@expo/code-review-cli 0.12.1 → 0.12.3

package/build/research-mcp/direct-fetch.js

@@ -0,0 +1,160 @@
+import { fetchDocumentationDocument } from "./fetch-document.js";
+import { chunkDocument } from "./html.js";
+import { getProvider, resolveAllowedUrl } from "./providers.js";
+import { assertSafeDocumentationUrlShape } from "./query-sanitizer.js";
+import { buildSearchIndex, searchDocumentation } from "./search-index.js";
+/** Specific corpora precede their broader host/path parents during URL inference. */
+const DIRECT_PROVIDER_ORDER = [
+    "apple-releases",
+    "sdwebimage",
+    "apple",
+    "swift-evolution",
+    "android-releases",
+    "media3",
+    "agp",
+    "android",
+    "glide",
+    "okhttp",
+    "kotlin-coroutines",
+    "gradle",
+    "jetbrains-issues",
+    "react-native-reanimated",
+    "react-native-gesture-handler",
+    "react-native-screens",
+    "react-native-worklets",
+    "react-native",
+    "expo",
+];
+const DIRECT_SOURCE_KIND = {
+    apple: "official-api",
+    "apple-releases": "release-notes",
+    "swift-evolution": "official-guide",
+    sdwebimage: "official-api",
+    android: "official-api",
+    "android-releases": "release-notes",
+    media3: "official-guide",
+    glide: "official-guide",
+    okhttp: "official-guide",
+    "kotlin-coroutines": "official-guide",
+    gradle: "official-guide",
+    agp: "release-notes",
+    "jetbrains-issues": "issue-tracker",
+    expo: "official-api",
+    "react-native": "official-api",
+    "react-native-reanimated": "official-guide",
+    "react-native-gesture-handler": "official-guide",
+    "react-native-screens": "official-guide",
+    "react-native-worklets": "official-guide",
+};
+export const DIRECT_DOCUMENT_CONTEXT_MODES = ["focused", "section", "document"];
+const SECTION_CONTEXT_CHARACTERS = 12_000;
+const DOCUMENT_CONTEXT_CHARACTERS = 20_000;
+function withScore(chunk, score = 0) {
+    return { ...chunk, score };
+}
+function rankedAnchor(chunks, document, provider, query) {
+    if (!query?.trim())
+        return chunks[0] ? withScore(chunks[0]) : undefined;
+    const index = buildSearchIndex(chunks, 1);
+    return (searchDocumentation(index, query, {
+        platform: document.platform,
+        providers: [provider],
+        limit: 1,
+    })[0] ?? (chunks[0] ? withScore(chunks[0]) : undefined));
+}
+function contiguousWindow(body, anchor, maxCharacters) {
+    if (body.length <= maxCharacters)
+        return body;
+    const exactIndex = body.indexOf(anchor);
+    const prefixIndex = exactIndex >= 0 ? exactIndex : body.indexOf(anchor.slice(0, 160));
+    const anchorIndex = prefixIndex >= 0 ? prefixIndex : 0;
+    const centeredStart = Math.max(0, anchorIndex - Math.floor(maxCharacters / 3));
+    let start = centeredStart;
+    const previousBoundary = body.lastIndexOf("\n\n", centeredStart);
+    if (previousBoundary >= Math.max(0, centeredStart - 300))
+        start = previousBoundary + 2;
+    let end = Math.min(body.length, start + maxCharacters);
+    const nextBoundary = body.indexOf("\n\n", end - 300);
+    if (nextBoundary >= 0 && nextBoundary <= start + maxCharacters)
+        end = nextBoundary;
+    return body.slice(start, end).trim();
+}
+function focusedResults(chunks, anchor, limit) {
+    if (!anchor)
+        return [];
+    const anchorIndex = Math.max(0, chunks.findIndex((chunk) => chunk.id === anchor.id));
+    const start = Math.max(0, Math.min(anchorIndex - Math.floor(limit / 2), chunks.length - limit));
+    return chunks
+        .slice(start, start + limit)
+        .map((chunk) => withScore(chunk, chunk.id === anchor.id ? anchor.score : 0));
+}
+/** Resolve a caller-supplied URL against the fixed provider allowlist. */
+export function resolveDirectDocumentationTarget(rawUrl, providerHint) {
+    assertSafeDocumentationUrlShape(rawUrl);
+    const candidates = providerHint ? [providerHint] : DIRECT_PROVIDER_ORDER;
+    for (const providerId of candidates) {
+        const provider = getProvider(providerId);
+        try {
+            return {
+                provider: providerId,
+                sourceKind: DIRECT_SOURCE_KIND[providerId],
+                url: resolveAllowedUrl(provider, rawUrl),
+            };
+        }
+        catch {
+            // Try the next fixed provider. No caller-controlled host is ever admitted.
+        }
+    }
+    throw new Error(providerHint
+        ? `URL is outside the ${providerHint} documentation allowlist`
+        : "URL is outside the supported documentation allowlist");
+}
+/** Fetch one allowlisted documentation URL and return bounded extracted passages. */
+export async function fetchDocumentationUrl(rawUrl, options = {}) {
+    const target = resolveDirectDocumentationTarget(rawUrl, options.provider);
+    const provider = getProvider(target.provider);
+    const document = await fetchDocumentationDocument(provider, target.url.href, target.sourceKind, options.fetchImplementation ?? fetch);
+    if (!document) {
+        throw new Error(`No readable documentation content at ${target.url.href}`);
+    }
+    const indexedAt = new Date().toISOString();
+    const chunks = chunkDocument(document, indexedAt);
+    const limit = Math.min(5, Math.max(1, options.limit ?? 3));
+    const mode = options.context ?? "section";
+    const anchor = rankedAnchor(chunks, document, target.provider, options.query);
+    let results = [];
+    if (mode === "focused") {
+        results = focusedResults(chunks, anchor, limit);
+    }
+    else if (anchor) {
+        const maxCharacters = mode === "document" ? DOCUMENT_CONTEXT_CHARACTERS : SECTION_CONTEXT_CHARACTERS;
+        const passage = mode === "document"
+            ? document.body.slice(0, maxCharacters).trim()
+            : contiguousWindow(document.body, anchor.passage, maxCharacters);
+        const { previousPassageId: _previous, nextPassageId: _next, ...anchorWithoutNeighbors } = anchor;
+        results = [
+            {
+                ...anchorWithoutNeighbors,
+                id: `${anchor.id.replace(/#\d+$/, "")}#${mode}`,
+                passage,
+            },
+        ];
+    }
+    const returnedCharacters = results.reduce((total, result) => total + result.passage.length, 0);
+    return {
+        provider: target.provider,
+        sourceKind: target.sourceKind,
+        canonicalUrl: target.url.href,
+        context: {
+            mode,
+            returnedCharacters,
+            documentCharacters: document.body.length,
+            truncated: returnedCharacters < document.body.length,
+            ...(anchor ? { anchorPassageId: anchor.id } : {}),
+            availablePassageCount: chunks.length,
+            availablePassageIds: chunks.slice(0, 100).map((chunk) => chunk.id),
+            ...(chunks.length > 100 ? { passageIdsTruncated: true } : {}),
+        },
+        results,
+    };
+}

package/build/research-mcp/html.js

@@ -128,11 +128,14 @@ export function chunkDocument(document, indexedAt, targetCharacters = 1400, over
         .update(`${document.provider ?? document.platform}\0${document.url}\0${document.title}`)
         .digest("hex")
         .slice(0, 16);
+    const passageId = (chunkIndex) => `${document.provider ?? document.platform}:${documentId}#${chunkIndex}`;
     return passages.map((passage, chunkIndex) => ({
         ...document,
         body: undefined,
-        id: `${document.provider ?? document.platform}:${documentId}#${chunkIndex}`,
+        id: passageId(chunkIndex),
         passage,
+        ...(chunkIndex > 0 ? { previousPassageId: passageId(chunkIndex - 1) } : {}),
+        ...(chunkIndex + 1 < passages.length ? { nextPassageId: passageId(chunkIndex + 1) } : {}),
         indexedAt,
     }));
 }

package/build/research-mcp/providers.js

@@ -130,6 +130,43 @@ export const swiftEvolutionProvider = {
         return documentUrl.hostname === "github.com" ? "markdown" : "html";
     },
 };
+const sdWebImageDocumentPrefix = "/documentation/sdwebimage";
+/** SDWebImage publishes a static DocC archive whose visible routes are JS shells. */
+export const sdWebImageProvider = {
+    id: "sdwebimage",
+    platform: "apple",
+    displayName: "SDWebImage documentation",
+    accepts(url) {
+        return (isSecurePublicUrl(url, "sdwebimage.github.io") &&
+            hasAllowedPath(url, [sdWebImageDocumentPrefix]));
+    },
+    acceptsRequest(url) {
+        if (this.accepts(url))
+            return true;
+        if (!isSecurePublicUrl(url, "sdwebimage.github.io") ||
+            !url.pathname.startsWith(`/data${sdWebImageDocumentPrefix}`) ||
+            !url.pathname.endsWith(".json")) {
+            return false;
+        }
+        const correspondingDocumentUrl = new URL(url.href);
+        correspondingDocumentUrl.pathname = url.pathname.slice("/data".length).replace(/\.json$/, "");
+        return hasAllowedPath(correspondingDocumentUrl, [sdWebImageDocumentPrefix]);
+    },
+    canonicalize(url) {
+        const hadTrailingSlash = url.pathname.endsWith("/");
+        const canonical = canonicalizeDocumentationUrl(url);
+        if (hadTrailingSlash && !canonical.pathname.endsWith("/"))
+            canonical.pathname += "/";
+        return canonical;
+    },
+    requestUrl(documentUrl) {
+        const documentPath = documentUrl.pathname.replace(/\/$/, "").toLowerCase();
+        return new URL(`/data${documentPath}.json`, documentUrl.origin);
+    },
+    responseFormat() {
+        return "docc-json";
+    },
+};
 const androidPrefixes = [
     "/build",
     "/develop",
@@ -272,6 +309,7 @@ const providers = {
     apple: appleProvider,
     "apple-releases": appleReleasesProvider,
     "swift-evolution": swiftEvolutionProvider,
+    sdwebimage: sdWebImageProvider,
     android: androidProvider,
     "android-releases": androidReleasesProvider,
     media3: media3Provider,

package/build/research-mcp/query-sanitizer.js

@@ -0,0 +1,146 @@
+const MAX_QUERY_CHARACTERS = 160;
+const MAX_QUERY_TOKENS = 8;
+const MAX_TOKEN_CHARACTERS = 64;
+const SECRET_SHAPE = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\b(?:sk|xox[baprs]|gh[opusr])[-_][A-Za-z0-9_-]{12,}\b|\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b)/i;
+const NAMED_SECRET = /\b(?:api[-_ ]?key|access[-_ ]?token|auth[-_ ]?token|password|passwd|secret|credential)\b\s*(?::|=|is)?\s*\S+/i;
+const QUOTED_LITERAL = /"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/g;
+const URL_OR_EMAIL = /\b(?:https?:\/\/|www\.)\S+|\b[^\s@]+@[^\s@]+\.[^\s@]+\b/gi;
+const PATH_LIKE = /(?:^|\s)(?:\.{0,2}[\\/]|[A-Za-z]:[\\/]|~[\\/])\S+/g;
+const QUERY_TOKEN = /[A-Za-z_][A-Za-z0-9_.:$#<>()[\]-]{0,63}|\b\d{1,4}(?:\.\d{1,3}){0,2}\b/g;
+const PROSE_STOP_WORDS = new Set([
+    "a",
+    "about",
+    "an",
+    "and",
+    "are",
+    "can",
+    "could",
+    "do",
+    "does",
+    "documentation",
+    "explain",
+    "find",
+    "for",
+    "from",
+    "how",
+    "i",
+    "in",
+    "is",
+    "it",
+    "of",
+    "on",
+    "or",
+    "please",
+    "search",
+    "show",
+    "tell",
+    "the",
+    "this",
+    "to",
+    "what",
+    "when",
+    "where",
+    "why",
+    "with",
+    "work",
+    "works",
+]);
+function shannonEntropy(value) {
+    const counts = new Map();
+    for (const character of value)
+        counts.set(character, (counts.get(character) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+function looksHighEntropy(value) {
+    if (/^[A-Fa-f0-9]{24,}$/.test(value))
+        return true;
+    if (/^[A-Za-z0-9+/]{20,}={0,2}$/.test(value) && /[+/=]/.test(value))
+        return true;
+    return (value.length >= 24 &&
+        /[a-z]/.test(value) &&
+        /[A-Z]/.test(value) &&
+        /\d/.test(value) &&
+        shannonEntropy(value) >= 4.2);
+}
+function isApiAnchor(value) {
+    return (/[a-z][A-Z]/.test(value) ||
+        /[A-Z][A-Za-z0-9_]{1,}/.test(value) ||
+        /[._:$#()]/.test(value) ||
+        /_[A-Z0-9]/.test(value));
+}
+/**
+ * Convert an agent-authored search into a short API-symbol query. Dangerous shapes
+ * fail closed; prose, literals, URLs, paths, and unsupported punctuation are removed.
+ */
+export function sanitizeDocumentationQuery(rawQuery) {
+    const visible = rawQuery
+        .normalize("NFKC")
+        // oxlint-disable-next-line no-control-regex -- outbound query containment
+        .replace(/[\u0000-\u001f\u007f]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!visible || visible.length > 300) {
+        throw new Error("Query must contain between 1 and 300 visible characters");
+    }
+    if (SECRET_SHAPE.test(visible) || NAMED_SECRET.test(visible)) {
+        throw new Error("Query contains credential-shaped or secret-labeled material");
+    }
+    const candidates = (visible
+        .replace(QUOTED_LITERAL, " ")
+        .replace(URL_OR_EMAIL, " ")
+        .replace(PATH_LIKE, " ")
+        .match(QUERY_TOKEN) ?? []).filter((token) => {
+        if (token.length > MAX_TOKEN_CHARACTERS || looksHighEntropy(token))
+            return false;
+        return !PROSE_STOP_WORDS.has(token.toLowerCase());
+    });
+    const unique = [...new Set(candidates)].slice(0, MAX_QUERY_TOKENS);
+    if (!unique.some(isApiAnchor)) {
+        throw new Error("Query must include an API-like symbol or member name");
+    }
+    const sanitized = unique.join(" ").slice(0, MAX_QUERY_CHARACTERS).trim();
+    if (!sanitized)
+        throw new Error("Query contained no safe documentation terms");
+    return sanitized;
+}
+/** Reject URL decorations and path segments that could encode arbitrary outbound data. */
+export function assertSafeDocumentationUrlShape(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("Invalid documentation URL");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.port) {
+        throw new Error("Documentation URL must use plain HTTPS without credentials or a port");
+    }
+    if (url.search || url.hash) {
+        throw new Error("Documentation URL must not contain a query string or fragment");
+    }
+    const segments = url.pathname.split("/").filter(Boolean);
+    for (const segment of segments) {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            throw new Error("Documentation URL contains an invalid encoded path segment");
+        }
+        // oxlint-disable-next-line no-control-regex -- URL path is an outbound data boundary
+        const containsControlCharacter = /[\\/\u0000-\u001f\u007f]/.test(decoded);
+        if (decoded.length > 120 ||
+            containsControlCharacter ||
+            SECRET_SHAPE.test(decoded) ||
+            NAMED_SECRET.test(decoded) ||
+            looksHighEntropy(decoded)) {
+            throw new Error("Documentation URL contains a suspicious path segment");
+        }
+    }
+    return url;
+}

package/build/research-mcp/remote-search.js

@@ -17,6 +17,10 @@ const providerSearchDefinitions = {
         scopes: ["github.com/swiftlang/swift-evolution/blob/main/proposals"],
         sourceKind: "official-guide",
     },
+    sdwebimage: {
+        scopes: ["sdwebimage.github.io/documentation/sdwebimage"],
+        sourceKind: "official-api",
+    },
     android: {
         scopes: ["developer.android.com/reference"],
         sourceKind: "official-api",

package/build/research-mcp/search-index.js

@@ -15,6 +15,8 @@ const miniSearchOptions = {
         "symbol",
         "language",
         "availability",
+        "previousPassageId",
+        "nextPassageId",
         "indexedAt",
     ],
 };
@@ -125,6 +127,8 @@ export function searchDocumentation(index, query, options) {
         ...(match.symbol ? { symbol: String(match.symbol) } : {}),
         ...(match.language ? { language: match.language } : {}),
         ...(Array.isArray(match.availability) ? { availability: match.availability.map(String) } : {}),
+        ...(match.previousPassageId ? { previousPassageId: String(match.previousPassageId) } : {}),
+        ...(match.nextPassageId ? { nextPassageId: String(match.nextPassageId) } : {}),
         indexedAt: String(match.indexedAt),
         score: match.score,
     }));