@arimakouyou/spec-workflow-mcp 2.2.7

package/dist/core/security-utils.js

@@ -0,0 +1,275 @@
+/**
+ * Security utilities for rate limiting and audit logging
+ * Implements security best practices for MCP servers
+ */
+import { appendFile, mkdir } from 'fs/promises';
+import { join } from 'path';
+// Default port for the dashboard
+export const DEFAULT_DASHBOARD_PORT = 5000;
+// Default security configuration (secure by default)
+// Note: allowedOrigins should be dynamically generated based on the actual port
+export const DEFAULT_SECURITY_CONFIG = {
+    rateLimitEnabled: true,
+    rateLimitPerMinute: 120, // 120 requests per minute per client
+    auditLogEnabled: true,
+    auditLogRetentionDays: 30,
+    corsEnabled: true,
+    allowedOrigins: [`http://localhost:${DEFAULT_DASHBOARD_PORT}`, `http://127.0.0.1:${DEFAULT_DASHBOARD_PORT}`]
+};
+// Default Vite dev server port (used when running frontend in dev mode)
+export const VITE_DEV_PORT = 5173;
+/**
+ * Generate allowed origins for CORS based on the actual port
+ * @param port - The port the dashboard is running on
+ * @param bindAddress - Optional bind address; non-localhost IPs are added to the list
+ * @returns Array of allowed origin URLs
+ */
+export function generateAllowedOrigins(port, bindAddress) {
+    const origins = [`http://localhost:${port}`, `http://127.0.0.1:${port}`];
+    // In non-production environments, also allow Vite dev server origin (port 5173)
+    // The Vite proxy forwards requests but preserves the Origin header
+    // Use !== 'production' to be permissive by default for local dev tools
+    if (process.env.NODE_ENV !== 'production') {
+        origins.push(`http://localhost:${VITE_DEV_PORT}`, `http://127.0.0.1:${VITE_DEV_PORT}`);
+    }
+    // When binding to a specific non-localhost address (e.g. 192.168.x.x), add it as allowed origin.
+    // '0.0.0.0' means all interfaces — handled separately via the '*' wildcard in getCorsConfig.
+    if (bindAddress && !isLocalhostAddress(bindAddress) && bindAddress !== '0.0.0.0') {
+        origins.push(`http://${bindAddress}:${port}`);
+    }
+    return origins;
+}
+/**
+ * Check if an IP address is localhost
+ * @param address - IP address or hostname to check
+ * @returns true if the address is localhost (127.x.x.x, localhost, or ::1)
+ */
+export function isLocalhostAddress(address) {
+    return address === 'localhost' ||
+        address === '::1' || // IPv6 localhost
+        address.startsWith('127.'); // Any 127.x.x.x address (includes 127.0.0.1)
+}
+/**
+ * Get security configuration with secure defaults
+ * Note: Network binding validation (bindAddress/allowExternalAccess) is handled separately at the config layer
+ * @param userConfig - Optional user-provided security configuration overrides
+ * @param port - The port the dashboard is running on (used to generate dynamic allowedOrigins)
+ * @param bindAddress - Optional bind address; non-localhost IPs are added to allowedOrigins
+ */
+export function getSecurityConfig(userConfig, port, bindAddress) {
+    const actualPort = port || DEFAULT_DASHBOARD_PORT;
+    // Generate dynamic allowedOrigins based on the actual port if not explicitly provided
+    const dynamicAllowedOrigins = generateAllowedOrigins(actualPort, bindAddress);
+    const config = {
+        ...DEFAULT_SECURITY_CONFIG,
+        allowedOrigins: dynamicAllowedOrigins,
+        ...userConfig
+    };
+    return config;
+}
+/**
+ * Rate limiting implementation
+ */
+export class RateLimiter {
+    requests = new Map();
+    config;
+    constructor(config) {
+        this.config = config;
+        // Clean up old entries every minute
+        setInterval(() => this.cleanup(), 60000);
+    }
+    /**
+     * Check if request should be rate limited
+     */
+    checkLimit(clientId) {
+        if (!this.config.rateLimitEnabled) {
+            return { allowed: true };
+        }
+        const now = Date.now();
+        const windowMs = 60000; // 1 minute window
+        const maxRequests = this.config.rateLimitPerMinute;
+        // Get client request history
+        const requests = this.requests.get(clientId) || [];
+        // Filter to requests within the current window
+        const recentRequests = requests.filter(timestamp => now - timestamp < windowMs);
+        // Check if limit exceeded
+        if (recentRequests.length >= maxRequests) {
+            const oldestRequest = recentRequests[0];
+            const retryAfter = Math.ceil((oldestRequest + windowMs - now) / 1000);
+            return { allowed: false, retryAfter };
+        }
+        // Add current request
+        recentRequests.push(now);
+        this.requests.set(clientId, recentRequests);
+        return { allowed: true };
+    }
+    /**
+     * Create rate limiting middleware
+     */
+    middleware() {
+        return async (request, reply) => {
+            // Use IP address as client identifier
+            const clientId = request.ip || 'unknown';
+            const result = this.checkLimit(clientId);
+            if (!result.allowed) {
+                return reply
+                    .code(429)
+                    .header('Retry-After', String(result.retryAfter || 60))
+                    .send({
+                    error: 'Too Many Requests',
+                    message: `Rate limit exceeded. Maximum ${this.config.rateLimitPerMinute} requests per minute.`,
+                    retryAfter: result.retryAfter
+                });
+            }
+        };
+    }
+    /**
+     * Clean up old request records
+     */
+    cleanup() {
+        const now = Date.now();
+        const windowMs = 60000;
+        for (const [clientId, requests] of this.requests.entries()) {
+            const recentRequests = requests.filter(timestamp => now - timestamp < windowMs);
+            if (recentRequests.length === 0) {
+                this.requests.delete(clientId);
+            }
+            else {
+                this.requests.set(clientId, recentRequests);
+            }
+        }
+    }
+}
+/**
+ * Audit logger for security events
+ */
+export class AuditLogger {
+    config;
+    logPath;
+    constructor(config, workspaceRoot) {
+        this.config = config;
+        // Determine audit log path
+        if (config.auditLogPath) {
+            this.logPath = config.auditLogPath;
+        }
+        else if (workspaceRoot) {
+            this.logPath = join(workspaceRoot, '.spec-workflow', 'audit.log');
+        }
+        else {
+            // Fallback to temp directory
+            this.logPath = join(process.cwd(), 'audit.log');
+        }
+    }
+    /**
+     * Initialize audit log (create directory if needed)
+     */
+    async initialize() {
+        if (!this.config.auditLogEnabled) {
+            return;
+        }
+        try {
+            const logDir = join(this.logPath, '..');
+            await mkdir(logDir, { recursive: true });
+        }
+        catch (error) {
+            console.error('Failed to initialize audit log:', error);
+        }
+    }
+    /**
+     * Log an audit event
+     */
+    async log(entry) {
+        if (!this.config.auditLogEnabled) {
+            return;
+        }
+        try {
+            const logLine = JSON.stringify(entry) + '\n';
+            await appendFile(this.logPath, logLine, 'utf-8');
+        }
+        catch (error) {
+            console.error('Failed to write audit log:', error);
+        }
+    }
+    /**
+     * Create audit logging middleware
+     */
+    middleware() {
+        return async (request, reply) => {
+            const startTime = Date.now();
+            // Log after response is sent using reply.then() which fires after response completes
+            reply.then(() => {
+                const entry = {
+                    timestamp: new Date().toISOString(),
+                    actor: request.ip || 'unknown',
+                    action: `${request.method} ${request.url}`,
+                    resource: request.url,
+                    result: reply.statusCode < 400 ? 'success' : reply.statusCode === 401 || reply.statusCode === 403 ? 'denied' : 'failure',
+                    details: {
+                        statusCode: reply.statusCode,
+                        duration: Date.now() - startTime,
+                        userAgent: request.headers['user-agent']
+                    }
+                };
+                // Fire and forget - don't await to avoid blocking
+                this.log(entry).catch(() => { });
+            }, () => { } // Ignore errors from reply.then
+            );
+        };
+    }
+}
+/**
+ * Security headers middleware
+ * @param port - The port the dashboard is running on (used for CSP connect-src for WebSocket)
+ */
+export function createSecurityHeadersMiddleware(port) {
+    const actualPort = port || DEFAULT_DASHBOARD_PORT;
+    // Build connect-src directive with WebSocket endpoints
+    let connectSrc = `'self' ws://localhost:${actualPort} ws://127.0.0.1:${actualPort}`;
+    // In non-production environments, also allow Vite dev server connections
+    if (process.env.NODE_ENV !== 'production') {
+        connectSrc += ` ws://localhost:${VITE_DEV_PORT} ws://127.0.0.1:${VITE_DEV_PORT}`;
+    }
+    return async (request, reply) => {
+        // Add security headers
+        reply.header('X-Content-Type-Options', 'nosniff'); // Prevent MIME type sniffing
+        reply.header('X-Frame-Options', 'DENY'); // Prevent clickjacking
+        reply.header('X-XSS-Protection', '1; mode=block'); // Enable XSS protection
+        reply.header('Referrer-Policy', 'strict-origin-when-cross-origin'); // Prevent referrer leakage
+        // CSP for dashboard
+        // Note: cdn.jsdelivr.net is required for highlight.js stylesheets used by the MDX editor
+        // connect-src allows WebSocket connections to the dashboard on the actual port
+        reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data:; connect-src ${connectSrc};`);
+    };
+}
+/**
+ * CORS configuration
+ */
+export function getCorsConfig(config) {
+    if (!config.corsEnabled) {
+        return false; // Disable CORS
+    }
+    // '*' sentinel means all origins are allowed (used when binding to 0.0.0.0 with external access)
+    const allowAll = config.allowedOrigins.includes('*');
+    return {
+        origin: allowAll
+            ? true
+            : (origin, callback) => {
+                // Allow requests with no origin (e.g., curl, Postman)
+                if (!origin) {
+                    callback(null, true);
+                    return;
+                }
+                // Check if origin is in allowed list
+                if (config.allowedOrigins.includes(origin)) {
+                    callback(null, true);
+                }
+                else {
+                    callback(new Error('Not allowed by CORS'));
+                }
+            },
+        credentials: true,
+        methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+        allowedHeaders: ['Content-Type']
+    };
+}
+//# sourceMappingURL=security-utils.js.map

package/dist/core/security-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-utils.js","sourceRoot":"","sources":["../../src/core/security-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAa,UAAU,EAAE,KAAK,EAAY,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,iCAAiC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C,qDAAqD;AACrD,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,GAAG,EAAE,qCAAqC;IAC9D,eAAe,EAAE,IAAI;IACrB,qBAAqB,EAAE,EAAE;IACzB,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,CAAC,oBAAoB,sBAAsB,EAAE,EAAE,oBAAoB,sBAAsB,EAAE,CAAC;CAC7G,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAElC;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,WAAoB;IACvE,MAAM,OAAO,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAEzE,gFAAgF;IAChF,mEAAmE;IACnE,uEAAuE;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,oBAAoB,aAAa,EAAE,EAAE,oBAAoB,aAAa,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,IAAI,WAAW,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,UAAU,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO,KAAK,WAAW;QACvB,OAAO,KAAK,KAAK,IAAI,iBAAiB;QACtC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAoC,EAAE,IAAa,EAAE,WAAoB;IACzG,MAAM,UAAU,GAAG,IAAI,IAAI,sBAAsB,CAAC;IAElD,sFAAsF;IACtF,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG;QACb,GAAG,uBAAuB;QAC1B,cAAc,EAAE,qBAAqB;QACrC,GAAG,UAAU;KACd,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACd,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAC;IAC5C,MAAM,CAAiB;IAE/B,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,oCAAoC;QACpC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,UAAU,CAAC,QAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAEnD,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnD,+CAA+C;QAC/C,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC;QAEhF,0BAA0B;QAC1B,IAAI,cAAc,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACxC,CAAC;QAED,sBAAsB;QACtB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAE5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACI,UAAU;QACf,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;YAC5D,sCAAsC;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;YAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,KAAK;qBACT,IAAI,CAAC,GAAG,CAAC;qBACT,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;qBACtD,IAAI,CAAC;oBACJ,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,gCAAgC,IAAI,CAAC,MAAM,CAAC,kBAAkB,uBAAuB;oBAC9F,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAC;YACP,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC;YAChF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAcD;;GAEG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAiB;IACvB,OAAO,CAAS;IAExB,YAAY,MAAsB,EAAE,aAAsB;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;QACrC,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,6BAA6B;YAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAAoB;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YAC7C,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,qFAAqF;YACrF,KAAK,CAAC,IAAI,CACR,GAAG,EAAE;gBACH,MAAM,KAAK,GAAkB;oBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;oBAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE;oBAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG;oBACrB,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBACxH,OAAO,EAAE;wBACP,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;wBAChC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;qBACzC;iBACF,CAAC;gBAEF,kDAAkD;gBAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,CAAC,EACD,GAAG,EAAE,GAAE,CAAC,CAAC,gCAAgC;aAC1C,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,MAAM,UAAU,GAAG,IAAI,IAAI,sBAAsB,CAAC;IAElD,uDAAuD;IACvD,IAAI,UAAU,GAAG,yBAAyB,UAAU,mBAAmB,UAAU,EAAE,CAAC;IAEpF,yEAAyE;IACzE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,UAAU,IAAI,mBAAmB,aAAa,mBAAmB,aAAa,EAAE,CAAC;IACnF,CAAC;IAED,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC5D,uBAAuB;QACvB,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC,6BAA6B;QAChF,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB;QAChE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC,wBAAwB;QAC3E,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC,CAAC,2BAA2B;QAE/F,oBAAoB;QACpB,yFAAyF;QACzF,+EAA+E;QAC/E,KAAK,CAAC,MAAM,CACV,yBAAyB,EACzB,uJAAuJ,UAAU,GAAG,CACrK,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAAsB;IAClD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,eAAe;IAC/B,CAAC;IAED,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAErD,OAAO;QACL,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,MAAc,EAAE,QAAwD,EAAE,EAAE;gBAC3E,sDAAsD;gBACtD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBAED,qCAAqC;gBACrC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;QACL,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpD,cAAc,EAAE,CAAC,cAAc,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/core/task-parser.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Unified Task Parser Module
+ * Provides consistent task parsing across all components
+ */
+export interface PromptSection {
+    key: string;
+    value: string;
+}
+export interface ParsedTask {
+    id: string;
+    description: string;
+    status: 'pending' | 'in-progress' | 'completed';
+    lineNumber: number;
+    indentLevel: number;
+    isHeader: boolean;
+    requirements?: string[];
+    leverage?: string;
+    files?: string[];
+    purposes?: string[];
+    implementationDetails?: string[];
+    prompt?: string;
+    promptStructured?: PromptSection[];
+    testFocus?: string;
+    isPhaseReview?: boolean;
+    phase?: string;
+    dependsOn?: string[];
+    completed: boolean;
+    inProgress: boolean;
+}
+export interface PhaseInfo {
+    name: string;
+    taskIds: string[];
+    reviewTaskId?: string;
+}
+export interface TaskParserResult {
+    tasks: ParsedTask[];
+    inProgressTask: string | null;
+    phases: PhaseInfo[];
+    summary: {
+        total: number;
+        completed: number;
+        inProgress: number;
+        pending: number;
+        headers: number;
+    };
+}
+/**
+ * Parse tasks from markdown content
+ * Handles any checkbox format at any indentation level
+ */
+export declare function parseTasksFromMarkdown(content: string): TaskParserResult;
+/**
+ * Update task status in markdown content
+ * Handles any indentation level and task numbering format
+ */
+export declare function updateTaskStatus(content: string, taskId: string, newStatus: 'pending' | 'in-progress' | 'completed'): string;
+/**
+ * Find the next pending task that is not a header
+ */
+export declare function findNextPendingTask(tasks: ParsedTask[]): ParsedTask | null;
+/**
+ * Get task by ID
+ */
+export declare function getTaskById(tasks: ParsedTask[], taskId: string): ParsedTask | undefined;
+/**
+ * Export for backward compatibility with existing code
+ */
+export declare function parseTaskProgress(content: string): {
+    total: number;
+    completed: number;
+    pending: number;
+};
+export interface ExecutionWave {
+    waveIndex: number;
+    taskIds: string[];
+}
+/**
+ * Phase内のタスクから依存関係に基づく実行Waveを計算する
+ * トポロジカルソートにより、依存関係のないタスクを同一Waveにグループ化
+ */
+export declare function computeExecutionWaves(tasks: ParsedTask[], phase: PhaseInfo): ExecutionWave[];
+/**
+ * 次に実行可能な Wave を返す
+ * 各 Phase を順に走査し、pending タスクを含む最初の Wave を返す
+ */
+export declare function findNextPendingWave(tasks: ParsedTask[], phases: PhaseInfo[]): {
+    phase: PhaseInfo;
+    wave: ExecutionWave;
+} | null;
+//# sourceMappingURL=task-parser.d.ts.map

package/dist/core/task-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-parser.d.ts","sourceRoot":"","sources":["../../src/core/task-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmGH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAGlB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAGrB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CA2PxE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,GACjD,MAAM,CAmCR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,GAAG,IAAI,CAE1E;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEvF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAOA;AAID,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EAAE,EACnB,KAAK,EAAE,SAAS,GACf,aAAa,EAAE,CA8DjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EAAE,EACnB,MAAM,EAAE,SAAS,EAAE,GAClB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG,IAAI,CA6BlD"}