shell-aliasforge 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pratik Surve
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,294 @@
-# Temporary Holding Version
+# AliasForge
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Reads your shell history **locally** and suggests aliases and functions for the commands you repeat most. It also flags risky habits (`chmod -R 777`, `rm -rf $VAR`) and secrets typed into commands.
+
+Offline by design. No network calls, no telemetry, and it never runs a command from your history.
+
+> Status: pre-release (not on npm yet). `suggest`, `risks`, `apply` and `stats` work.
+
+## Install
+
+The npm package is named `shell-aliasforge`; the command it installs is `aliasforge`. It is not published yet, so for now build from a clone (Node 24 or newer):
+
+```sh
+git clone https://github.com/prsurve/aliasforge.git
+cd aliasforge
+npm ci
+npm run build
+node dist/cli.js --help
+```
+
+After the first release:
+
+```sh
+npm install -g shell-aliasforge
+aliasforge suggest
+
+# or without installing
+npx shell-aliasforge suggest
+```
+
+The examples below use the `aliasforge` command.
+
+## Commands
+
+### `aliasforge suggest`
+
+Ranks the aliases that would save the most keystrokes, with ready-to-paste definitions.
+
+```sh
+aliasforge suggest [--shell bash|zsh|fish] [--file <path>] [--min-count N] [--min-length N] [--top N] [--json]
+```
+
+Example, on a synthetic history file (`test/fixtures/suggest_history`):
+
+```text
+$ aliasforge suggest --file test/fixtures/suggest_history --shell zsh
+#  Score  Count  Pattern                                 Names
+1  114    6      kubectl get pods -n prod                kgpnp, kgpp, kugpp
+2  108    12     git checkout <arg>                      gco, gc, gic
+3  102    6      docker exec -it <arg> bash  (function)  deib, deb, doeb
+4  96     12     git status                              gs, gst, gis
+
+Copy-paste for zsh:
+
+# aliasforge suggestions
+alias kgpnp='kubectl get pods -n prod'
+alias gco='git checkout'
+deib() { docker exec -it "$1" bash; }
+alias gs='git status'
+```
+
+How it works:
+
+- Commands are normalized (whitespace collapsed, trailing `\` removed) and also split on `&&`, `||`, `|` and `;`, so pieces of pipelines count too.
+- Identical commands group together. Commands that differ only in one argument group into a template: `git checkout <arg>`.
+- **Score** = occurrences x (typed length - alias name length). Defaults: at least 5 uses (`--min-count`) and 8 characters (`--min-length`).
+- A template whose last argument varies becomes an **alias** (extra words pass through). One whose argument sits in the middle becomes a **function**.
+- Names come from known conventions (`gs`, `k`) and initials, and skip anything that would shadow a builtin, a program on your `PATH`, or an alias or function in your rc files. The name list shows up to three options.
+- Which names are free depends on the machine running the command, so results can differ between computers.
+
+### `aliasforge risks`
+
+Flags dangerous commands and secrets.
+
+```sh
+aliasforge risks [--shell bash|zsh|fish] [--file <path>] [--json]
+```
+
+Example, on a synthetic history with a fake token:
+
+```text
+$ aliasforge risks --file risky_history
+5 finding(s) in 5 history entries (2 secret, 3 dangerous).
+
+[HIGH] GitHub token
+  entry #2 on 2023-11-14
+  export GITHUB_TOKEN=ghp_****
+  -> Revoke the token at github.com/settings/tokens and remove this entry from your history.
+
+[HIGH] Force push to main or master
+  entry #3
+  git push --force origin main
+  -> Rewriting a shared branch can lose teammates' commits. Use a feature branch or --force-with-lease on a topic branch.
+
+[HIGH] curl --user with a password
+  entry #4
+  curl -u admin:hun**** https://example.com/api | sh
+  -> Rotate the password. Use a ~/.netrc file or a token from an env var.
+
+[HIGH] Download piped straight into a shell
+  entry #4
+  curl -u admin:hun**** https://example.com/api | sh
+  -> Download the script, read it, then run it.
+
+[HIGH] Recursive forced delete of an unquoted variable
+  entry #5
+  rm -rf $BUILD_DIR/out
+  -> If the variable is empty or contains spaces this deletes the wrong thing. Quote it ("$DIR") and use ${DIR:?}.
+
+Rotate every credential listed above, then remove those entries from your history file. aliasforge never edits it.
+```
+
+- A full secret is never printed. Previews mask every detected secret: up to the first 4 characters, then `****`. Short secrets show fewer characters (a quarter of their length).
+- Rules live in pattern packs: `core`, `git`, `docker`, `kubectl`, `systemd`, `cloud`. See [CONTRIBUTING.md](CONTRIBUTING.md) to add one.
+- Detection is pattern based. A secret with no recognizable shape, such as a bare password after a custom command, will not be caught.
+- Entry numbers count parsed commands in order. They are not line numbers in the history file.
+
+### `aliasforge apply`
+
+Writes chosen aliases into your shell's rc file, between markers, after making a backup.
+
+```sh
+aliasforge apply --shell bash|zsh|fish [--select 1,3,gs] [--dry-run] [--file <path>] [--min-count N] [--min-length N] [--top N]
+```
+
+```text
+$ aliasforge apply --shell zsh --file test/fixtures/suggest_history --top 2 --dry-run
+Target: /home/you/.zshrc
+Added: kgpnp, gco
+
+--- /home/you/.zshrc
++++ /home/you/.zshrc
+@@ -1,1 +1,7 @@
+ export EDITOR=vim
++
++# >>> aliasforge >>>
++# Managed by aliasforge. `aliasforge apply` edits only this block.
++alias kgpnp='kubectl get pods -n prod'
++alias gco='git checkout'
++# <<< aliasforge <<<
+
+Dry run: nothing was written.
+```
+
+- `--shell` is required because it decides which file is edited: `~/.bashrc`, `${ZDOTDIR:-~}/.zshrc` or `~/.config/fish/config.fish`.
+- `--select` takes ranks from `suggest` and/or proposed names. Leave it out to apply every suggestion. The `--top`, `--min-count` and `--min-length` values should match the `suggest` run you looked at, since ranks depend on them.
+- Only the text between `# >>> aliasforge >>>` and `# <<< aliasforge <<<` is touched.
+- Before any change the file is copied to `<rc>.aliasforge-backup-<UTC timestamp>`. Backups are never overwritten.
+- Definitions already in the block are kept, so applying again adds to it. If a name clashes with a different definition in the block, the next proposed name is used, or the suggestion is skipped.
+- Running it twice changes nothing: if the result would match the file, nothing is written and no backup is made.
+- A damaged block (missing, duplicate or reversed markers) stops the command and changes nothing.
+- Remove the block by hand to uninstall.
+
+### `aliasforge stats`
+
+History size, most-used programs and the time span.
+
+```sh
+aliasforge stats [--shell bash|zsh|fish] [--file <path>] [--top N] [--json]
+```
+
+```text
+$ aliasforge stats --file history.txt --top 3
+Shell: bash
+Entries: 4 (4 unique)
+Time span: 2023-11-14 to 2024-01-11 (57 days, 3 entries with a time)
+
+Top commands:
+   1  git   2
+   2  apt   1
+   3  grep  1
+```
+
+- Programs are counted per sub-command, so both sides of a pipeline count. `VAR=x`, `sudo`, `time` and similar prefixes are skipped to find the real program.
+- The time span needs timestamps. Plain bash history has none unless `HISTTIMEFORMAT` was set.
+- Ties are listed alphabetically.
+
+## `--json` output
+
+All JSON is printed to stdout. New fields may be added in later versions; existing ones keep their meaning.
+
+### `suggest --json`
+
+```json
+{
+  "shell": "zsh",
+  "historyEntries": 39,
+  "suggestions": [
+    {
+      "rank": 2,
+      "kind": "alias",
+      "pattern": "git checkout <arg>",
+      "command": "git checkout",
+      "count": 12,
+      "score": 108,
+      "names": ["gco", "gc", "gic"],
+      "definition": "alias gco='git checkout'"
+    }
+  ]
+}
+```
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `shell` | `"bash" \| "zsh" \| "fish"` | Dialect used for `definition`, and how the history was parsed |
+| `historyEntries` | number | Commands parsed from the history file |
+| `suggestions[].rank` | number | 1-based position, best first |
+| `suggestions[].kind` | `"alias" \| "function"` | What `definition` defines |
+| `suggestions[].pattern` | string | What is being replaced. `<arg>` marks the part that varies |
+| `suggestions[].command` | string | The alias body. For a function, the body with `<arg>` where the argument goes |
+| `suggestions[].count` | number | How often the pattern occurs |
+| `suggestions[].score` | number | `count x (typed length - name length)`, using the first name |
+| `suggestions[].names` | string[] | Up to three free names. The first is used in `definition` |
+| `suggestions[].definition` | string | Ready to paste. May contain newlines (fish functions) |
+
+### `risks --json`
+
+```json
+{
+  "shell": "bash",
+  "historyEntries": 5,
+  "findings": [
+    {
+      "id": "git/github-token",
+      "category": "secret",
+      "severity": "high",
+      "title": "GitHub token",
+      "advice": "Revoke the token at github.com/settings/tokens and remove this entry from your history.",
+      "entry": 2,
+      "preview": "export GITHUB_TOKEN=ghp_****",
+      "date": "2023-11-14"
+    }
+  ]
+}
+```
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `shell`, `historyEntries` | | As above |
+| `findings[].id` | string | Rule id, `<pack>/<name>` |
+| `findings[].category` | `"danger" \| "secret"` | |
+| `findings[].severity` | `"high" \| "medium" \| "low"` | Findings are sorted high first, then by `entry` |
+| `findings[].title`, `advice` | string | Human-readable |
+| `findings[].entry` | number | 1-based position of the command in the parsed history |
+| `findings[].preview` | string | The command with secrets masked, cut to 100 characters |
+| `findings[].date` | string, optional | `YYYY-MM-DD` (UTC), present only if the history file recorded a time |
+
+### `stats --json`
+
+```json
+{
+  "shell": "bash",
+  "historyEntries": 4,
+  "uniqueCommands": 4,
+  "timestampedEntries": 3,
+  "firstDate": "2023-11-14",
+  "lastDate": "2024-01-11",
+  "spanDays": 57,
+  "topCommands": [{ "command": "git", "count": 2 }]
+}
+```
+
+`firstDate`, `lastDate` and `spanDays` are left out when the history has no timestamps. `uniqueCommands` counts distinct commands after whitespace is collapsed.
+
+## History files
+
+By default AliasForge reads `~/.bash_history`, `~/.zsh_history` or `~/.local/share/fish/fish_history`, based on `--shell` or `$SHELL`. Point it at any file with `--file`; the shell is guessed from the file name and content unless you pass `--shell`.
+
+- **bash:** one command per line. `#1700000000` timestamp lines (from `HISTTIMEFORMAT`) are used for dates.
+- **zsh:** plain or extended (`: 1700000000:0;command`) lines, backslash continuations, and zsh's escaped ("metafied") bytes.
+- **fish:** `- cmd:` / `when:` entries.
+- Malformed lines, CRLF, a BOM, blank lines and very large files are handled.
+- The working directory is not recorded in history, so there are no per-directory suggestions.
+
+## Privacy and safety
+
+- No network access. A test fails if the source imports `fetch`, `http` or similar.
+- Commands from history are only read as text. They are never executed.
+- `suggest` and `risks` are read-only. `apply` is the only command that writes, and only inside its marked block, after a backup.
+- Alias bodies are single-quoted when written. A function is offered only if its body has balanced quotes and brackets and nothing that could break out of it, because that text is pasted into your rc file.
+- Collision checks read the directories on your `PATH` and your rc files. They never start a shell.
+
+## Not the same as
+
+- Alias managers (store aliases you write yourself): AliasForge *discovers* them from what you actually type.
+- The unrelated OSINT repo also named "Aliasforge": no connection.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). The full spec and build plan is in [CLAUDE.md](CLAUDE.md).
+
+## License
+
+[MIT](LICENSE)

package/dist/analyze/environment.js

@@ -0,0 +1,84 @@
+import { accessSync, constants, readdirSync, readFileSync } from "node:fs";
+import { delimiter, join } from "node:path";
+import { stripManagedBlock } from "../apply/block.js";
+import { isReserved } from "./reserved.js";
+const RC_FILES = {
+    bash: [".bashrc", ".bash_profile", ".bash_aliases", ".profile"],
+    zsh: [".zshrc", ".zprofile", ".zshenv"],
+    fish: [".config/fish/config.fish"],
+};
+const ALIAS_LINE = /^\s*(?:alias|abbr)\s+(?:-\S+\s+)*([^\s=]+)/;
+const FUNCTION_KEYWORD = /^\s*function\s+([^\s({;]+)/;
+const FUNCTION_PARENS = /^\s*([A-Za-z_][\w.-]*)\s*\(\s*\)/;
+function readText(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function listDir(path) {
+    try {
+        return readdirSync(path);
+    }
+    catch {
+        return [];
+    }
+}
+function isExecutable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function namesOnPath(pathVar) {
+    const names = new Set();
+    for (const dir of pathVar.split(delimiter).filter((entry) => entry !== "")) {
+        for (const file of listDir(dir)) {
+            if (!names.has(file) && isExecutable(join(dir, file)))
+                names.add(file);
+        }
+    }
+    return names;
+}
+/** Names defined by alias/function/abbr lines in the given rc text. */
+export function definedNames(rcText) {
+    const names = new Set();
+    for (const line of rcText.split(/\r?\n/)) {
+        const match = ALIAS_LINE.exec(line) ?? FUNCTION_KEYWORD.exec(line) ?? FUNCTION_PARENS.exec(line);
+        if (match)
+            names.add(match[1]);
+    }
+    return names;
+}
+function fishFunctionFiles(home) {
+    const dirs = [join(home, ".config/fish/functions"), join(home, ".config/fish/conf.d")];
+    return dirs.flatMap((dir) => listDir(dir).map((file) => join(dir, file)));
+}
+function namesFromRcFiles(shell, home) {
+    const files = RC_FILES[shell].map((file) => join(home, file));
+    if (shell === "fish")
+        files.push(...fishFunctionFiles(home));
+    const names = new Set();
+    for (const file of files) {
+        // Names we wrote ourselves are not collisions, or `apply` would never be idempotent.
+        for (const name of definedNames(stripManagedBlock(readText(file))))
+            names.add(name);
+        if (shell === "fish" && file.endsWith(".fish"))
+            names.add(file.slice(file.lastIndexOf("/") + 1, -5));
+    }
+    return names;
+}
+/**
+ * Checks whether a proposed alias name would shadow something. It reads PATH
+ * directories and rc files; it never runs a shell or any command.
+ */
+export function createEnvironment(options) {
+    const onPath = namesOnPath(options.path);
+    const defined = namesFromRcFiles(options.shell, options.home);
+    return (name) => isReserved(options.shell, name) || onPath.has(name) || defined.has(name);
+}

package/dist/analyze/naming.js

@@ -0,0 +1,84 @@
+import { isFlag, tokenize } from "./normalize.js";
+import { kindOf, VAR } from "./templates.js";
+const MAX_NAME_LENGTH = 5;
+const MAX_OPTIONS = 3;
+const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ALIAS_NAME = /^[A-Za-z0-9_.-]+$/;
+/** Well-known short names, keyed by the exact command they stand for. */
+const CONVENTIONS = {
+    git: ["g"],
+    kubectl: ["k"],
+    docker: ["d"],
+    "git status": ["gs", "gst"],
+    "git add": ["ga"],
+    "git add .": ["gaa", "gad"],
+    "git commit": ["gc", "gci"],
+    "git commit -m": ["gcm"],
+    "git checkout": ["gco"],
+    "git diff": ["gd"],
+    "git pull": ["gpl", "gl"],
+    "git push": ["gp", "gps"],
+    "git log": ["glg", "gl"],
+    "git log --oneline": ["glo"],
+    "docker ps": ["dps"],
+    "docker compose up": ["dcu"],
+    "docker compose down": ["dcd"],
+    "kubectl get pods": ["kgp"],
+    "ls -la": ["ll", "la"],
+    "cd ..": ["..", "up"],
+    "npm test": ["nt"],
+    "npm install": ["ni"],
+    "npm run dev": ["nrd"],
+    "npm run build": ["nrb"],
+};
+function firstAlnum(word) {
+    return /[A-Za-z0-9]/.exec(word)?.[0].toLowerCase() ?? "";
+}
+function programPrefix(program, length) {
+    const base = program.slice(program.lastIndexOf("/") + 1).replace(/[^A-Za-z0-9]/g, "");
+    return base.slice(0, length).toLowerCase();
+}
+function initials(words, options) {
+    const [program = "", ...rest] = words;
+    const letters = rest
+        .filter((word) => options.flags || !isFlag(word))
+        .map(firstAlnum)
+        .join("");
+    return (programPrefix(program, options.programChars) + letters).slice(0, MAX_NAME_LENGTH);
+}
+function validFor(candidate, name) {
+    const pattern = kindOf(candidate) === "function" ? IDENTIFIER : ALIAS_NAME;
+    return pattern.test(name) && name.length < candidate.replacedLength;
+}
+function rawOptions(candidate, words) {
+    const known = candidate.shape === "middle" ? [] : (CONVENTIONS[words.join(" ")] ?? []);
+    return [
+        ...known,
+        initials(words, { flags: true, programChars: 1 }),
+        initials(words, { flags: false, programChars: 1 }),
+        initials(words, { flags: false, programChars: 2 }),
+    ];
+}
+function withSuffix(base, isTaken) {
+    for (let n = 2; n <= 9; n++) {
+        if (!isTaken(`${base}${n}`))
+            return `${base}${n}`;
+    }
+    return undefined;
+}
+/**
+ * Propose up to three names for a candidate: known conventions first, then
+ * initials. Names that collide with commands, builtins or existing aliases
+ * and functions are skipped. Returns an empty list when nothing is free.
+ */
+export function proposeNames(candidate, isTaken) {
+    const words = tokenize(candidate.command).filter((word) => word !== VAR);
+    const options = rawOptions(candidate, words).filter((name) => validFor(candidate, name));
+    const free = [...new Set(options)].filter((name) => !isTaken(name));
+    if (free.length === 0 && options[0] !== undefined) {
+        const suffixed = withSuffix(options[0], isTaken);
+        if (suffixed !== undefined && validFor(candidate, suffixed))
+            free.push(suffixed);
+    }
+    return free.slice(0, MAX_OPTIONS);
+}

package/dist/analyze/normalize.js

@@ -0,0 +1,160 @@
+/** Trim, collapse whitespace (newlines included) and strip a trailing backslash. */
+export function normalizeCommand(raw) {
+    return raw.replace(/\s+/g, " ").trim().replace(/(?:\s*\\)+$/, "").trim();
+}
+export function isFlag(token) {
+    return token.startsWith("-") && token.length > 1;
+}
+/** Split text on delimiters that sit outside quotes. Empty parts are dropped. */
+function splitUnquoted(text, delimiterAt) {
+    const parts = [];
+    let current = "";
+    let quote = "";
+    let i = 0;
+    while (i < text.length) {
+        const char = text[i];
+        const escaped = char === "\\" && quote !== "'" && i + 1 < text.length;
+        if (escaped) {
+            current += char + text[i + 1];
+            i += 2;
+            continue;
+        }
+        if (quote) {
+            if (char === quote)
+                quote = "";
+        }
+        else if (char === "'" || char === '"') {
+            quote = char;
+        }
+        else {
+            const length = delimiterAt(text, i);
+            if (length > 0) {
+                parts.push(current);
+                current = "";
+                i += length;
+                continue;
+            }
+        }
+        current += char;
+        i++;
+    }
+    parts.push(current);
+    return parts.map((part) => part.trim()).filter((part) => part !== "");
+}
+function operatorAt(text, index) {
+    const pair = text.slice(index, index + 2);
+    if (pair === "&&" || pair === "||")
+        return 2;
+    return text[index] === "|" || text[index] === ";" ? 1 : 0;
+}
+function whitespaceAt(text, index) {
+    return /\s/.test(text[index]) ? 1 : 0;
+}
+/** Split a command line on `&&`, `||`, `|` and `;` outside quotes. */
+export function splitSubcommands(command) {
+    return splitUnquoted(command, operatorAt);
+}
+/** Split into words on whitespace outside quotes. Quotes stay in the tokens. */
+export function tokenize(command) {
+    return splitUnquoted(command, whitespaceAt);
+}
+/**
+ * True when quotes, parentheses, braces and backticks outside quotes pair up.
+ * Used to keep text that would break a shell function body out of rc files.
+ */
+export function isBalanced(command) {
+    let quote = "";
+    let parens = 0;
+    let braces = 0;
+    let backticks = 0;
+    for (let i = 0; i < command.length; i++) {
+        const char = command[i];
+        if (char === "\\" && quote !== "'") {
+            if (i + 1 >= command.length)
+                return false;
+            i++;
+        }
+        else if (quote) {
+            if (char === quote)
+                quote = "";
+        }
+        else if (char === "'" || char === '"') {
+            quote = char;
+        }
+        else if (char === "`") {
+            backticks++;
+        }
+        else if (char === "(" || char === ")") {
+            parens += char === "(" ? 1 : -1;
+        }
+        else if (char === "{" || char === "}") {
+            braces += char === "{" ? 1 : -1;
+        }
+        if (parens < 0 || braces < 0)
+            return false;
+    }
+    return quote === "" && parens === 0 && braces === 0 && backticks % 2 === 0;
+}
+function isLineBreak(raw, index) {
+    return raw[index] === "\n" || (raw[index] === "\r" && raw[index + 1] === "\n");
+}
+/** Index of the end of a comment that starts at `index`, i.e. of the next newline. */
+function commentEnd(raw, index) {
+    const end = raw.indexOf("\n", index);
+    return end === -1 ? raw.length : end;
+}
+/**
+ * Split one stored history entry into the command lines it contains.
+ *
+ * - A backslash before a newline is a continuation: the lines are joined with a space.
+ * - Any other newline outside quotes ends a command (pasted scripts).
+ * - A newline inside quotes stays part of that command.
+ * - A `#` that starts a word begins a comment, so an apostrophe in a comment
+ *   cannot swallow the lines after it.
+ *
+ * Each line is normalized and empty ones are dropped.
+ */
+export function commandLines(raw) {
+    const lines = [];
+    let current = "";
+    let quote = "";
+    let i = 0;
+    while (i < raw.length) {
+        const char = raw[i];
+        if (char === "\\" && quote !== "'" && isLineBreak(raw, i + 1)) {
+            current += " ";
+            i += raw[i + 1] === "\r" ? 3 : 2;
+        }
+        else if (char === "\\" && quote !== "'" && i + 1 < raw.length) {
+            current += char + raw[i + 1];
+            i += 2;
+        }
+        else if (quote) {
+            if (char === quote)
+                quote = "";
+            current += char;
+            i++;
+        }
+        else if (char === "#" && (current === "" || /\s$/.test(current))) {
+            const end = commentEnd(raw, i);
+            current += raw.slice(i, end);
+            i = end;
+        }
+        else if (char === "'" || char === '"') {
+            quote = char;
+            current += char;
+            i++;
+        }
+        else if (isLineBreak(raw, i)) {
+            lines.push(current);
+            current = "";
+            i += char === "\r" ? 2 : 1;
+        }
+        else {
+            current += char;
+            i++;
+        }
+    }
+    lines.push(current);
+    return lines.map(normalizeCommand).filter((line) => line !== "");
+}

package/dist/analyze/render.js

@@ -0,0 +1,23 @@
+import { VAR } from "./templates.js";
+function posixQuote(text) {
+    return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function fishQuote(text) {
+    return `'${text.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+function functionBody(shell, command) {
+    const positional = shell === "fish" ? "$argv[1]" : '"$1"';
+    return command.split(VAR).join(positional);
+}
+/** Ready-to-paste definition for one suggestion in the given shell's dialect. */
+export function renderDefinition(shell, item) {
+    if (item.kind === "alias") {
+        return shell === "fish"
+            ? `alias ${item.name} ${fishQuote(item.command)}`
+            : `alias ${item.name}=${posixQuote(item.command)}`;
+    }
+    const body = functionBody(shell, item.command);
+    return shell === "fish"
+        ? `function ${item.name}\n    ${body}\nend`
+        : `${item.name}() { ${body}; }`;
+}