opencode-hashline 1.1.1 → 1.1.3

package/dist/{chunk-DDXOFWTU.js → chunk-I6RACR3D.js}

@@ -28,7 +28,24 @@ var DEFAULT_EXCLUDE_PATTERNS = [
   "**/*.exe",
   "**/*.dll",
   "**/*.so",
-  "**/*.dylib"
+  "**/*.dylib",
+  // Sensitive credential and secret files
+  "**/.env",
+  "**/.env.*",
+  "**/*.pem",
+  "**/*.key",
+  "**/*.p12",
+  "**/*.pfx",
+  "**/id_rsa",
+  "**/id_rsa.pub",
+  "**/id_ed25519",
+  "**/id_ed25519.pub",
+  "**/id_ecdsa",
+  "**/id_ecdsa.pub",
+  "**/.npmrc",
+  "**/.netrc",
+  "**/credentials",
+  "**/credentials.json"
 ];
 var DEFAULT_PREFIX = "#HL ";
 var DEFAULT_CONFIG = {
@@ -88,16 +105,24 @@ function computeLineHash(idx, line, hashLen = 3) {
   return hash.toString(16).padStart(hashLen, "0");
 }
 function formatFileWithHashes(content, hashLen, prefix) {
-  const lines = content.split("\n");
+  const normalized = content.includes("\r\n") ? content.replace(/\r\n/g, "\n") : content;
+  const lines = normalized.split("\n");
   const effectiveLen = hashLen && hashLen >= 3 ? hashLen : getAdaptiveHashLength(lines.length);
   const effectivePrefix = prefix === void 0 ? DEFAULT_PREFIX : prefix === false ? "" : prefix;
   const hashes = new Array(lines.length);
   const seen = /* @__PURE__ */ new Map();
+  const upgraded = /* @__PURE__ */ new Set();
   for (let idx = 0; idx < lines.length; idx++) {
     const hash = computeLineHash(idx, lines[idx], effectiveLen);
     if (seen.has(hash)) {
       const longerLen = Math.min(effectiveLen + 1, 8);
+      const prevIdx = seen.get(hash);
+      if (!upgraded.has(prevIdx)) {
+        hashes[prevIdx] = computeLineHash(prevIdx, lines[prevIdx], longerLen);
+        upgraded.add(prevIdx);
+      }
       hashes[idx] = computeLineHash(idx, lines[idx], longerLen);
+      upgraded.add(idx);
     } else {
       seen.set(hash, idx);
       hashes[idx] = hash;
@@ -116,7 +141,9 @@ function stripHashes(content, prefix) {
     hashLinePattern = new RegExp(`^([+ \\-])?${escapedPrefix}\\d+:[0-9a-f]{2,8}\\|`);
     stripRegexCache.set(escapedPrefix, hashLinePattern);
   }
-  return content.split("\n").map((line) => {
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const result = normalized.split("\n").map((line) => {
     const match = line.match(hashLinePattern);
     if (match) {
       const patchMarker = match[1] || "";
@@ -124,11 +151,13 @@ function stripHashes(content, prefix) {
     }
     return line;
   }).join("\n");
+  return lineEnding === "\r\n" ? result.replace(/\n/g, "\r\n") : result;
 }
 function parseHashRef(ref) {
   const match = ref.match(/^(\d+):([0-9a-f]{2,8})$/);
   if (!match) {
-    throw new Error(`Invalid hash reference: "${ref}". Expected format: "<line>:<2-8 char hex>"`);
+    const display = ref.length > 100 ? `${ref.slice(0, 100)}\u2026` : ref;
+    throw new Error(`Invalid hash reference: "${display}". Expected format: "<line>:<2-8 char hex>"`);
   }
   return {
     line: parseInt(match[1], 10),
@@ -145,8 +174,9 @@ function normalizeHashRef(ref) {
   if (annotated) {
     return `${parseInt(annotated[1], 10)}:${annotated[2].toLowerCase()}`;
   }
+  const display = ref.length > 100 ? `${ref.slice(0, 100)}\u2026` : ref;
   throw new Error(
-    `Invalid hash reference: "${ref}". Expected "<line>:<hash>" or an annotated line like "#HL <line>:<hash>|..."`
+    `Invalid hash reference: "${display}". Expected "<line>:<hash>" or an annotated line like "#HL <line>:<hash>|..."`
   );
 }
 function buildHashMap(content, hashLen) {
@@ -189,12 +219,14 @@ function resolveRange(startRef, endRef, content, hashLen) {
       `Invalid range: start line ${start.line} is after end line ${end.line}`
     );
   }
-  const lines = content.split("\n");
-  const startVerify = verifyHash(start.line, start.hash, content, hashLen, lines);
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const lines = normalized.split("\n");
+  const startVerify = verifyHash(start.line, start.hash, normalized, hashLen, lines);
   if (!startVerify.valid) {
     throw new Error(`Start reference invalid: ${startVerify.message}`);
   }
-  const endVerify = verifyHash(end.line, end.hash, content, hashLen, lines);
+  const endVerify = verifyHash(end.line, end.hash, normalized, hashLen, lines);
   if (!endVerify.valid) {
     throw new Error(`End reference invalid: ${endVerify.message}`);
   }
@@ -203,22 +235,27 @@ function resolveRange(startRef, endRef, content, hashLen) {
     startLine: start.line,
     endLine: end.line,
     lines: rangeLines,
-    content: rangeLines.join("\n")
+    content: rangeLines.join(lineEnding)
   };
 }
 function replaceRange(startRef, endRef, content, replacement, hashLen) {
-  const range = resolveRange(startRef, endRef, content, hashLen);
-  const lines = content.split("\n");
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const range = resolveRange(startRef, endRef, normalized, hashLen);
+  const lines = normalized.split("\n");
   const before = lines.slice(0, range.startLine - 1);
   const after = lines.slice(range.endLine);
   const replacementLines = replacement.split("\n");
-  return [...before, ...replacementLines, ...after].join("\n");
+  const result = [...before, ...replacementLines, ...after].join("\n");
+  return lineEnding === "\r\n" ? result.replace(/\n/g, "\r\n") : result;
 }
 function applyHashEdit(input, content, hashLen) {
+  const lineEnding = detectLineEnding(content);
+  const workContent = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
   const normalizedStart = normalizeHashRef(input.startRef);
   const start = parseHashRef(normalizedStart);
-  const lines = content.split("\n");
-  const startVerify = verifyHash(start.line, start.hash, content, hashLen, lines);
+  const lines = workContent.split("\n");
+  const startVerify = verifyHash(start.line, start.hash, workContent, hashLen, lines);
   if (!startVerify.valid) {
     throw new Error(`Start reference invalid: ${startVerify.message}`);
   }
@@ -237,7 +274,7 @@ function applyHashEdit(input, content, hashLen) {
       operation: input.operation,
       startLine: start.line,
       endLine: start.line,
-      content: next2
+      content: lineEnding === "\r\n" ? next2.replace(/\n/g, "\r\n") : next2
     };
   }
   const normalizedEnd = normalizeHashRef(input.endRef ?? input.startRef);
@@ -247,7 +284,7 @@ function applyHashEdit(input, content, hashLen) {
       `Invalid range: start line ${start.line} is after end line ${end.line}`
     );
   }
-  const endVerify = verifyHash(end.line, end.hash, content, hashLen, lines);
+  const endVerify = verifyHash(end.line, end.hash, workContent, hashLen, lines);
   if (!endVerify.valid) {
     throw new Error(`End reference invalid: ${endVerify.message}`);
   }
@@ -263,7 +300,7 @@ function applyHashEdit(input, content, hashLen) {
     operation: input.operation,
     startLine: start.line,
     endLine: end.line,
-    content: next
+    content: lineEnding === "\r\n" ? next.replace(/\n/g, "\r\n") : next
   };
 }
 var HashlineCache = class {
@@ -325,10 +362,15 @@ var HashlineCache = class {
     return this.cache.size;
   }
 };
+var globMatcherCache = /* @__PURE__ */ new Map();
 function matchesGlob(filePath, pattern) {
   const normalizedPath = filePath.replace(/\\/g, "/");
   const normalizedPattern = pattern.replace(/\\/g, "/");
-  const isMatch = picomatch(normalizedPattern, { dot: true });
+  let isMatch = globMatcherCache.get(normalizedPattern);
+  if (!isMatch) {
+    isMatch = picomatch(normalizedPattern, { dot: true });
+    globMatcherCache.set(normalizedPattern, isMatch);
+  }
   return isMatch(normalizedPath);
 }
 function shouldExclude(filePath, patterns) {
@@ -338,6 +380,9 @@ var textEncoder = new TextEncoder();
 function getByteLength(content) {
   return textEncoder.encode(content).length;
 }
+function detectLineEnding(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
 function createHashline(config) {
   const resolved = resolveConfig(config);
   const cache = new HashlineCache(resolved.cacheSize);
@@ -410,5 +455,6 @@ export {
   matchesGlob,
   shouldExclude,
   getByteLength,
+  detectLineEnding,
   createHashline
 };

package/dist/{chunk-JOA7B5LK.js → chunk-VPCMHCTB.js}

@@ -4,7 +4,7 @@ import {
   resolveConfig,
   shouldExclude,
   stripHashes
-} from "./chunk-DDXOFWTU.js";
+} from "./chunk-I6RACR3D.js";
 
 // src/hooks.ts
 import { appendFileSync } from "fs";

package/dist/{hashline-GY4XM34F.js → hashline-5PFAXY3H.js}

@@ -7,6 +7,7 @@ import {
   buildHashMap,
   computeLineHash,
   createHashline,
+  detectLineEnding,
   formatFileWithHashes,
   getAdaptiveHashLength,
   getByteLength,
@@ -19,7 +20,7 @@ import {
   shouldExclude,
   stripHashes,
   verifyHash
-} from "./chunk-DDXOFWTU.js";
+} from "./chunk-I6RACR3D.js";
 export {
   DEFAULT_CONFIG,
   DEFAULT_EXCLUDE_PATTERNS,
@@ -29,6 +30,7 @@ export {
   buildHashMap,
   computeLineHash,
   createHashline,
+  detectLineEnding,
   formatFileWithHashes,
   getAdaptiveHashLength,
   getByteLength,

package/dist/opencode-hashline.cjs

@@ -41,6 +41,7 @@ __export(hashline_exports, {
   buildHashMap: () => buildHashMap,
   computeLineHash: () => computeLineHash,
   createHashline: () => createHashline,
+  detectLineEnding: () => detectLineEnding,
   formatFileWithHashes: () => formatFileWithHashes,
   getAdaptiveHashLength: () => getAdaptiveHashLength,
   getByteLength: () => getByteLength,
@@ -100,16 +101,24 @@ function computeLineHash(idx, line, hashLen = 3) {
   return hash.toString(16).padStart(hashLen, "0");
 }
 function formatFileWithHashes(content, hashLen, prefix) {
-  const lines = content.split("\n");
+  const normalized = content.includes("\r\n") ? content.replace(/\r\n/g, "\n") : content;
+  const lines = normalized.split("\n");
   const effectiveLen = hashLen && hashLen >= 3 ? hashLen : getAdaptiveHashLength(lines.length);
   const effectivePrefix = prefix === void 0 ? DEFAULT_PREFIX : prefix === false ? "" : prefix;
   const hashes = new Array(lines.length);
   const seen = /* @__PURE__ */ new Map();
+  const upgraded = /* @__PURE__ */ new Set();
   for (let idx = 0; idx < lines.length; idx++) {
     const hash = computeLineHash(idx, lines[idx], effectiveLen);
     if (seen.has(hash)) {
       const longerLen = Math.min(effectiveLen + 1, 8);
+      const prevIdx = seen.get(hash);
+      if (!upgraded.has(prevIdx)) {
+        hashes[prevIdx] = computeLineHash(prevIdx, lines[prevIdx], longerLen);
+        upgraded.add(prevIdx);
+      }
       hashes[idx] = computeLineHash(idx, lines[idx], longerLen);
+      upgraded.add(idx);
     } else {
       seen.set(hash, idx);
       hashes[idx] = hash;
@@ -127,7 +136,9 @@ function stripHashes(content, prefix) {
     hashLinePattern = new RegExp(`^([+ \\-])?${escapedPrefix}\\d+:[0-9a-f]{2,8}\\|`);
     stripRegexCache.set(escapedPrefix, hashLinePattern);
   }
-  return content.split("\n").map((line) => {
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const result = normalized.split("\n").map((line) => {
     const match = line.match(hashLinePattern);
     if (match) {
       const patchMarker = match[1] || "";
@@ -135,11 +146,13 @@ function stripHashes(content, prefix) {
     }
     return line;
   }).join("\n");
+  return lineEnding === "\r\n" ? result.replace(/\n/g, "\r\n") : result;
 }
 function parseHashRef(ref) {
   const match = ref.match(/^(\d+):([0-9a-f]{2,8})$/);
   if (!match) {
-    throw new Error(`Invalid hash reference: "${ref}". Expected format: "<line>:<2-8 char hex>"`);
+    const display = ref.length > 100 ? `${ref.slice(0, 100)}\u2026` : ref;
+    throw new Error(`Invalid hash reference: "${display}". Expected format: "<line>:<2-8 char hex>"`);
   }
   return {
     line: parseInt(match[1], 10),
@@ -156,8 +169,9 @@ function normalizeHashRef(ref) {
   if (annotated) {
     return `${parseInt(annotated[1], 10)}:${annotated[2].toLowerCase()}`;
   }
+  const display = ref.length > 100 ? `${ref.slice(0, 100)}\u2026` : ref;
   throw new Error(
-    `Invalid hash reference: "${ref}". Expected "<line>:<hash>" or an annotated line like "#HL <line>:<hash>|..."`
+    `Invalid hash reference: "${display}". Expected "<line>:<hash>" or an annotated line like "#HL <line>:<hash>|..."`
   );
 }
 function buildHashMap(content, hashLen) {
@@ -200,12 +214,14 @@ function resolveRange(startRef, endRef, content, hashLen) {
       `Invalid range: start line ${start.line} is after end line ${end.line}`
     );
   }
-  const lines = content.split("\n");
-  const startVerify = verifyHash(start.line, start.hash, content, hashLen, lines);
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const lines = normalized.split("\n");
+  const startVerify = verifyHash(start.line, start.hash, normalized, hashLen, lines);
   if (!startVerify.valid) {
     throw new Error(`Start reference invalid: ${startVerify.message}`);
   }
-  const endVerify = verifyHash(end.line, end.hash, content, hashLen, lines);
+  const endVerify = verifyHash(end.line, end.hash, normalized, hashLen, lines);
   if (!endVerify.valid) {
     throw new Error(`End reference invalid: ${endVerify.message}`);
   }
@@ -214,22 +230,27 @@ function resolveRange(startRef, endRef, content, hashLen) {
     startLine: start.line,
     endLine: end.line,
     lines: rangeLines,
-    content: rangeLines.join("\n")
+    content: rangeLines.join(lineEnding)
   };
 }
 function replaceRange(startRef, endRef, content, replacement, hashLen) {
-  const range = resolveRange(startRef, endRef, content, hashLen);
-  const lines = content.split("\n");
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const range = resolveRange(startRef, endRef, normalized, hashLen);
+  const lines = normalized.split("\n");
   const before = lines.slice(0, range.startLine - 1);
   const after = lines.slice(range.endLine);
   const replacementLines = replacement.split("\n");
-  return [...before, ...replacementLines, ...after].join("\n");
+  const result = [...before, ...replacementLines, ...after].join("\n");
+  return lineEnding === "\r\n" ? result.replace(/\n/g, "\r\n") : result;
 }
 function applyHashEdit(input, content, hashLen) {
+  const lineEnding = detectLineEnding(content);
+  const workContent = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
   const normalizedStart = normalizeHashRef(input.startRef);
   const start = parseHashRef(normalizedStart);
-  const lines = content.split("\n");
-  const startVerify = verifyHash(start.line, start.hash, content, hashLen, lines);
+  const lines = workContent.split("\n");
+  const startVerify = verifyHash(start.line, start.hash, workContent, hashLen, lines);
   if (!startVerify.valid) {
     throw new Error(`Start reference invalid: ${startVerify.message}`);
   }
@@ -248,7 +269,7 @@ function applyHashEdit(input, content, hashLen) {
       operation: input.operation,
       startLine: start.line,
       endLine: start.line,
-      content: next2
+      content: lineEnding === "\r\n" ? next2.replace(/\n/g, "\r\n") : next2
     };
   }
   const normalizedEnd = normalizeHashRef(input.endRef ?? input.startRef);
@@ -258,7 +279,7 @@ function applyHashEdit(input, content, hashLen) {
       `Invalid range: start line ${start.line} is after end line ${end.line}`
     );
   }
-  const endVerify = verifyHash(end.line, end.hash, content, hashLen, lines);
+  const endVerify = verifyHash(end.line, end.hash, workContent, hashLen, lines);
   if (!endVerify.valid) {
     throw new Error(`End reference invalid: ${endVerify.message}`);
   }
@@ -274,13 +295,17 @@ function applyHashEdit(input, content, hashLen) {
     operation: input.operation,
     startLine: start.line,
     endLine: end.line,
-    content: next
+    content: lineEnding === "\r\n" ? next.replace(/\n/g, "\r\n") : next
   };
 }
 function matchesGlob(filePath, pattern) {
   const normalizedPath = filePath.replace(/\\/g, "/");
   const normalizedPattern = pattern.replace(/\\/g, "/");
-  const isMatch = (0, import_picomatch.default)(normalizedPattern, { dot: true });
+  let isMatch = globMatcherCache.get(normalizedPattern);
+  if (!isMatch) {
+    isMatch = (0, import_picomatch.default)(normalizedPattern, { dot: true });
+    globMatcherCache.set(normalizedPattern, isMatch);
+  }
   return isMatch(normalizedPath);
 }
 function shouldExclude(filePath, patterns) {
@@ -289,6 +314,9 @@ function shouldExclude(filePath, patterns) {
 function getByteLength(content) {
   return textEncoder.encode(content).length;
 }
+function detectLineEnding(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
 function createHashline(config) {
   const resolved = resolveConfig(config);
   const cache = new HashlineCache(resolved.cacheSize);
@@ -340,7 +368,7 @@ function createHashline(config) {
     }
   };
 }
-var import_picomatch, DEFAULT_EXCLUDE_PATTERNS, DEFAULT_PREFIX, DEFAULT_CONFIG, modulusCache, stripRegexCache, HashlineCache, textEncoder;
+var import_picomatch, DEFAULT_EXCLUDE_PATTERNS, DEFAULT_PREFIX, DEFAULT_CONFIG, modulusCache, stripRegexCache, HashlineCache, globMatcherCache, textEncoder;
 var init_hashline = __esm({
   "src/hashline.ts"() {
     "use strict";
@@ -373,7 +401,24 @@ var init_hashline = __esm({
       "**/*.exe",
       "**/*.dll",
       "**/*.so",
-      "**/*.dylib"
+      "**/*.dylib",
+      // Sensitive credential and secret files
+      "**/.env",
+      "**/.env.*",
+      "**/*.pem",
+      "**/*.key",
+      "**/*.p12",
+      "**/*.pfx",
+      "**/id_rsa",
+      "**/id_rsa.pub",
+      "**/id_ed25519",
+      "**/id_ed25519.pub",
+      "**/id_ecdsa",
+      "**/id_ecdsa.pub",
+      "**/.npmrc",
+      "**/.netrc",
+      "**/credentials",
+      "**/credentials.json"
     ];
     DEFAULT_PREFIX = "#HL ";
     DEFAULT_CONFIG = {
@@ -447,6 +492,7 @@ var init_hashline = __esm({
         return this.cache.size;
       }
     };
+    globMatcherCache = /* @__PURE__ */ new Map();
     textEncoder = new TextEncoder();
   }
 });
@@ -690,23 +736,37 @@ function createHashlineEditTool(config, cache) {
       operation: import_zod.z.enum(["replace", "delete", "insert_before", "insert_after"]).describe("Edit operation"),
       startRef: import_zod.z.string().describe('Start hash reference, e.g. "5:a3f" or "#HL 5:a3f|const x = 1;"'),
       endRef: import_zod.z.string().optional().describe("End hash reference for range operations. Defaults to startRef when omitted."),
-      replacement: import_zod.z.string().optional().describe("Replacement/inserted content. Required for replace/insert operations.")
+      replacement: import_zod.z.string().max(1e7).optional().describe("Replacement/inserted content. Required for replace/insert operations.")
     },
     async execute(args, context) {
       const { path, operation, startRef, endRef, replacement } = args;
       const absPath = (0, import_path2.isAbsolute)(path) ? path : (0, import_path2.resolve)(context.directory, path);
-      let realAbs;
-      try {
-        realAbs = (0, import_fs2.realpathSync)(absPath);
-      } catch {
-        realAbs = (0, import_path2.resolve)(absPath);
-      }
       const realDirectory = (0, import_fs2.realpathSync)((0, import_path2.resolve)(context.directory));
       const realWorktree = (0, import_fs2.realpathSync)((0, import_path2.resolve)(context.worktree));
       function isWithin(filePath, dir) {
         if (dir === import_path2.sep) return false;
+        if (process.platform === "win32") {
+          if (/^[A-Za-z]:\\$/.test(dir)) return false;
+          if (/^\\\\[^\\]+\\[^\\]+$/.test(dir)) return false;
+        }
         return filePath === dir || filePath.startsWith(dir + import_path2.sep);
       }
+      let realAbs;
+      try {
+        realAbs = (0, import_fs2.realpathSync)(absPath);
+      } catch {
+        const parentDir = (0, import_path2.dirname)(absPath);
+        let realParent;
+        try {
+          realParent = (0, import_fs2.realpathSync)(parentDir);
+        } catch {
+          throw new Error(`Access denied: cannot verify parent directory for "${path}"`);
+        }
+        if (!isWithin(realParent, realDirectory) && !isWithin(realParent, realWorktree)) {
+          throw new Error(`Access denied: "${path}" resolves outside the project directory`);
+        }
+        realAbs = (0, import_path2.resolve)(absPath);
+      }
       if (!isWithin(realAbs, realDirectory) && !isWithin(realAbs, realWorktree)) {
         throw new Error(`Access denied: "${path}" resolves outside the project directory`);
       }
@@ -719,6 +779,11 @@ function createHashlineEditTool(config, cache) {
         const reason = error instanceof Error ? error.message : String(error);
         throw new Error(`Failed to read "${displayPath}": ${reason}`);
       }
+      if (config.maxFileSize > 0 && getByteLength(current) > config.maxFileSize) {
+        throw new Error(
+          `File "${displayPath}" exceeds the configured maximum size (${config.maxFileSize} bytes)`
+        );
+      }
       let nextContent;
       let startLine;
       let endLine;
@@ -773,10 +838,40 @@ function createHashlineEditTool(config, cache) {
 
 // src/index.ts
 var CONFIG_FILENAME = "opencode-hashline.json";
+function sanitizeConfig(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {};
+  const r = raw;
+  const result = {};
+  if (Array.isArray(r.exclude)) {
+    result.exclude = r.exclude.filter(
+      (p) => typeof p === "string" && p.length <= 512
+    );
+  }
+  if (typeof r.maxFileSize === "number" && Number.isFinite(r.maxFileSize) && r.maxFileSize >= 0) {
+    result.maxFileSize = r.maxFileSize;
+  }
+  if (typeof r.hashLength === "number" && Number.isFinite(r.hashLength)) {
+    result.hashLength = Math.max(0, Math.min(8, Math.floor(r.hashLength)));
+  }
+  if (typeof r.cacheSize === "number" && Number.isFinite(r.cacheSize) && r.cacheSize > 0) {
+    result.cacheSize = Math.min(Math.floor(r.cacheSize), 1e4);
+  }
+  if (r.prefix === false) {
+    result.prefix = false;
+  } else if (typeof r.prefix === "string") {
+    if (/^[\x20-\x7E]{0,20}$/.test(r.prefix)) {
+      result.prefix = r.prefix;
+    }
+  }
+  if (typeof r.debug === "boolean") {
+    result.debug = r.debug;
+  }
+  return result;
+}
 function loadConfigFile(filePath) {
   try {
     const raw = (0, import_fs3.readFileSync)(filePath, "utf-8");
-    return JSON.parse(raw);
+    return sanitizeConfig(JSON.parse(raw));
   } catch {
     return void 0;
   }

package/dist/opencode-hashline.js

@@ -3,12 +3,13 @@ import {
   createFileReadAfterHook,
   createSystemPromptHook,
   setDebug
-} from "./chunk-JOA7B5LK.js";
+} from "./chunk-VPCMHCTB.js";
 import {
   HashlineCache,
   applyHashEdit,
+  getByteLength,
   resolveConfig
-} from "./chunk-DDXOFWTU.js";
+} from "./chunk-I6RACR3D.js";
 
 // src/index.ts
 import { readFileSync as readFileSync2, realpathSync as realpathSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
@@ -18,7 +19,7 @@ import { fileURLToPath } from "url";
 
 // src/hashline-tool.ts
 import { readFileSync, realpathSync, writeFileSync } from "fs";
-import { isAbsolute, relative, resolve, sep } from "path";
+import { dirname, isAbsolute, relative, resolve, sep } from "path";
 import { z } from "zod";
 function createHashlineEditTool(config, cache) {
   return {
@@ -28,23 +29,37 @@ function createHashlineEditTool(config, cache) {
       operation: z.enum(["replace", "delete", "insert_before", "insert_after"]).describe("Edit operation"),
       startRef: z.string().describe('Start hash reference, e.g. "5:a3f" or "#HL 5:a3f|const x = 1;"'),
       endRef: z.string().optional().describe("End hash reference for range operations. Defaults to startRef when omitted."),
-      replacement: z.string().optional().describe("Replacement/inserted content. Required for replace/insert operations.")
+      replacement: z.string().max(1e7).optional().describe("Replacement/inserted content. Required for replace/insert operations.")
     },
     async execute(args, context) {
       const { path, operation, startRef, endRef, replacement } = args;
       const absPath = isAbsolute(path) ? path : resolve(context.directory, path);
-      let realAbs;
-      try {
-        realAbs = realpathSync(absPath);
-      } catch {
-        realAbs = resolve(absPath);
-      }
       const realDirectory = realpathSync(resolve(context.directory));
       const realWorktree = realpathSync(resolve(context.worktree));
       function isWithin(filePath, dir) {
         if (dir === sep) return false;
+        if (process.platform === "win32") {
+          if (/^[A-Za-z]:\\$/.test(dir)) return false;
+          if (/^\\\\[^\\]+\\[^\\]+$/.test(dir)) return false;
+        }
         return filePath === dir || filePath.startsWith(dir + sep);
       }
+      let realAbs;
+      try {
+        realAbs = realpathSync(absPath);
+      } catch {
+        const parentDir = dirname(absPath);
+        let realParent;
+        try {
+          realParent = realpathSync(parentDir);
+        } catch {
+          throw new Error(`Access denied: cannot verify parent directory for "${path}"`);
+        }
+        if (!isWithin(realParent, realDirectory) && !isWithin(realParent, realWorktree)) {
+          throw new Error(`Access denied: "${path}" resolves outside the project directory`);
+        }
+        realAbs = resolve(absPath);
+      }
       if (!isWithin(realAbs, realDirectory) && !isWithin(realAbs, realWorktree)) {
         throw new Error(`Access denied: "${path}" resolves outside the project directory`);
       }
@@ -57,6 +72,11 @@ function createHashlineEditTool(config, cache) {
         const reason = error instanceof Error ? error.message : String(error);
         throw new Error(`Failed to read "${displayPath}": ${reason}`);
       }
+      if (config.maxFileSize > 0 && getByteLength(current) > config.maxFileSize) {
+        throw new Error(
+          `File "${displayPath}" exceeds the configured maximum size (${config.maxFileSize} bytes)`
+        );
+      }
       let nextContent;
       let startLine;
       let endLine;
@@ -111,10 +131,40 @@ function createHashlineEditTool(config, cache) {
 
 // src/index.ts
 var CONFIG_FILENAME = "opencode-hashline.json";
+function sanitizeConfig(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {};
+  const r = raw;
+  const result = {};
+  if (Array.isArray(r.exclude)) {
+    result.exclude = r.exclude.filter(
+      (p) => typeof p === "string" && p.length <= 512
+    );
+  }
+  if (typeof r.maxFileSize === "number" && Number.isFinite(r.maxFileSize) && r.maxFileSize >= 0) {
+    result.maxFileSize = r.maxFileSize;
+  }
+  if (typeof r.hashLength === "number" && Number.isFinite(r.hashLength)) {
+    result.hashLength = Math.max(0, Math.min(8, Math.floor(r.hashLength)));
+  }
+  if (typeof r.cacheSize === "number" && Number.isFinite(r.cacheSize) && r.cacheSize > 0) {
+    result.cacheSize = Math.min(Math.floor(r.cacheSize), 1e4);
+  }
+  if (r.prefix === false) {
+    result.prefix = false;
+  } else if (typeof r.prefix === "string") {
+    if (/^[\x20-\x7E]{0,20}$/.test(r.prefix)) {
+      result.prefix = r.prefix;
+    }
+  }
+  if (typeof r.debug === "boolean") {
+    result.debug = r.debug;
+  }
+  return result;
+}
 function loadConfigFile(filePath) {
   try {
     const raw = readFileSync2(filePath, "utf-8");
-    return JSON.parse(raw);
+    return sanitizeConfig(JSON.parse(raw));
   } catch {
     return void 0;
   }
@@ -172,7 +222,7 @@ function createHashlinePlugin(userConfig) {
           const out = output;
           const hashLen = config.hashLength || 0;
           const prefix = config.prefix;
-          const { formatFileWithHashes, shouldExclude, getByteLength } = await import("./hashline-GY4XM34F.js");
+          const { formatFileWithHashes, shouldExclude, getByteLength: getByteLength2 } = await import("./hashline-5PFAXY3H.js");
           for (const p of out.parts ?? []) {
             if (p.type !== "file") continue;
             if (!p.url || !p.mime?.startsWith("text/")) continue;
@@ -199,7 +249,7 @@ function createHashlinePlugin(userConfig) {
             } catch {
               continue;
             }
-            if (config.maxFileSize > 0 && getByteLength(content) > config.maxFileSize) continue;
+            if (config.maxFileSize > 0 && getByteLength2(content) > config.maxFileSize) continue;
             const cached = cache.get(filePath, content);
             if (cached) {
               const tmpPath2 = join(tmpdir(), `hashline-${p.id}.txt`);

package/dist/utils.cjs

@@ -87,7 +87,24 @@ var DEFAULT_EXCLUDE_PATTERNS = [
   "**/*.exe",
   "**/*.dll",
   "**/*.so",
-  "**/*.dylib"
+  "**/*.dylib",
+  // Sensitive credential and secret files
+  "**/.env",
+  "**/.env.*",
+  "**/*.pem",
+  "**/*.key",
+  "**/*.p12",
+  "**/*.pfx",
+  "**/id_rsa",
+  "**/id_rsa.pub",
+  "**/id_ed25519",
+  "**/id_ed25519.pub",
+  "**/id_ecdsa",
+  "**/id_ecdsa.pub",
+  "**/.npmrc",
+  "**/.netrc",
+  "**/credentials",
+  "**/credentials.json"
 ];
 var DEFAULT_PREFIX = "#HL ";
 var DEFAULT_CONFIG = {
@@ -147,16 +164,24 @@ function computeLineHash(idx, line, hashLen = 3) {
   return hash.toString(16).padStart(hashLen, "0");
 }
 function formatFileWithHashes(content, hashLen, prefix) {
-  const lines = content.split("\n");
+  const normalized = content.includes("\r\n") ? content.replace(/\r\n/g, "\n") : content;
+  const lines = normalized.split("\n");
   const effectiveLen = hashLen && hashLen >= 3 ? hashLen : getAdaptiveHashLength(lines.length);
   const effectivePrefix = prefix === void 0 ? DEFAULT_PREFIX : prefix === false ? "" : prefix;
   const hashes = new Array(lines.length);
   const seen = /* @__PURE__ */ new Map();
+  const upgraded = /* @__PURE__ */ new Set();
   for (let idx = 0; idx < lines.length; idx++) {
     const hash = computeLineHash(idx, lines[idx], effectiveLen);
     if (seen.has(hash)) {
       const longerLen = Math.min(effectiveLen + 1, 8);
+      const prevIdx = seen.get(hash);
+      if (!upgraded.has(prevIdx)) {
+        hashes[prevIdx] = computeLineHash(prevIdx, lines[prevIdx], longerLen);
+        upgraded.add(prevIdx);
+      }
       hashes[idx] = computeLineHash(idx, lines[idx], longerLen);
+      upgraded.add(idx);
     } else {
       seen.set(hash, idx);
       hashes[idx] = hash;
@@ -175,7 +200,9 @@ function stripHashes(content, prefix) {
     hashLinePattern = new RegExp(`^([+ \\-])?${escapedPrefix}\\d+:[0-9a-f]{2,8}\\|`);
     stripRegexCache.set(escapedPrefix, hashLinePattern);
   }
-  return content.split("\n").map((line) => {
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const result = normalized.split("\n").map((line) => {
     const match = line.match(hashLinePattern);
     if (match) {
       const patchMarker = match[1] || "";
@@ -183,11 +210,13 @@ function stripHashes(content, prefix) {
     }
     return line;
   }).join("\n");
+  return lineEnding === "\r\n" ? result.replace(/\n/g, "\r\n") : result;
 }
 function parseHashRef(ref) {
   const match = ref.match(/^(\d+):([0-9a-f]{2,8})$/);
   if (!match) {
-    throw new Error(`Invalid hash reference: "${ref}". Expected format: "<line>:<2-8 char hex>"`);
+    const display = ref.length > 100 ? `${ref.slice(0, 100)}\u2026` : ref;
+    throw new Error(`Invalid hash reference: "${display}". Expected format: "<line>:<2-8 char hex>"`);
   }
   return {
     line: parseInt(match[1], 10),
@@ -204,8 +233,9 @@ function normalizeHashRef(ref) {
   if (annotated) {
     return `${parseInt(annotated[1], 10)}:${annotated[2].toLowerCase()}`;
   }
+  const display = ref.length > 100 ? `${ref.slice(0, 100)}\u2026` : ref;
   throw new Error(
-    `Invalid hash reference: "${ref}". Expected "<line>:<hash>" or an annotated line like "#HL <line>:<hash>|..."`
+    `Invalid hash reference: "${display}". Expected "<line>:<hash>" or an annotated line like "#HL <line>:<hash>|..."`
   );
 }
 function buildHashMap(content, hashLen) {
@@ -248,12 +278,14 @@ function resolveRange(startRef, endRef, content, hashLen) {
       `Invalid range: start line ${start.line} is after end line ${end.line}`
     );
   }
-  const lines = content.split("\n");
-  const startVerify = verifyHash(start.line, start.hash, content, hashLen, lines);
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const lines = normalized.split("\n");
+  const startVerify = verifyHash(start.line, start.hash, normalized, hashLen, lines);
   if (!startVerify.valid) {
     throw new Error(`Start reference invalid: ${startVerify.message}`);
   }
-  const endVerify = verifyHash(end.line, end.hash, content, hashLen, lines);
+  const endVerify = verifyHash(end.line, end.hash, normalized, hashLen, lines);
   if (!endVerify.valid) {
     throw new Error(`End reference invalid: ${endVerify.message}`);
   }
@@ -262,22 +294,27 @@ function resolveRange(startRef, endRef, content, hashLen) {
     startLine: start.line,
     endLine: end.line,
     lines: rangeLines,
-    content: rangeLines.join("\n")
+    content: rangeLines.join(lineEnding)
   };
 }
 function replaceRange(startRef, endRef, content, replacement, hashLen) {
-  const range = resolveRange(startRef, endRef, content, hashLen);
-  const lines = content.split("\n");
+  const lineEnding = detectLineEnding(content);
+  const normalized = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
+  const range = resolveRange(startRef, endRef, normalized, hashLen);
+  const lines = normalized.split("\n");
   const before = lines.slice(0, range.startLine - 1);
   const after = lines.slice(range.endLine);
   const replacementLines = replacement.split("\n");
-  return [...before, ...replacementLines, ...after].join("\n");
+  const result = [...before, ...replacementLines, ...after].join("\n");
+  return lineEnding === "\r\n" ? result.replace(/\n/g, "\r\n") : result;
 }
 function applyHashEdit(input, content, hashLen) {
+  const lineEnding = detectLineEnding(content);
+  const workContent = lineEnding === "\r\n" ? content.replace(/\r\n/g, "\n") : content;
   const normalizedStart = normalizeHashRef(input.startRef);
   const start = parseHashRef(normalizedStart);
-  const lines = content.split("\n");
-  const startVerify = verifyHash(start.line, start.hash, content, hashLen, lines);
+  const lines = workContent.split("\n");
+  const startVerify = verifyHash(start.line, start.hash, workContent, hashLen, lines);
   if (!startVerify.valid) {
     throw new Error(`Start reference invalid: ${startVerify.message}`);
   }
@@ -296,7 +333,7 @@ function applyHashEdit(input, content, hashLen) {
       operation: input.operation,
       startLine: start.line,
       endLine: start.line,
-      content: next2
+      content: lineEnding === "\r\n" ? next2.replace(/\n/g, "\r\n") : next2
     };
   }
   const normalizedEnd = normalizeHashRef(input.endRef ?? input.startRef);
@@ -306,7 +343,7 @@ function applyHashEdit(input, content, hashLen) {
       `Invalid range: start line ${start.line} is after end line ${end.line}`
     );
   }
-  const endVerify = verifyHash(end.line, end.hash, content, hashLen, lines);
+  const endVerify = verifyHash(end.line, end.hash, workContent, hashLen, lines);
   if (!endVerify.valid) {
     throw new Error(`End reference invalid: ${endVerify.message}`);
   }
@@ -322,7 +359,7 @@ function applyHashEdit(input, content, hashLen) {
     operation: input.operation,
     startLine: start.line,
     endLine: end.line,
-    content: next
+    content: lineEnding === "\r\n" ? next.replace(/\n/g, "\r\n") : next
   };
 }
 var HashlineCache = class {
@@ -384,10 +421,15 @@ var HashlineCache = class {
     return this.cache.size;
   }
 };
+var globMatcherCache = /* @__PURE__ */ new Map();
 function matchesGlob(filePath, pattern) {
   const normalizedPath = filePath.replace(/\\/g, "/");
   const normalizedPattern = pattern.replace(/\\/g, "/");
-  const isMatch = (0, import_picomatch.default)(normalizedPattern, { dot: true });
+  let isMatch = globMatcherCache.get(normalizedPattern);
+  if (!isMatch) {
+    isMatch = (0, import_picomatch.default)(normalizedPattern, { dot: true });
+    globMatcherCache.set(normalizedPattern, isMatch);
+  }
   return isMatch(normalizedPath);
 }
 function shouldExclude(filePath, patterns) {
@@ -397,6 +439,9 @@ var textEncoder = new TextEncoder();
 function getByteLength(content) {
   return textEncoder.encode(content).length;
 }
+function detectLineEnding(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
 function createHashline(config) {
   const resolved = resolveConfig(config);
   const cache = new HashlineCache(resolved.cacheSize);

package/dist/utils.js

@@ -3,7 +3,7 @@ import {
   createFileReadAfterHook,
   createSystemPromptHook,
   isFileReadTool
-} from "./chunk-JOA7B5LK.js";
+} from "./chunk-VPCMHCTB.js";
 import {
   DEFAULT_CONFIG,
   DEFAULT_EXCLUDE_PATTERNS,
@@ -25,7 +25,7 @@ import {
   shouldExclude,
   stripHashes,
   verifyHash
-} from "./chunk-DDXOFWTU.js";
+} from "./chunk-I6RACR3D.js";
 export {
   DEFAULT_CONFIG,
   DEFAULT_EXCLUDE_PATTERNS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-hashline",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Hashline plugin for OpenCode — content-addressable line hashing for precise AI code editing",
   "main": "dist/opencode-hashline.cjs",
   "module": "dist/opencode-hashline.js",