sema-core 2.0.5 → 2.0.7

package/dist/util/commands.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasCommandInjection = hasCommandInjection;
+exports.stripHeredocBody = stripHeredocBody;
 exports.splitCommand = splitCommand;
 exports.getCommandPrefix = getCommandPrefix;
 const shell_quote_1 = require("shell-quote");
@@ -10,11 +11,121 @@ const commands_1 = require("../prompt/commands");
 const SQ_PLACEHOLDER = '__SQ_PLACEHOLDER__';
 const DQ_PLACEHOLDER = '__DQ_PLACEHOLDER__';
 const BS_PLACEHOLDER = '__BS_PLACEHOLDER__';
-// 命令注入特征：反引号 / $( / 换行 / && / || / ;（与 COMMAND_PREFIX 提示词 step1 保持一致）。
-// splitCommand 已按 && || ; 拆分，子命令里仍残留这些字符即视为注入，按危险处理（fail-closed）。
-const COMMAND_INJECTION_PATTERN = /[`\n;]|\$\(|&&|\|\|/;
+// 命令注入特征：反引号 / $( / 换行 / && / || / ;。
+// 但必须区分引号内外——引号里的换行/分号是字面数据（如 echo "多行文本"），不是命令分隔：
+//  - 单引号内：全部字面，shell 不做任何解释 → 一律忽略
+//  - 双引号内：换行 / ; / && / || 是字面，但 $( 与反引号仍是命令替换 → 仅检出这两者
+//  - 引号外：换行 / ; / && / || / $( / 反引号 全部视为注入
+// 反斜杠转义会跳过下一个字符，避免把 \" \' 误判为引号边界。解析始终保守（fail-closed）。
 function hasCommandInjection(command) {
-    return COMMAND_INJECTION_PATTERN.test(command);
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        if (inSingle) {
+            // 单引号内无转义，仅 ' 结束
+            if (c === "'")
+                inSingle = false;
+            continue;
+        }
+        if (c === '\\') {
+            // 引号外或双引号内：反斜杠转义下一个字符，跳过
+            i++;
+            continue;
+        }
+        if (inDouble) {
+            if (c === '`')
+                return true;
+            if (c === '$' && next === '(')
+                return true;
+            if (c === '"')
+                inDouble = false;
+            continue;
+        }
+        // 引号外
+        if (c === "'") {
+            inSingle = true;
+            continue;
+        }
+        if (c === '"') {
+            inDouble = true;
+            continue;
+        }
+        if (c === '`' || c === '\n' || c === ';')
+            return true;
+        if (c === '$' && next === '(')
+            return true;
+        if ((c === '&' || c === '|') && next === c)
+            return true;
+    }
+    return false;
+}
+// heredoc 起始标记：<< 或 <<-，后跟可选引号包裹的结束符。
+// 不匹配 <<<（here-string，语义不同）：<< 后紧跟 < 不是引号也不是标识符首字符，自然落空。
+const HEREDOC_START_RE = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/g;
+/**
+ * 剥离 heredoc 正文,返回仅含"命令骨架"的字符串,供注入检测使用。
+ *
+ * heredoc 正文是喂给程序的「数据」而非 shell 命令,但底层 shell-quote 不理解 heredoc,
+ * 会把正文按 token 打散、换行有时残留,导致 hasCommandInjection 把正文换行误判为命令注入
+ * （是否误判还取决于正文里有无 # 注释等,结果不稳定）。本函数在解析前把正文摘掉:
+ *  - 结束符带引号（<< 'X' / << "X"）：正文纯字面,shell 不展开,直接剥离
+ *  - 结束符不带引号（<< X）：shell 会对正文做命令替换,仅当正文不含 $( / 反引号 时才剥离;
+ *    含命令替换则保留拦截（返回原命令,让 hasCommandInjection 照常检出）
+ *
+ * 任何无法可靠解析的情形（多 heredoc 同行、缺结束符等）一律返回原命令（fail-closed,维持现状）,
+ * 绝不因剥离而放过真注入。
+ */
+function stripHeredocBody(command) {
+    if (!command.includes('\n'))
+        return command;
+    const lines = command.split('\n');
+    const out = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        const matches = [...line.matchAll(HEREDOC_START_RE)];
+        if (matches.length === 0) {
+            out.push(line);
+            i++;
+            continue;
+        }
+        // 同一行多个 heredoc：正文顺序复杂,放弃剥离
+        if (matches.length > 1)
+            return command;
+        const m = matches[0];
+        const quoted = m[1] !== '';
+        const delim = m[2];
+        // 起始行保留,正文从下一行起到独占一行的结束符为止。
+        // 结束符匹配忽略两侧空白：真实 shell 对 << 要求结束符顶格（仅 <<- 允许 tab），但调用方/agent
+        // 常带缩进。放宽只会让我们更早判定正文边界——结束符之后的内容仍照常做注入检测（更保守，不放过
+        // 真注入）；带引号正文本就字面、不带引号正文已先扫 $(/反引号，故放宽不削弱安全性。
+        out.push(line);
+        let j = i + 1;
+        const body = [];
+        let foundEnd = false;
+        for (; j < lines.length; j++) {
+            const bodyLine = lines[j];
+            if (bodyLine.trim() === delim) {
+                foundEnd = true;
+                break;
+            }
+            body.push(bodyLine);
+        }
+        // 没找到结束符（命令被截断等）→ fail-closed
+        if (!foundEnd)
+            return command;
+        // 不带引号且正文含命令替换 → shell 会真执行,保留拦截
+        if (!quoted) {
+            const bodyText = body.join('\n');
+            if (bodyText.includes('$(') || bodyText.includes('`'))
+                return command;
+        }
+        // 剥离正文与结束符行,直接跳到结束符行之后
+        i = j + 1;
+    }
+    return out.join('\n');
 }
 /**
  * 根据shell操作符将命令字符串拆分为单个命令

package/dist/util/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/util/commands.ts"],"names":[],"mappings":";;AAoBA,kDAEC;AAKD,oCA+GC;AAED,4CA2DC;AAvMD,6CAAqE;AACrE,uDAAqD;AACrD,uCAA0C;AAC1C,iDAA6F;AAE7F,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAC3C,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAC3C,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAS3C,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,yBAAyB,GAAG,qBAAqB,CAAA;AAEvD,SAAgB,mBAAmB,CAAC,OAAe;IACjD,OAAO,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAChD,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,OAAe;IAC1C,MAAM,KAAK,GAAiB,EAAE,CAAA;IAE9B,cAAc;IACd,KAAK,MAAM,IAAI,IAAI,IAAA,mBAAK,EACtB,OAAO;SACJ,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC;SAChC,UAAU,CAAC,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC;SACrC,UAAU,CAAC,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC,EACxC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CACzB,EAAE,CAAC;QACF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,IAAI,CAAA;gBACrC,SAAQ;YACV,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,eAAe;IACf,MAAM,WAAW,GAAG,KAAK;SACtB,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,OAAO,CAAA;QACrB,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,EAAE,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAEvD,gBAAgB;IAChB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACzC,OAAO,IAAI;aACR,UAAU,CAAC,GAAG,cAAc,EAAE,EAAE,GAAG,CAAC;aACpC,UAAU,CAAC,GAAG,cAAc,EAAE,EAAE,GAAG,CAAC;aACpC,UAAU,CAAC,GAAG,cAAc,EAAE,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,YAAY;IACZ,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,cAAc,GAAkB,IAAI,CAAA;IACxC,IAAI,wBAAwB,GAAG,CAAC,CAAA;IAEhC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;QAClC,cAAc,GAAG,cAAc;YAC7B,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC5B,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE;gBAC5B,CAAC,CAAC,GAAG,cAAc,IAAI,IAAI,EAAE;YAC/B,CAAC,CAAC,IAAI,CAAA;IACV,CAAC,CAAA;IAED,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,IAAI,CAAC,cAAc;YAAE,OAAM;QAC3B,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACjC,cAAc,GAAG,IAAI,CAAA;IACvB,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAE,CAAA;QAEhC,IAAI,IAAI,KAAK,GAAG,IAAI,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,cAAc,IAAI,IAAI,CAAA;YACtB,wBAAwB,EAAE,CAAA;YAC1B,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,wBAAwB,GAAG,CAAC,EAAE,CAAC;YACjD,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YACnE,wBAAwB,EAAE,CAAA;YAC1B,SAAQ;QACV,CAAC;QAED,IAAK,qBAAqC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,mBAAmB,EAAE,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAK,wBAAwC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,mBAAmB,EAAE,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACvC,IACE,QAAQ;gBACR,CAAE,wBAAwC,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxD,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAChC,CAAC;gBACD,cAAc,GAAG,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;gBAClE,KAAK,EAAE,CAAA;YACT,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YAC1D,CAAC;YACD,SAAQ;QACV,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,mBAAmB,EAAE,CAAA;IACrB,OAAO,YAAY,CAAA;AACrB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,WAAwB,EACxB,SAAkB;IAElB,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,qBAAU,EAAC;YAC1B,YAAY,EAAE;gBACZ;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,uCAA4B;iBACnC;aACF;YACD,UAAU,EAAE,IAAA,qCAA0B,EAAC,OAAO,CAAC;YAC/C,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,KAAK;YACrB,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,CACb,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;QAC1B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI;gBAC5D,MAAM,CAAC;YACT,CAAC,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,CAAA;IAER,IAAI,MAAM,CAAC,UAAU,CAAC,wBAAc,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,KAAK,4BAA4B,EAAE,CAAC;QAC5C,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAA;IAC3C,CAAC;IAED,0CAA0C;IAC1C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,wBAAwB,EAAE,KAAK;SAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,wBAAwB,EAAE,KAAK;SAChC,CAAA;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,wBAAwB,EAAE,KAAK;KAChC,CAAA;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAkB;IACrD,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,GAAG;IACH,GAAG;IACH,IAAI;CACL,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS;IAC/C,GAAG,qBAAqB;IACxB,GAAG;IACH,GAAG;CACJ,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS;IAC/C,GAAG;IACH,GAAG;CACJ,CAAC,CAAA;AAEF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG;IACH,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;CACN,CAAC,CAAA;AAEF,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAe;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IACnE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,EAAE,CAAA;AACnF,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/util/commands.ts"],"names":[],"mappings":";;AAsBA,kDAkCC;AAmBD,4CAsDC;AAKD,oCA+GC;AAED,4CA2DC;AAlTD,6CAAqE;AACrE,uDAAqD;AACrD,uCAA0C;AAC1C,iDAA6F;AAE7F,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAC3C,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAC3C,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAS3C,sCAAsC;AACtC,mDAAmD;AACnD,mCAAmC;AACnC,wDAAwD;AACxD,4CAA4C;AAC5C,uDAAuD;AACvD,SAAgB,mBAAmB,CAAC,OAAe;IACjD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAE3B,IAAI,QAAQ,EAAE,CAAC;YACb,iBAAiB;YACjB,IAAI,CAAC,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAA;YAC/B,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,yBAAyB;YACzB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YAC1C,IAAI,CAAC,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAA;YAC/B,SAAQ;QACV,CAAC;QAED,MAAM;QACN,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC1C,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACzD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sCAAsC;AACtC,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,2CAA2C,CAAA;AAEpE;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAA;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,CAAA;IAET,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACtB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAEpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,4BAA4B;QAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAA;QAEtC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAA;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAEnB,4BAA4B;QAC5B,6DAA6D;QAC7D,iDAAiD;QACjD,6CAA6C;QAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;YAC1B,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAK;YACP,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAA;QAE7B,iCAAiC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAA;QACvE,CAAC;QAED,uBAAuB;QACvB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACX,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,OAAe;IAC1C,MAAM,KAAK,GAAiB,EAAE,CAAA;IAE9B,cAAc;IACd,KAAK,MAAM,IAAI,IAAI,IAAA,mBAAK,EACtB,OAAO;SACJ,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC;SAChC,UAAU,CAAC,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC;SACrC,UAAU,CAAC,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC,EACxC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CACzB,EAAE,CAAC;QACF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,IAAI,CAAA;gBACrC,SAAQ;YACV,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,eAAe;IACf,MAAM,WAAW,GAAG,KAAK;SACtB,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,OAAO,CAAA;QACrB,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,EAAE,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAEvD,gBAAgB;IAChB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACzC,OAAO,IAAI;aACR,UAAU,CAAC,GAAG,cAAc,EAAE,EAAE,GAAG,CAAC;aACpC,UAAU,CAAC,GAAG,cAAc,EAAE,EAAE,GAAG,CAAC;aACpC,UAAU,CAAC,GAAG,cAAc,EAAE,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,YAAY;IACZ,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,cAAc,GAAkB,IAAI,CAAA;IACxC,IAAI,wBAAwB,GAAG,CAAC,CAAA;IAEhC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;QAClC,cAAc,GAAG,cAAc;YAC7B,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC5B,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE;gBAC5B,CAAC,CAAC,GAAG,cAAc,IAAI,IAAI,EAAE;YAC/B,CAAC,CAAC,IAAI,CAAA;IACV,CAAC,CAAA;IAED,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,IAAI,CAAC,cAAc;YAAE,OAAM;QAC3B,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACjC,cAAc,GAAG,IAAI,CAAA;IACvB,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAE,CAAA;QAEhC,IAAI,IAAI,KAAK,GAAG,IAAI,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,cAAc,IAAI,IAAI,CAAA;YACtB,wBAAwB,EAAE,CAAA;YAC1B,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,wBAAwB,GAAG,CAAC,EAAE,CAAC;YACjD,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YACnE,wBAAwB,EAAE,CAAA;YAC1B,SAAQ;QACV,CAAC;QAED,IAAK,qBAAqC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,mBAAmB,EAAE,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAK,wBAAwC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,mBAAmB,EAAE,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACvC,IACE,QAAQ;gBACR,CAAE,wBAAwC,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxD,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAChC,CAAC;gBACD,cAAc,GAAG,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;gBAClE,KAAK,EAAE,CAAA;YACT,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YAC1D,CAAC;YACD,SAAQ;QACV,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,mBAAmB,EAAE,CAAA;IACrB,OAAO,YAAY,CAAA;AACrB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,WAAwB,EACxB,SAAkB;IAElB,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,qBAAU,EAAC;YAC1B,YAAY,EAAE;gBACZ;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,uCAA4B;iBACnC;aACF;YACD,UAAU,EAAE,IAAA,qCAA0B,EAAC,OAAO,CAAC;YAC/C,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,KAAK;YACrB,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,CACb,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;QAC1B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI;gBAC5D,MAAM,CAAC;YACT,CAAC,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,CAAA;IAER,IAAI,MAAM,CAAC,UAAU,CAAC,wBAAc,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,KAAK,4BAA4B,EAAE,CAAC;QAC5C,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAA;IAC3C,CAAC;IAED,0CAA0C;IAC1C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,wBAAwB,EAAE,KAAK;SAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,wBAAwB,EAAE,KAAK;SAChC,CAAA;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,wBAAwB,EAAE,KAAK;KAChC,CAAA;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAkB;IACrD,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,GAAG;IACH,GAAG;IACH,IAAI;CACL,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS;IAC/C,GAAG,qBAAqB;IACxB,GAAG;IACH,GAAG;CACJ,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS;IAC/C,GAAG;IACH,GAAG;CACJ,CAAC,CAAA;AAEF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG;IACH,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;CACN,CAAC,CAAA;AAEF,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAe;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IACnE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,EAAE,CAAA;AACnF,CAAC"}

package/dist/util/commands.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=commands.test.d.ts.map

package/dist/util/commands.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.test.d.ts","sourceRoot":"","sources":["../../src/util/commands.test.ts"],"names":[],"mappings":""}

package/dist/util/commands.test.js

@@ -0,0 +1,93 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const commands_1 = require("./commands");
+(0, node_test_1.test)('引号外元字符判为注入', () => {
+    for (const c of [
+        'echo a; rm x',
+        'ls && rm',
+        'ls || rm',
+        'echo $(id)',
+        'echo `id`',
+        'cat a\nrm b',
+    ]) {
+        strict_1.default.equal((0, commands_1.hasCommandInjection)(c), true, c);
+    }
+});
+(0, node_test_1.test)('回归: 引号内的换行/分号是字面数据，不得判为注入', () => {
+    // 多行 echo —— 此前因双引号内换行被误判为注入，导致 AutoRun 不调模型直接转人工
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "banana\napple\n100"'), false);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "a;b"'), false);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)("echo 'a;b;c'"), false);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)("echo '$(id)'"), false);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "he said \\"hi\\""'), false);
+});
+(0, node_test_1.test)('双引号内命令替换仍生效，必须判为注入', () => {
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "$(id)"'), true);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "`id`"'), true);
+});
+// ============ 误伤回归：以下都是合法命令，绝不能判为注入 ============
+(0, node_test_1.test)('误伤回归: 引号内含 shell 元字符的合法命令', () => {
+    for (const c of [
+        'echo "hello world"',
+        'git commit -m "fix: handle a, b and c"',
+        'python -c "print(\'hello\')"', // 双引号内嵌单引号
+        'node -e "console.log(1+1)"',
+        'grep -E "foo|bar" file', // 双引号内管道是字面
+        "grep -E 'foo|bar' .", // 单引号内管道是字面
+        "awk '{print $1}' data.txt", // 单引号内 $1
+        "sed 's/a/b/g' file",
+        'echo "price is $5 today"', // $ 后非 ( 不算替换
+        'echo "say \\"hi\\" now"', // 双引号内转义引号
+        'echo "a && b || c ; d"', // 全在双引号内 → 字面
+        "echo 'a && b || c ; d'", // 单引号内 → 字面
+        'psql -c "SELECT 1; SELECT 2;"', // 双引号内分号是合法 SQL
+        'echo "var=${HOME}/bin"', // ${} 不是命令替换
+        'echo "literal backslash-n: a\\nb"', // 字面 \n（非真换行）
+        'find . -name "*.ts"',
+        'git log --pretty=format:"%h %s"',
+        'echo "url=http://a.com?x=1&y=2"', // 单个 & 在双引号内
+    ]) {
+        strict_1.default.equal((0, commands_1.hasCommandInjection)(c), false, `不应误伤: ${JSON.stringify(c)}`);
+    }
+});
+(0, node_test_1.test)('误伤回归: 多行文本（你的原始场景）', () => {
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "banana\napple\ncherry\n100"'), false);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)("printf '%s\\n' 'line1\nline2'"), false);
+});
+// ============ 真注入：必须检出 ============
+(0, node_test_1.test)('真注入: 引号外的命令分隔/替换必须检出', () => {
+    for (const c of [
+        'ls; rm -rf /',
+        'ls && rm x',
+        'ls || rm x',
+        'echo $(whoami)',
+        'echo `whoami`',
+        'cat a\nrm b', // 引号外真实换行
+        'echo "$(cat /etc/passwd)"', // 双引号内命令替换
+        'foo "abc"; rm bar', // 引号闭合后的分号
+        "cat 'x'`id`", // 单引号闭合后反引号
+    ]) {
+        strict_1.default.equal((0, commands_1.hasCommandInjection)(c), true, `应检出注入: ${JSON.stringify(c)}`);
+    }
+});
+// ============ 边界行为文档化（断言实际行为，便于回归对比）============
+(0, node_test_1.test)('边界: 反斜杠转义的字符不参与判定', () => {
+    // 双引号内转义的 $ / 反引号是字面，不是命令替换
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "\\$(not sub)"'), false);
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "\\`not sub\\`"'), false);
+    // 行连接符 \<换行> 是续行，被转义跳过，不算注入
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo a \\\nb'), false);
+});
+(0, node_test_1.test)('边界: $(( 算术展开仍按注入处理（与历史行为一致，偏保守）', () => {
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo $((1+1))'), true);
+});
+(0, node_test_1.test)('边界: 未闭合引号内的分隔符不检出（命令本身在 shell 中即语法错误）', () => {
+    // 双引号未闭合 → 整段被当引号内，; 不检出；该命令在 shell 中会因 EOF 报错而不执行
+    strict_1.default.equal((0, commands_1.hasCommandInjection)('echo "a; rm b'), false);
+});
+//# sourceMappingURL=commands.test.js.map

package/dist/util/commands.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.test.js","sourceRoot":"","sources":["../../src/util/commands.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAgC;AAChC,gEAAuC;AACvC,yCAAgD;AAEhD,IAAA,gBAAI,EAAC,YAAY,EAAE,GAAG,EAAE;IACtB,KAAK,MAAM,CAAC,IAAI;QACd,cAAc;QACd,UAAU;QACV,UAAU;QACV,YAAY;QACZ,WAAW;QACX,aAAa;KACd,EAAE,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,2BAA2B,EAAE,GAAG,EAAE;IACrC,kDAAkD;IAClD,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,2BAA2B,CAAC,EAAE,KAAK,CAAC,CAAA;IACrE,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAA;IACtD,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACxD,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACxD,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,yBAAyB,CAAC,EAAE,KAAK,CAAC,CAAA;AACrE,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,oBAAoB,EAAE,GAAG,EAAE;IAC9B,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAA;IACvD,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA;AAEF,kDAAkD;AAClD,IAAA,gBAAI,EAAC,2BAA2B,EAAE,GAAG,EAAE;IACrC,KAAK,MAAM,CAAC,IAAI;QACd,oBAAoB;QACpB,wCAAwC;QACxC,8BAA8B,EAAW,WAAW;QACpD,4BAA4B;QAC5B,wBAAwB,EAAiB,YAAY;QACrD,qBAAqB,EAAoB,YAAY;QACrD,2BAA2B,EAAc,UAAU;QACnD,oBAAoB;QACpB,0BAA0B,EAAe,cAAc;QACvD,yBAAyB,EAAgB,WAAW;QACpD,wBAAwB,EAAiB,cAAc;QACvD,wBAAwB,EAAiB,YAAY;QACrD,+BAA+B,EAAU,gBAAgB;QACzD,wBAAwB,EAAiB,aAAa;QACtD,mCAAmC,EAAM,cAAc;QACvD,qBAAqB;QACrB,iCAAiC;QACjC,iCAAiC,EAAQ,aAAa;KACvD,EAAE,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,oBAAoB,EAAE,GAAG,EAAE;IAC9B,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC7E,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,+BAA+B,CAAC,EAAE,KAAK,CAAC,CAAA;AAC3E,CAAC,CAAC,CAAA;AAEF,qCAAqC;AACrC,IAAA,gBAAI,EAAC,sBAAsB,EAAE,GAAG,EAAE;IAChC,KAAK,MAAM,CAAC,IAAI;QACd,cAAc;QACd,YAAY;QACZ,YAAY;QACZ,gBAAgB;QAChB,eAAe;QACf,aAAa,EAA4B,UAAU;QACnD,2BAA2B,EAAc,WAAW;QACpD,mBAAmB,EAAsB,WAAW;QACpD,aAAa,EAA4B,YAAY;KACtD,EAAE,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,kDAAkD;AAClD,IAAA,gBAAI,EAAC,mBAAmB,EAAE,GAAG,EAAE;IAC7B,4BAA4B;IAC5B,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAA;IAC/D,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAA;IAChE,4BAA4B;IAC5B,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC3C,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAA;AAC1D,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,mDAAmD;IACnD,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAmB,EAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAA;AAC3D,CAAC,CAAC,CAAA"}

package/dist/util/fetchSafety.d.ts

@@ -0,0 +1,11 @@
+/**
+ * fetch_url 的确定性 SSRF 兜底：命中环回 / 链路本地（含云元数据 169.254.169.254）/
+ * 内网 / 未指定地址 / 本地主机名，一律按危险处理，不交给模型。URL 解析失败同样按危险处理。
+ *
+ * 说明：new URL() (WHATWG) 已把 十进制/十六进制/八进制/短写 IPv4（如 2130706433、0x7f000001、
+ * 127.1）规范化为点分十进制，故无需额外处理；这里额外补：
+ *  - IPv4-mapped IPv6（::ffff:7f00:1 等）
+ *  - 末尾点 FQDN（localhost. 等）
+ */
+export declare function isBlockedFetchHost(url: string): boolean;
+//# sourceMappingURL=fetchSafety.d.ts.map

package/dist/util/fetchSafety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchSafety.d.ts","sourceRoot":"","sources":["../../src/util/fetchSafety.ts"],"names":[],"mappings":"AAoBA;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA2CvD"}

package/dist/util/fetchSafety.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isBlockedFetchHost = isBlockedFetchHost;
+/**
+ * IPv4-mapped IPv6 → 内嵌 IPv4 点分形式。
+ * Node 的 URL 会把 ::ffff:127.0.0.1 规范化为 ::ffff:7f00:1，两种写法都要还原。
+ *   ::ffff:127.0.0.1 → "127.0.0.1"
+ *   ::ffff:7f00:1    → "127.0.0.1"
+ */
+function extractMappedIpv4(host) {
+    const m = host.match(/^::ffff:(.+)$/i);
+    if (!m)
+        return null;
+    const tail = m[1];
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(tail))
+        return tail;
+    const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    if (hex) {
+        const hi = parseInt(hex[1], 16);
+        const lo = parseInt(hex[2], 16);
+        return `${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`;
+    }
+    return null;
+}
+/**
+ * fetch_url 的确定性 SSRF 兜底：命中环回 / 链路本地（含云元数据 169.254.169.254）/
+ * 内网 / 未指定地址 / 本地主机名，一律按危险处理，不交给模型。URL 解析失败同样按危险处理。
+ *
+ * 说明：new URL() (WHATWG) 已把 十进制/十六进制/八进制/短写 IPv4（如 2130706433、0x7f000001、
+ * 127.1）规范化为点分十进制，故无需额外处理；这里额外补：
+ *  - IPv4-mapped IPv6（::ffff:7f00:1 等）
+ *  - 末尾点 FQDN（localhost. 等）
+ */
+function isBlockedFetchHost(url) {
+    let hostname;
+    try {
+        hostname = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return true;
+    }
+    // 去掉 IPv6 字面量方括号，并去掉末尾点（FQDN 绝对形式，如 localhost.）
+    let host = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    // 本地主机名 / 已知云元数据主机名
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host === 'metadata.google.internal')
+        return true;
+    // IPv4-mapped IPv6 → 取出内嵌 IPv4，按下方 IPv4 规则判定
+    const mapped = extractMappedIpv4(host);
+    if (mapped)
+        host = mapped;
+    // IPv4 字面量
+    const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4) {
+        const a = Number(ipv4[1]);
+        const b = Number(ipv4[2]);
+        if (a === 0)
+            return true; // 0.0.0.0/8 未指定
+        if (a === 10)
+            return true; // 10.0.0.0/8 私网
+        if (a === 127)
+            return true; // 127.0.0.0/8 环回
+        if (a === 169 && b === 254)
+            return true; // 169.254.0.0/16 链路本地（含元数据）
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // 172.16.0.0/12 私网
+        if (a === 192 && b === 168)
+            return true; // 192.168.0.0/16 私网
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // 100.64.0.0/10 CGNAT
+        return false;
+    }
+    // IPv6 字面量：环回 / 未指定 / ULA(fc00::/7) / 链路本地(fe80::/10)
+    if (host.includes(':')) {
+        if (host === '::1' || host === '::')
+            return true;
+        if (/^f[cd]/.test(host))
+            return true; // fc00::/7
+        if (/^fe[89ab]/.test(host))
+            return true; // fe80::/10
+        return false;
+    }
+    return false;
+}
+//# sourceMappingURL=fetchSafety.js.map

package/dist/util/fetchSafety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchSafety.js","sourceRoot":"","sources":["../../src/util/fetchSafety.ts"],"names":[],"mappings":";;AA6BA,gDA2CC;AAxED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;IAClB,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAC5D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QAChC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE9D,oBAAoB;IACpB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IAEpD,6CAA6C;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,MAAM;QAAE,IAAI,GAAG,MAAM,CAAA;IAEzB,WAAW;IACX,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAA0B,gBAAgB;QAClE,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA,CAAyB,gBAAgB;QAClE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAwB,iBAAiB;QACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAW,4BAA4B;QAC9E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA,CAAE,mBAAmB;QACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAW,oBAAoB;QACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,sBAAsB;QACxE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sDAAsD;IACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA,CAAG,WAAW;QAClD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,YAAY;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/util/fetchSafety.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fetchSafety.test.d.ts.map

package/dist/util/fetchSafety.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchSafety.test.d.ts","sourceRoot":"","sources":["../../src/util/fetchSafety.test.ts"],"names":[],"mappings":""}

package/dist/util/fetchSafety.test.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const fetchSafety_1 = require("./fetchSafety");
+(0, node_test_1.test)('环回/内网/链路本地/元数据 拦截', () => {
+    for (const u of [
+        'http://127.0.0.1/', 'http://localhost/', 'http://10.0.0.5/',
+        'http://192.168.1.1/', 'http://172.16.0.1/',
+        'http://169.254.169.254/latest/meta-data/',
+        'http://metadata.google.internal/', 'http://[::1]/',
+        'http://100.64.0.1/',
+    ]) {
+        strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)(u), true, u);
+    }
+});
+(0, node_test_1.test)('回归: IPv4 数值/短写编码 (URL 规范化后) 仍拦截', () => {
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://2130706433/'), true); // 127.0.0.1
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://0x7f000001/'), true);
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://127.1/'), true);
+});
+(0, node_test_1.test)('回归: IPv4-mapped IPv6 拦截', () => {
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://[::ffff:127.0.0.1]/'), true);
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://[::ffff:7f00:1]/'), true); // 127.0.0.1
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://[::ffff:169.254.169.254]/'), true);
+});
+(0, node_test_1.test)('回归: 末尾点 FQDN 拦截', () => {
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('http://localhost./'), true);
+});
+(0, node_test_1.test)('公网正常域名放行', () => {
+    for (const u of [
+        'https://registry.npmjs.org/react',
+        'https://github.com/x/y', 'https://8.8.8.8/',
+    ]) {
+        strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)(u), false, u);
+    }
+});
+(0, node_test_1.test)('非法 URL 按危险处理', () => {
+    strict_1.default.equal((0, fetchSafety_1.isBlockedFetchHost)('not a url'), true);
+});
+//# sourceMappingURL=fetchSafety.test.js.map

package/dist/util/fetchSafety.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchSafety.test.js","sourceRoot":"","sources":["../../src/util/fetchSafety.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAgC;AAChC,gEAAuC;AACvC,+CAAkD;AAElD,IAAA,gBAAI,EAAC,mBAAmB,EAAE,GAAG,EAAE;IAC7B,KAAK,MAAM,CAAC,IAAI;QACd,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB;QAC5D,qBAAqB,EAAE,oBAAoB;QAC3C,0CAA0C;QAC1C,kCAAkC,EAAE,eAAe;QACnD,oBAAoB;KACrB,EAAE,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC3C,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAA,CAAG,YAAY;IAC3E,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAA;IAC5D,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAA;AACzD,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACnC,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,CAAA;IACpE,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,CAAA,CAAO,YAAY;IACpF,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,CAAA;AAC5E,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,iBAAiB,EAAE,GAAG,EAAE;IAC3B,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,UAAU,EAAE,GAAG,EAAE;IACpB,KAAK,MAAM,CAAC,IAAI;QACd,kCAAkC;QAClC,wBAAwB,EAAE,kBAAkB;KAC7C,EAAE,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAA,gBAAI,EAAC,cAAc,EAAE,GAAG,EAAE;IACxB,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAkB,EAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAA;AACrD,CAAC,CAAC,CAAA"}

package/dist/util/fetchUrl.d.ts

@@ -13,6 +13,6 @@ type RedirectRecord = {
     statusCode: number;
 };
 export declare function fetchUrlAsMarkdown(url: string, abortController: AbortController): Promise<FetchUrlResult | RedirectRecord>;
-export declare function injectPromptIntoMarkdown(prompt: string, markdownContent: string, signal: AbortSignal): Promise<string>;
+export declare function injectPromptIntoMarkdown(prompt: string, markdownContent: string, signal: AbortSignal, sessionId?: string): Promise<string>;
 export {};
 //# sourceMappingURL=fetchUrl.d.ts.map

package/dist/util/fetchUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchUrl.d.ts","sourceRoot":"","sources":["../../src/util/fetchUrl.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,0BAA0B,QAAS,CAAA;AAEhD,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAQD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,CAsE1C;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}
+{"version":3,"file":"fetchUrl.d.ts","sourceRoot":"","sources":["../../src/util/fetchUrl.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,0BAA0B,QAAS,CAAA;AAEhD,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAQD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,CAsE1C;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/util/fetchUrl.js

@@ -81,13 +81,13 @@ async function fetchUrlAsMarkdown(url, abortController) {
         contentType,
     };
 }
-async function injectPromptIntoMarkdown(prompt, markdownContent, signal) {
+async function injectPromptIntoMarkdown(prompt, markdownContent, signal, sessionId) {
     const truncated = markdownContent.length > exports.FETCH_URL_MAX_MARKDOWN_LEN
         ? markdownContent.slice(0, exports.FETCH_URL_MAX_MARKDOWN_LEN) + '\n\n[Content trimmed — exceeded length limit.]'
         : markdownContent;
     const userPrompt = (0, fetchUrl_1.buildSecondaryModelPrompt)(truncated, prompt);
     try {
-        const { message } = await (0, queryLLM_1.queryQuick)({ userPrompt, signal });
+        const { message } = await (0, queryLLM_1.queryQuick)({ userPrompt, signal, sessionId });
         const firstBlock = message.content[0];
         return firstBlock && 'text' in firstBlock ? firstBlock.text : 'The model returned an empty response.';
     }

package/dist/util/fetchUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetchUrl.js","sourceRoot":"","sources":["../../src/util/fetchUrl.ts"],"names":[],"mappings":";;;AA8BA,gDAyEC;AAED,4DAqBC;AA9HD,+BAAgC;AAChC,uDAAoE;AACpE,uDAAqD;AAErD,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,MAAM;AAChD,MAAM,UAAU,GAAG,MAAM,CAAA;AAEZ,QAAA,0BAA0B,GAAG,MAAM,CAAA;AAiBhD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAQ,CAAA;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAA;IAC/B,OAAO,IAAI,IAAI,EAAwC,CAAA;AACzD,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,eAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC9H,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;YAC1B,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAA;IAEnE,IAAI,QAA6B,CAAA;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,MAAM,EAAE,+BAA+B;gBACvC,YAAY,EAAE,8BAA8B;aAC7C;SACF,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,UAAU;IACV,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAChD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,WAAW,EAAE,GAAG;gBAChB,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,UAAU,EAAE,GAAG;aAChB,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,MAAM,iBAAiB,iBAAiB,GAAG,CAAC,CAAA;IACpG,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAI,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,QAAQ,EAAE,QAAQ,CAAC,UAAU;QAC7B,OAAO;QACP,WAAW;KACZ,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,eAAuB,EACvB,MAAmB;IAEnB,MAAM,SAAS,GACb,eAAe,CAAC,MAAM,GAAG,kCAA0B;QACjD,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,kCAA0B,CAAC,GAAG,gDAAgD;QACzG,CAAC,CAAC,eAAe,CAAA;IAErB,MAAM,UAAU,GAAG,IAAA,oCAAyB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAE/D,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,qBAAU,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,UAAU,IAAI,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAA;IACvG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;QACjD,IAAA,cAAQ,EAAC,CAAC,CAAC,CAAA;QACX,OAAO,yCAAyC,CAAA;IAClD,CAAC;AACH,CAAC"}
+{"version":3,"file":"fetchUrl.js","sourceRoot":"","sources":["../../src/util/fetchUrl.ts"],"names":[],"mappings":";;;AA8BA,gDAyEC;AAED,4DAsBC;AA/HD,+BAAgC;AAChC,uDAAoE;AACpE,uDAAqD;AAErD,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,MAAM;AAChD,MAAM,UAAU,GAAG,MAAM,CAAA;AAEZ,QAAA,0BAA0B,GAAG,MAAM,CAAA;AAiBhD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAQ,CAAA;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAA;IAC/B,OAAO,IAAI,IAAI,EAAwC,CAAA;AACzD,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,eAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC9H,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;YAC1B,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAA;IAEnE,IAAI,QAA6B,CAAA;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,MAAM,EAAE,+BAA+B;gBACvC,YAAY,EAAE,8BAA8B;aAC7C;SACF,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,UAAU;IACV,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAChD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,WAAW,EAAE,GAAG;gBAChB,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,UAAU,EAAE,GAAG;aAChB,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,MAAM,iBAAiB,iBAAiB,GAAG,CAAC,CAAA;IACpG,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAI,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,QAAQ,EAAE,QAAQ,CAAC,UAAU;QAC7B,OAAO;QACP,WAAW;KACZ,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,eAAuB,EACvB,MAAmB,EACnB,SAAkB;IAElB,MAAM,SAAS,GACb,eAAe,CAAC,MAAM,GAAG,kCAA0B;QACjD,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,kCAA0B,CAAC,GAAG,gDAAgD;QACzG,CAAC,CAAC,eAAe,CAAA;IAErB,MAAM,UAAU,GAAG,IAAA,oCAAyB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAE/D,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,qBAAU,EAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACrC,OAAO,UAAU,IAAI,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAA;IACvG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;QACjD,IAAA,cAAQ,EAAC,CAAC,CAAC,CAAA;QACX,OAAO,yCAAyC,CAAA;IAClD,CAAC;AACH,CAAC"}

package/dist/util/shellSafety.d.ts

@@ -0,0 +1,34 @@
+/**
+ * 命令是否含重定向。用于「前缀授权」纵深防御：前缀匹配只看首词，
+ * 而 `echo x > file` 的危险来自重定向，故含重定向的命令不应被前缀授权覆盖，
+ * 也不应向用户提供「按前缀授权」选项。
+ *
+ * 先用 splitCommand 规范化（它会把 `x>file` 这类无空格重定向还原成带空格的 ` > ` 形式，
+ * 并正确处理引号），再用 REDIRECTION_RE 检测；解析失败时保守按「含重定向」处理。
+ */
+export declare function hasRedirection(command: string): boolean;
+/**
+ * 命令是否含「语义危险」子命令：危险首词（rm/sudo/mv 等）或 find 危险 flag。
+ * 不含重定向——重定向是否危险取决于路径（项目内可能安全），应交给上层模型判断。
+ *
+ * 用于 AutoRun：命中即「确定性危险」，直接转人工，不调模型（避免模型误判 safe 放行）。
+ * 解析失败保守按「危险」处理（fail-closed）。
+ */
+export declare function hasDangerousCommand(command: string): boolean;
+/**
+ * 命令是否「不适合按前缀授权」。命中则：
+ *  - checkRunShellPermission 不向用户提供「按前缀授权」选项（只许单次确认）
+ *  - matchesSavedPrefix 即便命中已存前缀也不放行（纵深防御，治存量配置）
+ *
+ * 涵盖：含重定向 / 危险首词（rm、sudo、mv 等）/ find 危险 flag。
+ */
+export declare function isUnsafeForPrefixAuth(command: string): boolean;
+/**
+ * 整条命令是否可判定为「只读安全」，可直接放行（无需人工/模型）。
+ * 基于 splitCommand 的分词逐子命令判定，从根本上消除「整串 split(' ')[0]」带来的
+ * 重定向 / 不带空格管道 / find 等绕过：
+ *  - 含 && || ; ` $( 换行 → 交上层逐子命令或人工，这里不放行
+ *  - 含管道时，要求每一段首词都在只读集合且段内无重定向
+ */
+export declare function isReadonlySafeCommand(command: string): boolean;
+//# sourceMappingURL=shellSafety.d.ts.map

package/dist/util/shellSafety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shellSafety.d.ts","sourceRoot":"","sources":["../../src/util/shellSafety.ts"],"names":[],"mappings":"AAsBA;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOvD;AAqBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D;AAWD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAW9D"}