@abelxiaoxing/cadence 1.8.4 → 2.0.1

package/src/safe-path.ts

@@ -1,77 +0,0 @@
-import { lstatSync } from "node:fs";
-import path from "node:path";
-
-import { isValidRelativePath } from "./contracts.ts";
-
-export type SafePathObservation =
-  | { kind: "file" }
-  | { kind: "directory" }
-  | { kind: "absent" }
-  | {
-      kind: "unsafe";
-      reason:
-        | "invalid-path"
-        | "root-unavailable"
-        | "path-unavailable"
-        | "symlink"
-        | "parent-not-directory"
-        | "special-file";
-    };
-
-export function observeSafePath(
-  root: string,
-  relative: string,
-): SafePathObservation {
-  if (!isValidRelativePath(relative)) {
-    return { kind: "unsafe", reason: "invalid-path" };
-  }
-  try {
-    const resolvedRoot = path.resolve(root);
-    const rootStat = lstatSync(resolvedRoot, { throwIfNoEntry: false });
-    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
-      return { kind: "unsafe", reason: "root-unavailable" };
-    }
-    if (relative === ".") return { kind: "directory" };
-
-    let current = resolvedRoot;
-    const parts = relative.split("/");
-    for (const [index, part] of parts.entries()) {
-      current = path.join(current, part);
-      if (!current.startsWith(`${resolvedRoot}${path.sep}`)) {
-        return { kind: "unsafe", reason: "invalid-path" };
-      }
-      const stat = lstatSync(current, { throwIfNoEntry: false });
-      if (!stat) return { kind: "absent" };
-      if (stat.isSymbolicLink()) {
-        return { kind: "unsafe", reason: "symlink" };
-      }
-      if (index < parts.length - 1) {
-        if (!stat.isDirectory()) {
-          return { kind: "unsafe", reason: "parent-not-directory" };
-        }
-        continue;
-      }
-      if (stat.isFile()) return { kind: "file" };
-      if (stat.isDirectory()) return { kind: "directory" };
-      return { kind: "unsafe", reason: "special-file" };
-    }
-  } catch {
-    return { kind: "unsafe", reason: "path-unavailable" };
-  }
-  return { kind: "unsafe", reason: "invalid-path" };
-}
-
-export function isSafeRegularFile(root: string, relative: string): boolean {
-  return observeSafePath(root, relative).kind === "file";
-}
-
-/** Require an exact regular-file or absent workspace fact without following links. */
-export function requireSafeWorkspacePath(
-  root: string,
-  relative: string,
-  expected: "file" | "absent",
-): SafePathObservation {
-  const observation = observeSafePath(root, relative);
-  if (observation.kind !== expected) throw new Error("unsafe-workspace-path");
-  return observation;
-}

package/src/scoped-grep-worker.mjs

@@ -1,23 +0,0 @@
-// Only matching runs here. File admission and bounded reads remain parent-owned.
-// A pathological JavaScript regexp can be terminated without blocking the host.
-import { parentPort } from "node:worker_threads";
-
-parentPort.on("message", ({ pattern, path, text, maxMatches, maxBytes }) => {
-  const regex = new RegExp(pattern, "u");
-  const matches = [];
-  let bytes = 0;
-  let truncated = false;
-  const lines = text.split("\n");
-  for (let index = 0; index < lines.length; index++) {
-    if (!regex.test(lines[index])) continue;
-    const match = { path, line: index + 1, text: lines[index].slice(0, 500) };
-    const size = Buffer.byteLength(JSON.stringify(match), "utf8") + 1;
-    if (matches.length >= maxMatches || bytes + size > maxBytes) {
-      truncated = true;
-      break;
-    }
-    matches.push(match);
-    bytes += size;
-  }
-  parentPort.postMessage({ matches, bytes, truncated });
-});