@geml/geml 1.4.5 → 1.5.0

package/codemap/mcp-server.mjs

@@ -290,7 +290,7 @@ export const TOOLS = [
       // EVERY line carries the full `doc.geml#id`, including same-document
       // targets that profile §4 would abbreviate to `#id`. The reader here is
       // an agent, and each line has to be usable as-is for the next
-      // `open_symbol`/`trace_calls` call. A bare id would make it infer the
+      // `geml_codemap_node`/`geml_codemap_callchain` call. A bare id would make it infer the
       // document from the line's ancestors — cheaper output, one more thing to
       // get wrong.
       const walk = (doc, id, level, prefix, last) => {

package/codemap/render-all.mjs

@@ -8,8 +8,8 @@
 // graph area (nested frame), so the whole map is browsable offline — this is
 // the "copy the folder to someone" mode. For a live view that never goes
 // stale, use `geml codemap serve` instead.
-import { readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, basename } from "node:path";
+import { readdirSync, readFileSync, writeFileSync, realpathSync } from "node:fs";
+import { join, basename, sep, resolve as resolvePath } from "node:path";
 import { parse, renderHtml } from "../dist/geml.js";
 
 if (process.argv[2] === "--help" || process.argv[2] === "-h") {
@@ -25,9 +25,22 @@ const dir = process.argv[2] || ".geml-code-graph";
 // text + parsed docs live in memory for the duration of the run).
 const texts = new Map();  // rel -> text | null
 const parsed = new Map(); // text -> Document
+// `rel` is document-controlled — a `src=` composed by the renderer — and the
+// output of this command is a published artifact, so an unconfined read here
+// writes any .geml on the filesystem into a file that then gets served. Gate on
+// the realpath, the same shape `serve` and the CLI resolver use.
+let realDir = null;
+try { realDir = realpathSync(resolvePath(dir)); } catch { realDir = null; }
 const loadDoc = (rel) => {
   if (!texts.has(rel)) {
-    try { texts.set(rel, readFileSync(join(dir, rel), "utf8")); } catch { texts.set(rel, null); }
+    let text = null;
+    if (realDir !== null) {
+      try {
+        const real = realpathSync(join(dir, rel));
+        if (real === realDir || real.startsWith(realDir + sep)) text = readFileSync(real, "utf8");
+      } catch { text = null; }
+    }
+    texts.set(rel, text);
   }
   return texts.get(rel);
 };

package/codemap/serve.mjs

@@ -182,7 +182,14 @@ export function createApp({ dir, root, port, cacheMb, srcRoot }) {
     return entry;
   };
   const loadDoc = (rel) => {
-    const e = loadCached(join(root, rel));
+    // `rel` is document-controlled — it is whatever a `src=` composed — so it goes
+    // through the same symlink-safe gate the URL router uses. Without it a
+    // transclusion could name `../../../secret.geml` and this loader would read
+    // and serve any .geml on the filesystem. (confine is declared below; loadDoc
+    // is only ever called while handling a request, so the closure is resolved.)
+    const abs = confine(join(root, rel));
+    if (abs === null) return null;
+    const e = loadCached(abs);
     return e ? e.text : null;
   };
   // loadDoc hands out the cached string instance, so the by-text lookup hits

package/dist/diagnostics.d.ts

@@ -1,4 +1,4 @@
-export type DiagnosticCode = "unterminated-block" | "unknown-block-type" | "block-nesting-too-deep" | "list-nesting-too-deep" | "inline-nesting-too-deep" | "duplicate-id" | "unresolved-reference" | "unresolved-footnote" | "unresolved-cross-document-reference" | "unresolvable-document" | "unchecked-cross-document-reference" | "unknown-metadata-reference" | "table-src-and-body" | "unknown-table-format" | "bad-compute-formula" | "unlexable-compute-formula" | "compute-error" | "bad-summary-entry" | "summary-unknown-column" | "unlexable-summary-expression" | "summary-error" | "bad-span" | "span-outside-table" | "unknown-diagram-format" | "ignored-diagram-body" | "code-graph-missing-src" | "code-graph-unresolvable-document" | "chart-missing-data" | "chart-data-not-a-table" | "chart-missing-type" | "chart-unknown-type" | "chart-unknown-rows-scope" | "chart-missing-channel" | "chart-empty-channel" | "chart-unknown-column" | "chart-unused-channel" | "chart-missing-summary-row" | "chart-summary-row-unavailable" | "chart-non-numeric-value";
+export type DiagnosticCode = "unterminated-block" | "unknown-block-type" | "block-nesting-too-deep" | "list-nesting-too-deep" | "inline-nesting-too-deep" | "duplicate-id" | "unresolved-reference" | "unresolved-footnote" | "unresolved-cross-document-reference" | "unresolvable-document" | "unchecked-cross-document-reference" | "embed-missing-src" | "ignored-embed-body" | "transclusion-cycle" | "embed-target-not-geml" | "media-target-is-document" | "inline-transclusion-not-inline" | "unsafe-embed-scheme" | "source-attr-conflict" | "unresolvable-table-source" | "table-source-not-a-table" | "unknown-metadata-reference" | "table-src-and-body" | "unknown-table-format" | "bad-compute-formula" | "unlexable-compute-formula" | "compute-error" | "bad-summary-entry" | "summary-unknown-column" | "unlexable-summary-expression" | "summary-error" | "bad-span" | "span-outside-table" | "unknown-diagram-format" | "ignored-diagram-body" | "code-graph-missing-src" | "code-graph-unresolvable-document" | "chart-missing-data" | "chart-data-not-a-table" | "chart-missing-type" | "chart-unknown-type" | "chart-unknown-rows-scope" | "chart-missing-channel" | "chart-empty-channel" | "chart-unknown-column" | "chart-unused-channel" | "chart-missing-summary-row" | "chart-summary-row-unavailable" | "chart-non-numeric-value";
 export interface Diagnostic {
     severity: "error" | "warning";
     code: DiagnosticCode;

package/dist/diagnostics.js

@@ -24,6 +24,16 @@ export const SEVERITY = {
     "unresolved-cross-document-reference": "error",
     "unresolvable-document": "error",
     "unchecked-cross-document-reference": "warning",
+    "embed-missing-src": "error",
+    "ignored-embed-body": "warning",
+    "transclusion-cycle": "error",
+    "embed-target-not-geml": "error",
+    "media-target-is-document": "error",
+    "inline-transclusion-not-inline": "error",
+    "unsafe-embed-scheme": "error",
+    "source-attr-conflict": "error",
+    "unresolvable-table-source": "error",
+    "table-source-not-a-table": "error",
     "unknown-metadata-reference": "error",
     "table-src-and-body": "error",
     "unknown-table-format": "warning",

package/dist/geml.d.ts

@@ -64,7 +64,11 @@ export interface Document {
 }
 export interface ParseOptions {
     resolveDoc?: (doc: string) => string | null;
+    self?: string;
 }
+export declare function projectableInlines(blocks: Block[], id: string): {
+    inlines: Inline[];
+} | "not-inline" | null;
 export declare function parse(source: string, opts?: ParseOptions): Document;
 export interface Span {
     start: number;