` covers that address — abandon otherwise). With NO creds, do not guess: ship the PR labelled \`proposed — unproven\` (\`${t("add_labels")}\`) with the proposed-unproven banner, stating the major bump ALTERS behaviour and the plan must be reviewed.
+   - behaviour-affecting → call \`${t("terraform_plan")}\` when cloud credentials are present and attach the **reviewed plan delta** as the proof; treat \`has_destroy_or_replace\`/\`stateful_destructive\` exactly as Remediate (a stateful destroy/replace is hard-blocked at push unless \`allow_replace\` covers that address — abandon otherwise). With NO creds, do not guess: ship the PR labelled \`proposed-unproven\` (exactly that name, \`${t("add_labels")}\`) with the proposed-unproven banner, stating the major bump ALTERS behaviour and the plan must be reviewed.
    - record either proof with \`${t("terraform_emit_evidence")}\`.
 
 7. **keep module tests consistent** (only if the bump changed a local module's interface): \`${t("terraform_module_tests")}\` — update the drifting \`examples/\`/tests, never weaken an assertion.

package/src/phases/applyPlan.ts

@@ -7,10 +7,11 @@
  *   - its marker says a re-scan PROVED the fix — never an unproven or a
  *     judgement suggestion, which the review showed as plain code on purpose,
  *   - it was proved against the PR's current head, so the lines it replaces are
- *     exactly the lines the proof saw — a push since then makes it stale,
+ *     exactly the lines the proof saw — a push since then makes it stale, until
+ *     the next review re-proves it there and replies with the lines it used,
  *   - its thread is still open: a resolved thread's finding is already handled.
  */
-import { isOwnReviewComment, parseCommentMarker } from "#app/mcp/reviewMarkers";
+import { isOwnReviewComment, parseCommentMarker, suggestionText } from "#app/mcp/reviewMarkers";
 
 export interface ReviewCommentLike {
   id: number;
@@ -39,14 +40,6 @@ export interface SkippedSuggestion {
   reason: string;
 }
 
-const SUGGESTION = /```suggestion\r?\n([\s\S]*?)```/;
-
-/** The text of a comment's `suggestion` block, without its closing newline. */
-export function suggestionText(body: string): string | undefined {
-  const m = SUGGESTION.exec(body);
-  return m ? (m[1] ?? "").replace(/\r?\n$/, "") : undefined;
-}
-
 export function planApply(input: {
   comments: readonly ReviewCommentLike[];
   /** root comment id → whether its thread is still open */
@@ -66,12 +59,21 @@ export function planApply(input: {
       skip("the comment carries no suggestion block");
       continue;
     }
+    // proved on this head, at the comment's own lines — or proved on an earlier
+    // one and re-proved here by the engine, at the lines the re-proof names
+    let line = c.original_line;
+    let startLine = c.original_start_line ?? line;
     if (c.original_commit_id !== input.headSha) {
-      skip("it was proved against an earlier commit; the next review re-proves it");
-      continue;
+      const reproof = reproofAt(input.comments, c.id, input.headSha);
+      if (!reproof) {
+        skip(
+          "it was proved against an earlier commit and does not hold on this one — the review re-proves it on each push while it still fits",
+        );
+        continue;
+      }
+      line = reproof.line;
+      startLine = reproof.startLine;
     }
-    const line = c.original_line;
-    const startLine = c.original_start_line ?? line;
     if (c.side === "LEFT" || line === undefined || startLine === undefined || startLine > line) {
       skip("it does not anchor to a line range of the new code");
       continue;
@@ -88,6 +90,23 @@ export function planApply(input: {
   return { edits, skipped };
 }
 
+/** The engine's latest re-proof of root `rootId`'s suggestion on `head`, if any. */
+function reproofAt(
+  comments: readonly ReviewCommentLike[],
+  rootId: number,
+  head: string,
+): { startLine: number; line: number } | null {
+  let found: { startLine: number; line: number } | null = null;
+  for (const r of comments) {
+    if (r.in_reply_to_id !== rootId || !isOwnReviewComment(r.user, r.body)) continue;
+    const marker = parseCommentMarker(r.body);
+    if (marker?.kind === "reproof" && marker.head === head) {
+      found = { startLine: marker.startLine, line: marker.line };
+    }
+  }
+  return found;
+}
+
 /**
  * Replace each edit's line range, bottom-up so earlier ranges keep their line
  * numbers. The file's line ending and final newline are kept.

package/src/phases/applySuggestions.ts

@@ -19,6 +19,7 @@ import {
   listOpenInfraweaverThreads,
   RESOLVE_REVIEW_THREAD_MUTATION,
 } from "#app/mcp/reviewComments";
+import { count } from "#app/mcp/terraform/prose";
 import {
   type ApplyEdit,
   applyEdits,
@@ -156,14 +157,13 @@ async function apply(repo: Repo, comment: PrCommentRunContext): Promise<ApplyOut
     base_tree: head.tree.sha,
     tree,
   });
-  const count = batch.length;
   const { data: commit } = await octokit.rest.git.createCommit({
     owner,
     repo: name,
     tree: newTree.sha,
     parents: [headSha],
     message:
-      `Apply ${count} proven review suggestion${count === 1 ? "" : "s"}\n\n` +
+      `Apply ${count(batch.length, "proven review suggestion")}\n\n` +
       `Each was proved by ${PRODUCT_NAME}'s re-scan of ${headSha.slice(0, 7)}; ` +
       `requested by @${comment.author} in #${comment.number}.`,
   });

package/src/phases/runAgentWithWatchdogs.ts

@@ -15,6 +15,7 @@ import { buildRunQuotas, hasGraceReserve } from "#app/agents/quotaReserve";
 import type { Agent, AgentResult } from "#app/agents/shared";
 import { reportProgress } from "#app/mcp/comment";
 import type { ToolContext } from "#app/mcp/server";
+import { count } from "#app/mcp/terraform/prose";
 import type { ToolState } from "#app/toolState";
 import { raceAgentRun } from "#app/utils/agent/agentRace";
 import { INFRAWEAVER_DATA_DIR } from "#app/utils/agent/codexHome";
@@ -236,7 +237,7 @@ export async function runAgentWithWatchdogs(params: RunAgentParams): Promise<Age
       if (!wasTracked) return;
       const trackedRanges = toolState.diffCoverage?.coveredRanges ?? [];
       log.debug(
-        `» diff coverage tracked from tool ${event.toolName} (${trackedRanges.length} merged range${trackedRanges.length === 1 ? "" : "s"})`,
+        `» diff coverage tracked from tool ${event.toolName} (${count(trackedRanges.length, "merged range")})`,
       );
     },
   });

package/src/toolState.ts

@@ -6,6 +6,7 @@ import {
 } from "@infraweaver-io/ci/progressComment";
 import type { AgentUsage } from "@infraweaver-io/models/usage";
 import { DispatchRecorder } from "#app/agents/dispatchMetrics";
+import type { StagedReview } from "#app/mcp/review";
 import { createScanSession, type ScanSession } from "#app/mcp/terraform/scanSession";
 import type { PrepResult } from "#app/prep/types";
 import type { AgentDiagnostic } from "#app/utils/agent/agentHangReport";
@@ -140,6 +141,10 @@ export interface ToolState {
   // number of remediation PRs opened this run. set only in Remediate mode by
   // create_pull_request; read by the max_prs guardrail (mcp/guardrails.ts).
   remediationPrsOpened?: number;
+  // remote branch → the commit push_branch pushed there this run. read by the
+  // pushed-head guardrail: a write mode's PR may only present a commit this
+  // run pushed, because the push is where every content guardrail runs.
+  pushedHeads?: Map<string, string>;
   // the terraform tool-to-tool session: the baseline/scan/plan/cost/refactor
   // signals the terraform MCP tools hand to one another and to end-of-run
   // reporting. Extracted from this god-bag into its own typed, documented
@@ -170,6 +175,8 @@ export interface ToolState {
     nodeId: string;
     reviewedSha: string | undefined;
   };
+  // comments and dismissals stage_review holds for the next review submission
+  stagedReview?: StagedReview | undefined;
   // dedupe key: parent review comment_id → most-recent reply written this
   // session by reply_to_review_comment. used by duplicateReplyDecision to
   // skip identical-body re-emissions of the same call (PR #610 root cause).

package/src/utils/agent/codexOAuth.ts

@@ -1,5 +1,5 @@
 /**
- * Pure-stdlib (fetch + Buffer) Codex OAuth refresh + JWT exp decoding.
+ * Codex OAuth refresh (fetch) + JWT exp decoding (jose, decode-only).
  *
  * Deliberately free of node:child_process / spawn / mkdtemp: the Cloud's
  * Next.js server imports `refreshCodexAuthBody` through the
@@ -8,6 +8,8 @@
  * bundle. `src/utils/agent/codexHome.ts` is the in-runner consumer.
  */
 
+import { decodeJwt } from "jose";
+
 export interface CodexAuthBody {
   auth_mode: "chatgpt";
   tokens: {
@@ -98,16 +100,14 @@ export async function refreshCodexAuthBody(body: CodexAuthBody): Promise<CodexAu
  * would just delay the inevitable 401 from OpenAI. No security boundary
  * at this decode step. */
 export function decodeJwtExpMs(token: string): number | null {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  let payload: { exp?: unknown };
+  let exp: unknown;
   try {
-    payload = JSON.parse(Buffer.from(parts[1]!, "base64url").toString("utf8"));
+    exp = decodeJwt(token).exp;
   } catch {
     return null;
   }
-  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
-  return payload.exp * 1000;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+  return exp * 1000;
 }
 
 /** parse + validate a Codex auth.json body from its JSON-string form.

package/src/utils/agent/openCodeModels.ts

@@ -29,6 +29,7 @@
 // (`selectFallbackModelIfNeeded` + `autoSelectModel`) share one shell-out.
 
 import { spawnSync } from "node:child_process";
+import { stripVTControlCharacters } from "node:util";
 import { getModelEnvVars } from "@infraweaver-io/models/catalog";
 import { log } from "#app/utils/cli";
 
@@ -62,11 +63,6 @@ let baseline: Set<string> | undefined;
 let authorized: Set<string> | undefined;
 let failure: string | undefined;
 
-// the CLI paints its errors; these get re-rendered into a PR comment, where raw
-// SGR escapes read as literal `[91m` noise.
-// biome-ignore lint/suspicious/noControlCharactersInRegex: matching SGR escapes is the point
-const ANSI_PATTERN = /\u001b\[[0-9;]*m/g;
-
 function readModels(cliPath: string): Set<string> {
   // spawnSync, not execFileSync: we want opencode's stderr as a VALUE rather
   // than a throw, so `getModelsFailure` can hand the real reason to
@@ -84,7 +80,9 @@ function readModels(cliPath: string): Set<string> {
     // `result.error` carries the only reason there is. without folding it in,
     // `failure` stays undefined and the empty set reaches `validateAgentApiKey`
     // as a bare "you have no key" verdict for what is really a runner problem.
-    const stderr = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim();
+    // the CLI paints its errors; this gets re-rendered into a PR comment, where
+    // raw escapes read as literal `[91m` noise.
+    const stderr = stripVTControlCharacters(result.stderr ?? "").trim();
     failure = stderr || result.error?.message;
     log.debug(`» \`opencode models\` failed (${result.status}): ${failure}`);
     return new Set();

package/src/utils/cli.ts

@@ -2,35 +2,5 @@
  * CLI utilities
  */
 
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-
 // re-export logging utilities for backward compatibility
-export {
-  formatIndentedField,
-  formatJsonValue,
-  formatUsageSummary,
-  log,
-  writeSummary,
-} from "#app/utils/log";
-
-/**
- * Finds a CLI executable path by checking if it's installed globally
- * @param name The name of the CLI executable to find
- * @returns The path to the CLI executable, or null if not found
- */
-export function findCliPath(name: string): string | null {
-  // `which` is POSIX-only. The action always runs on Linux, but this repo is
-  // developed on Windows, where `which` does not exist and the lookup fails
-  // silently as "not installed" — use `where` there. `where` can print several
-  // matches, one per line, so take the first.
-  const isWindows = process.platform === "win32";
-  const result = spawnSync(isWindows ? "where" : "which", [name], { encoding: "utf-8" });
-  if (result.status === 0 && result.stdout) {
-    const cliPath = result.stdout.split(/\r?\n/)[0]?.trim();
-    if (cliPath && existsSync(cliPath)) {
-      return cliPath;
-    }
-  }
-  return null;
-}
+export { formatJsonValue, formatUsageSummary, log, writeSummary } from "#app/utils/log";

package/src/utils/cloud/runContext.ts

@@ -210,10 +210,7 @@ export async function fetchRunContext(params: {
   repoContext: RepoContext;
   oidcToken?: string | undefined;
 }): Promise<RunContext> {
-  const timeoutMs = 30000;
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-
+  // no `signal`: apiFetch applies the cloud transport's default timeout
   try {
     const headers: Record<string, string> = {
       Authorization: `Bearer ${params.token}`,
@@ -225,11 +222,8 @@ export async function fetchRunContext(params: {
     const response = await apiFetch({
       path: `/api/repo/${params.repoContext.owner}/${params.repoContext.name}/run-context`,
       headers,
-      signal: controller.signal,
     });
 
-    clearTimeout(timeoutId);
-
     if (!response.ok) {
       if ((response.status === 401 || response.status === 403) && isBackendConfigured()) {
         log.warning(cloudAuthHint(response.status, params.oidcToken));
@@ -285,7 +279,6 @@ export async function fetchRunContext(params: {
       ...(moduleCredentials ? { moduleCredentials } : {}),
     };
   } catch (err) {
-    clearTimeout(timeoutId);
     return fellBackToDefaults(errorMessageOr(err, "request failed"), true);
   }
 }

package/src/utils/config/baseRefConfig.ts

@@ -80,6 +80,12 @@ export const GATE_RELEVANT_CONFIG_KEYS = [
   // silence it from the PR that set it, which is the shape this module exists
   // to refuse. Read from the base ref; a PR cannot retune it for its own run.
   "repeated_literal_threshold",
+  // which variable files the scanners load: a PR that unmaps its own var file
+  // would hide what that file sets.
+  "var_files",
+  // how many review comments post inline: lowering it moves findings out of
+  // the diff view and into the body, which a PR should not do for itself.
+  "review_comment_limit",
 ] as const satisfies readonly InfraweaverConfigKey[];
 
 /**

package/src/utils/config/infraweaverConfig.ts

@@ -58,6 +58,8 @@ export const INFRAWEAVER_CONFIG_KEYS = [
   "module_catalogue",
   "repeated_literal_threshold",
   "required_controls",
+  "var_files",
+  "review_comment_limit",
 ] as const;
 
 export type InfraweaverConfigKey = (typeof INFRAWEAVER_CONFIG_KEYS)[number];

package/src/utils/config/payload.ts

@@ -6,6 +6,7 @@ import { type } from "arktype";
 import { PRODUCT_SLUG } from "#app/brand";
 import type { AuthorPermission, PayloadEvent } from "#app/external";
 import { parseToolsNetwork } from "#app/mcp/terraform/scannerEgress";
+import { parseVarFileMappings, type VarFileMapping } from "#app/mcp/terraform/treeLayout";
 import { log } from "#app/utils/cli";
 import type { RepoSettings } from "#app/utils/cloud/runContext";
 import { applyBaseRefConfigPolicy } from "#app/utils/config/baseRefConfig";
@@ -115,6 +116,8 @@ export const Inputs = type({
   "protected_paths?": type.string.or("undefined"),
   "autonomy_threshold?": type.string.or("undefined"),
   "repeated_literal_threshold?": type.string.or("undefined"),
+  "var_files?": type.string.or("undefined"),
+  "review_comment_limit?": type.string.or("undefined"),
   "required_controls?": type.string.or("undefined"),
   "gitleaks?": type.string.or("undefined"),
   "cost_increase_block_usd?": type.string.or("undefined"),
@@ -216,6 +219,8 @@ function resolveNonPromptInputs() {
     protected_paths: core.getInput("protected_paths") || undefined,
     autonomy_threshold: core.getInput("autonomy_threshold") || undefined,
     repeated_literal_threshold: core.getInput("repeated_literal_threshold") || undefined,
+    var_files: core.getInput("var_files") || undefined,
+    review_comment_limit: core.getInput("review_comment_limit") || undefined,
     required_controls: core.getInput("required_controls") || undefined,
     gitleaks: core.getInput("gitleaks") || undefined,
     cost_increase_block_usd: core.getInput("cost_increase_block_usd") || undefined,
@@ -275,6 +280,35 @@ function parseRepeatThreshold(raw: string | undefined): number | undefined {
   return n;
 }
 
+/** Inline comments one review posts when `review_comment_limit` is unset. */
+const DEFAULT_REVIEW_COMMENT_LIMIT = 25;
+
+/**
+ * The `review_comment_limit` setting: a whole number of inline comments, 0 for
+ * no limit. Unset or unusable falls back to the default rather than failing the
+ * run — a presentation knob set wrong is not worth losing a review over — and an
+ * unusable value says so, since silently ignoring it would look like a bug.
+ */
+function parseReviewCommentLimit(raw: string | undefined): number {
+  const text = raw?.trim();
+  if (!text) return DEFAULT_REVIEW_COMMENT_LIMIT;
+  const n = Number(text);
+  if (Number.isInteger(n) && n >= 0) return n;
+  log.warning(
+    `» review_comment_limit: "${text}" is not a whole number — using ${DEFAULT_REVIEW_COMMENT_LIMIT}`,
+  );
+  return DEFAULT_REVIEW_COMMENT_LIMIT;
+}
+
+/** The `var_files` setting as mappings; a malformed entry is reported and left out. */
+function parseVarFiles(raw: string | undefined): VarFileMapping[] | undefined {
+  const { mappings, invalid } = parseVarFileMappings(raw);
+  for (const entry of invalid) {
+    log.warning(`» var_files: "${entry}" is not root=file — ignored`);
+  }
+  return mappings.length > 0 ? mappings : undefined;
+}
+
 function parseSeverityThreshold(raw: string | undefined): string | undefined {
   if (!raw) return undefined;
   const v = raw.trim().toLowerCase();
@@ -569,6 +603,13 @@ export function resolvePayload(
     repeatedLiteralThreshold: parseRepeatThreshold(
       inputs.repeated_literal_threshold ?? fileConfig.repeated_literal_threshold,
     ),
+    // `-var-file` files and the root each belongs to, for the files no
+    // matching can place (`treeLayout.ts`).
+    varFiles: parseVarFiles(inputs.var_files ?? fileConfig.var_files),
+    // inline comments one review posts; the rest are listed in its body.
+    reviewCommentLimit: parseReviewCommentLimit(
+      inputs.review_comment_limit ?? fileConfig.review_comment_limit,
+    ),
     // compliance controls that must have NO open finding — a finding mapping to
     // one fails the gate regardless of severity (the "required controls" policy:
     // binds the crosswalk to the gate). Matched by framework / control /

package/src/utils/github/assets.ts

@@ -83,11 +83,6 @@ export async function downloadAssetsInMarkdown(
  *  {@link MAX_ASSET_BYTES}). */
 const ASSET_DOWNLOAD_CONCURRENCY = 5;
 
-/** Escape a literal for embedding in a RegExp. */
-function escapeRegExp(literal: string): string {
-  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 /**
  * Substitute every key of `replacements` in `text` in ONE pass, via a single
  * alternation.
@@ -103,7 +98,7 @@ function replaceAll(text: string, replacements: Map<string, string>): string {
   if (replacements.size === 0) return text;
   const pattern = [...replacements.keys()]
     .sort((a, b) => b.length - a.length)
-    .map(escapeRegExp)
+    .map((key) => RegExp.escape(key))
     .join("|");
   return text.replace(new RegExp(pattern, "g"), (match) => replacements.get(match) ?? match);
 }