From 1a27ba0e2ec736aa9b30c69a3aa2ee2ab86d0709 Mon Sep 17 00:00:00 2001 From: Agando Date: Thu, 29 Oct 2026 12:47:46 +0100 Subject: fix(newos4): shell tokenises command lines quote-aware everywhere (v4.6.132) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v4.6.131 taught the pipe stages to forward their raw text, but the shell's own wrapper still split each stage with `cmdText.split(/\s+/)` โ€” so `grep "alpha beta" /qt.txt | wc -l` handed grep the two args `"alpha` and `beta"` and matched nothing. Measured live: the wrapper (ShellModule.init() replaces terminal.executePipeChain) is the implementation that runs, so the core fix alone is decorative. All six command-line split sites in modules/ext/shell.js now go through one helper, `_tokenize()`, which delegates to `security._parseArgs` โ€” the parser the bare-command path already uses โ€” so the two cannot drift again: 111 single command in a `&&` / `;` chain -> `grep "a b" f ; echo done` 176 pipe stage (the wrapper that runs) -> `grep "a b" f | wc -l` 358 `<` redirect input -> `cat < /f` 401 pipe chain inside the script runner -> also forwards the stage's raw text now 424 single command in the script runner -> also forwards raw text 778 `[ -f "path" ]` / `test -f "path"` -> quoted paths in test expressions Empty stages are skipped instead of being dispatched as a command named '' (`help | | wc -l`). The guard test grew the assertion that would have caught this: test-pipe-guard.js now checks `shellTokensQuoted` (tokeniser used, no `cmdText.split(`, empty-stage guard present) alongside `shellForwardsRaw`; both are RED against HEAD's shell.js. Verification node modules/test/test-pipe-guard.js -> {"empty":[],"blank":[],"classifyGuarded":true, "pipeGuarded":true,"shellForwardsRaw":true,"shellTokensQuoted":true} node modules/test/test-parse-args.js -> 28/28 ยท daily job -> node tests 21/21 pass newos4-maintain.py -> maintenance result: OK (index 349, help 363/363, changelog v4.6.132) live v4.6.132, read from the terminal DOM (no print monkey-patch): cat /qt.txt -> alpha beta grep "alpha beta" /qt.txt -> 1 match, 1 file grep "alpha beta" /qt.txt | wc -l -> 2 (match line + summary; 1 when the quotes are lost) grep "alpha beta" /qt.txt ; echo done-> match count + done ShellModule._tokenize(c) === security._parseArgs(c) for 5 sample lines -> true _tokenize('') / _tokenize(' ') -> [] / [] Also closes the last open feedback item: RPT-20261027-160751 ("Connection failed on all providers") -> resolve, recorded in decisions.jsonl with evidence (headless probe URL `?probe=ctx`, v4.6.117, single occurrence, no stack; Ollama answers 200 with 37 models now). Feedback queue: awaiting 0. --- modules/test/test-pipe-guard.js | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'modules/test') diff --git a/modules/test/test-pipe-guard.js b/modules/test/test-pipe-guard.js index 7851613..e689e60 100644 --- a/modules/test/test-pipe-guard.js +++ b/modules/test/test-pipe-guard.js @@ -43,10 +43,16 @@ const shellBody = si >= 0 ? shellSrc.slice(si, shellSrc.indexOf('_splitSequence( const shellForwardsRaw = si >= 0 && shellBody.indexOf('this.dispatchCommand(cmd, args, cmdText)') > 0 && shellBody.indexOf('this.capturePipeOutput(cmd, args, cmdText)') > 0; +// 5. v4.6.132: that override must tokenise with the quote-aware parser, not split(/\s+/), and must +// skip empty stages instead of dispatching cmd ''. +const shellTokensQuoted = si >= 0 + && shellBody.indexOf('this.security._parseArgs(String(cmdText') > 0 + && shellBody.indexOf('if (argv.length === 0) continue') > 0 + && shellBody.indexOf('cmdText.split(') < 0; -const report = { empty, blank, classifyGuarded, pipeGuarded, shellForwardsRaw }; +const report = { empty, blank, classifyGuarded, pipeGuarded, shellForwardsRaw, shellTokensQuoted }; console.log(JSON.stringify(report)); const ok = Array.isArray(empty) && empty.length === 0 && Array.isArray(blank) && blank.length === 0 - && classifyGuarded && pipeGuarded && shellForwardsRaw; + && classifyGuarded && pipeGuarded && shellForwardsRaw && shellTokensQuoted; process.exit(ok ? 0 : 1); -- cgit v1.2.3