@gmickel/gno 1.25.1 → 1.27.0

package/src/config/project-profile.ts

@@ -0,0 +1,374 @@
+import { z } from "zod";
+
+import { NOTE_PRESETS } from "../core/note-presets";
+import { hasLikelySecretPath } from "../core/path-rules";
+import {
+  CONTENT_TYPE_SEARCH_BOOST_MAX,
+  CONTENT_TYPE_SEARCH_BOOST_MIN,
+  isValidLanguageHint,
+  PROJECT_AFFINITY_MAX_CONTRIBUTION,
+} from "./types";
+
+export const PROJECT_PROFILE_SCHEMA_VERSION = "1.0" as const;
+export const PROJECT_PROFILE_FINGERPRINT_DOMAIN = "gno-project-profile\0v1.0\0";
+export const PROJECT_PROFILE_FORCED_EXCLUDES = [".gno"] as const;
+
+const COLLECTION_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const REFERENCE_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const CAPABILITY_PATTERN = /^[a-z][a-z0-9._-]{0,63}$/;
+const WINDOWS_DRIVE_PATH_PATTERN = /^[a-z]:/i;
+const WINDOWS_UNC_PATH_PATTERN = /^(?:\\\\|\/\/)/;
+const ENV_EXPANSION_PATTERN =
+  /(?:\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z_][A-Za-z0-9_]*%)/;
+const GLOB_META_PATTERN = /[*?[\]{}]/;
+const WINDOWS_INVALID_COMPONENT_PATTERN = /[<>:"|]/;
+const WINDOWS_RESERVED_COMPONENT_PATTERN =
+  /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+const RUNTIME_PATH_PATTERN =
+  /(?:^|\/)\.gno(?:\/|$)|\.(?:db|sqlite|sqlite3|gguf|lock)$/i;
+const NOTE_PRESET_IDS = new Set<string>(
+  NOTE_PRESETS.map((preset) => preset.id)
+);
+
+const globStructureIssue = (value: string): string | null => {
+  if (value.startsWith("!")) {
+    return "must not use whole-pattern negation";
+  }
+  let braceDepth = 0;
+  let bracketDepth = 0;
+  for (const character of value) {
+    if (character === "{") braceDepth += 1;
+    else if (character === "}") {
+      braceDepth -= 1;
+      if (braceDepth < 0) return "contains an unmatched closing brace";
+    } else if (character === "[") bracketDepth += 1;
+    else if (character === "]") {
+      bracketDepth -= 1;
+      if (bracketDepth < 0) return "contains an unmatched closing bracket";
+    }
+    if (braceDepth > 16 || bracketDepth > 16) {
+      return "contains excessively nested glob groups";
+    }
+  }
+  if (braceDepth !== 0) return "contains an unmatched opening brace";
+  if (bracketDepth !== 0) return "contains an unmatched opening bracket";
+  return null;
+};
+
+const windowsComponentIssue = (
+  normalized: string,
+  allowGlob: boolean
+): string | null => {
+  const components: string[] = [];
+  let component = "";
+  let braceDepth = 0;
+  const pushComponent = (): void => {
+    if (component !== "") components.push(component);
+    component = "";
+  };
+  for (const character of normalized) {
+    const isBraceSeparator =
+      character === "{" ||
+      character === "}" ||
+      (character === "," && braceDepth > 0);
+    if (character === "/" || isBraceSeparator) {
+      pushComponent();
+      if (character === "{") braceDepth += 1;
+      else if (character === "}") braceDepth -= 1;
+      continue;
+    }
+    component += character;
+  }
+  pushComponent();
+
+  for (const component of components) {
+    if (component === "." || component === "") continue;
+    let hasControlCharacter = false;
+    for (const character of component) {
+      if ((character.codePointAt(0) ?? 0) < 32) {
+        hasControlCharacter = true;
+        break;
+      }
+    }
+    if (
+      hasControlCharacter ||
+      WINDOWS_INVALID_COMPONENT_PATTERN.test(component)
+    ) {
+      return "contains characters invalid in Windows path components";
+    }
+    if (component.endsWith(".") || component.endsWith(" ")) {
+      return "contains a component ending in a dot or space";
+    }
+    if (
+      (!allowGlob || !GLOB_META_PATTERN.test(component)) &&
+      WINDOWS_RESERVED_COMPONENT_PATTERN.test(component)
+    ) {
+      return "contains a Windows-reserved path component";
+    }
+  }
+  return null;
+};
+
+const portablePathIssue = (
+  value: string,
+  options: { allowGlob: boolean; allowRuntimeExclusion: boolean }
+): string | null => {
+  if (value.includes("\0")) return "contains a NUL byte";
+  if (
+    value.startsWith("/") ||
+    value.startsWith("\\") ||
+    WINDOWS_UNC_PATH_PATTERN.test(value) ||
+    WINDOWS_DRIVE_PATH_PATTERN.test(value) ||
+    value.startsWith("~")
+  ) {
+    return "must be repository-relative on every supported platform";
+  }
+  if (ENV_EXPANSION_PATTERN.test(value)) {
+    return "must not contain environment expansion";
+  }
+
+  const normalized = value.replaceAll("\\", "/");
+  if (normalized.split("/").includes("..")) {
+    return "must not contain traversal segments";
+  }
+  const windowsIssue = windowsComponentIssue(normalized, options.allowGlob);
+  if (windowsIssue) return windowsIssue;
+  if (!options.allowGlob && GLOB_META_PATTERN.test(normalized)) {
+    return "must not contain glob metacharacters";
+  }
+  if (options.allowGlob) {
+    const globIssue = globStructureIssue(normalized);
+    if (globIssue) return globIssue;
+    if (normalized.includes("{") || normalized.includes("}")) {
+      return "must not use brace alternatives; use separate include or exclude entries";
+    }
+  }
+  if (!options.allowRuntimeExclusion && RUNTIME_PATH_PATTERN.test(normalized)) {
+    return "must not reference GNO runtime state";
+  }
+  return null;
+};
+
+const portablePathSchema = (
+  options: { allowGlob?: boolean; allowRuntimeExclusion?: boolean } = {}
+) =>
+  z
+    .string()
+    .min(1)
+    .max(512)
+    .superRefine((value, context) => {
+      const issue = portablePathIssue(value, {
+        allowGlob: options.allowGlob ?? false,
+        allowRuntimeExclusion: options.allowRuntimeExclusion ?? false,
+      });
+      if (issue) {
+        context.addIssue({
+          code: "custom",
+          message: `UNSAFE_PATH: ${issue}`,
+        });
+      }
+    });
+
+export const ProjectProfileCollectionSchema = z
+  .object({
+    name: z.string().regex(COLLECTION_NAME_PATTERN),
+    root: portablePathSchema().default("."),
+    include: z
+      .array(portablePathSchema({ allowGlob: true }))
+      .min(1)
+      .max(128)
+      .superRefine((values, context) => {
+        const seen = new Set<string>();
+        for (const [index, value] of values.entries()) {
+          if (seen.has(value)) {
+            context.addIssue({
+              code: "custom",
+              path: [index],
+              message: "Duplicate include rule",
+            });
+          }
+          seen.add(value);
+        }
+      })
+      .default(["**/*"]),
+    exclude: z
+      .array(
+        portablePathSchema({
+          allowGlob: true,
+          allowRuntimeExclusion: true,
+        })
+      )
+      .max(128)
+      .superRefine((values, context) => {
+        const seen = new Set<string>();
+        for (const [index, value] of values.entries()) {
+          if (seen.has(value)) {
+            context.addIssue({
+              code: "custom",
+              path: [index],
+              message: "Duplicate exclude rule",
+            });
+          }
+          seen.add(value);
+        }
+      })
+      .default([]),
+    languageHint: z
+      .string()
+      .refine(isValidLanguageHint, "Invalid BCP-47 language hint")
+      .optional(),
+    modelPreset: z.string().regex(REFERENCE_PATTERN).optional(),
+  })
+  .strict();
+
+const InlineProjectProfileContextSchema = z
+  .object({
+    text: z.string().min(1).max(65_536),
+  })
+  .strict();
+
+const FileProjectProfileContextSchema = z
+  .object({
+    file: portablePathSchema().superRefine((value, context) => {
+      if (hasLikelySecretPath(value)) {
+        context.addIssue({
+          code: "custom",
+          message:
+            "UNSAFE_PATH: likely credential and secret files cannot be profile contexts",
+        });
+      }
+    }),
+  })
+  .strict();
+
+export const ProjectProfileContextSchema = z.union([
+  InlineProjectProfileContextSchema,
+  FileProjectProfileContextSchema,
+]);
+
+export const ProjectProfileContentTypeSchema = z
+  .object({
+    prefixes: z
+      .array(portablePathSchema())
+      .min(1)
+      .max(64)
+      .superRefine((values, context) => {
+        const seen = new Set<string>();
+        for (const [index, value] of values.entries()) {
+          if (seen.has(value)) {
+            context.addIssue({
+              code: "custom",
+              path: [index],
+              message: "Duplicate content type prefix",
+            });
+          }
+          seen.add(value);
+        }
+      }),
+    preset: z
+      .string()
+      .min(1)
+      .refine((value) => NOTE_PRESET_IDS.has(value), "Unknown note preset"),
+    graphHints: z
+      .array(z.string().min(1).max(64))
+      .max(16)
+      .superRefine((values, context) => {
+        const seen = new Set<string>();
+        for (const [index, value] of values.entries()) {
+          if (seen.has(value)) {
+            context.addIssue({
+              code: "custom",
+              path: [index],
+              message: "Duplicate graph hint",
+            });
+          }
+          seen.add(value);
+        }
+      })
+      .optional(),
+    searchBoost: z
+      .number()
+      .finite()
+      .min(CONTENT_TYPE_SEARCH_BOOST_MIN)
+      .max(CONTENT_TYPE_SEARCH_BOOST_MAX)
+      .optional(),
+    temporal: z.boolean().optional(),
+  })
+  .strict();
+
+export const ProjectProfileAffinityDefaultsSchema = z
+  .object({
+    enabled: z.boolean().default(true),
+    contribution: z
+      .number()
+      .finite()
+      .min(0)
+      .max(PROJECT_AFFINITY_MAX_CONTRIBUTION)
+      .default(PROJECT_AFFINITY_MAX_CONTRIBUTION),
+  })
+  .strict();
+
+export const ProjectProfileSchema = z
+  .object({
+    schemaVersion: z.literal(PROJECT_PROFILE_SCHEMA_VERSION),
+    collection: ProjectProfileCollectionSchema,
+    contexts: z
+      .array(ProjectProfileContextSchema)
+      .max(64)
+      .superRefine((values, context) => {
+        const seen = new Set<string>();
+        for (const [index, value] of values.entries()) {
+          const key = JSON.stringify(value);
+          if (seen.has(key)) {
+            context.addIssue({
+              code: "custom",
+              path: [index],
+              message: "Duplicate context declaration",
+            });
+          }
+          seen.add(key);
+        }
+      })
+      .default([]),
+    contentTypes: z
+      .record(
+        z.string().regex(REFERENCE_PATTERN),
+        ProjectProfileContentTypeSchema
+      )
+      .superRefine((rules, context) => {
+        if (Object.keys(rules).length > 64) {
+          context.addIssue({
+            code: "custom",
+            message: "Too many content type rules; maximum is 64",
+          });
+        }
+      })
+      .default({}),
+    affinityDefaults: ProjectProfileAffinityDefaultsSchema.default({
+      enabled: true,
+      contribution: PROJECT_AFFINITY_MAX_CONTRIBUTION,
+    }),
+    recommendedCapabilities: z
+      .array(z.string().regex(CAPABILITY_PATTERN))
+      .max(32)
+      .superRefine((values, context) => {
+        const seen = new Set<string>();
+        for (const [index, value] of values.entries()) {
+          if (seen.has(value)) {
+            context.addIssue({
+              code: "custom",
+              path: [index],
+              message: "Duplicate recommended capability",
+            });
+          }
+          seen.add(value);
+        }
+      })
+      .default([]),
+  })
+  .strict();
+
+export type ProjectProfile = z.infer<typeof ProjectProfileSchema>;
+export type ProjectProfileContentType = z.infer<
+  typeof ProjectProfileContentTypeSchema
+>;

package/src/config/saver.ts

@@ -62,9 +62,18 @@ export async function saveConfigToPath(
     };
   }
 
-  // Convert to YAML
-  const yamlContent = Bun.YAML.stringify(config);
+  return saveTextToPath(Bun.YAML.stringify(config), filePath);
+}
 
+/**
+ * Atomically save deterministic text outside the config schema.
+ * Used for runtime receipts that need the same crash-safe write discipline as
+ * the user config.
+ */
+export async function saveTextToPath(
+  content: string,
+  filePath: string
+): Promise<SaveResult> {
   // Ensure parent directory exists
   const dir = dirname(filePath);
   try {
@@ -88,7 +97,7 @@ export async function saveConfigToPath(
   );
 
   try {
-    await Bun.write(tempPath, yamlContent);
+    await Bun.write(tempPath, content);
   } catch (cause) {
     return {
       ok: false,
@@ -102,10 +111,10 @@ export async function saveConfigToPath(
 
   // Rename temp to target (atomic on POSIX, needs unlink on Windows)
   try {
-    // Windows: rename fails if dest exists, so unlink first (ignore if not exists)
-    await unlink(filePath).catch(() => {
-      /* ENOENT ok */
-    });
+    if (process.platform === "win32") {
+      // Windows rename fails if dest exists, so unlink first (ignore ENOENT).
+      await unlink(filePath).catch(() => undefined);
+    }
     await rename(tempPath, filePath);
   } catch (cause) {
     // Clean up temp file on rename failure

package/src/config/types.ts

@@ -5,6 +5,8 @@
  * @module src/config/types
  */
 
+// node:path provides platform-correct absolute-path validation; Bun has no path utilities.
+import { isAbsolute } from "node:path";
 import { z } from "zod";
 
 import { URI_PREFIX } from "../app/constants";
@@ -123,6 +125,7 @@ export const TrustedProjectRootSourceSchema = z.enum([
   "cli_cwd",
   "cli_explicit",
   "cli_worktree",
+  "project_profile",
 ]);
 export type TrustedProjectRootSource = z.infer<
   typeof TrustedProjectRootSourceSchema
@@ -183,6 +186,26 @@ export const ProjectAffinityConfigSchema = z.object({
 });
 export type ProjectAffinityConfig = z.infer<typeof ProjectAffinityConfigSchema>;
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Local Project Profile Bindings
+// ─────────────────────────────────────────────────────────────────────────────
+
+const SHA256_HEX_REGEX = /^[a-f0-9]{64}$/;
+
+/**
+ * Machine-local provenance for a project profile projected into this config.
+ * Apply canonicalizes `path`; the schema rejects relative paths and malformed
+ * fingerprints without making the tracked profile machine-specific.
+ */
+export const ProjectProfileBindingSchema = z.object({
+  path: z.string().min(1).refine(isAbsolute, {
+    message: "Project profile binding path must be absolute",
+  }),
+  fingerprint: z.string().regex(SHA256_HEX_REGEX),
+  collection: z.string().regex(COLLECTION_NAME_REGEX),
+});
+export type ProjectProfileBinding = z.infer<typeof ProjectProfileBindingSchema>;
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Context Schema
 // ─────────────────────────────────────────────────────────────────────────────
@@ -362,6 +385,10 @@ export const CONTENT_TYPE_GRAPH_HINTS = [
 
 export type ContentTypeGraphHint = (typeof CONTENT_TYPE_GRAPH_HINTS)[number];
 
+export const CONTENT_TYPE_SEARCH_BOOST_MIN = 0.5;
+export const CONTENT_TYPE_SEARCH_BOOST_NEUTRAL = 1;
+export const CONTENT_TYPE_SEARCH_BOOST_MAX = 2;
+
 export const ContentTypeSchema = z.object({
   /** Stable content type identifier */
   id: z.string().min(1),
@@ -371,8 +398,13 @@ export const ContentTypeSchema = z.object({
   preset: z.string().min(1),
   /** Reserved for fn-84 typed graph hints; accepted but no-op in fn-83 */
   graphHints: z.array(z.string().min(1)).optional(),
-  /** Reserved for future ranking; accepted but no-op in fn-83 */
-  searchBoost: z.number().finite().optional(),
+  /** Bounded soft ranking factor; normalized to 1.0 when omitted */
+  searchBoost: z
+    .number()
+    .finite()
+    .min(CONTENT_TYPE_SEARCH_BOOST_MIN)
+    .max(CONTENT_TYPE_SEARCH_BOOST_MAX)
+    .optional(),
   /** Marks time-oriented content types; accepted but no-op in fn-83 */
   temporal: z.boolean().optional(),
 });
@@ -413,6 +445,25 @@ export const ConfigSchema = z.object({
 
   /** Bounded project-aware retrieval affinity. */
   projectAffinity: ProjectAffinityConfigSchema.optional(),
+
+  /** Machine-local, timestamp-free project profile provenance. */
+  projectProfileBindings: z
+    .array(ProjectProfileBindingSchema)
+    .max(256)
+    .superRefine((bindings, ctx) => {
+      const paths = new Set<string>();
+      for (const [index, binding] of bindings.entries()) {
+        if (paths.has(binding.path)) {
+          ctx.addIssue({
+            code: "custom",
+            message: "Project profile binding paths must be unique",
+            path: [index, "path"],
+          });
+        }
+        paths.add(binding.path);
+      }
+    })
+    .optional(),
 });
 
 export type Config = Omit<z.infer<typeof ConfigSchema>, "contentTypes"> & {