/** * Miscellaneous utilities * Shared helpers that don't belong in other specific modules. */ /** * Escape a string for literal use inside a `RegExp`. * * Needed wherever a caller-supplied identifier is interpolated into a pattern: an * unescaped `.` or `(` silently changes what the pattern matches, and a crafted * value can produce catastrophic backtracking. Callers are not always trusted — * MCP tool arguments reach some of these paths. */ export declare function escapeRegExp(s: string): string; /** * Quote a value for use inside a double-quoted Graphviz DOT string. * * Three things have to happen, in this order: * * 1. `\` first. Escaping quotes first would leave a trailing `\` escaping the * closing `"` that follows it, swallowing the rest of the document. * 2. `"`, so the value cannot terminate its own string. * 3. Control characters. The emitter is line-oriented (statements are joined with * `\n`), and a file name may legally contain a newline on Linux and macOS — so * an unescaped one splits the statement in two and the tail is parsed as new * DOT. Escaping quotes alone does not prevent that, which is why this is done * here rather than left to the caller. * * Newline/CR/tab become their DOT escape sequences (the backslash is emitted after * step 1, so it stays a real escape). Any other control character has no DOT * representation and is dropped; two names differing only by such a character would * collide, which is accepted as strictly better than emitting a corrupt graph. */ export declare function escapeDotString(s: string): string; /** * Neutralize terminal control sequences in a value that came from an analyzed * repository, before it is printed. * * OpenLore's job is to read repositories it does not trust and report on them, and * SECURITY.md scopes exactly that. A file name may legally contain ESC on Linux and * macOS, so a hostile repository can smuggle cursor-movement, screen-clear or OSC * sequences through any path/symbol OpenLore echoes back. Printed raw, those let the * repository being analyzed overwrite OpenLore's own output — for a tool whose value * is a trustworthy verdict, a forged "[ok] all checks passed" line is the attack, * not a cosmetic glitch. * * Everything in C0, DEL and C1 is removed, which includes ESC and therefore every * sequence introduced by it (CSI, OSC, DCS) without needing to parse them. Newline * and tab go too: these are single-line display values (a path, a symbol name), so a * newline in one is itself a way to forge an extra output line. * * This is for UNTRUSTED values only. OpenLore's own color codes are applied by the * shared color layer AFTER this runs, so they are unaffected. */ export declare function sanitizeForTerminal(value: string, opts?: { keepNewlines?: boolean; }): string; /** True when a path segment would escape the target object into its prototype. */ export declare function isProtoPollutingKey(key: string): boolean; /** * Parse JSON from LLM output, handling markdown code fences. * Strips ``` fences, extracts JSON array or object, returns fallback on failure. */ export declare function parseJSON(text: string, fallback: T): T; //# sourceMappingURL=misc.d.ts.map