token-goat 2.8.6 → 2.9.2

package/SECURITY.md

@@ -49,7 +49,7 @@ The following are not treated as security issues unless paired with a working pr
 | an install without optional packages | `npm install --omit=optional token-goat` then `npm audit --omit=dev --omit=optional` | clean, 2 packages |
 | a default install | `npm install token-goat` then `npm audit --omit=dev` | clean, 70 packages |
 
-The repository carries an `overrides` block in [`package.json`](package.json) that pins six transitive packages to patched versions, and **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. That distinction used to matter a great deal, because a clean repository scan was standing in for an install that was not clean. It decides one thing now, and the section on the embedding runtime below says which. Otherwise the packages those pins were protecting against are not in a consumer's tree at all, whether or not the pins travel; the block stays because the development tree still resolves them.
+The repository carries an `overrides` block in [`package.json`](package.json) that pins six packages to patched versions, and **npm applies `overrides` only in the root project**, so those pins do not travel to anyone who installs Token-Goat as a dependency. That distinction used to matter a great deal, because a clean repository scan was standing in for an install that was not clean. It decides one thing now, and the section on the embedding runtime below says which. Otherwise the packages those pins were protecting against are not in a consumer's tree at all, whether or not the pins travel; the block stays because the development tree still resolves them.
 
 There is no table of reaching advisories here any more, and the last entry in it is worth recording rather than deleting. `@xenova/transformers` was an optional dependency, which in npm means everyone got it unless they asked not to, and it carried [`protobufjs`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) through `onnx-proto` and `onnxruntime-web` -- one critical advisory and four more -- plus its own nested, older `sharp` carrying [four inherited libvips CVEs](https://github.com/advisories/GHSA-f88m-g3jw-g9cj). None of the six was fixable from here: every one sits in a transitive package with no patched version, and the pins that would have solved it do not travel to consumers.
 

package/dist/token-goat-chunk-CGWACYYZ.mjs

@@ -0,0 +1,79 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  detectHarness
+} from "./token-goat-chunk-UZ2NFOOZ.mjs";
+
+// src/delivery_cap.ts
+var CLAUDE_CODE_BASH_OUTPUT_CAP_BYTES = 2e4;
+function bashOutputCapBytes(harness = detectHarness()) {
+  return harness === "claudecode" ? CLAUDE_CODE_BASH_OUTPUT_CAP_BYTES : null;
+}
+function deliveredOutputBytes(originalBytes, harness) {
+  const cap = bashOutputCapBytes(harness);
+  if (cap === null) return Math.max(0, originalBytes);
+  return Math.max(0, Math.min(originalBytes, cap));
+}
+
+// src/shell.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+var WSL_LAUNCHER_SEGMENTS = /* @__PURE__ */ new Set(["system32", "syswow64", "windowsapps"]);
+function isExecutable(p) {
+  try {
+    return fs.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function isWslLauncherDir(dir) {
+  return dir.toLowerCase().split(/[\\/]+/).some((seg) => WSL_LAUNCHER_SEGMENTS.has(seg));
+}
+function locateBashOnPath(pathValue, isExe = isExecutable) {
+  for (const dir of (pathValue ?? "").split(path.delimiter)) {
+    if (!dir || isWslLauncherDir(dir)) continue;
+    const cand = path.join(dir, "bash.exe");
+    if (isExe(cand)) return cand;
+  }
+  return null;
+}
+function knownGitBashPaths() {
+  const localPrograms = process.env["LOCALAPPDATA"] ? path.join(process.env["LOCALAPPDATA"], "Programs") : void 0;
+  const bases = [
+    process.env["ProgramFiles"],
+    process.env["ProgramFiles(x86)"],
+    process.env["ProgramW6432"],
+    localPrograms
+  ];
+  const out = [];
+  for (const base of bases) {
+    if (!base) continue;
+    out.push(path.join(base, "Git", "bin", "bash.exe"));
+    out.push(path.join(base, "Git", "usr", "bin", "bash.exe"));
+  }
+  return out;
+}
+function resolveWindowsBash() {
+  if (process.platform !== "win32") return null;
+  const override = process.env["TOKEN_GOAT_BASH"];
+  if (override && isExecutable(override)) return override;
+  const onPath = locateBashOnPath(process.env["PATH"]);
+  if (onPath) return onPath;
+  for (const cand of knownGitBashPaths()) {
+    if (isExecutable(cand)) return cand;
+  }
+  return null;
+}
+function wrappedShell() {
+  if (process.platform !== "win32") return true;
+  return resolveWindowsBash() ?? true;
+}
+function canRunWrappedShell() {
+  return process.platform !== "win32" || resolveWindowsBash() !== null;
+}
+
+export {
+  deliveredOutputBytes,
+  wrappedShell,
+  canRunWrappedShell
+};