@blackbox_ai/blackbox-cli-core 0.0.4

package/dist/src/utils/safeJsonParse.test.js

@@ -0,0 +1,112 @@
+/**
+ * @license
+ * Copyright 2025 Blackbox
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { safeJsonParse } from './safeJsonParse.js';
+describe('safeJsonParse', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    describe('valid JSON parsing', () => {
+        it('should parse valid JSON correctly', () => {
+            const validJson = '{"name": "test", "value": 123}';
+            const result = safeJsonParse(validJson);
+            expect(result).toEqual({ name: 'test', value: 123 });
+        });
+        it('should parse valid JSON arrays', () => {
+            const validArray = '["item1", "item2", "item3"]';
+            const result = safeJsonParse(validArray);
+            expect(result).toEqual(['item1', 'item2', 'item3']);
+        });
+        it('should parse valid JSON with nested objects', () => {
+            const validNested = '{"config": {"paths": ["testlogs/*.py"], "options": {"recursive": true}}}';
+            const result = safeJsonParse(validNested);
+            expect(result).toEqual({
+                config: {
+                    paths: ['testlogs/*.py'],
+                    options: { recursive: true },
+                },
+            });
+        });
+    });
+    describe('malformed JSON with jsonrepair fallback', () => {
+        it('should handle malformed JSON with single quotes', () => {
+            const malformedJson = "{'name': 'test', 'value': 123}";
+            const result = safeJsonParse(malformedJson);
+            expect(result).toEqual({ name: 'test', value: 123 });
+        });
+        it('should handle malformed JSON with unquoted keys', () => {
+            const malformedJson = '{name: "test", value: 123}';
+            const result = safeJsonParse(malformedJson);
+            expect(result).toEqual({ name: 'test', value: 123 });
+        });
+        it('should handle malformed JSON with trailing commas', () => {
+            const malformedJson = '{"name": "test", "value": 123,}';
+            const result = safeJsonParse(malformedJson);
+            expect(result).toEqual({ name: 'test', value: 123 });
+        });
+        it('should handle malformed JSON with comments', () => {
+            const malformedJson = '{"name": "test", // comment\n "value": 123}';
+            const result = safeJsonParse(malformedJson);
+            expect(result).toEqual({ name: 'test', value: 123 });
+        });
+    });
+    describe('fallback behavior', () => {
+        it('should return fallback value for empty string', () => {
+            const emptyString = '';
+            const fallback = { default: 'value' };
+            const result = safeJsonParse(emptyString, fallback);
+            expect(result).toEqual(fallback);
+        });
+        it('should return fallback value for null input', () => {
+            const nullInput = null;
+            const fallback = { default: 'value' };
+            const result = safeJsonParse(nullInput, fallback);
+            expect(result).toEqual(fallback);
+        });
+        it('should return fallback value for undefined input', () => {
+            const undefinedInput = undefined;
+            const fallback = { default: 'value' };
+            const result = safeJsonParse(undefinedInput, fallback);
+            expect(result).toEqual(fallback);
+        });
+        it('should return empty object as default fallback', () => {
+            const invalidJson = 'invalid json';
+            const result = safeJsonParse(invalidJson);
+            // jsonrepair returns the original string for completely invalid JSON
+            expect(result).toEqual('invalid json');
+        });
+        it('should return custom fallback when parsing fails', () => {
+            const invalidJson = 'invalid json';
+            const customFallback = { error: 'parsing failed', data: null };
+            const result = safeJsonParse(invalidJson, customFallback);
+            // jsonrepair returns the original string for completely invalid JSON
+            expect(result).toEqual('invalid json');
+        });
+    });
+    describe('type safety', () => {
+        it('should preserve generic type when parsing valid JSON', () => {
+            const validJson = '{"name": "test", "value": 123}';
+            const result = safeJsonParse(validJson);
+            expect(result).toEqual({ name: 'test', value: 123 });
+            // TypeScript should infer the correct type
+            expect(typeof result.name).toBe('string');
+            expect(typeof result.value).toBe('number');
+        });
+        it('should return fallback type when parsing fails', () => {
+            const invalidJson = 'invalid json';
+            const fallback = { error: 'fallback' };
+            const result = safeJsonParse(invalidJson, fallback);
+            // jsonrepair returns the original string for completely invalid JSON
+            expect(result).toEqual('invalid json');
+            // TypeScript should preserve the fallback type
+            expect(typeof result).toBe('string');
+        });
+    });
+});
+//# sourceMappingURL=safeJsonParse.test.js.map

package/dist/src/utils/safeJsonParse.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeJsonParse.test.js","sourceRoot":"","sources":["../../../src/utils/safeJsonParse.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,SAAS,GAAG,gCAAgC,CAAC;YACnD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YAExC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,UAAU,GAAG,6BAA6B,CAAC;YACjD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YAEzC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,WAAW,GACf,0EAA0E,CAAC;YAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE;oBACN,KAAK,EAAE,CAAC,eAAe,CAAC;oBACxB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,aAAa,GAAG,gCAAgC,CAAC;YACvD,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,aAAa,GAAG,4BAA4B,CAAC;YACnD,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,aAAa,GAAG,iCAAiC,CAAC;YACxD,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,aAAa,GAAG,6CAA6C,CAAC;YACpE,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,WAAW,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAEtC,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAEpD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,SAAS,GAAG,IAAyB,CAAC;YAC5C,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAEtC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAElD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,cAAc,GAAG,SAA8B,CAAC;YACtD,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAEtC,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAEvD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,WAAW,GAAG,cAAc,CAAC;YAEnC,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAE1C,qEAAqE;YACrE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC;YACnC,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAE/D,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAE1D,qEAAqE;YACrE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,MAAM,SAAS,GAAG,gCAAgC,CAAC;YACnD,MAAM,MAAM,GAAG,aAAa,CAAkC,SAAS,CAAC,CAAC;YAEzE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,2CAA2C;YAC3C,MAAM,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,WAAW,GAAG,cAAc,CAAC;YACnC,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,UAAU,EAAW,CAAC;YAEhD,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAEpD,qEAAqE;YACrE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACvC,+CAA+C;YAC/C,MAAM,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/utils/safeJsonStringify.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Safely stringifies an object to JSON, handling circular references by replacing them with [Circular].
+ *
+ * @param obj - The object to stringify
+ * @param space - Optional space parameter for formatting (defaults to no formatting)
+ * @returns JSON string with circular references replaced by [Circular]
+ */
+export declare function safeJsonStringify(obj: unknown, space?: string | number): string;

package/dist/src/utils/safeJsonStringify.js

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Safely stringifies an object to JSON, handling circular references by replacing them with [Circular].
+ *
+ * @param obj - The object to stringify
+ * @param space - Optional space parameter for formatting (defaults to no formatting)
+ * @returns JSON string with circular references replaced by [Circular]
+ */
+export function safeJsonStringify(obj, space) {
+    const seen = new WeakSet();
+    return JSON.stringify(obj, (key, value) => {
+        if (typeof value === 'object' && value !== null) {
+            if (seen.has(value)) {
+                return '[Circular]';
+            }
+            seen.add(value);
+        }
+        return value;
+    }, space);
+}
+//# sourceMappingURL=safeJsonStringify.js.map

package/dist/src/utils/safeJsonStringify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeJsonStringify.js","sourceRoot":"","sources":["../../../src/utils/safeJsonStringify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAY,EACZ,KAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,SAAS,CACnB,GAAG,EACH,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,EACD,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/src/utils/safeJsonStringify.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/utils/safeJsonStringify.test.js

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect } from 'vitest';
+import { safeJsonStringify } from './safeJsonStringify.js';
+describe('safeJsonStringify', () => {
+    it('should stringify normal objects without issues', () => {
+        const obj = { name: 'test', value: 42 };
+        const result = safeJsonStringify(obj);
+        expect(result).toBe('{"name":"test","value":42}');
+    });
+    it('should handle circular references by replacing them with [Circular]', () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const obj = { name: 'test' };
+        obj.circular = obj; // Create circular reference
+        const result = safeJsonStringify(obj);
+        expect(result).toBe('{"name":"test","circular":"[Circular]"}');
+    });
+    it('should handle complex circular structures like HttpsProxyAgent', () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const agent = {
+            sockets: {},
+            options: { host: 'example.com' },
+        };
+        agent.sockets['example.com'] = [{ agent }];
+        const result = safeJsonStringify(agent);
+        expect(result).toContain('[Circular]');
+        expect(result).toContain('example.com');
+    });
+    it('should respect the space parameter for formatting', () => {
+        const obj = { name: 'test', value: 42 };
+        const result = safeJsonStringify(obj, 2);
+        expect(result).toBe('{\n  "name": "test",\n  "value": 42\n}');
+    });
+    it('should handle circular references with formatting', () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const obj = { name: 'test' };
+        obj.circular = obj;
+        const result = safeJsonStringify(obj, 2);
+        expect(result).toBe('{\n  "name": "test",\n  "circular": "[Circular]"\n}');
+    });
+    it('should handle arrays with circular references', () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const arr = [{ id: 1 }];
+        arr[0].parent = arr; // Create circular reference
+        const result = safeJsonStringify(arr);
+        expect(result).toBe('[{"id":1,"parent":"[Circular]"}]');
+    });
+    it('should handle null and undefined values', () => {
+        expect(safeJsonStringify(null)).toBe('null');
+        expect(safeJsonStringify(undefined)).toBe(undefined);
+    });
+    it('should handle primitive values', () => {
+        expect(safeJsonStringify('test')).toBe('"test"');
+        expect(safeJsonStringify(42)).toBe('42');
+        expect(safeJsonStringify(true)).toBe('true');
+    });
+});
+//# sourceMappingURL=safeJsonStringify.test.js.map

package/dist/src/utils/safeJsonStringify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeJsonStringify.test.js","sourceRoot":"","sources":["../../../src/utils/safeJsonStringify.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,8DAA8D;QAC9D,MAAM,GAAG,GAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,4BAA4B;QAEhD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,8DAA8D;QAC9D,MAAM,KAAK,GAAQ;YACjB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;SACjC,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,8DAA8D;QAC9D,MAAM,GAAG,GAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;QAEnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,8DAA8D;QAC9D,MAAM,GAAG,GAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,4BAA4B;QAEjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/utils/schemaValidator.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Simple utility to validate objects against JSON Schemas
+ */
+export declare class SchemaValidator {
+    /**
+     * Returns null if the data confroms to the schema described by schema (or if schema
+     *  is null). Otherwise, returns a string describing the error.
+     */
+    static validate(schema: unknown | undefined, data: unknown): string | null;
+}

package/dist/src/utils/schemaValidator.js

@@ -0,0 +1,57 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import AjvPkg from 'ajv';
+import * as addFormats from 'ajv-formats';
+// Ajv's ESM/CJS interop: use 'any' for compatibility as recommended by Ajv docs
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const AjvClass = AjvPkg.default || AjvPkg;
+const ajValidator = new AjvClass({ coerceTypes: true });
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const addFormatsFunc = addFormats.default || addFormats;
+addFormatsFunc(ajValidator);
+/**
+ * Simple utility to validate objects against JSON Schemas
+ */
+export class SchemaValidator {
+    /**
+     * Returns null if the data confroms to the schema described by schema (or if schema
+     *  is null). Otherwise, returns a string describing the error.
+     */
+    static validate(schema, data) {
+        if (!schema) {
+            return null;
+        }
+        if (typeof data !== 'object' || data === null) {
+            return 'Value of params must be an object';
+        }
+        const validate = ajValidator.compile(schema);
+        const valid = validate(data);
+        if (!valid && validate.errors) {
+            // Find any True or False values and lowercase them
+            fixBooleanCasing(data);
+            const validate = ajValidator.compile(schema);
+            const valid = validate(data);
+            if (!valid && validate.errors) {
+                return ajValidator.errorsText(validate.errors, { dataVar: 'params' });
+            }
+        }
+        return null;
+    }
+}
+function fixBooleanCasing(data) {
+    for (const key of Object.keys(data)) {
+        if (!(key in data))
+            continue;
+        if (typeof data[key] === 'object') {
+            fixBooleanCasing(data[key]);
+        }
+        else if (data[key] === 'True')
+            data[key] = 'true';
+        else if (data[key] === 'False')
+            data[key] = 'false';
+    }
+}
+//# sourceMappingURL=schemaValidator.js.map

package/dist/src/utils/schemaValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaValidator.js","sourceRoot":"","sources":["../../../src/utils/schemaValidator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,MAAM,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,UAAU,MAAM,aAAa,CAAC;AAC1C,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,QAAQ,GAAI,MAAc,CAAC,OAAO,IAAI,MAAM,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,8DAA8D;AAC9D,MAAM,cAAc,GAAI,UAAkB,CAAC,OAAO,IAAI,UAAU,CAAC;AACjE,cAAc,CAAC,WAAW,CAAC,CAAC;AAE5B;;GAEG;AACH,MAAM,OAAO,eAAe;IAC1B;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,MAA2B,EAAE,IAAa;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,mCAAmC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9B,mDAAmD;YACnD,gBAAgB,CAAC,IAA+B,CAAC,CAAC;YAElD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7B,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC9B,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,IAA6B;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;YAAE,SAAS;QAE7B,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAA4B,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;aAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/src/utils/secure-browser-launcher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Opens a URL in the default browser using platform-specific commands.
+ * This implementation avoids shell injection vulnerabilities by:
+ * 1. Validating the URL to ensure it's HTTP/HTTPS only
+ * 2. Using execFile instead of exec to avoid shell interpretation
+ * 3. Passing the URL as an argument rather than constructing a command string
+ *
+ * @param url The URL to open
+ * @throws Error if the URL is invalid or if opening the browser fails
+ */
+export declare function openBrowserSecurely(url: string): Promise<void>;
+/**
+ * Checks if the current environment should attempt to launch a browser.
+ * This is the same logic as in browser.ts for consistency.
+ *
+ * @returns True if the tool should attempt to launch a browser
+ */
+export declare function shouldLaunchBrowser(): boolean;

package/dist/src/utils/secure-browser-launcher.js

@@ -0,0 +1,165 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { platform } from 'node:os';
+import { URL } from 'node:url';
+const execFileAsync = promisify(execFile);
+/**
+ * Validates that a URL is safe to open in a browser.
+ * Only allows HTTP and HTTPS URLs to prevent command injection.
+ *
+ * @param url The URL to validate
+ * @throws Error if the URL is invalid or uses an unsafe protocol
+ */
+function validateUrl(url) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch (_error) {
+        throw new Error(`Invalid URL: ${url}`);
+    }
+    // Only allow HTTP and HTTPS protocols
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        throw new Error(`Unsafe protocol: ${parsedUrl.protocol}. Only HTTP and HTTPS are allowed.`);
+    }
+    // Additional validation: ensure no newlines or control characters
+    // eslint-disable-next-line no-control-regex
+    if (/[\r\n\x00-\x1f]/.test(url)) {
+        throw new Error('URL contains invalid characters');
+    }
+}
+/**
+ * Opens a URL in the default browser using platform-specific commands.
+ * This implementation avoids shell injection vulnerabilities by:
+ * 1. Validating the URL to ensure it's HTTP/HTTPS only
+ * 2. Using execFile instead of exec to avoid shell interpretation
+ * 3. Passing the URL as an argument rather than constructing a command string
+ *
+ * @param url The URL to open
+ * @throws Error if the URL is invalid or if opening the browser fails
+ */
+export async function openBrowserSecurely(url) {
+    // Validate the URL first
+    validateUrl(url);
+    const platformName = platform();
+    let command;
+    let args;
+    switch (platformName) {
+        case 'darwin':
+            // macOS
+            command = 'open';
+            args = [url];
+            break;
+        case 'win32':
+            // Windows - use PowerShell with Start-Process
+            // This avoids the cmd.exe shell which is vulnerable to injection
+            command = 'powershell.exe';
+            args = [
+                '-NoProfile',
+                '-NonInteractive',
+                '-WindowStyle',
+                'Hidden',
+                '-Command',
+                `Start-Process '${url.replace(/'/g, "''")}'`,
+            ];
+            break;
+        case 'linux':
+        case 'freebsd':
+        case 'openbsd':
+            // Linux and BSD variants
+            // Try xdg-open first, fall back to other options
+            command = 'xdg-open';
+            args = [url];
+            break;
+        default:
+            throw new Error(`Unsupported platform: ${platformName}`);
+    }
+    const options = {
+        // Don't inherit parent's environment to avoid potential issues
+        env: {
+            ...process.env,
+            // Ensure we're not in a shell that might interpret special characters
+            SHELL: undefined,
+        },
+        // Detach the browser process so it doesn't block
+        detached: true,
+        stdio: 'ignore',
+    };
+    try {
+        await execFileAsync(command, args, options);
+    }
+    catch (error) {
+        // For Linux, try fallback commands if xdg-open fails
+        if ((platformName === 'linux' ||
+            platformName === 'freebsd' ||
+            platformName === 'openbsd') &&
+            command === 'xdg-open') {
+            const fallbackCommands = [
+                'gnome-open',
+                'kde-open',
+                'firefox',
+                'chromium',
+                'google-chrome',
+            ];
+            for (const fallbackCommand of fallbackCommands) {
+                try {
+                    await execFileAsync(fallbackCommand, [url], options);
+                    return; // Success!
+                }
+                catch {
+                    // Try next command
+                    continue;
+                }
+            }
+        }
+        // Re-throw the error if all attempts failed
+        throw new Error(`Failed to open browser: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+/**
+ * Checks if the current environment should attempt to launch a browser.
+ * This is the same logic as in browser.ts for consistency.
+ *
+ * @returns True if the tool should attempt to launch a browser
+ */
+export function shouldLaunchBrowser() {
+    // A list of browser names that indicate we should not attempt to open a
+    // web browser for the user.
+    const browserBlocklist = ['www-browser'];
+    const browserEnv = process.env['BROWSER'];
+    if (browserEnv && browserBlocklist.includes(browserEnv)) {
+        return false;
+    }
+    // Common environment variables used in CI/CD or other non-interactive shells.
+    if (process.env['CI'] ||
+        process.env['DEBIAN_FRONTEND'] === 'noninteractive') {
+        return false;
+    }
+    // The presence of SSH_CONNECTION indicates a remote session.
+    // We should not attempt to launch a browser unless a display is explicitly available
+    // (checked below for Linux).
+    const isSSH = !!process.env['SSH_CONNECTION'];
+    // On Linux, the presence of a display server is a strong indicator of a GUI.
+    if (platform() === 'linux') {
+        // These are environment variables that can indicate a running compositor on Linux.
+        const displayVariables = ['DISPLAY', 'WAYLAND_DISPLAY', 'MIR_SOCKET'];
+        const hasDisplay = displayVariables.some((v) => !!process.env[v]);
+        if (!hasDisplay) {
+            return false;
+        }
+    }
+    // If in an SSH session on a non-Linux OS (e.g., macOS), don't launch browser.
+    // The Linux case is handled above (it's allowed if DISPLAY is set).
+    if (isSSH && platform() !== 'linux') {
+        return false;
+    }
+    // For non-Linux OSes, we generally assume a GUI is available
+    // unless other signals (like SSH) suggest otherwise.
+    return true;
+}
+//# sourceMappingURL=secure-browser-launcher.js.map

package/dist/src/utils/secure-browser-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-browser-launcher.js","sourceRoot":"","sources":["../../../src/utils/secure-browser-launcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,SAAc,CAAC;IAEnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,CAAC,QAAQ,oCAAoC,CAC3E,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,yBAAyB;IACzB,WAAW,CAAC,GAAG,CAAC,CAAC;IAEjB,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC;IAChC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IAEnB,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,QAAQ;YACR,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,MAAM;QAER,KAAK,OAAO;YACV,8CAA8C;YAC9C,iEAAiE;YACjE,OAAO,GAAG,gBAAgB,CAAC;YAC3B,IAAI,GAAG;gBACL,YAAY;gBACZ,iBAAiB;gBACjB,cAAc;gBACd,QAAQ;gBACR,UAAU;gBACV,kBAAkB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;aAC7C,CAAC;YACF,MAAM;QAER,KAAK,OAAO,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,yBAAyB;YACzB,iDAAiD;YACjD,OAAO,GAAG,UAAU,CAAC;YACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,MAAM;QAER;YACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,+DAA+D;QAC/D,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,sEAAsE;YACtE,KAAK,EAAE,SAAS;SACjB;QACD,iDAAiD;QACjD,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;KAChB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qDAAqD;QACrD,IACE,CAAC,YAAY,KAAK,OAAO;YACvB,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS,CAAC;YAC7B,OAAO,KAAK,UAAU,EACtB,CAAC;YACD,MAAM,gBAAgB,GAAG;gBACvB,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,UAAU;gBACV,eAAe;aAChB,CAAC;YAEF,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,aAAa,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;oBACrD,OAAO,CAAC,WAAW;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,mBAAmB;oBACnB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,wEAAwE;IACxE,4BAA4B;IAC5B,MAAM,gBAAgB,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,UAAU,IAAI,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,IACE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,gBAAgB,EACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,qFAAqF;IACrF,6BAA6B;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE9C,6EAA6E;IAC7E,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,mFAAmF;QACnF,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,KAAK,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,qDAAqD;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/utils/secure-browser-launcher.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};