@assistant-ui/core 0.1.2 → 0.1.5

package/src/tests/no-unsafe-process-env.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { resolve, relative, join } from "node:path";
+
+const SRC_DIR = resolve(__dirname, "..");
+
+function findFiles(dir: string, ext: string[]): string[] {
+  const results: string[] = [];
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) {
+      results.push(...findFiles(full, ext));
+    } else if (ext.some((e) => full.endsWith(e))) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+describe("no unsafe process.env access", () => {
+  it("all process.env access for non-NODE_ENV vars must have a typeof process guard", () => {
+    const files = findFiles(SRC_DIR, [".ts", ".tsx"]).filter(
+      (f) => !f.includes("/tests/") && !f.includes(".test."),
+    );
+
+    const violations: string[] = [];
+
+    for (const file of files) {
+      const content = readFileSync(file, "utf-8");
+
+      // Check if file has process.env access beyond NODE_ENV
+      // Match process.env, process?.env, process.env?, process?.env?
+      const hasNonNodeEnvProcessAccess =
+        /process\??\.env\??(?!\.NODE_ENV\b)/.test(
+          content.replace(/process\??\.env\??\.NODE_ENV/g, ""),
+        );
+
+      if (!hasNonNodeEnvProcessAccess) continue;
+
+      // File accesses process.env for non-NODE_ENV vars — must have typeof guard
+      const hasTypeofGuard = /typeof process\s*!==\s*["']undefined["']/.test(
+        content,
+      );
+
+      if (!hasTypeofGuard) {
+        violations.push(relative(SRC_DIR, file));
+      }
+    }
+
+    expect(
+      violations,
+      `These files access process.env (non-NODE_ENV) without a typeof process !== "undefined" guard.\n` +
+        `@assistant-ui/core lacks @types/node, so bare process.env access crashes in Vite and other bundlers.\n` +
+        `Add: typeof process !== "undefined" ? process.env?.["VAR_NAME"] : undefined\n\n` +
+        `Files:\n${violations.map((f) => `  - ${f}`).join("\n")}`,
+    ).toEqual([]);
+  });
+});

package/src/utils/json/is-json-equal.ts

@@ -0,0 +1,48 @@
+import type { ReadonlyJSONValue } from "assistant-stream/utils";
+import { isJSONValue, isRecord } from "./is-json";
+
+const MAX_JSON_DEPTH = 100;
+
+const isJSONValueEqualAtDepth = (
+  a: ReadonlyJSONValue,
+  b: ReadonlyJSONValue,
+  currentDepth: number,
+): boolean => {
+  if (a === b) return true;
+  if (currentDepth > MAX_JSON_DEPTH) return false;
+
+  if (a == null || b == null) return false;
+
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, index) =>
+      isJSONValueEqualAtDepth(
+        item,
+        b[index] as ReadonlyJSONValue,
+        currentDepth + 1,
+      ),
+    );
+  }
+
+  if (Array.isArray(b)) return false;
+  if (!isRecord(a) || !isRecord(b)) return false;
+
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+
+  return aKeys.every(
+    (key) =>
+      Object.hasOwn(b, key) &&
+      isJSONValueEqualAtDepth(
+        a[key] as ReadonlyJSONValue,
+        b[key] as ReadonlyJSONValue,
+        currentDepth + 1,
+      ),
+  );
+};
+
+export const isJSONValueEqual = (a: unknown, b: unknown): boolean => {
+  if (!isJSONValue(a) || !isJSONValue(b)) return false;
+  return isJSONValueEqualAtDepth(a, b, 0);
+};

package/src/utils/json/is-json.ts

@@ -0,0 +1,58 @@
+import {
+  ReadonlyJSONArray,
+  ReadonlyJSONObject,
+  ReadonlyJSONValue,
+} from "assistant-stream/utils";
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function isJSONValue(
+  value: unknown,
+  currentDepth: number = 0,
+): value is ReadonlyJSONValue {
+  // Protect against too deep recursion
+  if (currentDepth > 100) {
+    return false;
+  }
+
+  if (
+    value === null ||
+    typeof value === "string" ||
+    typeof value === "boolean"
+  ) {
+    return true;
+  }
+
+  // Handle special number cases
+  if (typeof value === "number") {
+    return !Number.isNaN(value) && Number.isFinite(value);
+  }
+
+  if (Array.isArray(value)) {
+    return value.every((item) => isJSONValue(item, currentDepth + 1));
+  }
+
+  if (isRecord(value)) {
+    return Object.entries(value).every(
+      ([key, val]) =>
+        typeof key === "string" && isJSONValue(val, currentDepth + 1),
+    );
+  }
+
+  return false;
+}
+
+export function isJSONArray(value: unknown): value is ReadonlyJSONArray {
+  return Array.isArray(value) && value.every(isJSONValue);
+}
+
+export function isJSONObject(value: unknown): value is ReadonlyJSONObject {
+  return (
+    isRecord(value) &&
+    Object.entries(value).every(
+      ([key, val]) => typeof key === "string" && isJSONValue(val),
+    )
+  );
+}