@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-RBBTBCHX.js

@@ -0,0 +1,289 @@
+import {
+  isValidId
+} from "./chunk-4DJL2VXA.js";
+import {
+  TOOL_OUTPUT_ROOT_PREFIXES
+} from "./chunk-QOIASNEJ.js";
+
+// src/core/utils/repo-path-classifier.ts
+import path from "path";
+var SYSTEM_WRITE_PATH_PREFIXES = [
+  "task/",
+  "sprint/",
+  "backlog/",
+  "tech-debt/",
+  "parking-lot/",
+  "finding/",
+  "issue/",
+  "suppression/",
+  ".build-project/task/",
+  ".build-project/sprint/",
+  ".build-project/backlog/",
+  ".build-project/tech-debt/",
+  ".build-project/parking-lot/",
+  ".build-project/finding/",
+  ".build-project/issue/",
+  ".build-project/suppression/",
+  ".build-project/codex-home/",
+  ".build-project/lifecycle/",
+  ".build-project/plans/",
+  ".build-project/planning/"
+];
+var RUNTIME_ARTIFACT_PATH_PREFIXES = [
+  ".gemini/",
+  ".cursor/",
+  ".vscode/",
+  ".git/",
+  ".build-project/.artifacts/",
+  ".build-project/analysis-synthesis/",
+  ".build-project/.cache/",
+  ".build-project/artifacts/",
+  ".build-project/autoloop/",
+  ".build-project/blocker-answers/",
+  ".build-project/cache/",
+  ".build-project/labs/",
+  ".build-project/merge-apply/",
+  ".build-project/provenance/",
+  ".build-project/registry/",
+  ".build-project/research/",
+  ".build-project/repair-patches/",
+  ".build-project/reviews/",
+  ".build-project/runs/",
+  ".build-project/state/",
+  ".build-project/temp/",
+  ".build-project/tmp/",
+  ".build-project/tmp",
+  ".build-project/validation/",
+  ".build-project/xdg-state/",
+  ".build-project/cursor/",
+  ".build-project/copilot/",
+  ".build-project/edits",
+  ".build-project/edits.jsonl",
+  ".build-project/implementations/",
+  ".build-project/lifecycle/",
+  ".build-project/provider-history/",
+  ".build-project/memory/",
+  ".build-project/telemetry/",
+  ".build-project/worktrees/"
+];
+var RUNTIME_ARTIFACT_PATHS = [
+  ".build-project",
+  ".build-project/",
+  ".build-project/config/project-context.json"
+];
+var GENERATED_ARTIFACT_PATH_PREFIXES = [
+  // Build and dependency output from every toolchain: the resolver's single
+  // tool-output table (root node_modules, dist, build, target, vendor, .gradle,
+  // dist-newstyle, ...). Nested copies are handled for untracked paths only.
+  ...TOOL_OUTPUT_ROOT_PREFIXES,
+  "coverage/",
+  "coverage",
+  "tmp/",
+  "tmp",
+  ".tmp/",
+  ".tmp",
+  ".vite-cache/",
+  ".vite-cache",
+  ".build-tasks/temp/",
+  // Generated provider artifacts: canonical .build-project/providers/ plus the
+  // legacy root-level paths kept for classifying pre-consolidation diffs.
+  ".build-project/providers/",
+  "providers/pricing.json",
+  "providers/registry.json"
+];
+var PLANNING_DELIVERABLE_PATH_PREFIX = ".build-project/planning/";
+var PLANNING_INDEX_CACHE_PATH_PREFIX = ".build-project/planning/indexes/";
+var EXCLUDED_REPO_PATH_PREFIXES = [
+  ...RUNTIME_ARTIFACT_PATH_PREFIXES,
+  ...GENERATED_ARTIFACT_PATH_PREFIXES,
+  // Repository-local hooks execute outside the provider sandbox on a later Git
+  // operation, so provider-authored edits must never be applied or committed.
+  ".githooks/",
+  ".build-project/codex-home/",
+  ".build-project/plans/",
+  PLANNING_INDEX_CACHE_PATH_PREFIX
+];
+var PROVIDER_REGISTRY_CONFIG_PATHS = [
+  ".build-project/config/providers.yaml",
+  ".build-project/config/provider-registry.yaml.v1.backup"
+];
+var EXCLUDED_REPO_PATHS = [
+  ...RUNTIME_ARTIFACT_PATHS,
+  ...PROVIDER_REGISTRY_CONFIG_PATHS
+];
+var EXCLUDED_REPO_FILENAMES = [
+  ".git",
+  ".build-run.json",
+  ".cursorignore",
+  "CURSOR.md"
+];
+var GENERATED_ARTIFACT_ANYWHERE_SEGMENTS = /* @__PURE__ */ new Set(["__pycache__"]);
+var GENERATED_ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Set([".pyc"]);
+function normalizeRepoPath(filePath) {
+  const normalizedSlashes = filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+  return path.posix.normalize(normalizedSlashes);
+}
+function matchesRepoPathPrefix(filePath, prefix) {
+  if (prefix.endsWith("/")) {
+    return filePath.startsWith(prefix);
+  }
+  return filePath === prefix || filePath.startsWith(`${prefix}/`);
+}
+function startsWithAny(filePath, prefixes) {
+  return prefixes.some((prefix) => matchesRepoPathPrefix(filePath, prefix));
+}
+function hasTraversalSegment(filePath) {
+  return filePath.replace(/\\/g, "/").split("/").some((segment) => segment === "..");
+}
+function escapesRepoRoot(filePath) {
+  return path.posix.isAbsolute(filePath) || filePath === ".." || filePath.startsWith("../") || filePath.includes("/../");
+}
+function isBuildRuntimeLockPath(filePath) {
+  return filePath.startsWith(".build-project/") && filePath.endsWith(".lock");
+}
+function isBuildHousekeepingPath(filePath) {
+  const normalized = normalizeRepoPath(filePath);
+  return path.posix.dirname(normalized) === ".build-project/config" && /\.backup\.[^/]*$/.test(path.posix.basename(normalized));
+}
+function isPlanningTempArtifact(filePath) {
+  return filePath.startsWith("planning/.tmp.");
+}
+function isGeneratedArtifactPath(filePath) {
+  if (hasTraversalSegment(filePath)) return false;
+  filePath = normalizeRepoPath(filePath);
+  if (escapesRepoRoot(filePath)) return false;
+  const segments = filePath.split("/").filter(Boolean);
+  return segments.some((segment) => GENERATED_ARTIFACT_ANYWHERE_SEGMENTS.has(segment)) || GENERATED_ARTIFACT_EXTENSIONS.has(path.posix.extname(filePath).toLowerCase());
+}
+function classifyRepoPath(filePath) {
+  if (hasTraversalSegment(filePath)) {
+    return "repo-content";
+  }
+  const normalized = normalizeRepoPath(filePath);
+  if (escapesRepoRoot(normalized)) {
+    return "repo-content";
+  }
+  if (startsWithAny(normalized, [
+    "task/",
+    "sprint/",
+    "backlog/",
+    "tech-debt/",
+    "parking-lot/",
+    "finding/",
+    "issue/",
+    "suppression/",
+    ".build-project/task/",
+    ".build-project/sprint/",
+    ".build-project/backlog/",
+    ".build-project/tech-debt/",
+    ".build-project/parking-lot/",
+    ".build-project/finding/",
+    ".build-project/issue/",
+    ".build-project/suppression/"
+  ])) {
+    return "managed-metadata";
+  }
+  if (startsWithAny(normalized, [".build-project/plans/", ".build-project/planning/"])) {
+    return "planning-artifact";
+  }
+  if (isPlanningTempArtifact(normalized)) {
+    return "runtime-artifact";
+  }
+  if (RUNTIME_ARTIFACT_PATHS.includes(normalized) || isBuildRuntimeLockPath(normalized) || isBuildHousekeepingPath(normalized) || normalized.startsWith(".build-project/codex-home/") || startsWithAny(normalized, RUNTIME_ARTIFACT_PATH_PREFIXES)) {
+    return "runtime-artifact";
+  }
+  if (startsWithAny(normalized, GENERATED_ARTIFACT_PATH_PREFIXES) || isGeneratedArtifactPath(normalized) || EXCLUDED_REPO_FILENAMES.includes(path.basename(normalized))) {
+    return "generated-artifact";
+  }
+  return "repo-content";
+}
+function isSystemWritePath(filePath) {
+  const kind = classifyRepoPath(filePath);
+  return kind === "managed-metadata" || kind === "planning-artifact" || kind === "runtime-artifact";
+}
+function isBuildBookkeepingPath(filePath, planningBucketPrefixes = []) {
+  const normalized = normalizeRepoPath(filePath);
+  if (normalized.startsWith(".build-project/")) {
+    const kind = classifyRepoPath(normalized);
+    if (kind === "managed-metadata" || kind === "runtime-artifact") return true;
+    return kind === "planning-artifact" && !isDeliverablePlanningPath(normalized);
+  }
+  return normalized.endsWith(".md") && isValidId(path.posix.basename(normalized, ".md")) && planningBucketPrefixes.some((prefix) => normalized.startsWith(normalizeRepoPath(prefix)));
+}
+function isHarmlessRepoPath(filePath) {
+  return classifyRepoPath(filePath) !== "repo-content";
+}
+function isDeliverablePlanningPath(filePath) {
+  if (hasTraversalSegment(filePath)) {
+    return false;
+  }
+  const normalized = normalizeRepoPath(filePath);
+  if (escapesRepoRoot(normalized)) {
+    return false;
+  }
+  return normalized.startsWith(PLANNING_DELIVERABLE_PATH_PREFIX) && !normalized.startsWith(PLANNING_INDEX_CACHE_PATH_PREFIX) && !isBuildRuntimeLockPath(normalized);
+}
+var VERSIONED_BUILD_CONFIG_PATH_PREFIX = ".build-project/config/";
+function isVersionedBuildConfigPath(filePath) {
+  if (hasTraversalSegment(filePath)) {
+    return false;
+  }
+  const normalized = normalizeRepoPath(filePath);
+  if (escapesRepoRoot(normalized)) {
+    return false;
+  }
+  return normalized.startsWith(VERSIONED_BUILD_CONFIG_PATH_PREFIX) && !RUNTIME_ARTIFACT_PATHS.includes(normalized);
+}
+function foldRepoPathCase(filePath) {
+  return normalizeRepoPath(filePath).split("/").map((segment) => segment.replace(/[. ]+$/, "")).join("/").toLowerCase();
+}
+function isCaseVariantControlPath(normalized) {
+  const folded = foldRepoPathCase(normalized);
+  return folded.startsWith(".git/") || path.posix.basename(folded) === ".git" || folded.startsWith(".githooks/") || PROVIDER_REGISTRY_CONFIG_PATHS.includes(folded);
+}
+function withoutTrackedToolOutputRoots(prefixes, trackedRoots) {
+  if (!trackedRoots || trackedRoots.size === 0) return prefixes;
+  return prefixes.filter((prefix) => !trackedRoots.has(prefix.replace(/\/$/, "")));
+}
+function shouldIgnoreRepoPath(filePath, trackedRoots) {
+  if (hasTraversalSegment(filePath)) {
+    return false;
+  }
+  const normalized = normalizeRepoPath(filePath);
+  if (escapesRepoRoot(normalized)) {
+    return false;
+  }
+  return isBuildRuntimeLockPath(normalized) || isPlanningTempArtifact(normalized) || EXCLUDED_REPO_PATHS.includes(normalized) || startsWithAny(
+    normalized,
+    withoutTrackedToolOutputRoots(EXCLUDED_REPO_PATH_PREFIXES, trackedRoots)
+  ) || isGeneratedArtifactPath(normalized) || EXCLUDED_REPO_FILENAMES.includes(path.basename(normalized)) || isCaseVariantControlPath(normalized);
+}
+function summarizeRepoPaths(filePaths) {
+  const normalizedPaths = filePaths.map(normalizeRepoPath);
+  const kinds = normalizedPaths.map(classifyRepoPath);
+  return {
+    kinds,
+    systemWriteOnly: normalizedPaths.length > 0 && normalizedPaths.every((filePath) => isSystemWritePath(filePath)),
+    harmlessOnly: normalizedPaths.length > 0 && normalizedPaths.every((filePath) => isHarmlessRepoPath(filePath)),
+    categories: Array.from(new Set(kinds))
+  };
+}
+
+export {
+  SYSTEM_WRITE_PATH_PREFIXES,
+  EXCLUDED_REPO_PATH_PREFIXES,
+  PROVIDER_REGISTRY_CONFIG_PATHS,
+  normalizeRepoPath,
+  isGeneratedArtifactPath,
+  classifyRepoPath,
+  isSystemWritePath,
+  isBuildBookkeepingPath,
+  isHarmlessRepoPath,
+  isDeliverablePlanningPath,
+  isVersionedBuildConfigPath,
+  foldRepoPathCase,
+  withoutTrackedToolOutputRoots,
+  shouldIgnoreRepoPath,
+  summarizeRepoPaths
+};
+//# sourceMappingURL=chunk-RBBTBCHX.js.map

package/dist/chunk-RBKLOUXA.js

@@ -0,0 +1,121 @@
+import {
+  sanitizeError
+} from "./chunk-CPSVQR2I.js";
+
+// src/core/providers/shared/diagnostic-output.ts
+var PUBLIC_DIAGNOSTICS_STRING_MAX = 500;
+var PUBLIC_DIAGNOSTICS_ARRAY_MAX = 16;
+var STDERR_SEVERITIES = /* @__PURE__ */ new Set(["none", "info", "warning", "error", "fatal"]);
+var ALLOWLISTED_BOOLEAN_KEYS = /* @__PURE__ */ new Set(["finalAnswerPresent", "terminalResultPresent"]);
+var ALLOWLISTED_ENUM_KEYS = /* @__PURE__ */ new Map([
+  ["stderrSeverity", STDERR_SEVERITIES]
+]);
+var ALLOWLISTED_STRING_ARRAY_KEYS = /* @__PURE__ */ new Set([
+  "toolErrors",
+  "authErrors",
+  "transportErrors",
+  "retryErrors"
+]);
+function sanitizeDiagnosticText(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return "";
+  }
+  return sanitizeError(new Error(value)).message;
+}
+function sanitizeDiagnosticOutput(value, maxLength) {
+  const sanitized = sanitizeDiagnosticText(value);
+  if (!sanitized) {
+    return void 0;
+  }
+  if (typeof maxLength === "number" && Number.isFinite(maxLength) && maxLength > 0) {
+    return sanitized.slice(0, Math.floor(maxLength));
+  }
+  return sanitized;
+}
+function boundPublicDiagnosticString(value, maxLength = PUBLIC_DIAGNOSTICS_STRING_MAX) {
+  return sanitizeDiagnosticOutput(value, maxLength) ?? sanitizeDiagnosticText(value).slice(0, Math.floor(maxLength));
+}
+function sanitizePublicProviderDiagnostics(value) {
+  if (value === null || value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  const input = value;
+  const out = {};
+  for (const key of ALLOWLISTED_BOOLEAN_KEYS) {
+    if (typeof input[key] === "boolean") {
+      out[key] = input[key];
+    }
+  }
+  for (const [key, allowed] of ALLOWLISTED_ENUM_KEYS) {
+    const raw = input[key];
+    if (typeof raw === "string" && allowed.has(raw)) {
+      out[key] = raw;
+    }
+  }
+  for (const key of ALLOWLISTED_STRING_ARRAY_KEYS) {
+    const raw = input[key];
+    if (!Array.isArray(raw)) continue;
+    const entries = [];
+    for (const entry of raw.slice(0, PUBLIC_DIAGNOSTICS_ARRAY_MAX)) {
+      if (typeof entry !== "string" || entry.length === 0) continue;
+      const sanitized = boundPublicDiagnosticString(entry);
+      if (sanitized.length > 0) {
+        entries.push(sanitized);
+      }
+    }
+    if (entries.length > 0) {
+      out[key] = entries;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function exactTransportString(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof Buffer !== "undefined" && Buffer.isBuffer(value)) {
+    return value.toString("utf8");
+  }
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value).toString("utf8");
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return void 0;
+}
+function providerExecutionTransportStreamOptions(stdout, stderr, options) {
+  const rawStdout = exactTransportString(stdout);
+  const rawStderr = exactTransportString(stderr);
+  const maxPublicLength = options?.maxPublicLength;
+  const publicStdout = rawStdout === void 0 ? void 0 : sanitizeDiagnosticOutput(rawStdout, maxPublicLength);
+  const publicStderr = rawStderr === void 0 ? void 0 : sanitizeDiagnosticOutput(rawStderr, maxPublicLength);
+  const stdoutBytes = options?.streamBytes?.stdout ?? (rawStdout === void 0 ? void 0 : Buffer.byteLength(rawStdout, "utf8"));
+  const stderrBytes = options?.streamBytes?.stderr ?? (rawStderr === void 0 ? void 0 : Buffer.byteLength(rawStderr, "utf8"));
+  const streamBytes = {
+    ...stdoutBytes !== void 0 ? { stdout: stdoutBytes } : {},
+    ...stderrBytes !== void 0 ? { stderr: stderrBytes } : {}
+  };
+  return {
+    ...rawStdout !== void 0 ? { rawStdout } : {},
+    ...rawStderr !== void 0 ? { rawStderr } : {},
+    ...publicStdout !== void 0 ? { stdout: publicStdout } : {},
+    ...publicStderr !== void 0 ? { stderr: publicStderr } : {},
+    ...Object.keys(streamBytes).length > 0 ? { streamBytes } : {}
+  };
+}
+
+export {
+  PUBLIC_DIAGNOSTICS_STRING_MAX,
+  sanitizeDiagnosticText,
+  sanitizeDiagnosticOutput,
+  sanitizePublicProviderDiagnostics,
+  providerExecutionTransportStreamOptions
+};
+//# sourceMappingURL=chunk-RBKLOUXA.js.map

package/dist/chunk-RCP2Y6DQ.js

@@ -0,0 +1,86 @@
+// src/core/utils/contained-path.ts
+import fs from "fs";
+import path from "path";
+function canonicalizeExistingPrefix(target) {
+  let current = path.resolve(target);
+  const trailing = [];
+  let hopsRemaining = 40;
+  for (; ; ) {
+    try {
+      const real = fs.realpathSync.native(current);
+      return trailing.length > 0 ? path.join(real, ...trailing.reverse()) : real;
+    } catch {
+      let link;
+      try {
+        if (fs.lstatSync(current).isSymbolicLink()) {
+          link = fs.readlinkSync(current);
+        } else {
+          return void 0;
+        }
+      } catch {
+      }
+      if (link !== void 0) {
+        if (hopsRemaining-- <= 0) return void 0;
+        const resolvedLink = path.resolve(path.dirname(current), link);
+        if (resolvedLink === current) return void 0;
+        current = resolvedLink;
+        continue;
+      }
+      const parent = path.dirname(current);
+      if (parent === current) return void 0;
+      trailing.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+function resolveContainedPath(root, candidate) {
+  if (root.includes("\0") || candidate.includes("\0")) {
+    return { contained: false, reason: "null byte in path" };
+  }
+  const canonicalRoot = canonicalizeExistingPrefix(root);
+  if (canonicalRoot === void 0) {
+    return { contained: false, reason: "root unresolvable" };
+  }
+  const lexical = path.resolve(canonicalRoot, candidate);
+  const lexicalRelative = path.relative(canonicalRoot, lexical);
+  if (lexicalRelative.startsWith("..") || path.isAbsolute(lexicalRelative)) {
+    return { contained: false, reason: "escapes root lexically" };
+  }
+  const canonical = canonicalizeExistingPrefix(lexical);
+  if (canonical === void 0) {
+    return { contained: false, reason: "escapes root via symlink" };
+  }
+  if (canonical === canonicalRoot) {
+    return { contained: true, canonicalPath: canonical };
+  }
+  const relative = path.relative(canonicalRoot, canonical);
+  if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
+    return { contained: false, reason: "escapes root via symlink" };
+  }
+  return { contained: true, canonicalPath: canonical };
+}
+function isContainedPath(root, candidate) {
+  return resolveContainedPath(root, candidate).contained;
+}
+function isSymlink(target) {
+  try {
+    return fs.lstatSync(target).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function assertContainedPath(root, candidate, label) {
+  const result = resolveContainedPath(root, candidate);
+  if (!result.contained) {
+    throw new Error(`${label} must stay within ${root} (${result.reason}): ${candidate}`);
+  }
+  return result.canonicalPath;
+}
+
+export {
+  resolveContainedPath,
+  isContainedPath,
+  isSymlink,
+  assertContainedPath
+};
+//# sourceMappingURL=chunk-RCP2Y6DQ.js.map