shell-aliasforge 0.1.0 → 0.1.1

package/dist/analyze/normalize.js

@@ -95,3 +95,66 @@ export function isBalanced(command) {
     }
     return quote === "" && parens === 0 && braces === 0 && backticks % 2 === 0;
 }
+function isLineBreak(raw, index) {
+    return raw[index] === "\n" || (raw[index] === "\r" && raw[index + 1] === "\n");
+}
+/** Index of the end of a comment that starts at `index`, i.e. of the next newline. */
+function commentEnd(raw, index) {
+    const end = raw.indexOf("\n", index);
+    return end === -1 ? raw.length : end;
+}
+/**
+ * Split one stored history entry into the command lines it contains.
+ *
+ * - A backslash before a newline is a continuation: the lines are joined with a space.
+ * - Any other newline outside quotes ends a command (pasted scripts).
+ * - A newline inside quotes stays part of that command.
+ * - A `#` that starts a word begins a comment, so an apostrophe in a comment
+ *   cannot swallow the lines after it.
+ *
+ * Each line is normalized and empty ones are dropped.
+ */
+export function commandLines(raw) {
+    const lines = [];
+    let current = "";
+    let quote = "";
+    let i = 0;
+    while (i < raw.length) {
+        const char = raw[i];
+        if (char === "\\" && quote !== "'" && isLineBreak(raw, i + 1)) {
+            current += " ";
+            i += raw[i + 1] === "\r" ? 3 : 2;
+        }
+        else if (char === "\\" && quote !== "'" && i + 1 < raw.length) {
+            current += char + raw[i + 1];
+            i += 2;
+        }
+        else if (quote) {
+            if (char === quote)
+                quote = "";
+            current += char;
+            i++;
+        }
+        else if (char === "#" && (current === "" || /\s$/.test(current))) {
+            const end = commentEnd(raw, i);
+            current += raw.slice(i, end);
+            i = end;
+        }
+        else if (char === "'" || char === '"') {
+            quote = char;
+            current += char;
+            i++;
+        }
+        else if (isLineBreak(raw, i)) {
+            lines.push(current);
+            current = "";
+            i += char === "\r" ? 2 : 1;
+        }
+        else {
+            current += char;
+            i++;
+        }
+    }
+    lines.push(current);
+    return lines.map(normalizeCommand).filter((line) => line !== "");
+}

package/dist/analyze/stats.js

@@ -1,10 +1,45 @@
-import { normalizeCommand, splitSubcommands, tokenize } from "./normalize.js";
+import { commandLines, splitSubcommands, tokenize } from "./normalize.js";
 const ASSIGNMENT = /^[A-Za-z_]\w*=/;
 /** Words that run another command, so the real program is the next word. */
 const WRAPPERS = new Set(["sudo", "doas", "time", "nohup", "command", "env", "exec", "nice", "builtin"]);
 /** Shell syntax that can start a sub-command without being a program. */
 const SYNTAX = new Set(["do", "then", "else", "elif", "!", "{", "(", "if", "while", "until"]);
 const DAY_SECONDS = 86_400;
+/** Options of each wrapper that consume the next word, so it is not mistaken for the program. */
+const WRAPPER_OPTIONS = {
+    sudo: {
+        short: "ughpCDRTUrt",
+        long: ["--user", "--group", "--host", "--prompt", "--close-from", "--chdir", "--chroot", "--command-timeout", "--other-user", "--role", "--type"],
+    },
+    doas: { short: "uC", long: [] },
+    env: { short: "uCS", long: ["--unset", "--chdir", "--split-string"] },
+    nice: { short: "n", long: ["--adjustment"] },
+    time: { short: "fo", long: ["--format", "--output"] },
+    exec: { short: "a", long: [] },
+};
+/** Number of words an option word uses: 1 alone, 2 when its value is the next word. */
+function optionWidth(option, wrapper) {
+    if (option.startsWith("--")) {
+        return !option.includes("=") && wrapper.long.includes(option) ? 2 : 1;
+    }
+    const letters = option.slice(1);
+    if (letters === "")
+        return 1;
+    const at = [...letters].findIndex((letter) => wrapper.short.includes(letter));
+    // `-uroot` carries its value; `-Eu` and `-u` take the next word.
+    return at === letters.length - 1 ? 2 : 1;
+}
+function skipWrapperOptions(tokens, start, wrapperName) {
+    const wrapper = WRAPPER_OPTIONS[wrapperName] ?? { short: "", long: [] };
+    let i = start;
+    while (i < tokens.length && tokens[i].startsWith("-")) {
+        const token = tokens[i];
+        if (token === "--")
+            return i + 1;
+        i += optionWidth(token, wrapper);
+    }
+    return i;
+}
 /** The program a sub-command runs, skipping `VAR=x`, `sudo`, `time` and similar. */
 export function programOf(unit) {
     const tokens = tokenize(unit);
@@ -15,9 +50,7 @@ export function programOf(unit) {
             i++;
         }
         else if (WRAPPERS.has(token)) {
-            i++;
-            while (i < tokens.length && tokens[i].startsWith("-"))
-                i++;
+            i = skipWrapperOptions(tokens, i + 1, token);
         }
         else {
             break;
@@ -40,10 +73,12 @@ function validTimestamps(entries) {
 function countPrograms(entries) {
     const counts = new Map();
     for (const entry of entries) {
-        for (const unit of splitSubcommands(normalizeCommand(entry.command))) {
-            const program = programOf(unit);
-            if (program !== undefined)
-                counts.set(program, (counts.get(program) ?? 0) + 1);
+        for (const line of commandLines(entry.command)) {
+            for (const unit of splitSubcommands(line)) {
+                const program = programOf(unit);
+                if (program !== undefined)
+                    counts.set(program, (counts.get(program) ?? 0) + 1);
+            }
         }
     }
     return [...counts]
@@ -52,8 +87,7 @@ function countPrograms(entries) {
 }
 /** Summarize parsed history: size, most-used programs and time span. */
 export function computeStats(entries, top) {
-    const unique = new Set(entries.map((entry) => normalizeCommand(entry.command)));
-    unique.delete("");
+    const unique = new Set(entries.flatMap((entry) => commandLines(entry.command)));
     const times = validTimestamps(entries);
     const stats = {
         historyEntries: entries.length,

package/dist/analyze/suggest.js

@@ -1,14 +1,12 @@
 import { proposeNames } from "./naming.js";
-import { normalizeCommand, splitSubcommands } from "./normalize.js";
+import { commandLines, splitSubcommands } from "./normalize.js";
 import { renderDefinition } from "./render.js";
 import { aliasScore } from "./score.js";
 import { buildCandidates, kindOf } from "./templates.js";
-/** Full normalized line plus its sub-commands, each counted once per entry. */
+/** Each command line plus its sub-commands, counted once per entry. */
 function unitsOf(entry) {
-    const line = normalizeCommand(entry.command);
-    if (line === "" || line.startsWith("#"))
-        return [];
-    return [...new Set([line, ...splitSubcommands(line)])];
+    const lines = commandLines(entry.command).filter((line) => !line.startsWith("#"));
+    return [...new Set(lines.flatMap((line) => [line, ...splitSubcommands(line)]))];
 }
 function candidatePool(entries, options) {
     const units = entries.map(unitsOf).filter((list) => list.length > 0);

package/dist/risks/engine.js

@@ -1,4 +1,4 @@
-import { normalizeCommand } from "../analyze/normalize.js";
+import { commandLines } from "../analyze/normalize.js";
 import { maskRanges, shorten } from "./mask.js";
 import { packs as defaultPacks } from "./packs/index.js";
 /** Longer command lines are scanned only up to this many characters. */
@@ -50,27 +50,25 @@ function hasMatch(text, rule) {
     rule.regex.lastIndex = 0;
     return rule.regex.test(text);
 }
+function scanLine(text, entry, timestamp, rules) {
+    const secrets = findSecrets(text, rules.secrets);
+    const preview = shorten(maskRanges(text, secrets.map((hit) => hit.range)));
+    const matched = [
+        ...secrets.map((hit) => hit.pattern),
+        ...rules.dangers.filter((rule) => hasMatch(text, rule)).map((rule) => rule.pattern),
+    ];
+    return matched.map((pattern) => toFinding(pattern, entry, timestamp, preview));
+}
 /**
  * Scan history entries for dangerous commands and secrets. Pure text matching:
  * nothing from history is ever executed. Every preview has secrets masked.
+ * An entry with several commands is scanned one command at a time.
  */
 export function scanHistory(entries, packList = defaultPacks) {
-    const rules = packList.flatMap((pack) => pack.patterns).map(compile);
-    const secretRules = rules.filter((rule) => rule.pattern.category === "secret");
-    const dangerRules = rules.filter((rule) => rule.pattern.category === "danger");
-    const findings = [];
-    entries.forEach((entry, index) => {
-        const text = normalizeCommand(entry.command).slice(0, MAX_SCAN_LENGTH);
-        if (text === "")
-            return;
-        const secrets = findSecrets(text, secretRules);
-        const preview = shorten(maskRanges(text, secrets.map((hit) => hit.range)));
-        const matched = [
-            ...secrets.map((hit) => hit.pattern),
-            ...dangerRules.filter((rule) => hasMatch(text, rule)).map((rule) => rule.pattern),
-        ];
-        for (const pattern of matched)
-            findings.push(toFinding(pattern, index + 1, entry.timestamp, preview));
-    });
-    return findings;
+    const compiled = packList.flatMap((pack) => pack.patterns).map(compile);
+    const rules = {
+        secrets: compiled.filter((rule) => rule.pattern.category === "secret"),
+        dangers: compiled.filter((rule) => rule.pattern.category === "danger"),
+    };
+    return entries.flatMap((entry, index) => commandLines(entry.command).flatMap((line) => scanLine(line.slice(0, MAX_SCAN_LENGTH), index + 1, entry.timestamp, rules)));
 }

package/dist/risks/packs/core.js

@@ -4,6 +4,8 @@ const RECURSIVE = R `(?=[^;&|]*\s(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)(?=\s|$)
 const FORCE = R `(?=[^;&|]*\s(?:-[a-zA-Z]*f[a-zA-Z]*|--force)(?=\s|$))`;
 const SECRET_NAME = R `[A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY)`;
 const VALUE = R `(?<secret>[^\s"'$-][^\s"']*)`;
+// A fish value must not be "=": that is SQL or config syntax, not a fish `set`.
+const FISH_VALUE = R `(?<secret>[^\s"'$=-][^\s"']*)`;
 export const core = [
     {
         id: "core/chmod-recursive-777",
@@ -143,7 +145,16 @@ export const core = [
         severity: "high",
         title: "Secret set in a fish command",
         advice: "Rotate the value. Load secrets from a file or a secret manager instead of typing them.",
-        pattern: R `\bset\s+(?:-\S+\s+)*${SECRET_NAME}\s+["']?${VALUE}`,
+        pattern: R `(?:^|[;&|]\s*)set\s+(?:-\S+\s+)*${SECRET_NAME}\s+["']?${FISH_VALUE}`,
+        flags: "i",
+    },
+    {
+        id: "core/quoted-secret-assignment",
+        category: "secret",
+        severity: "high",
+        title: "Quoted secret assigned to a token, password or key",
+        advice: "Rotate the value. Keep secrets out of commands, SQL and JSON typed in the shell.",
+        pattern: R `[A-Za-z0-9_]*(?:token|secret|passw(?:or)?d|api_?key|access_?key|private_?key)["']?\s*[=:]\s*["'](?<secret>[^"'\s$<{][^"']{5,})["']`,
         flags: "i",
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shell-aliasforge",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Mine your shell history to suggest aliases and flag risky or secret-leaking commands. Local-first, offline, zero dependencies.",
   "license": "MIT",
   "author": "Pratik Surve",