open-multi-agent-kit 0.90.7 → 0.90.9

package/dist/guardrails/replay-ledger-store.js

@@ -0,0 +1,211 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, existsSync, constants as fsConstants, fstatSync, fsyncSync, ftruncateSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, } from "node:fs";
+import { dirname } from "node:path";
+import { fsyncDirectory, ReplayLedgerLock, writeAll } from "./replay-ledger-lock.js";
+import { quarantineReplayLedgerSuffix } from "./replay-ledger-quarantine.js";
+const GENESIS_HASH = "genesis";
+export const EMPTY_REPLAY_LEDGER_HEAD = Object.freeze({
+    fileIdentity: null,
+    size: 0,
+    lastSeq: 0,
+    lastHash: GENESIS_HASH,
+});
+function identity(stat) {
+    return Object.freeze({ dev: String(stat.dev), ino: String(stat.ino) });
+}
+function sameIdentity(left, right) {
+    return left === null ? right === null : right !== null && left.dev === right.dev && left.ino === right.ino;
+}
+export function replayLedgerHeadsEqual(left, right) {
+    return (sameIdentity(left.fileIdentity, right.fileIdentity) &&
+        left.size === right.size &&
+        left.lastSeq === right.lastSeq &&
+        left.lastHash === right.lastHash);
+}
+function parseHead(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error("replay committed head is invalid");
+    const record = value;
+    if (Object.keys(record).sort().join(",") !== "fileIdentity,lastHash,lastSeq,size") {
+        throw new Error("replay committed head has an invalid key set");
+    }
+    const rawIdentity = record.fileIdentity;
+    let fileIdentity = null;
+    if (rawIdentity !== null) {
+        if (typeof rawIdentity !== "object" || Array.isArray(rawIdentity))
+            throw new Error("replay file identity is invalid");
+        const fields = rawIdentity;
+        if (Object.keys(fields).sort().join(",") !== "dev,ino" ||
+            typeof fields.dev !== "string" ||
+            typeof fields.ino !== "string" ||
+            !/^\d+$/.test(fields.dev) ||
+            !/^\d+$/.test(fields.ino)) {
+            throw new Error("replay file identity is invalid");
+        }
+        fileIdentity = Object.freeze({ dev: fields.dev, ino: fields.ino });
+    }
+    if (!Number.isSafeInteger(record.size) ||
+        record.size < 0 ||
+        !Number.isSafeInteger(record.lastSeq) ||
+        record.lastSeq < 0 ||
+        typeof record.lastHash !== "string" ||
+        (record.lastSeq === 0 ? record.lastHash !== GENESIS_HASH : !/^[0-9a-f]{64}$/.test(record.lastHash))) {
+        throw new Error("replay committed head fields are invalid");
+    }
+    return Object.freeze({
+        fileIdentity,
+        size: record.size,
+        lastSeq: record.lastSeq,
+        lastHash: record.lastHash,
+    });
+}
+export class ReplayLedgerStore {
+    path;
+    inspect;
+    headPath;
+    lock;
+    afterLedgerFsync;
+    beforeQuarantineFsync;
+    constructor(path, inspect, options = {}) {
+        this.path = path;
+        this.inspect = inspect;
+        mkdirSync(dirname(path), { recursive: true });
+        this.headPath = `${path}.head`;
+        this.lock = new ReplayLedgerLock(`${path}.lock`);
+        this.afterLedgerFsync = options.afterLedgerFsync;
+        this.beforeQuarantineFsync = options.beforeQuarantineFsync;
+    }
+    withLock(operation) {
+        return this.lock.run(operation);
+    }
+    readVerified() {
+        const ledgerExists = existsSync(this.path);
+        const headExists = existsSync(this.headPath);
+        if (!ledgerExists && !headExists)
+            return { bytes: Buffer.alloc(0), head: EMPTY_REPLAY_LEDGER_HEAD };
+        if (ledgerExists && !headExists) {
+            const fd = openSync(this.path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+            try {
+                const stat = fstatSync(fd);
+                if (!stat.isFile() || stat.size !== 0)
+                    throw new Error("replay ledger or committed head suffix is missing");
+            }
+            finally {
+                closeSync(fd);
+            }
+            unlinkSync(this.path);
+            fsyncDirectory(dirname(this.path));
+            return { bytes: Buffer.alloc(0), head: EMPTY_REPLAY_LEDGER_HEAD };
+        }
+        if (!ledgerExists)
+            throw new Error("replay ledger or committed head suffix is missing");
+        const head = parseHead(JSON.parse(readFileSync(this.headPath, "utf8")));
+        const fd = openSync(this.path, fsConstants.O_RDWR | (fsConstants.O_NOFOLLOW ?? 0));
+        try {
+            const before = fstatSync(fd);
+            const bytes = readFileSync(fd);
+            const after = fstatSync(fd);
+            if (!before.isFile() ||
+                !after.isFile() ||
+                !sameIdentity(identity(before), identity(after)) ||
+                before.size !== after.size ||
+                after.size !== bytes.byteLength ||
+                !sameIdentity(head.fileIdentity, identity(after)) ||
+                head.size > after.size) {
+                throw new Error("replay ledger tampered: file identity or size does not match its committed head");
+            }
+            const committedBytes = head.size === after.size ? bytes : bytes.subarray(0, head.size);
+            const inspected = this.inspect(committedBytes);
+            if (inspected.lastSeq !== head.lastSeq || inspected.lastHash !== head.lastHash) {
+                throw new Error("replay ledger suffix does not match its committed head");
+            }
+            if (head.size < after.size) {
+                quarantineReplayLedgerSuffix(this.path, bytes.subarray(head.size), this.beforeQuarantineFsync);
+                ftruncateSync(fd, head.size);
+                fsyncSync(fd);
+                fsyncDirectory(dirname(this.path));
+            }
+            return { bytes: committedBytes, head };
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    initializeGenesis() {
+        const fd = openSync(this.path, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);
+        try {
+            fsyncSync(fd);
+            const stat = fstatSync(fd);
+            const head = Object.freeze({ ...EMPTY_REPLAY_LEDGER_HEAD, fileIdentity: identity(stat) });
+            this.publishHead(head);
+            return head;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    publishHead(head) {
+        const temp = `${this.headPath}.${randomUUID()}.tmp`;
+        const fd = openSync(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);
+        try {
+            writeAll(fd, Buffer.from(`${JSON.stringify(head)}\n`, "utf8"));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        try {
+            renameSync(temp, this.headPath);
+            fsyncDirectory(dirname(this.path));
+        }
+        catch (error) {
+            if (existsSync(temp))
+                unlinkSync(temp);
+            throw error;
+        }
+    }
+    load(expectedHead) {
+        return this.withLock(() => {
+            const snapshot = this.readVerified();
+            if (expectedHead !== undefined && !replayLedgerHeadsEqual(snapshot.head, expectedHead)) {
+                throw new Error("replay ledger expected-head CAS verification failed");
+            }
+            return snapshot;
+        });
+    }
+    append(line, nextSeq, nextHash, expectedHead) {
+        return this.withLock(() => {
+            const snapshot = this.readVerified();
+            if (!replayLedgerHeadsEqual(snapshot.head, expectedHead)) {
+                throw new Error("replay ledger concurrent append failed expected-head CAS");
+            }
+            const appendHead = snapshot.head.fileIdentity === null ? this.initializeGenesis() : snapshot.head;
+            const fd = openSync(this.path, fsConstants.O_CREAT | fsConstants.O_APPEND | fsConstants.O_WRONLY | (fsConstants.O_NOFOLLOW ?? 0), 0o600);
+            try {
+                const before = fstatSync(fd);
+                if (before.size !== appendHead.size || !sameIdentity(appendHead.fileIdentity, identity(before))) {
+                    throw new Error("replay ledger file identity or size changed before CAS append");
+                }
+                writeAll(fd, line);
+                fsyncSync(fd);
+                const after = fstatSync(fd);
+                if (!sameIdentity(identity(before), identity(after)) || after.size !== appendHead.size + line.byteLength) {
+                    throw new Error("replay ledger file changed during CAS append");
+                }
+                const head = Object.freeze({
+                    fileIdentity: identity(after),
+                    size: after.size,
+                    lastSeq: nextSeq,
+                    lastHash: nextHash,
+                });
+                this.afterLedgerFsync?.();
+                this.publishHead(head);
+                return head;
+            }
+            finally {
+                closeSync(fd);
+            }
+        });
+    }
+}
+//# sourceMappingURL=replay-ledger-store.js.map

package/dist/guardrails/replay-ledger-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-ledger-store.js","sourceRoot":"","sources":["../../src/guardrails/replay-ledger-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAE7E,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,CAAC,MAAM,wBAAwB,GAAqB,MAAM,CAAC,MAAM,CAAC;IACvE,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,YAAY;CACtB,CAAC,CAAC;AASH,SAAS,QAAQ,CAAC,IAAkC,EAAoC;IACvF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAAA,CACvE;AAED,SAAS,YAAY,CAAC,IAAsC,EAAE,KAAuC,EAAW;IAC/G,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAAA,CAC3G;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAsB,EAAE,KAAuB,EAAW;IAChG,OAAO,CACN,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;QACnD,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAChC,CAAC;AAAA,CACF;AAED,SAAS,SAAS,CAAC,KAAc,EAAoB;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,oCAAoC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IAAI,YAAY,GAAqC,IAAI,CAAC;IAC1D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,WAAsC,CAAC;QACtD,IACC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;YAClD,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACzB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EACxB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,CAAC,IAAe,GAAG,CAAC;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACpC,MAAM,CAAC,OAAkB,GAAG,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAClG,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,YAAY;QACZ,IAAI,EAAE,MAAM,CAAC,IAAc;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAiB;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAC,CAAC;AAAA,CACH;AAOD,MAAM,OAAO,iBAAiB;IACZ,IAAI,CAAS;IACb,OAAO,CAAqC;IAC5C,QAAQ,CAAS;IACjB,IAAI,CAAmB;IACvB,gBAAgB,CAA2B;IAC3C,qBAAqB,CAA2B;IAEjE,YAAY,IAAY,EAAE,OAA2C,EAAE,OAAO,GAA6B,EAAE,EAAE;QAC9G,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAAA,CAC3D;IAEO,QAAQ,CAAI,SAAkB,EAAK;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAAA,CAChC;IAEO,YAAY,GAAkB;QACrC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACpG,IAAI,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;YACrF,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAC7G,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC5B,IACC,CAAC,MAAM,CAAC,MAAM,EAAE;gBAChB,CAAC,KAAK,CAAC,MAAM,EAAE;gBACf,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;gBAC1B,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU;gBAC/B,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,EACrB,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACvF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC/C,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5B,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBAC/F,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IAAA,CACD;IAEO,iBAAiB,GAAqB;QAC7C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvG,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,wBAAwB,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IAAA,CACD;IAEO,WAAW,CAAC,IAAsB,EAAQ;QACjD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClG,IAAI,CAAC;YACJ,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACJ,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAED,IAAI,CAAC,YAA+B,EAAiB;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,QAAQ,CAAC;QAAA,CAChB,CAAC,CAAC;IAAA,CACH;IAED,MAAM,CAAC,IAAY,EAAE,OAAe,EAAE,QAAgB,EAAE,YAA8B,EAAoB;QACzG,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClG,MAAM,EAAE,GAAG,QAAQ,CAClB,IAAI,CAAC,IAAI,EACT,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EACjG,KAAK,CACL,CAAC;YACF,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACjG,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBAClF,CAAC;gBACD,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBACnB,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1G,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC1B,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC;oBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,OAAO;oBAChB,QAAQ,EAAE,QAAQ;iBAClB,CAAC,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACb,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QAAA,CACD,CAAC,CAAC;IAAA,CACH;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n\tcloseSync,\n\texistsSync,\n\tconstants as fsConstants,\n\tfstatSync,\n\tfsyncSync,\n\tftruncateSync,\n\tmkdirSync,\n\topenSync,\n\treadFileSync,\n\trenameSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport type { ReplayLedgerHead } from \"../types/evidence.ts\";\nimport { fsyncDirectory, ReplayLedgerLock, writeAll } from \"./replay-ledger-lock.ts\";\nimport { quarantineReplayLedgerSuffix } from \"./replay-ledger-quarantine.ts\";\n\nconst GENESIS_HASH = \"genesis\";\nexport const EMPTY_REPLAY_LEDGER_HEAD: ReplayLedgerHead = Object.freeze({\n\tfileIdentity: null,\n\tsize: 0,\n\tlastSeq: 0,\n\tlastHash: GENESIS_HASH,\n});\ninterface InspectedLedger {\n\treadonly lastSeq: number;\n\treadonly lastHash: string;\n}\ninterface StoreSnapshot {\n\treadonly bytes: Buffer;\n\treadonly head: ReplayLedgerHead;\n}\nfunction identity(stat: ReturnType<typeof fstatSync>): ReplayLedgerHead[\"fileIdentity\"] {\n\treturn Object.freeze({ dev: String(stat.dev), ino: String(stat.ino) });\n}\n\nfunction sameIdentity(left: ReplayLedgerHead[\"fileIdentity\"], right: ReplayLedgerHead[\"fileIdentity\"]): boolean {\n\treturn left === null ? right === null : right !== null && left.dev === right.dev && left.ino === right.ino;\n}\n\nexport function replayLedgerHeadsEqual(left: ReplayLedgerHead, right: ReplayLedgerHead): boolean {\n\treturn (\n\t\tsameIdentity(left.fileIdentity, right.fileIdentity) &&\n\t\tleft.size === right.size &&\n\t\tleft.lastSeq === right.lastSeq &&\n\t\tleft.lastHash === right.lastHash\n\t);\n}\n\nfunction parseHead(value: unknown): ReplayLedgerHead {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value))\n\t\tthrow new Error(\"replay committed head is invalid\");\n\tconst record = value as Record<string, unknown>;\n\tif (Object.keys(record).sort().join(\",\") !== \"fileIdentity,lastHash,lastSeq,size\") {\n\t\tthrow new Error(\"replay committed head has an invalid key set\");\n\t}\n\tconst rawIdentity = record.fileIdentity;\n\tlet fileIdentity: ReplayLedgerHead[\"fileIdentity\"] = null;\n\tif (rawIdentity !== null) {\n\t\tif (typeof rawIdentity !== \"object\" || Array.isArray(rawIdentity))\n\t\t\tthrow new Error(\"replay file identity is invalid\");\n\t\tconst fields = rawIdentity as Record<string, unknown>;\n\t\tif (\n\t\t\tObject.keys(fields).sort().join(\",\") !== \"dev,ino\" ||\n\t\t\ttypeof fields.dev !== \"string\" ||\n\t\t\ttypeof fields.ino !== \"string\" ||\n\t\t\t!/^\\d+$/.test(fields.dev) ||\n\t\t\t!/^\\d+$/.test(fields.ino)\n\t\t) {\n\t\t\tthrow new Error(\"replay file identity is invalid\");\n\t\t}\n\t\tfileIdentity = Object.freeze({ dev: fields.dev, ino: fields.ino });\n\t}\n\tif (\n\t\t!Number.isSafeInteger(record.size) ||\n\t\t(record.size as number) < 0 ||\n\t\t!Number.isSafeInteger(record.lastSeq) ||\n\t\t(record.lastSeq as number) < 0 ||\n\t\ttypeof record.lastHash !== \"string\" ||\n\t\t(record.lastSeq === 0 ? record.lastHash !== GENESIS_HASH : !/^[0-9a-f]{64}$/.test(record.lastHash))\n\t) {\n\t\tthrow new Error(\"replay committed head fields are invalid\");\n\t}\n\treturn Object.freeze({\n\t\tfileIdentity,\n\t\tsize: record.size as number,\n\t\tlastSeq: record.lastSeq as number,\n\t\tlastHash: record.lastHash,\n\t});\n}\n\nexport interface ReplayLedgerStoreOptions {\n\treadonly afterLedgerFsync?: () => void;\n\treadonly beforeQuarantineFsync?: () => void;\n}\n\nexport class ReplayLedgerStore {\n\tprivate readonly path: string;\n\tprivate readonly inspect: (bytes: Buffer) => InspectedLedger;\n\tprivate readonly headPath: string;\n\tprivate readonly lock: ReplayLedgerLock;\n\tprivate readonly afterLedgerFsync: (() => void) | undefined;\n\tprivate readonly beforeQuarantineFsync: (() => void) | undefined;\n\n\tconstructor(path: string, inspect: (bytes: Buffer) => InspectedLedger, options: ReplayLedgerStoreOptions = {}) {\n\t\tthis.path = path;\n\t\tthis.inspect = inspect;\n\t\tmkdirSync(dirname(path), { recursive: true });\n\t\tthis.headPath = `${path}.head`;\n\t\tthis.lock = new ReplayLedgerLock(`${path}.lock`);\n\t\tthis.afterLedgerFsync = options.afterLedgerFsync;\n\t\tthis.beforeQuarantineFsync = options.beforeQuarantineFsync;\n\t}\n\n\tprivate withLock<T>(operation: () => T): T {\n\t\treturn this.lock.run(operation);\n\t}\n\n\tprivate readVerified(): StoreSnapshot {\n\t\tconst ledgerExists = existsSync(this.path);\n\t\tconst headExists = existsSync(this.headPath);\n\t\tif (!ledgerExists && !headExists) return { bytes: Buffer.alloc(0), head: EMPTY_REPLAY_LEDGER_HEAD };\n\t\tif (ledgerExists && !headExists) {\n\t\t\tconst fd = openSync(this.path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n\t\t\ttry {\n\t\t\t\tconst stat = fstatSync(fd);\n\t\t\t\tif (!stat.isFile() || stat.size !== 0) throw new Error(\"replay ledger or committed head suffix is missing\");\n\t\t\t} finally {\n\t\t\t\tcloseSync(fd);\n\t\t\t}\n\t\t\tunlinkSync(this.path);\n\t\t\tfsyncDirectory(dirname(this.path));\n\t\t\treturn { bytes: Buffer.alloc(0), head: EMPTY_REPLAY_LEDGER_HEAD };\n\t\t}\n\t\tif (!ledgerExists) throw new Error(\"replay ledger or committed head suffix is missing\");\n\t\tconst head = parseHead(JSON.parse(readFileSync(this.headPath, \"utf8\")));\n\t\tconst fd = openSync(this.path, fsConstants.O_RDWR | (fsConstants.O_NOFOLLOW ?? 0));\n\t\ttry {\n\t\t\tconst before = fstatSync(fd);\n\t\t\tconst bytes = readFileSync(fd);\n\t\t\tconst after = fstatSync(fd);\n\t\t\tif (\n\t\t\t\t!before.isFile() ||\n\t\t\t\t!after.isFile() ||\n\t\t\t\t!sameIdentity(identity(before), identity(after)) ||\n\t\t\t\tbefore.size !== after.size ||\n\t\t\t\tafter.size !== bytes.byteLength ||\n\t\t\t\t!sameIdentity(head.fileIdentity, identity(after)) ||\n\t\t\t\thead.size > after.size\n\t\t\t) {\n\t\t\t\tthrow new Error(\"replay ledger tampered: file identity or size does not match its committed head\");\n\t\t\t}\n\t\t\tconst committedBytes = head.size === after.size ? bytes : bytes.subarray(0, head.size);\n\t\t\tconst inspected = this.inspect(committedBytes);\n\t\t\tif (inspected.lastSeq !== head.lastSeq || inspected.lastHash !== head.lastHash) {\n\t\t\t\tthrow new Error(\"replay ledger suffix does not match its committed head\");\n\t\t\t}\n\t\t\tif (head.size < after.size) {\n\t\t\t\tquarantineReplayLedgerSuffix(this.path, bytes.subarray(head.size), this.beforeQuarantineFsync);\n\t\t\t\tftruncateSync(fd, head.size);\n\t\t\t\tfsyncSync(fd);\n\t\t\t\tfsyncDirectory(dirname(this.path));\n\t\t\t}\n\t\t\treturn { bytes: committedBytes, head };\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t}\n\n\tprivate initializeGenesis(): ReplayLedgerHead {\n\t\tconst fd = openSync(this.path, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);\n\t\ttry {\n\t\t\tfsyncSync(fd);\n\t\t\tconst stat = fstatSync(fd);\n\t\t\tconst head = Object.freeze({ ...EMPTY_REPLAY_LEDGER_HEAD, fileIdentity: identity(stat) });\n\t\t\tthis.publishHead(head);\n\t\t\treturn head;\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t}\n\n\tprivate publishHead(head: ReplayLedgerHead): void {\n\t\tconst temp = `${this.headPath}.${randomUUID()}.tmp`;\n\t\tconst fd = openSync(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);\n\t\ttry {\n\t\t\twriteAll(fd, Buffer.from(`${JSON.stringify(head)}\\n`, \"utf8\"));\n\t\t\tfsyncSync(fd);\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t\ttry {\n\t\t\trenameSync(temp, this.headPath);\n\t\t\tfsyncDirectory(dirname(this.path));\n\t\t} catch (error) {\n\t\t\tif (existsSync(temp)) unlinkSync(temp);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tload(expectedHead?: ReplayLedgerHead): StoreSnapshot {\n\t\treturn this.withLock(() => {\n\t\t\tconst snapshot = this.readVerified();\n\t\t\tif (expectedHead !== undefined && !replayLedgerHeadsEqual(snapshot.head, expectedHead)) {\n\t\t\t\tthrow new Error(\"replay ledger expected-head CAS verification failed\");\n\t\t\t}\n\t\t\treturn snapshot;\n\t\t});\n\t}\n\n\tappend(line: Buffer, nextSeq: number, nextHash: string, expectedHead: ReplayLedgerHead): ReplayLedgerHead {\n\t\treturn this.withLock(() => {\n\t\t\tconst snapshot = this.readVerified();\n\t\t\tif (!replayLedgerHeadsEqual(snapshot.head, expectedHead)) {\n\t\t\t\tthrow new Error(\"replay ledger concurrent append failed expected-head CAS\");\n\t\t\t}\n\t\t\tconst appendHead = snapshot.head.fileIdentity === null ? this.initializeGenesis() : snapshot.head;\n\t\t\tconst fd = openSync(\n\t\t\t\tthis.path,\n\t\t\t\tfsConstants.O_CREAT | fsConstants.O_APPEND | fsConstants.O_WRONLY | (fsConstants.O_NOFOLLOW ?? 0),\n\t\t\t\t0o600,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tconst before = fstatSync(fd);\n\t\t\t\tif (before.size !== appendHead.size || !sameIdentity(appendHead.fileIdentity, identity(before))) {\n\t\t\t\t\tthrow new Error(\"replay ledger file identity or size changed before CAS append\");\n\t\t\t\t}\n\t\t\t\twriteAll(fd, line);\n\t\t\t\tfsyncSync(fd);\n\t\t\t\tconst after = fstatSync(fd);\n\t\t\t\tif (!sameIdentity(identity(before), identity(after)) || after.size !== appendHead.size + line.byteLength) {\n\t\t\t\t\tthrow new Error(\"replay ledger file changed during CAS append\");\n\t\t\t\t}\n\t\t\t\tconst head = Object.freeze({\n\t\t\t\t\tfileIdentity: identity(after),\n\t\t\t\t\tsize: after.size,\n\t\t\t\t\tlastSeq: nextSeq,\n\t\t\t\t\tlastHash: nextHash,\n\t\t\t\t});\n\t\t\t\tthis.afterLedgerFsync?.();\n\t\t\t\tthis.publishHead(head);\n\t\t\t\treturn head;\n\t\t\t} finally {\n\t\t\t\tcloseSync(fd);\n\t\t\t}\n\t\t});\n\t}\n}\n"]}

package/dist/guardrails/shell-command-name-glob.d.ts

@@ -0,0 +1,3 @@
+import { type NormalizedStaticShell } from "./shell-command-tokenizer.ts";
+export declare function hasActiveShellNameGlob(shell: NormalizedStaticShell): boolean;
+//# sourceMappingURL=shell-command-name-glob.d.ts.map

package/dist/guardrails/shell-command-name-glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-name-glob.d.ts","sourceRoot":"","sources":["../../src/guardrails/shell-command-name-glob.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,qBAAqB,EAAwB,MAAM,8BAA8B,CAAC;AA6HhG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAyH5E","sourcesContent":["import { curlValue, ENV_VALUE_OPTIONS } from \"./shell-command-option.ts\";\nimport { type NormalizedStaticShell, normalizeStaticShell } from \"./shell-command-tokenizer.ts\";\nimport {\n\tconsumeShellCommandWrapper,\n\ttype ShellCommandWrapperState,\n\tshellCommandWrapper,\n} from \"./shell-command-wrapper.ts\";\n\nfunction activeSource(shell: NormalizedStaticShell, index: number): boolean {\n\tconst source = shell.sources[index];\n\treturn source !== undefined && !source.escaped && source.quoteStart === undefined;\n}\n\nfunction bracketEnd(shell: NormalizedStaticShell, start: number, end: number): number | undefined {\n\tif (shell.text[start] !== \"[\" || !activeSource(shell, start)) return undefined;\n\tlet cursor = start + 1;\n\tif (cursor < end && (shell.text[cursor] === \"!\" || shell.text[cursor] === \"^\") && activeSource(shell, cursor)) {\n\t\tcursor++;\n\t}\n\tlet members = 0;\n\tif (cursor < end && shell.text[cursor] === \"]\" && activeSource(shell, cursor)) {\n\t\tmembers++;\n\t\tcursor++;\n\t}\n\twhile (cursor < end) {\n\t\tif (shell.text[cursor] === \"]\" && activeSource(shell, cursor) && members > 0) return cursor;\n\t\tif (\n\t\t\tshell.text[cursor] === \"[\" &&\n\t\t\tactiveSource(shell, cursor) &&\n\t\t\t\".=:\".includes(shell.text[cursor + 1] ?? \"\") &&\n\t\t\tactiveSource(shell, cursor + 1)\n\t\t) {\n\t\t\tconst terminator = `${shell.text[cursor + 1]}]`;\n\t\t\tconst nestedEnd = shell.text.indexOf(terminator, cursor + 2);\n\t\t\tif (nestedEnd >= 0 && nestedEnd + 1 < end && activeSource(shell, nestedEnd + 1)) {\n\t\t\t\tmembers++;\n\t\t\t\tcursor = nestedEnd + 2;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\t\tmembers++;\n\t\tcursor++;\n\t}\n\treturn undefined;\n}\n\nfunction activeGlob(shell: NormalizedStaticShell, start: number, end: number): boolean {\n\tfor (let index = start; index < end; index++) {\n\t\tif (!activeSource(shell, index)) continue;\n\t\tconst character = shell.text[index];\n\t\tif (character === \"*\" || character === \"?\") return true;\n\t\tconst close = bracketEnd(shell, index, end);\n\t\tif (close !== undefined) return true;\n\t}\n\treturn false;\n}\n\nfunction separator(shell: NormalizedStaticShell, start: number, end: number, delimiters: string): number {\n\tfor (let index = start; index < end; index++) {\n\t\tconst close = bracketEnd(shell, index, end);\n\t\tif (close !== undefined) {\n\t\t\tindex = close;\n\t\t\tcontinue;\n\t\t}\n\t\tif (delimiters.includes(shell.text[index])) return index;\n\t}\n\treturn end;\n}\n\nfunction previousArgument(shell: NormalizedStaticShell, index: number): string | undefined {\n\tconst current = shell.words[index];\n\tconst previous = shell.words[index - 1];\n\treturn current !== undefined && previous !== undefined && /^\\s*$/.test(shell.text.slice(previous.end, current.start))\n\t\t? shell.text.slice(previous.start, previous.end)\n\t\t: undefined;\n}\n\nfunction nameLike(shell: NormalizedStaticShell, start: number, end: number, allowLeadingQuestion: boolean): boolean {\n\tconst first = shell.text[start];\n\tif (\n\t\tfirst === undefined ||\n\t\t(!/[A-Za-z_*_]/.test(first) && first !== \"[\" && !(allowLeadingQuestion && first === \"?\"))\n\t) {\n\t\treturn false;\n\t}\n\tfor (let index = start; index < end; index++) {\n\t\tconst close = bracketEnd(shell, index, end);\n\t\tif (close !== undefined) {\n\t\t\tindex = close;\n\t\t\tcontinue;\n\t\t}\n\t\tif (\"/:.\".includes(shell.text[index])) return false;\n\t}\n\treturn true;\n}\n\nfunction hasActiveQueryNameGlob(\n\tshell: NormalizedStaticShell,\n\twordStart: number,\n\twordEnd: number,\n\tcommandTreatsArgumentsAsUrls: boolean,\n): boolean {\n\tconst text = shell.text.slice(wordStart, wordEnd);\n\tconst question = text.indexOf(\"?\");\n\tif (question < 0) return false;\n\tconst markerStart = wordStart + question;\n\tconst hasQuerySeparator = separator(shell, markerStart + 1, wordEnd, \"=&#\") < wordEnd;\n\tconst structuralQuery = hasQuerySeparator && (question === 0 || text.slice(0, question).startsWith(\"/\"));\n\tif (!commandTreatsArgumentsAsUrls && !text.slice(0, question).includes(\"://\") && !structuralQuery) return false;\n\tlet marker = markerStart;\n\twhile (marker < wordEnd) {\n\t\tconst nameStart = marker + 1;\n\t\tconst nameEnd = separator(shell, nameStart, wordEnd, \"=&#\");\n\t\tif (activeGlob(shell, nameStart, nameEnd)) return true;\n\t\tif (nameEnd >= wordEnd || shell.text[nameEnd] === \"#\") return false;\n\t\tif (shell.text[nameEnd] === \"&\") {\n\t\t\tmarker = nameEnd;\n\t\t\tcontinue;\n\t\t}\n\t\tconst next = separator(shell, nameEnd + 1, wordEnd, \"&#\");\n\t\tif (next >= wordEnd || shell.text[next] === \"#\") return false;\n\t\tmarker = next;\n\t}\n\treturn false;\n}\n\nexport function hasActiveShellNameGlob(shell: NormalizedStaticShell): boolean {\n\tlet optionsEnded = false;\n\tlet commandName: string | undefined;\n\tlet commandWord = -1;\n\tlet wrapper: ShellCommandWrapperState | undefined;\n\tfor (let index = 0; index < shell.words.length; index++) {\n\t\tconst word = shell.words[index];\n\t\tconst previousWord = shell.words[index - 1];\n\t\tif (previousWord !== undefined && /[;&|()\\n]/.test(shell.text.slice(previousWord.end, word.start))) {\n\t\t\tif (wrapper !== undefined) return true;\n\t\t\toptionsEnded = false;\n\t\t\tcommandName = undefined;\n\t\t\twrapper = undefined;\n\t\t}\n\t\tconst text = shell.text.slice(word.start, word.end);\n\t\tconst previous = previousArgument(shell, index);\n\t\tconst assignment = separator(shell, word.start, word.end, \"=\");\n\t\tconst commandWasUnset = commandName === undefined;\n\t\tconst staticAssignment =\n\t\t\tassignment < word.end &&\n\t\t\tnameLike(shell, word.start, assignment, false) &&\n\t\t\t!activeGlob(shell, word.start, assignment);\n\t\tif (commandWasUnset && !staticAssignment) {\n\t\t\tcommandName = text;\n\t\t\tcommandWord = index;\n\t\t\twrapper = shellCommandWrapper(text);\n\t\t}\n\t\tlet wrapperOptionEnd: number | undefined;\n\t\tlet wrapperValue = false;\n\t\tif (wrapper !== undefined && index !== commandWord) {\n\t\t\tconst step = consumeShellCommandWrapper(wrapper, text);\n\t\t\tif (step.ambiguous) return true;\n\t\t\twrapper = step.state;\n\t\t\twrapperOptionEnd = step.optionEnd;\n\t\t\twrapperValue = step.value === true;\n\t\t\tif (step.target) {\n\t\t\t\tcommandName = text;\n\t\t\t\tcommandWord = index;\n\t\t\t\toptionsEnded = false;\n\t\t\t\twrapper = shellCommandWrapper(text);\n\t\t\t}\n\t\t}\n\t\tlet envCommand = commandName !== undefined && /(?:^|\\/)env(?:\\.exe)?$/.test(commandName);\n\t\tconst envAssignment = assignment < word.end && nameLike(shell, word.start, assignment, true);\n\t\tconst envOptionValue = envCommand && previous !== undefined && ENV_VALUE_OPTIONS.has(previous);\n\t\tif (envCommand && index !== commandWord && !text.startsWith(\"-\") && !envAssignment && !envOptionValue) {\n\t\t\tcommandName = text;\n\t\t\tcommandWord = index;\n\t\t\toptionsEnded = false;\n\t\t\twrapper = shellCommandWrapper(text);\n\t\t\tenvCommand = false;\n\t\t}\n\t\tconst curlCommand = commandName !== undefined && /(?:^|\\/)curl(?:\\.exe)?$/.test(commandName);\n\t\tconst currentCurlValue = !optionsEnded && curlCommand ? curlValue(text) : undefined;\n\t\tconst previousCurlValue =\n\t\t\t!optionsEnded && curlCommand && previous !== undefined ? curlValue(previous) : undefined;\n\t\tconst valueFromPrevious = previousCurlValue !== undefined && previousCurlValue.offset === previous?.length;\n\t\tconst fileValue =\n\t\t\t(currentCurlValue?.kind === \"file\" && currentCurlValue.offset < text.length) ||\n\t\t\t(valueFromPrevious && previousCurlValue?.kind === \"file\");\n\t\tconst headerValue =\n\t\t\t(currentCurlValue?.kind === \"header\" && currentCurlValue.offset < text.length) ||\n\t\t\t(valueFromPrevious && previousCurlValue?.kind === \"header\");\n\t\tconst optionValue = fileValue || headerValue || envOptionValue || wrapperValue;\n\t\tif (!optionsEnded && !optionValue && text === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcontinue;\n\t\t}\n\t\tconst optionPrefix =\n\t\t\t!optionsEnded && !valueFromPrevious && !envOptionValue && !wrapperValue\n\t\t\t\t? /^--?/.exec(text)?.[0].length\n\t\t\t\t: undefined;\n\t\tif (optionPrefix !== undefined) {\n\t\t\tconst optionEnd =\n\t\t\t\twrapperOptionEnd ??\n\t\t\t\tcurrentCurlValue?.offset ??\n\t\t\t\tseparator(shell, word.start + optionPrefix, word.end, \"=\") - word.start;\n\t\t\tif (activeGlob(shell, word.start + optionPrefix, word.start + optionEnd)) return true;\n\t\t}\n\t\tconst shellCommand = commandName !== undefined && /(?:^|\\/)(?:ba|da|k|z)?sh(?:\\.exe)?$/i.test(commandName);\n\t\tif (shellCommand && index !== commandWord && /^-[A-Za-z]*c[A-Za-z]*$/.test(text)) {\n\t\t\tconst script = previousArgument(shell, index + 1) === text ? shell.words[index + 1] : undefined;\n\t\t\tif (script !== undefined) normalizeStaticShell(shell.text.slice(script.start, script.end));\n\t\t}\n\t\tif (commandName !== undefined && /(?:^|\\/)eval$/.test(commandName) && index === commandWord + 1) {\n\t\t\tlet last = index;\n\t\t\twhile (\n\t\t\t\tpreviousArgument(shell, last + 1) === shell.text.slice(shell.words[last].start, shell.words[last].end)\n\t\t\t) {\n\t\t\t\tlast++;\n\t\t\t}\n\t\t\tnormalizeStaticShell(shell.text.slice(word.start, shell.words[last].end));\n\t\t}\n\t\tif (\n\t\t\t!fileValue &&\n\t\t\t!headerValue &&\n\t\t\thasActiveQueryNameGlob(shell, word.start, word.end, index !== commandWord && curlCommand)\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tconst explicitEnvironment = index !== commandWord && (envCommand || commandName === \"export\");\n\t\tif (\n\t\t\t(commandWasUnset || explicitEnvironment) &&\n\t\t\tassignment < word.end &&\n\t\t\t(!text.startsWith(\"?\") || explicitEnvironment) &&\n\t\t\tnameLike(shell, word.start, assignment, explicitEnvironment) &&\n\t\t\tactiveGlob(shell, word.start, assignment)\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tconst headerStart = headerValue\n\t\t\t? currentCurlValue?.kind === \"header\"\n\t\t\t\t? word.start + currentCurlValue.offset\n\t\t\t\t: word.start\n\t\t\t: undefined;\n\t\tif (headerStart !== undefined) {\n\t\t\tconst headerEnd = separator(shell, headerStart, word.end, \":=\");\n\t\t\tif (activeGlob(shell, headerStart, headerEnd)) return true;\n\t\t}\n\t}\n\treturn wrapper !== undefined;\n}\n"]}

package/dist/guardrails/shell-command-name-glob.js

@@ -0,0 +1,233 @@
+import { curlValue, ENV_VALUE_OPTIONS } from "./shell-command-option.js";
+import { normalizeStaticShell } from "./shell-command-tokenizer.js";
+import { consumeShellCommandWrapper, shellCommandWrapper, } from "./shell-command-wrapper.js";
+function activeSource(shell, index) {
+    const source = shell.sources[index];
+    return source !== undefined && !source.escaped && source.quoteStart === undefined;
+}
+function bracketEnd(shell, start, end) {
+    if (shell.text[start] !== "[" || !activeSource(shell, start))
+        return undefined;
+    let cursor = start + 1;
+    if (cursor < end && (shell.text[cursor] === "!" || shell.text[cursor] === "^") && activeSource(shell, cursor)) {
+        cursor++;
+    }
+    let members = 0;
+    if (cursor < end && shell.text[cursor] === "]" && activeSource(shell, cursor)) {
+        members++;
+        cursor++;
+    }
+    while (cursor < end) {
+        if (shell.text[cursor] === "]" && activeSource(shell, cursor) && members > 0)
+            return cursor;
+        if (shell.text[cursor] === "[" &&
+            activeSource(shell, cursor) &&
+            ".=:".includes(shell.text[cursor + 1] ?? "") &&
+            activeSource(shell, cursor + 1)) {
+            const terminator = `${shell.text[cursor + 1]}]`;
+            const nestedEnd = shell.text.indexOf(terminator, cursor + 2);
+            if (nestedEnd >= 0 && nestedEnd + 1 < end && activeSource(shell, nestedEnd + 1)) {
+                members++;
+                cursor = nestedEnd + 2;
+                continue;
+            }
+        }
+        members++;
+        cursor++;
+    }
+    return undefined;
+}
+function activeGlob(shell, start, end) {
+    for (let index = start; index < end; index++) {
+        if (!activeSource(shell, index))
+            continue;
+        const character = shell.text[index];
+        if (character === "*" || character === "?")
+            return true;
+        const close = bracketEnd(shell, index, end);
+        if (close !== undefined)
+            return true;
+    }
+    return false;
+}
+function separator(shell, start, end, delimiters) {
+    for (let index = start; index < end; index++) {
+        const close = bracketEnd(shell, index, end);
+        if (close !== undefined) {
+            index = close;
+            continue;
+        }
+        if (delimiters.includes(shell.text[index]))
+            return index;
+    }
+    return end;
+}
+function previousArgument(shell, index) {
+    const current = shell.words[index];
+    const previous = shell.words[index - 1];
+    return current !== undefined && previous !== undefined && /^\s*$/.test(shell.text.slice(previous.end, current.start))
+        ? shell.text.slice(previous.start, previous.end)
+        : undefined;
+}
+function nameLike(shell, start, end, allowLeadingQuestion) {
+    const first = shell.text[start];
+    if (first === undefined ||
+        (!/[A-Za-z_*_]/.test(first) && first !== "[" && !(allowLeadingQuestion && first === "?"))) {
+        return false;
+    }
+    for (let index = start; index < end; index++) {
+        const close = bracketEnd(shell, index, end);
+        if (close !== undefined) {
+            index = close;
+            continue;
+        }
+        if ("/:.".includes(shell.text[index]))
+            return false;
+    }
+    return true;
+}
+function hasActiveQueryNameGlob(shell, wordStart, wordEnd, commandTreatsArgumentsAsUrls) {
+    const text = shell.text.slice(wordStart, wordEnd);
+    const question = text.indexOf("?");
+    if (question < 0)
+        return false;
+    const markerStart = wordStart + question;
+    const hasQuerySeparator = separator(shell, markerStart + 1, wordEnd, "=&#") < wordEnd;
+    const structuralQuery = hasQuerySeparator && (question === 0 || text.slice(0, question).startsWith("/"));
+    if (!commandTreatsArgumentsAsUrls && !text.slice(0, question).includes("://") && !structuralQuery)
+        return false;
+    let marker = markerStart;
+    while (marker < wordEnd) {
+        const nameStart = marker + 1;
+        const nameEnd = separator(shell, nameStart, wordEnd, "=&#");
+        if (activeGlob(shell, nameStart, nameEnd))
+            return true;
+        if (nameEnd >= wordEnd || shell.text[nameEnd] === "#")
+            return false;
+        if (shell.text[nameEnd] === "&") {
+            marker = nameEnd;
+            continue;
+        }
+        const next = separator(shell, nameEnd + 1, wordEnd, "&#");
+        if (next >= wordEnd || shell.text[next] === "#")
+            return false;
+        marker = next;
+    }
+    return false;
+}
+export function hasActiveShellNameGlob(shell) {
+    let optionsEnded = false;
+    let commandName;
+    let commandWord = -1;
+    let wrapper;
+    for (let index = 0; index < shell.words.length; index++) {
+        const word = shell.words[index];
+        const previousWord = shell.words[index - 1];
+        if (previousWord !== undefined && /[;&|()\n]/.test(shell.text.slice(previousWord.end, word.start))) {
+            if (wrapper !== undefined)
+                return true;
+            optionsEnded = false;
+            commandName = undefined;
+            wrapper = undefined;
+        }
+        const text = shell.text.slice(word.start, word.end);
+        const previous = previousArgument(shell, index);
+        const assignment = separator(shell, word.start, word.end, "=");
+        const commandWasUnset = commandName === undefined;
+        const staticAssignment = assignment < word.end &&
+            nameLike(shell, word.start, assignment, false) &&
+            !activeGlob(shell, word.start, assignment);
+        if (commandWasUnset && !staticAssignment) {
+            commandName = text;
+            commandWord = index;
+            wrapper = shellCommandWrapper(text);
+        }
+        let wrapperOptionEnd;
+        let wrapperValue = false;
+        if (wrapper !== undefined && index !== commandWord) {
+            const step = consumeShellCommandWrapper(wrapper, text);
+            if (step.ambiguous)
+                return true;
+            wrapper = step.state;
+            wrapperOptionEnd = step.optionEnd;
+            wrapperValue = step.value === true;
+            if (step.target) {
+                commandName = text;
+                commandWord = index;
+                optionsEnded = false;
+                wrapper = shellCommandWrapper(text);
+            }
+        }
+        let envCommand = commandName !== undefined && /(?:^|\/)env(?:\.exe)?$/.test(commandName);
+        const envAssignment = assignment < word.end && nameLike(shell, word.start, assignment, true);
+        const envOptionValue = envCommand && previous !== undefined && ENV_VALUE_OPTIONS.has(previous);
+        if (envCommand && index !== commandWord && !text.startsWith("-") && !envAssignment && !envOptionValue) {
+            commandName = text;
+            commandWord = index;
+            optionsEnded = false;
+            wrapper = shellCommandWrapper(text);
+            envCommand = false;
+        }
+        const curlCommand = commandName !== undefined && /(?:^|\/)curl(?:\.exe)?$/.test(commandName);
+        const currentCurlValue = !optionsEnded && curlCommand ? curlValue(text) : undefined;
+        const previousCurlValue = !optionsEnded && curlCommand && previous !== undefined ? curlValue(previous) : undefined;
+        const valueFromPrevious = previousCurlValue !== undefined && previousCurlValue.offset === previous?.length;
+        const fileValue = (currentCurlValue?.kind === "file" && currentCurlValue.offset < text.length) ||
+            (valueFromPrevious && previousCurlValue?.kind === "file");
+        const headerValue = (currentCurlValue?.kind === "header" && currentCurlValue.offset < text.length) ||
+            (valueFromPrevious && previousCurlValue?.kind === "header");
+        const optionValue = fileValue || headerValue || envOptionValue || wrapperValue;
+        if (!optionsEnded && !optionValue && text === "--") {
+            optionsEnded = true;
+            continue;
+        }
+        const optionPrefix = !optionsEnded && !valueFromPrevious && !envOptionValue && !wrapperValue
+            ? /^--?/.exec(text)?.[0].length
+            : undefined;
+        if (optionPrefix !== undefined) {
+            const optionEnd = wrapperOptionEnd ??
+                currentCurlValue?.offset ??
+                separator(shell, word.start + optionPrefix, word.end, "=") - word.start;
+            if (activeGlob(shell, word.start + optionPrefix, word.start + optionEnd))
+                return true;
+        }
+        const shellCommand = commandName !== undefined && /(?:^|\/)(?:ba|da|k|z)?sh(?:\.exe)?$/i.test(commandName);
+        if (shellCommand && index !== commandWord && /^-[A-Za-z]*c[A-Za-z]*$/.test(text)) {
+            const script = previousArgument(shell, index + 1) === text ? shell.words[index + 1] : undefined;
+            if (script !== undefined)
+                normalizeStaticShell(shell.text.slice(script.start, script.end));
+        }
+        if (commandName !== undefined && /(?:^|\/)eval$/.test(commandName) && index === commandWord + 1) {
+            let last = index;
+            while (previousArgument(shell, last + 1) === shell.text.slice(shell.words[last].start, shell.words[last].end)) {
+                last++;
+            }
+            normalizeStaticShell(shell.text.slice(word.start, shell.words[last].end));
+        }
+        if (!fileValue &&
+            !headerValue &&
+            hasActiveQueryNameGlob(shell, word.start, word.end, index !== commandWord && curlCommand)) {
+            return true;
+        }
+        const explicitEnvironment = index !== commandWord && (envCommand || commandName === "export");
+        if ((commandWasUnset || explicitEnvironment) &&
+            assignment < word.end &&
+            (!text.startsWith("?") || explicitEnvironment) &&
+            nameLike(shell, word.start, assignment, explicitEnvironment) &&
+            activeGlob(shell, word.start, assignment)) {
+            return true;
+        }
+        const headerStart = headerValue
+            ? currentCurlValue?.kind === "header"
+                ? word.start + currentCurlValue.offset
+                : word.start
+            : undefined;
+        if (headerStart !== undefined) {
+            const headerEnd = separator(shell, headerStart, word.end, ":=");
+            if (activeGlob(shell, headerStart, headerEnd))
+                return true;
+        }
+    }
+    return wrapper !== undefined;
+}
+//# sourceMappingURL=shell-command-name-glob.js.map

package/dist/guardrails/shell-command-name-glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-name-glob.js","sourceRoot":"","sources":["../../src/guardrails/shell-command-name-glob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAA8B,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EACN,0BAA0B,EAE1B,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,SAAS,YAAY,CAAC,KAA4B,EAAE,KAAa,EAAW;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC;AAAA,CAClF;AAED,SAAS,UAAU,CAAC,KAA4B,EAAE,KAAa,EAAE,GAAW,EAAsB;IACjG,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;IACvB,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/G,MAAM,EAAE,CAAC;IACV,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;IACV,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC5F,IACC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;YAC1B,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAC3B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,EAC9B,CAAC;YACF,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YAChD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjF,OAAO,EAAE,CAAC;gBACV,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;gBACvB,SAAS;YACV,CAAC;QACF,CAAC;QACD,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;IACV,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,UAAU,CAAC,KAA4B,EAAE,KAAa,EAAE,GAAW,EAAW;IACtF,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,SAAS;QAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,SAAS,CAAC,KAA4B,EAAE,KAAa,EAAE,GAAW,EAAE,UAAkB,EAAU;IACxG,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACX;AAED,SAAS,gBAAgB,CAAC,KAA4B,EAAE,KAAa,EAAsB;IAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpH,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,SAAS,CAAC;AAAA,CACb;AAED,SAAS,QAAQ,CAAC,KAA4B,EAAE,KAAa,EAAE,GAAW,EAAE,oBAA6B,EAAW;IACnH,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IACC,KAAK,KAAK,SAAS;QACnB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,oBAAoB,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,EACxF,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,sBAAsB,CAC9B,KAA4B,EAC5B,SAAiB,EACjB,OAAe,EACf,4BAAqC,EAC3B;IACV,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC;IACtF,MAAM,eAAe,GAAG,iBAAiB,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAChH,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,OAAO,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,OAAO,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,GAAG,OAAO,CAAC;YACjB,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,GAAG,IAAI,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA4B,EAAW;IAC7E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,OAA6C,CAAC;IAClD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,YAAY,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpG,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACvC,YAAY,GAAG,KAAK,CAAC;YACrB,WAAW,GAAG,SAAS,CAAC;YACxB,OAAO,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,WAAW,KAAK,SAAS,CAAC;QAClD,MAAM,gBAAgB,GACrB,UAAU,GAAG,IAAI,CAAC,GAAG;YACrB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;YAC9C,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,IAAI,eAAe,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1C,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,KAAK,CAAC;YACpB,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,gBAAoC,CAAC;QACzC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACrB,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,WAAW,GAAG,IAAI,CAAC;gBACnB,WAAW,GAAG,KAAK,CAAC;gBACpB,YAAY,GAAG,KAAK,CAAC;gBACrB,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACF,CAAC;QACD,IAAI,UAAU,GAAG,WAAW,KAAK,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7F,MAAM,cAAc,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/F,IAAI,UAAU,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACvG,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,KAAK,CAAC;YACpB,YAAY,GAAG,KAAK,CAAC;YACrB,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACpC,UAAU,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,IAAI,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,MAAM,gBAAgB,GAAG,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,MAAM,iBAAiB,GACtB,CAAC,YAAY,IAAI,WAAW,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,iBAAiB,GAAG,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC;QAC3G,MAAM,SAAS,GACd,CAAC,gBAAgB,EAAE,IAAI,KAAK,MAAM,IAAI,gBAAgB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5E,CAAC,iBAAiB,IAAI,iBAAiB,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;QAC3D,MAAM,WAAW,GAChB,CAAC,gBAAgB,EAAE,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC9E,CAAC,iBAAiB,IAAI,iBAAiB,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,SAAS,IAAI,WAAW,IAAI,cAAc,IAAI,YAAY,CAAC;QAC/E,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACpD,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,MAAM,YAAY,GACjB,CAAC,YAAY,IAAI,CAAC,iBAAiB,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY;YACtE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,SAAS,GACd,gBAAgB;gBAChB,gBAAgB,EAAE,MAAM;gBACxB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;YACzE,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,YAAY,EAAE,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvF,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,KAAK,SAAS,IAAI,sCAAsC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3G,IAAI,YAAY,IAAI,KAAK,KAAK,WAAW,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChG,IAAI,MAAM,KAAK,SAAS;gBAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YACjG,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,OACC,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EACrG,CAAC;gBACF,IAAI,EAAE,CAAC;YACR,CAAC;YACD,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IACC,CAAC,SAAS;YACV,CAAC,WAAW;YACZ,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,KAAK,WAAW,IAAI,WAAW,CAAC,EACxF,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,mBAAmB,GAAG,KAAK,KAAK,WAAW,IAAI,CAAC,UAAU,IAAI,WAAW,KAAK,QAAQ,CAAC,CAAC;QAC9F,IACC,CAAC,eAAe,IAAI,mBAAmB,CAAC;YACxC,UAAU,GAAG,IAAI,CAAC,GAAG;YACrB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC;YAC5D,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EACxC,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,WAAW,GAAG,WAAW;YAC9B,CAAC,CAAC,gBAAgB,EAAE,IAAI,KAAK,QAAQ;gBACpC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,MAAM;gBACtC,CAAC,CAAC,IAAI,CAAC,KAAK;YACb,CAAC,CAAC,SAAS,CAAC;QACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;IACF,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,CAAC;AAAA,CAC7B","sourcesContent":["import { curlValue, ENV_VALUE_OPTIONS } from \"./shell-command-option.ts\";\nimport { type NormalizedStaticShell, normalizeStaticShell } from \"./shell-command-tokenizer.ts\";\nimport {\n\tconsumeShellCommandWrapper,\n\ttype ShellCommandWrapperState,\n\tshellCommandWrapper,\n} from \"./shell-command-wrapper.ts\";\n\nfunction activeSource(shell: NormalizedStaticShell, index: number): boolean {\n\tconst source = shell.sources[index];\n\treturn source !== undefined && !source.escaped && source.quoteStart === undefined;\n}\n\nfunction bracketEnd(shell: NormalizedStaticShell, start: number, end: number): number | undefined {\n\tif (shell.text[start] !== \"[\" || !activeSource(shell, start)) return undefined;\n\tlet cursor = start + 1;\n\tif (cursor < end && (shell.text[cursor] === \"!\" || shell.text[cursor] === \"^\") && activeSource(shell, cursor)) {\n\t\tcursor++;\n\t}\n\tlet members = 0;\n\tif (cursor < end && shell.text[cursor] === \"]\" && activeSource(shell, cursor)) {\n\t\tmembers++;\n\t\tcursor++;\n\t}\n\twhile (cursor < end) {\n\t\tif (shell.text[cursor] === \"]\" && activeSource(shell, cursor) && members > 0) return cursor;\n\t\tif (\n\t\t\tshell.text[cursor] === \"[\" &&\n\t\t\tactiveSource(shell, cursor) &&\n\t\t\t\".=:\".includes(shell.text[cursor + 1] ?? \"\") &&\n\t\t\tactiveSource(shell, cursor + 1)\n\t\t) {\n\t\t\tconst terminator = `${shell.text[cursor + 1]}]`;\n\t\t\tconst nestedEnd = shell.text.indexOf(terminator, cursor + 2);\n\t\t\tif (nestedEnd >= 0 && nestedEnd + 1 < end && activeSource(shell, nestedEnd + 1)) {\n\t\t\t\tmembers++;\n\t\t\t\tcursor = nestedEnd + 2;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\t\tmembers++;\n\t\tcursor++;\n\t}\n\treturn undefined;\n}\n\nfunction activeGlob(shell: NormalizedStaticShell, start: number, end: number): boolean {\n\tfor (let index = start; index < end; index++) {\n\t\tif (!activeSource(shell, index)) continue;\n\t\tconst character = shell.text[index];\n\t\tif (character === \"*\" || character === \"?\") return true;\n\t\tconst close = bracketEnd(shell, index, end);\n\t\tif (close !== undefined) return true;\n\t}\n\treturn false;\n}\n\nfunction separator(shell: NormalizedStaticShell, start: number, end: number, delimiters: string): number {\n\tfor (let index = start; index < end; index++) {\n\t\tconst close = bracketEnd(shell, index, end);\n\t\tif (close !== undefined) {\n\t\t\tindex = close;\n\t\t\tcontinue;\n\t\t}\n\t\tif (delimiters.includes(shell.text[index])) return index;\n\t}\n\treturn end;\n}\n\nfunction previousArgument(shell: NormalizedStaticShell, index: number): string | undefined {\n\tconst current = shell.words[index];\n\tconst previous = shell.words[index - 1];\n\treturn current !== undefined && previous !== undefined && /^\\s*$/.test(shell.text.slice(previous.end, current.start))\n\t\t? shell.text.slice(previous.start, previous.end)\n\t\t: undefined;\n}\n\nfunction nameLike(shell: NormalizedStaticShell, start: number, end: number, allowLeadingQuestion: boolean): boolean {\n\tconst first = shell.text[start];\n\tif (\n\t\tfirst === undefined ||\n\t\t(!/[A-Za-z_*_]/.test(first) && first !== \"[\" && !(allowLeadingQuestion && first === \"?\"))\n\t) {\n\t\treturn false;\n\t}\n\tfor (let index = start; index < end; index++) {\n\t\tconst close = bracketEnd(shell, index, end);\n\t\tif (close !== undefined) {\n\t\t\tindex = close;\n\t\t\tcontinue;\n\t\t}\n\t\tif (\"/:.\".includes(shell.text[index])) return false;\n\t}\n\treturn true;\n}\n\nfunction hasActiveQueryNameGlob(\n\tshell: NormalizedStaticShell,\n\twordStart: number,\n\twordEnd: number,\n\tcommandTreatsArgumentsAsUrls: boolean,\n): boolean {\n\tconst text = shell.text.slice(wordStart, wordEnd);\n\tconst question = text.indexOf(\"?\");\n\tif (question < 0) return false;\n\tconst markerStart = wordStart + question;\n\tconst hasQuerySeparator = separator(shell, markerStart + 1, wordEnd, \"=&#\") < wordEnd;\n\tconst structuralQuery = hasQuerySeparator && (question === 0 || text.slice(0, question).startsWith(\"/\"));\n\tif (!commandTreatsArgumentsAsUrls && !text.slice(0, question).includes(\"://\") && !structuralQuery) return false;\n\tlet marker = markerStart;\n\twhile (marker < wordEnd) {\n\t\tconst nameStart = marker + 1;\n\t\tconst nameEnd = separator(shell, nameStart, wordEnd, \"=&#\");\n\t\tif (activeGlob(shell, nameStart, nameEnd)) return true;\n\t\tif (nameEnd >= wordEnd || shell.text[nameEnd] === \"#\") return false;\n\t\tif (shell.text[nameEnd] === \"&\") {\n\t\t\tmarker = nameEnd;\n\t\t\tcontinue;\n\t\t}\n\t\tconst next = separator(shell, nameEnd + 1, wordEnd, \"&#\");\n\t\tif (next >= wordEnd || shell.text[next] === \"#\") return false;\n\t\tmarker = next;\n\t}\n\treturn false;\n}\n\nexport function hasActiveShellNameGlob(shell: NormalizedStaticShell): boolean {\n\tlet optionsEnded = false;\n\tlet commandName: string | undefined;\n\tlet commandWord = -1;\n\tlet wrapper: ShellCommandWrapperState | undefined;\n\tfor (let index = 0; index < shell.words.length; index++) {\n\t\tconst word = shell.words[index];\n\t\tconst previousWord = shell.words[index - 1];\n\t\tif (previousWord !== undefined && /[;&|()\\n]/.test(shell.text.slice(previousWord.end, word.start))) {\n\t\t\tif (wrapper !== undefined) return true;\n\t\t\toptionsEnded = false;\n\t\t\tcommandName = undefined;\n\t\t\twrapper = undefined;\n\t\t}\n\t\tconst text = shell.text.slice(word.start, word.end);\n\t\tconst previous = previousArgument(shell, index);\n\t\tconst assignment = separator(shell, word.start, word.end, \"=\");\n\t\tconst commandWasUnset = commandName === undefined;\n\t\tconst staticAssignment =\n\t\t\tassignment < word.end &&\n\t\t\tnameLike(shell, word.start, assignment, false) &&\n\t\t\t!activeGlob(shell, word.start, assignment);\n\t\tif (commandWasUnset && !staticAssignment) {\n\t\t\tcommandName = text;\n\t\t\tcommandWord = index;\n\t\t\twrapper = shellCommandWrapper(text);\n\t\t}\n\t\tlet wrapperOptionEnd: number | undefined;\n\t\tlet wrapperValue = false;\n\t\tif (wrapper !== undefined && index !== commandWord) {\n\t\t\tconst step = consumeShellCommandWrapper(wrapper, text);\n\t\t\tif (step.ambiguous) return true;\n\t\t\twrapper = step.state;\n\t\t\twrapperOptionEnd = step.optionEnd;\n\t\t\twrapperValue = step.value === true;\n\t\t\tif (step.target) {\n\t\t\t\tcommandName = text;\n\t\t\t\tcommandWord = index;\n\t\t\t\toptionsEnded = false;\n\t\t\t\twrapper = shellCommandWrapper(text);\n\t\t\t}\n\t\t}\n\t\tlet envCommand = commandName !== undefined && /(?:^|\\/)env(?:\\.exe)?$/.test(commandName);\n\t\tconst envAssignment = assignment < word.end && nameLike(shell, word.start, assignment, true);\n\t\tconst envOptionValue = envCommand && previous !== undefined && ENV_VALUE_OPTIONS.has(previous);\n\t\tif (envCommand && index !== commandWord && !text.startsWith(\"-\") && !envAssignment && !envOptionValue) {\n\t\t\tcommandName = text;\n\t\t\tcommandWord = index;\n\t\t\toptionsEnded = false;\n\t\t\twrapper = shellCommandWrapper(text);\n\t\t\tenvCommand = false;\n\t\t}\n\t\tconst curlCommand = commandName !== undefined && /(?:^|\\/)curl(?:\\.exe)?$/.test(commandName);\n\t\tconst currentCurlValue = !optionsEnded && curlCommand ? curlValue(text) : undefined;\n\t\tconst previousCurlValue =\n\t\t\t!optionsEnded && curlCommand && previous !== undefined ? curlValue(previous) : undefined;\n\t\tconst valueFromPrevious = previousCurlValue !== undefined && previousCurlValue.offset === previous?.length;\n\t\tconst fileValue =\n\t\t\t(currentCurlValue?.kind === \"file\" && currentCurlValue.offset < text.length) ||\n\t\t\t(valueFromPrevious && previousCurlValue?.kind === \"file\");\n\t\tconst headerValue =\n\t\t\t(currentCurlValue?.kind === \"header\" && currentCurlValue.offset < text.length) ||\n\t\t\t(valueFromPrevious && previousCurlValue?.kind === \"header\");\n\t\tconst optionValue = fileValue || headerValue || envOptionValue || wrapperValue;\n\t\tif (!optionsEnded && !optionValue && text === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcontinue;\n\t\t}\n\t\tconst optionPrefix =\n\t\t\t!optionsEnded && !valueFromPrevious && !envOptionValue && !wrapperValue\n\t\t\t\t? /^--?/.exec(text)?.[0].length\n\t\t\t\t: undefined;\n\t\tif (optionPrefix !== undefined) {\n\t\t\tconst optionEnd =\n\t\t\t\twrapperOptionEnd ??\n\t\t\t\tcurrentCurlValue?.offset ??\n\t\t\t\tseparator(shell, word.start + optionPrefix, word.end, \"=\") - word.start;\n\t\t\tif (activeGlob(shell, word.start + optionPrefix, word.start + optionEnd)) return true;\n\t\t}\n\t\tconst shellCommand = commandName !== undefined && /(?:^|\\/)(?:ba|da|k|z)?sh(?:\\.exe)?$/i.test(commandName);\n\t\tif (shellCommand && index !== commandWord && /^-[A-Za-z]*c[A-Za-z]*$/.test(text)) {\n\t\t\tconst script = previousArgument(shell, index + 1) === text ? shell.words[index + 1] : undefined;\n\t\t\tif (script !== undefined) normalizeStaticShell(shell.text.slice(script.start, script.end));\n\t\t}\n\t\tif (commandName !== undefined && /(?:^|\\/)eval$/.test(commandName) && index === commandWord + 1) {\n\t\t\tlet last = index;\n\t\t\twhile (\n\t\t\t\tpreviousArgument(shell, last + 1) === shell.text.slice(shell.words[last].start, shell.words[last].end)\n\t\t\t) {\n\t\t\t\tlast++;\n\t\t\t}\n\t\t\tnormalizeStaticShell(shell.text.slice(word.start, shell.words[last].end));\n\t\t}\n\t\tif (\n\t\t\t!fileValue &&\n\t\t\t!headerValue &&\n\t\t\thasActiveQueryNameGlob(shell, word.start, word.end, index !== commandWord && curlCommand)\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tconst explicitEnvironment = index !== commandWord && (envCommand || commandName === \"export\");\n\t\tif (\n\t\t\t(commandWasUnset || explicitEnvironment) &&\n\t\t\tassignment < word.end &&\n\t\t\t(!text.startsWith(\"?\") || explicitEnvironment) &&\n\t\t\tnameLike(shell, word.start, assignment, explicitEnvironment) &&\n\t\t\tactiveGlob(shell, word.start, assignment)\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tconst headerStart = headerValue\n\t\t\t? currentCurlValue?.kind === \"header\"\n\t\t\t\t? word.start + currentCurlValue.offset\n\t\t\t\t: word.start\n\t\t\t: undefined;\n\t\tif (headerStart !== undefined) {\n\t\t\tconst headerEnd = separator(shell, headerStart, word.end, \":=\");\n\t\t\tif (activeGlob(shell, headerStart, headerEnd)) return true;\n\t\t}\n\t}\n\treturn wrapper !== undefined;\n}\n"]}

package/dist/guardrails/shell-command-option.d.ts

@@ -0,0 +1,7 @@
+export type CurlValue = {
+    readonly kind: "file" | "header";
+    readonly offset: number;
+};
+export declare const ENV_VALUE_OPTIONS: Set<string>;
+export declare function curlValue(text: string): CurlValue | undefined;
+//# sourceMappingURL=shell-command-option.d.ts.map

package/dist/guardrails/shell-command-option.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-option.d.ts","sourceRoot":"","sources":["../../src/guardrails/shell-command-option.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGtF,eAAO,MAAM,iBAAiB,aAAuF,CAAC;AAEtH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAa7D","sourcesContent":["export type CurlValue = { readonly kind: \"file\" | \"header\"; readonly offset: number };\n\nconst CURL_FILE_LONG = [\"--config\", \"--output\", \"--upload-file\"] as const;\nexport const ENV_VALUE_OPTIONS = new Set([\"-C\", \"--chdir\", \"-S\", \"--split-string\", \"-a\", \"--argv0\", \"-u\", \"--unset\"]);\n\nexport function curlValue(text: string): CurlValue | undefined {\n\tfor (const option of CURL_FILE_LONG) {\n\t\tif (text === option) return { kind: \"file\", offset: text.length };\n\t\tif (text.startsWith(`${option}=`)) return { kind: \"file\", offset: option.length + 1 };\n\t}\n\tif (text === \"--header\") return { kind: \"header\", offset: text.length };\n\tif (text.startsWith(\"--header=\")) return { kind: \"header\", offset: 9 };\n\tif (!text.startsWith(\"-\") || text.startsWith(\"--\")) return undefined;\n\tfor (let index = 1; index < text.length; index++) {\n\t\tif (\"KoT\".includes(text[index])) return { kind: \"file\", offset: index + 1 };\n\t\tif (text[index] === \"H\") return { kind: \"header\", offset: index + 1 };\n\t}\n\treturn undefined;\n}\n"]}

package/dist/guardrails/shell-command-option.js

@@ -0,0 +1,24 @@
+const CURL_FILE_LONG = ["--config", "--output", "--upload-file"];
+export const ENV_VALUE_OPTIONS = new Set(["-C", "--chdir", "-S", "--split-string", "-a", "--argv0", "-u", "--unset"]);
+export function curlValue(text) {
+    for (const option of CURL_FILE_LONG) {
+        if (text === option)
+            return { kind: "file", offset: text.length };
+        if (text.startsWith(`${option}=`))
+            return { kind: "file", offset: option.length + 1 };
+    }
+    if (text === "--header")
+        return { kind: "header", offset: text.length };
+    if (text.startsWith("--header="))
+        return { kind: "header", offset: 9 };
+    if (!text.startsWith("-") || text.startsWith("--"))
+        return undefined;
+    for (let index = 1; index < text.length; index++) {
+        if ("KoT".includes(text[index]))
+            return { kind: "file", offset: index + 1 };
+        if (text[index] === "H")
+            return { kind: "header", offset: index + 1 };
+    }
+    return undefined;
+}
+//# sourceMappingURL=shell-command-option.js.map

package/dist/guardrails/shell-command-option.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-option.js","sourceRoot":"","sources":["../../src/guardrails/shell-command-option.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAU,CAAC;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAyB;IAC9D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB","sourcesContent":["export type CurlValue = { readonly kind: \"file\" | \"header\"; readonly offset: number };\n\nconst CURL_FILE_LONG = [\"--config\", \"--output\", \"--upload-file\"] as const;\nexport const ENV_VALUE_OPTIONS = new Set([\"-C\", \"--chdir\", \"-S\", \"--split-string\", \"-a\", \"--argv0\", \"-u\", \"--unset\"]);\n\nexport function curlValue(text: string): CurlValue | undefined {\n\tfor (const option of CURL_FILE_LONG) {\n\t\tif (text === option) return { kind: \"file\", offset: text.length };\n\t\tif (text.startsWith(`${option}=`)) return { kind: \"file\", offset: option.length + 1 };\n\t}\n\tif (text === \"--header\") return { kind: \"header\", offset: text.length };\n\tif (text.startsWith(\"--header=\")) return { kind: \"header\", offset: 9 };\n\tif (!text.startsWith(\"-\") || text.startsWith(\"--\")) return undefined;\n\tfor (let index = 1; index < text.length; index++) {\n\t\tif (\"KoT\".includes(text[index])) return { kind: \"file\", offset: index + 1 };\n\t\tif (text[index] === \"H\") return { kind: \"header\", offset: index + 1 };\n\t}\n\treturn undefined;\n}\n"]}

package/dist/guardrails/shell-command-tokenizer.d.ts

@@ -0,0 +1,29 @@
+export interface ShellSourceRange {
+    readonly start: number;
+    readonly end: number;
+    readonly contentEnd: number;
+    readonly quoteStart?: number;
+    readonly kind: "literal" | "variable";
+    readonly escaped: boolean;
+}
+export interface StaticShellWord {
+    readonly start: number;
+    readonly end: number;
+}
+export interface StaticShellVariable {
+    readonly start: number;
+    readonly end: number;
+    readonly sourceStart: number;
+    readonly sourceEnd: number;
+}
+export interface NormalizedStaticShell {
+    readonly text: string;
+    readonly sources: readonly ShellSourceRange[];
+    readonly words: readonly StaticShellWord[];
+    readonly variables: readonly StaticShellVariable[];
+}
+export declare class StaticShellSyntaxError extends Error {
+    constructor();
+}
+export declare function normalizeStaticShell(text: string): NormalizedStaticShell;
+//# sourceMappingURL=shell-command-tokenizer.d.ts.map