Function validateCarriageReturn

src/tools/BashTool/bashSecurity.ts:971–1015

* SECURITY: Carriage return (\r, 0x0D) IS a misparsing concern, unlike LF. * * Parser differential: * - shell-quote's BAREWORD regex uses `[^\s...]` — JS `\s` INCLUDES \r, so * shell-quote treats CR as a token boundary. `TZ=UTC\recho` tokenizes as * TWO tokens: ['TZ=UTC', 'echo']. spl

(context: ValidationContext)

 * and shell-quote preserves the token (no split).
 */
function validateCarriageReturn(context: ValidationContext): PermissionResult {
  const { originalCommand } = context

  if (!originalCommand.includes('\r')) {
    return { behavior: 'passthrough', message: 'No carriage return' }
  }

  // Check if CR appears outside double quotes. CR outside DQ (including inside
  // SQ and unquoted) causes the shell-quote/bash tokenization differential.
  let inSingleQuote = false
  let inDoubleQuote = false
  let escaped = false
  for (let i = 0; i < originalCommand.length; i++) {
    const c = originalCommand[i]
    if (escaped) {
      escaped = false
      continue
    }
    if (c === '\\' && !inSingleQuote) {
      escaped = true
      continue
    }
    if (c === "'" && !inDoubleQuote) {
      inSingleQuote = !inSingleQuote
      continue
    }
    if (c === '"' && !inSingleQuote) {
      inDoubleQuote = !inDoubleQuote
      continue
    }
    if (c === '\r' && !inDoubleQuote) {
      logEvent('tengu_bash_security_check_triggered', {
        checkId: BASH_SECURITY_CHECK_IDS.NEWLINES,
        subId: 2,
      })
      return {
        behavior: 'ask',
        message:
          'Command contains carriage return (\\r) which shell-quote and bash tokenize differently',
      }
    }
  }

  return { behavior: 'passthrough', message: 'CR only inside double quotes' }
}

function validateIFSInjection(context: ValidationContext): PermissionResult {
  const { originalCommand } = context