aboutsummaryrefslogtreecommitdiff
path: root/modules/core
diff options
context:
space:
mode:
Diffstat (limited to 'modules/core')
-rw-r--r--modules/core/core-bundle.js45
-rw-r--r--modules/core/module-debug-supervisor.js5
-rw-r--r--modules/core/module-loader.js2
-rw-r--r--modules/core/module-system.js4
-rw-r--r--modules/core/terminal.js36
5 files changed, 75 insertions, 17 deletions
diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js
index 212573d..67747bf 100644
--- a/modules/core/core-bundle.js
+++ b/modules/core/core-bundle.js
@@ -2609,7 +2609,14 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
return args;
}
_classify(raw) {
- const parts = this._parseArgs(raw.trim());
+ const parts = this._parseArgs(String(raw || '').trim());
+ // `help |` and `| wc -l` produce an empty pipeline stage; parts[0] was undefined
+ // and every such invocation threw TypeError from this line (989 occurrences,
+ // first filed 2026-10-20). Classify the empty command as inert instead.
+ if (!parts.length) {
+ return { cmd: '', args: [], known: true, destructive: false, system: false,
+ unknown: false, hasSuspicious: false };
+ }
const cmd = parts[0].toLowerCase();
const args = parts.slice(1);
// Internal commands always allowed at terminal level, but security still classifies
@@ -3984,12 +3991,27 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
return parts;
}
async executePipeChain(pipeParts) {
+ // Parse every stage once, then drop the ones with no argv. `help |` splits to
+ // ['help',''], `help | ""` to ['help',''] and `| wc -l` to ['','wc -l'] — all three
+ // produced an empty argv whose parts[0] was undefined and threw TypeError from
+ // parts[0].toLowerCase() (989 occurrences, first filed 2026-10-20). Filtering on
+ // argv (not just the string) also keeps the LAST real stage final, so its output is
+ // never swallowed by a trailing empty segment.
+ const stages = pipeParts
+ .map(t => this.security._parseArgs(String(t || '').trim()))
+ .filter(argv => argv.length > 0);
+ if (!stages.length) {
+ this.print('⚠️ Empty pipeline — nothing to run', 'warning');
+ return;
+ }
let pipeInput = null;
- for (let i = 0; i < pipeParts.length; i++) {
- const cmdText = pipeParts[i];
- const parts = this.security._parseArgs(cmdText);
- const cmd = parts[0].toLowerCase();
- const args = parts.slice(1);
+ for (let i = 0; i < stages.length; i++) {
+ const argv = stages[i];
+ const cmd = argv[0].toLowerCase();
+ const args = argv.slice(1);
+ // Rebuilt from argv so the security classifier sees the same tokenisation the
+ // dispatcher will use (quotes already stripped by _parseArgs).
+ const cmdText = argv.join(' ');
// v4.5.67: Security gate for pipe stages — was completely bypassed
const cls = this.security._classify(cmdText);
if (cls.destructive && this.security.level > 0) {
@@ -4005,7 +4027,7 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
return;
}
this._pipeInput = pipeInput;
- if (i < pipeParts.length - 1) {
+ if (i < stages.length - 1) {
pipeInput = await this.capturePipeOutput(cmd, args);
} else {
await this.dispatchCommand(cmd, args);
@@ -5820,6 +5842,10 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
message: String(e.message || e.msg || '').slice(0, 300),
source: String(e.source || e.url || '').slice(0, 200),
count: Number(e.count) || 1,
+ // The stack is the only thing that makes a report actionable; it was
+ // dropped here while ingest kept it, which is why the 2026-10-20
+ // `toLowerCase` report could not be localised for three days.
+ stack: e.stack ? String(e.stack).split('\n').slice(0, 10).join('\n').slice(0, 1200) : null,
}));
} catch (_e) {}
try {
@@ -20332,7 +20358,7 @@ class DebugSupervisorModule {
// v4.6.38 (A5): auto-file fatal/error-class failures, max 3 per day, deduped by hash.
if (classification.severity === 'fatal' || classification.severity === 'error') {
- this._maybeAutoFile({ hash, message, source, type: classification.type, severity: classification.severity });
+ this._maybeAutoFile({ hash, message, source, type: classification.type, severity: classification.severity, stack });
}
}
@@ -20376,6 +20402,9 @@ class DebugSupervisorModule {
type: e.type,
severity: e.severity,
count: 1,
+ // Auto-filed reports are the majority of the inbox; without the stack they are
+ // a message with no location (the 2026-10-20 `toLowerCase` report proved it).
+ stack: e.stack ? String(e.stack).split('\n').slice(0, 10).join('\n').slice(0, 1200) : null,
}],
},
};
diff --git a/modules/core/module-debug-supervisor.js b/modules/core/module-debug-supervisor.js
index 485f4e2..78e3a46 100644
--- a/modules/core/module-debug-supervisor.js
+++ b/modules/core/module-debug-supervisor.js
@@ -325,7 +325,7 @@ class DebugSupervisorModule {
// v4.6.38 (A5): auto-file fatal/error-class failures, max 3 per day, deduped by hash.
if (classification.severity === 'fatal' || classification.severity === 'error') {
- this._maybeAutoFile({ hash, message, source, type: classification.type, severity: classification.severity });
+ this._maybeAutoFile({ hash, message, source, type: classification.type, severity: classification.severity, stack });
}
}
@@ -369,6 +369,9 @@ class DebugSupervisorModule {
type: e.type,
severity: e.severity,
count: 1,
+ // Auto-filed reports are the majority of the inbox; without the stack they are
+ // a message with no location (the 2026-10-20 `toLowerCase` report proved it).
+ stack: e.stack ? String(e.stack).split('\n').slice(0, 10).join('\n').slice(0, 1200) : null,
}],
},
};
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index a3b3a6f..ff908cd 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
// Core module bundle loaded synchronously in main.html.
// This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
- const LATEST_VER = 'v4.6.54';
+ const LATEST_VER = 'v4.6.55';
const CACHE = '?v=' + LATEST_VER;
const stored = localStorage.getItem('webx11_cache_ver');
if (stored !== LATEST_VER) {
diff --git a/modules/core/module-system.js b/modules/core/module-system.js
index bedceef..e7f7e5a 100644
--- a/modules/core/module-system.js
+++ b/modules/core/module-system.js
@@ -334,6 +334,10 @@
message: String(e.message || e.msg || '').slice(0, 300),
source: String(e.source || e.url || '').slice(0, 200),
count: Number(e.count) || 1,
+ // The stack is the only thing that makes a report actionable; it was
+ // dropped here while ingest kept it, which is why the 2026-10-20
+ // `toLowerCase` report could not be localised for three days.
+ stack: e.stack ? String(e.stack).split('\n').slice(0, 10).join('\n').slice(0, 1200) : null,
}));
} catch (_e) {}
try {
diff --git a/modules/core/terminal.js b/modules/core/terminal.js
index c586538..ad4b105 100644
--- a/modules/core/terminal.js
+++ b/modules/core/terminal.js
@@ -157,7 +157,14 @@
return args;
}
_classify(raw) {
- const parts = this._parseArgs(raw.trim());
+ const parts = this._parseArgs(String(raw || '').trim());
+ // `help |` and `| wc -l` produce an empty pipeline stage; parts[0] was undefined
+ // and every such invocation threw TypeError from this line (989 occurrences,
+ // first filed 2026-10-20). Classify the empty command as inert instead.
+ if (!parts.length) {
+ return { cmd: '', args: [], known: true, destructive: false, system: false,
+ unknown: false, hasSuspicious: false };
+ }
const cmd = parts[0].toLowerCase();
const args = parts.slice(1);
// Internal commands always allowed at terminal level, but security still classifies
@@ -1532,12 +1539,27 @@
return parts;
}
async executePipeChain(pipeParts) {
+ // Parse every stage once, then drop the ones with no argv. `help |` splits to
+ // ['help',''], `help | ""` to ['help',''] and `| wc -l` to ['','wc -l'] — all three
+ // produced an empty argv whose parts[0] was undefined and threw TypeError from
+ // parts[0].toLowerCase() (989 occurrences, first filed 2026-10-20). Filtering on
+ // argv (not just the string) also keeps the LAST real stage final, so its output is
+ // never swallowed by a trailing empty segment.
+ const stages = pipeParts
+ .map(t => this.security._parseArgs(String(t || '').trim()))
+ .filter(argv => argv.length > 0);
+ if (!stages.length) {
+ this.print('⚠️ Empty pipeline — nothing to run', 'warning');
+ return;
+ }
let pipeInput = null;
- for (let i = 0; i < pipeParts.length; i++) {
- const cmdText = pipeParts[i];
- const parts = this.security._parseArgs(cmdText);
- const cmd = parts[0].toLowerCase();
- const args = parts.slice(1);
+ for (let i = 0; i < stages.length; i++) {
+ const argv = stages[i];
+ const cmd = argv[0].toLowerCase();
+ const args = argv.slice(1);
+ // Rebuilt from argv so the security classifier sees the same tokenisation the
+ // dispatcher will use (quotes already stripped by _parseArgs).
+ const cmdText = argv.join(' ');
// v4.5.67: Security gate for pipe stages — was completely bypassed
const cls = this.security._classify(cmdText);
if (cls.destructive && this.security.level > 0) {
@@ -1553,7 +1575,7 @@
return;
}
this._pipeInput = pipeInput;
- if (i < pipeParts.length - 1) {
+ if (i < stages.length - 1) {
pipeInput = await this.capturePipeOutput(cmd, args);
} else {
await this.dispatchCommand(cmd, args);
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-06 22:46:22 +0000