@archmax-ai/harness 0.6.0 → 0.6.1

package/dist/core/frontmatter.d.ts

@@ -1,3 +1,14 @@
+export declare const ENGINES: {
+    yaml: (input: string) => object;
+    js: {
+        parse: () => never;
+        stringify: () => never;
+    };
+    javascript: {
+        parse: () => never;
+        stringify: () => never;
+    };
+};
 export interface ParsedFrontmatter {
     /** Parsed YAML frontmatter block (whatever shape the caller expects). */
     data: unknown;

package/dist/core/frontmatter.js

@@ -7,9 +7,33 @@ import { parse as parseYaml } from "yaml";
  * block over with CRLF line endings intact, and a trailing `\r` would otherwise
  * end up inside parsed string values, so normalize before parsing.
  */
-const YAML_ENGINE = {
-    yaml: (input) => (parseYaml(input.replace(/\r(?=\n|$)/g, "")) ?? {}),
+const yamlEngine = (input) => (parseYaml(input.replace(/\r(?=\n|$)/g, "")) ?? {});
+/**
+ * gray-matter picks a parser from the language tag on the opening fence, so
+ * `---js` would hand the block to its bundled `javascript` engine, which runs
+ * the block through `eval` in the host process. We parse only YAML, so refuse
+ * any fence that names a language, and point the `js`/`javascript` engines at a
+ * thrower in case a tag ever reaches gray-matter.
+ */
+const throwEngine = {
+    parse: () => {
+        throw new Error("frontmatter: only a plain `---` YAML fence is supported");
+    },
+    stringify: () => {
+        throw new Error("frontmatter: only a plain `---` YAML fence is supported");
+    },
 };
+export const ENGINES = { yaml: yamlEngine, js: throwEngine, javascript: throwEngine };
+/**
+ * Whether the opening `---` fence carries a language tag (e.g. `---js` or
+ * `--- javascript`). `matter.test` has already confirmed the input opens with
+ * `---`, so the tag is whatever follows on that first line.
+ */
+function hasLanguageTag(raw) {
+    const newline = raw.search(/\r?\n/);
+    const firstLine = newline === -1 ? raw : raw.slice(0, newline);
+    return firstLine.replace(/^-+/, "").trim().length > 0;
+}
 /**
  * Parse a `---`-delimited YAML frontmatter block followed by a Markdown body,
  * the convention shared by `SUBAGENT.md` and `WORKFLOW.md`. Returns `null` when
@@ -21,8 +45,10 @@ const YAML_ENGINE = {
 export function parseFrontmatter(raw) {
     if (!matter.test(raw))
         return null;
+    if (hasLanguageTag(raw))
+        return null;
     try {
-        const parsed = matter(raw, { engines: YAML_ENGINE });
+        const parsed = matter(raw, { engines: ENGINES, language: "yaml" });
         return { data: parsed.data, body: parsed.content };
     }
     catch {

package/dist/core/frontmatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/core/frontmatter.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,CAAC,KAAa,EAAU,EAAE,CAC9B,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAW;CAChE,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/core/frontmatter.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAW,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,GAAG;IAClB,KAAK,EAAE,GAAU,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,SAAS,EAAE,GAAU,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAEtF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACxD,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archmax-ai/harness",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "Agents can't reliably follow a process. archmax harness makes them: a governed layer over LangChain Deep Agents that enforces a declarative workflow state machine on every step.",
   "keywords": [