@aligndottech/cli 0.47.1 → 0.48.0

package/dist/lib/launch/strict-entry.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The strict "Align is already here" test for the wave A agents (Codex, Gemini CLI, Copilot).
+ * Project and workspace files are untrusted input, so an entry stands in for the injected
+ * `align-local` only when it is EXACTLY align's own local server: the command, the args, and
+ * no other key that could change what runs (env, cwd, url, envFile, a timeout, a filter...).
+ *
+ * Deliberately separate from project-state.ts's isLocalAlignServer (Claude Code, pi, Cursor),
+ * which matches any command line that mentions align and mcp.
+ */
+export type StrictHost = 'mcpServers' | 'codex' | 'copilot';
+export interface CanonicalOptions {
+    /** Whether a bare `align mcp` reads the local graph on this machine. */
+    localIsDefault: boolean;
+    platform: string;
+    host: StrictHost;
+}
+type Json = Record<string, unknown>;
+export declare function isCanonicalLocalEntry(entry: unknown, o: CanonicalOptions): boolean;
+/**
+ * JSON with `//` and block comments removed, the way Gemini reads its settings and
+ * trustedFolders.json (strip-json-comments). Comment markers inside strings are kept. Comments
+ * become spaces, so line and column numbers in a parse error still point at the right place.
+ */
+export declare function stripJsonComments(text: string): string;
+/** JSON or JSONC as an object; null when it is not one. */
+export declare function parseJsonc(text: string | null): Json | null;
+/** What the agent's loaded config layers already hold for Align, decided by the strict test above. */
+export interface AlignLocalState {
+    /** A layer the agent loads already runs align's own local server (align-local or align). */
+    present: boolean;
+    /** Files whose `align-local` this launch replaces whole with align's own. */
+    overridden: string[];
+    /** A file whose `align-local` cannot be replaced whole: no graph this session. */
+    conflict?: string;
+}
+/** One config layer the agent loads, and its servers object (absent when the file has none). */
+export interface Layer {
+    file: string;
+    servers: unknown;
+}
+/**
+ * Fold the loaded layers, in the agent's merge order, into an AlignLocalState.
+ * `replaceable(entry)`: whether this launch's injection overwrites EVERY key of a non-canonical
+ * align-local (Gemini: always, its system tier replaces the entry whole; Codex: only when it
+ * carries nothing beyond command/args/enabled; Copilot: never known, so never).
+ */
+export declare function foldLayers(layers: Layer[], o: CanonicalOptions, replaceable: (entry: unknown) => boolean): AlignLocalState;
+export {};
+//# sourceMappingURL=strict-entry.d.ts.map

package/dist/lib/launch/strict-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-entry.d.ts","sourceRoot":"","sources":["../../../src/lib/launch/strict-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAepC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAelF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0BtD;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAQ3D;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,4FAA4F;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,eAAe,CAY1H"}

package/dist/lib/launch/strict-entry.js

@@ -0,0 +1,106 @@
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const sameArgs = (a, b) => Array.isArray(a) && a.length === b.length && a.every((x, i) => x === b[i]);
+/** The keys each host's canonical entry may carry, beyond command and args, and what they must hold. */
+const EXTRA = {
+    mcpServers: {},
+    // `enabled = false` leaves the server configured and not started: not doing our job.
+    codex: { enabled: (v) => v === true },
+    // Copilot needs `type`, and a `tools` allowlist: without '*' the tools are not callable.
+    copilot: { type: (v) => v === 'local' || v === 'stdio', tools: (v) => sameArgs(v, ['*']) },
+};
+const REQUIRED = { mcpServers: [], codex: [], copilot: ['type', 'tools'] };
+export function isCanonicalLocalEntry(entry, o) {
+    if (!isObject(entry))
+        return false;
+    const extra = EXTRA[o.host];
+    for (const key of Object.keys(entry)) {
+        if (key === 'command' || key === 'args')
+            continue;
+        // Own keys of the allowlist only: an entry's `constructor`, `toString` or an own `__proto__`
+        // (JSON.parse and smol-toml both return one) must not reach Object.prototype's members.
+        if (!Object.hasOwn(extra, key) || !extra[key](entry[key]))
+            return false;
+    }
+    if (!REQUIRED[o.host].every((k) => Object.hasOwn(entry, k)))
+        return false;
+    // On win32 an npm global install is align.cmd, which only cmd can spawn (mcp-setup.ts, ALI-1135).
+    const [command, prefix] = o.platform === 'win32' ? ['cmd', ['/c', 'align']] : ['align', []];
+    if (entry['command'] !== command)
+        return false;
+    const accepted = o.localIsDefault ? [['mcp'], ['mcp', '--env', 'local']] : [['mcp', '--env', 'local']];
+    return accepted.some((a) => sameArgs(entry['args'], [...prefix, ...a]));
+}
+/**
+ * JSON with `//` and block comments removed, the way Gemini reads its settings and
+ * trustedFolders.json (strip-json-comments). Comment markers inside strings are kept. Comments
+ * become spaces, so line and column numbers in a parse error still point at the right place.
+ */
+export function stripJsonComments(text) {
+    let out = '';
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === '"') {
+            let j = i + 1;
+            while (j < text.length && text[j] !== '"')
+                j += text[j] === '\\' ? 2 : 1;
+            out += text.slice(i, j + 1);
+            i = j + 1;
+        }
+        else if (c === '/' && text[i + 1] === '/') {
+            const end = text.indexOf('\n', i);
+            const stop = end < 0 ? text.length : end;
+            out += ' '.repeat(stop - i);
+            i = stop;
+        }
+        else if (c === '/' && text[i + 1] === '*') {
+            const end = text.indexOf('*/', i + 2);
+            const stop = end < 0 ? text.length : end + 2;
+            out += text.slice(i, stop).replace(/[^\n]/g, ' ');
+            i = stop;
+        }
+        else {
+            out += c;
+            i += 1;
+        }
+    }
+    return out;
+}
+/** JSON or JSONC as an object; null when it is not one. */
+export function parseJsonc(text) {
+    if (text === null)
+        return null;
+    try {
+        const parsed = JSON.parse(stripJsonComments(text));
+        return isObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Fold the loaded layers, in the agent's merge order, into an AlignLocalState.
+ * `replaceable(entry)`: whether this launch's injection overwrites EVERY key of a non-canonical
+ * align-local (Gemini: always, its system tier replaces the entry whole; Codex: only when it
+ * carries nothing beyond command/args/enabled; Copilot: never known, so never).
+ */
+export function foldLayers(layers, o, replaceable) {
+    const state = { present: false, overridden: [] };
+    for (const { file, servers } of layers) {
+        if (!isObject(servers))
+            continue;
+        if (isCanonicalLocalEntry(servers['align'], o))
+            state.present = true;
+        if (!('align-local' in servers))
+            continue;
+        const ours = servers['align-local'];
+        if (isCanonicalLocalEntry(ours, o))
+            state.present = true;
+        else if (replaceable(ours))
+            state.overridden.push(file);
+        else
+            state.conflict ??= file;
+    }
+    return state;
+}
+//# sourceMappingURL=strict-entry.js.map

package/dist/lib/launch/strict-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-entry.js","sourceRoot":"","sources":["../../../src/lib/launch/strict-entry.ts"],"names":[],"mappings":"AAmBA,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAErG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,CAAW,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElI,wGAAwG;AACxG,MAAM,KAAK,GAAgE;IACzE,UAAU,EAAE,EAAE;IACd,qFAAqF;IACrF,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;IACrC,yFAAyF;IACzF,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;CAC3F,CAAC;AACF,MAAM,QAAQ,GAAiC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAEzG,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,CAAmB;IACvE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM;YAAE,SAAS;QAClD,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,kGAAkG;IAClG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACvG,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YACzC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC,GAAG,IAAI,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7C,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC,GAAG,IAAI,CAAC;QACX,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,CAAC,CAAC;YACT,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAe,EAAE,CAAmB,EAAE,WAAwC;IACvG,MAAM,KAAK,GAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAClE,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,IAAI,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrE,IAAI,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACpC,IAAI,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;aACpD,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACnD,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aligndottech/cli",
-  "version": "0.47.1",
+  "version": "0.48.0",
   "mcpName": "io.github.aligndottech/cli",
   "type": "module",
   "description": "Align CLI - capture decisions, check alignment, and manage connectors",
@@ -46,7 +46,8 @@
     "eventsource": "^3.0.2",
     "execa": "^9.5.2",
     "open": "^10.1.0",
-    "ora": "^8.1.1"
+    "ora": "^8.1.1",
+    "smol-toml": "1.9.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",