Claudio Ortolina
a88c704fe5
Replace regex-based command blocking with structural AST parsing using unbash (zero-dependency TypeScript bash parser). The walker collects command names only from executable positions (simple commands, pipelines, subshells, command substitutions, control-flow bodies), excluding arguments, comments, and quoted strings. - Convert to directory-style extension with pinned unbash@3.0.0 - Add AST walker (ast.ts) covering 15 shell construct types - Update blocked_commands to plain names instead of regexes - Keep regex fallback for parse failures (degradation path) - Path-based blocking unchanged for non-bash tools - 41 tests cover blocked/allowed cases including false positives
12 lines
172 B
JSON
12 lines
172 B
JSON
{
|
|
"name": "sensitive-file-guard",
|
|
"private": true,
|
|
"type": "module",
|
|
"dependencies": {
|
|
"unbash": "3.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"tsx": "^4.21.0"
|
|
}
|
|
}
|