@hasna/instructions 0.5.6 → 0.6.1

package/dist/chunks/package-manager-guard-x70xrwk2.js

@@ -0,0 +1,391 @@
+// @bun
+import"./index-bsan4c16.js";
+
+// src/lib/package-manager-guard.ts
+import { execFileSync } from "child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "path";
+var SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".cache"
+]);
+var LOCKFILE_NAMES = new Set([
+  "bun.lock",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+]);
+var HOME_FILES = [
+  ".npmrc",
+  ".bunfig.toml",
+  "bunfig.toml",
+  ".bashrc",
+  ".bash_profile",
+  ".zshrc",
+  ".zprofile",
+  ".profile"
+];
+var TOKEN_VALUE_PATTERNS = [
+  { re: /npm_[A-Za-z0-9]{36,}/, rule: "literal-npm-token", detail: "literal npm token-like value" },
+  { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, rule: "literal-github-token", detail: "literal GitHub token-like value" },
+  { re: /sk[-]ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" },
+  { re: /sk-[A-Za-z0-9]{48,}/, rule: "literal-openai-key", detail: "literal OpenAI key-like value" },
+  { re: /AKIA[0-9A-Z]{16}/, rule: "literal-aws-access-key", detail: "literal AWS access-key-like value" },
+  { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }
+];
+function scanPackageManagerSecrets(options = {}) {
+  const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve(cwd, root));
+  const findings = [];
+  let scannedFiles = 0;
+  for (const root of roots) {
+    if (!existsSync(root))
+      continue;
+    const stat = lstatSync(root);
+    if (stat.isFile()) {
+      if (!shouldScanRepoFile(root))
+        continue;
+      const text = readTextFile(root);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname(root)));
+      continue;
+    }
+    if (!stat.isDirectory())
+      continue;
+    const tracked = trackedFiles(root);
+    for (const file of collectRepoFiles(root)) {
+      const rel = toPosix(relative(root, file));
+      const isTracked = tracked.has(rel);
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyRepoFile(file), isTracked, root));
+    }
+  }
+  if (options.includeHome) {
+    const home = homedir();
+    for (const name of HOME_FILES) {
+      const file = join(home, name);
+      if (!existsSync(file))
+        continue;
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyHomeFile(name), false, home));
+    }
+  }
+  findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.rule.localeCompare(b.rule));
+  return {
+    clean: findings.length === 0,
+    scannedFiles,
+    scannedRoots: roots,
+    findings
+  };
+}
+function collectRepoFiles(root) {
+  const out = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name))
+          continue;
+        visit(join(dir, entry.name));
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      const file = join(dir, entry.name);
+      if (shouldScanRepoFile(file))
+        out.push(file);
+    }
+  };
+  visit(root);
+  return out;
+}
+function shouldScanRepoFile(file) {
+  const name = basename(file);
+  return isNpmrcName(name) || isBunConfigName(name) || LOCKFILE_NAMES.has(name);
+}
+function classifyRepoFile(file) {
+  const name = basename(file);
+  if (isNpmrcName(name))
+    return "repo-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "lockfile";
+}
+function classifyHomeFile(name) {
+  if (name === ".npmrc")
+    return "home-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "shell-profile";
+}
+function isBunConfigName(name) {
+  return name === "bunfig.toml" || name === ".bunfig.toml";
+}
+function isNpmrcName(name) {
+  return name === ".npmrc" || name.startsWith(".npmrc.") || name.endsWith(".npmrc");
+}
+function readTextFile(file) {
+  try {
+    const stat = lstatSync(file);
+    if (!stat.isFile() || stat.size > 5000000)
+      return null;
+    const buf = readFileSync(file);
+    if (buf.includes(0))
+      return null;
+    return buf.toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+function scanFile(file, text, surface, tracked, root) {
+  const findings = [];
+  const path = displayPath(file, root);
+  if (surface === "bun-config")
+    return scanBunConfigFile(text, path, tracked);
+  const lines = text.split(/\r?\n/);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    if (surface === "repo-npmrc" || surface === "home-npmrc") {
+      findings.push(...scanNpmrcLine(line, path, lineNo, surface, tracked));
+    } else if (surface === "shell-profile") {
+      findings.push(...scanShellProfileLine(line, path, lineNo, tracked));
+    } else {
+      findings.push(...scanLockfileLine(line, path, lineNo, tracked));
+    }
+  }
+  return findings;
+}
+function scanNpmrcLine(lineText, path, line, surface, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#") || stripped.startsWith(";"))
+    return findings;
+  const auth = stripped.match(/(?:^|:)(_[A-Za-z]*(?:auth|password)[A-Za-z]*|password)\s*=\s*(.+)$/i);
+  if (auth) {
+    const value = stripQuotes(stripInlineComment(auth[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "npmrc-literal-auth",
+        surface,
+        severity: "error",
+        tracked,
+        detail: tracked ? "tracked npm auth entry uses a literal value" : "npm auth entry uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanCredentialedUrl(stripped, path, line, surface, tracked));
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, surface, tracked));
+  return findings;
+}
+function scanBunConfigFile(text, path, tracked) {
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  let inReleaseAgeExcludes = false;
+  let hasMinimumReleaseAge = false;
+  for (let i = 0;i < lines.length; i++) {
+    const lineText = lines[i];
+    const line = i + 1;
+    const stripped = lineText.trim();
+    if (stripped === "" || stripped.startsWith("#"))
+      continue;
+    const releaseAge = stripped.match(/^minimumReleaseAge\s*=\s*(?:"([^"]+)"|'([^']+)'|([0-9]+))\s*(?:#.*)?$/i);
+    if (releaseAge) {
+      hasMinimumReleaseAge = true;
+      const rawValue = releaseAge[1] ?? releaseAge[2] ?? releaseAge[3] ?? "";
+      const value = Number(rawValue);
+      if (!Number.isFinite(value) || value <= 0) {
+        findings.push({
+          path,
+          line,
+          rule: "bun-release-age-disabled",
+          surface: "bun-config",
+          severity: "error",
+          tracked,
+          detail: "Bun release-age quarantine is disabled"
+        });
+      }
+    }
+    const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped);
+    const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes;
+    if (scanExcludes) {
+      const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
+      for (const item of quoted) {
+        if (!isExactHasnaPackageName(item)) {
+          findings.push({
+            path,
+            line,
+            rule: "bun-release-age-broad-exclude",
+            surface: "bun-config",
+            severity: "error",
+            tracked,
+            detail: "Bun release-age exclude must be an exact @hasna package name"
+          });
+        }
+      }
+    }
+    inReleaseAgeExcludes = startsReleaseAgeExcludes ? stripped.includes("[") && !stripped.includes("]") : inReleaseAgeExcludes && !stripped.includes("]");
+    findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked));
+  }
+  if (!hasMinimumReleaseAge) {
+    findings.push({
+      path,
+      line: 1,
+      rule: "bun-release-age-missing",
+      surface: "bun-config",
+      severity: "error",
+      tracked,
+      detail: "Bun release-age quarantine must be configured with a positive minimumReleaseAge"
+    });
+  }
+  return findings;
+}
+function scanShellProfileLine(lineText, path, line, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#"))
+    return findings;
+  const assignment = stripped.match(/^(?:export\s+)?(NPM(?:_CONFIG)?_[A-Z0-9_]*TOKEN|NODE_AUTH_TOKEN|NPM_TOKEN)\s*=\s*(.+)$/);
+  if (assignment) {
+    const value = stripQuotes(stripInlineComment(assignment[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "shell-literal-package-token",
+        surface: "shell-profile",
+        severity: "error",
+        tracked,
+        detail: "shell profile package-manager token uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, "shell-profile", tracked));
+  return findings;
+}
+function scanLockfileLine(lineText, path, line, tracked) {
+  const findings = scanKnownTokenPatterns(lineText, path, line, "lockfile", tracked);
+  if (/(?:^|:)_authToken\s*=\s*/i.test(lineText) && !/\$\{[A-Z0-9_]+\}|\{\{[A-Z0-9_]+\}\}/.test(lineText)) {
+    findings.push({
+      path,
+      line,
+      rule: "lockfile-auth-token",
+      surface: "lockfile",
+      severity: "error",
+      tracked,
+      detail: "lockfile contains package-manager auth token material"
+    });
+  }
+  return findings;
+}
+function scanKnownTokenPatterns(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const pattern of TOKEN_VALUE_PATTERNS) {
+    if (pattern.re.test(lineText)) {
+      findings.push({
+        path,
+        line,
+        rule: pattern.rule,
+        surface,
+        severity: "error",
+        tracked,
+        detail: pattern.detail
+      });
+    }
+  }
+  return findings;
+}
+function scanCredentialedUrl(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const match of lineText.matchAll(/\bhttps?:\/\/([^/\s#;]+)@/gi)) {
+    const userInfo = match[1];
+    const credentialPart = userInfo.includes(":") ? userInfo.split(":").slice(1).join(":") : userInfo;
+    if (credentialPart && !isSafeReference(credentialPart)) {
+      findings.push({
+        path,
+        line,
+        rule: "package-manager-url-credentials",
+        surface,
+        severity: "error",
+        tracked,
+        detail: "package-manager URL embeds literal credentials"
+      });
+    }
+  }
+  return findings;
+}
+function trackedFiles(root) {
+  try {
+    const output = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return new Set(output.split("\x00").filter(Boolean).map(toPosix));
+  } catch {
+    return new Set;
+  }
+}
+function isTrackedFile(file) {
+  try {
+    const repoRoot = execFileSync("git", ["-C", dirname(file), "rev-parse", "--show-toplevel"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const rel = toPosix(relative(repoRoot, file));
+    execFileSync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isExactHasnaPackageName(item) {
+  return /^@hasna\/[a-z0-9][a-z0-9._-]*$/.test(item);
+}
+function isSafeReference(value) {
+  const trimmed = stripQuotes(value.trim());
+  return /^\$\{[A-Z][A-Z0-9_]*\}$/.test(trimmed) || /^\$[A-Z][A-Z0-9_]*$/.test(trimmed) || /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(trimmed) || /^%[A-Z][A-Z0-9_]*%$/.test(trimmed);
+}
+function stripQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function stripInlineComment(value) {
+  return value.replace(/\s[#;].*$/, "").trim();
+}
+function displayPath(file, root) {
+  const home = homedir();
+  if (root === home && (file === home || file.startsWith(home + "/")))
+    return "~/" + toPosix(relative(home, file));
+  if (isAbsolute(root) && file.startsWith(root + "/"))
+    return toPosix(relative(root, file));
+  if (file === home || file.startsWith(home + "/"))
+    return "~/" + toPosix(relative(home, file));
+  return file;
+}
+function toPosix(path) {
+  return path.split("\\").join("/");
+}
+export {
+  scanPackageManagerSecrets
+};

package/dist/chunks/redact-hnq4sc4r.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  hasSecrets,
+  isSecretVarName,
+  redactContent,
+  redactFormatForTarget,
+  scanSecrets
+} from "./index-35z65jsa.js";
+import"./index-nnwp92tk.js";
+export {
+  scanSecrets,
+  redactFormatForTarget,
+  redactContent,
+  isSecretVarName,
+  hasSecrets
+};

package/dist/chunks/sync-m46fc257.js

@@ -0,0 +1,33 @@
+// @bun
+import {
+  CLAUDE_PROMPT_OUTPUTS,
+  KNOWN_CONFIGS,
+  PROJECT_CONFIG_FILES,
+  detectAgent,
+  detectCategory,
+  detectFormat,
+  diffConfig,
+  syncFromDir,
+  syncKnown,
+  syncProject,
+  syncToDir,
+  syncToDisk
+} from "./index-85n5wnd8.js";
+import"./index-e9epbsvs.js";
+import"./index-1hpwskwd.js";
+import"./index-pkscjnj5.js";
+import"./index-bsan4c16.js";
+export {
+  syncToDisk,
+  syncToDir,
+  syncProject,
+  syncKnown,
+  syncFromDir,
+  diffConfig,
+  detectFormat,
+  detectCategory,
+  detectAgent,
+  PROJECT_CONFIG_FILES,
+  KNOWN_CONFIGS,
+  CLAUDE_PROMPT_OUTPUTS
+};

package/dist/chunks/sync-vy1yjvs6.js

@@ -0,0 +1,34 @@
+// @bun
+import {
+  CLAUDE_PROMPT_OUTPUTS,
+  KNOWN_CONFIGS,
+  PROJECT_CONFIG_FILES,
+  detectAgent,
+  detectCategory,
+  detectFormat,
+  diffConfig,
+  syncFromDir,
+  syncKnown,
+  syncProject,
+  syncToDir,
+  syncToDisk
+} from "./index-9p9gn7gh.js";
+import"./index-axhwg61p.js";
+import"./index-v7dkb384.js";
+import"./index-35z65jsa.js";
+import"./index-pkscjnj5.js";
+import"./index-nnwp92tk.js";
+export {
+  syncToDisk,
+  syncToDir,
+  syncProject,
+  syncKnown,
+  syncFromDir,
+  diffConfig,
+  detectFormat,
+  detectCategory,
+  detectAgent,
+  PROJECT_CONFIG_FILES,
+  KNOWN_CONFIGS,
+  CLAUDE_PROMPT_OUTPUTS
+};

package/dist/chunks/template-02wjvv05.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  extractTemplateVars,
+  isTemplate,
+  parseTemplateVars,
+  renderTemplate,
+  renderTemplatePreview
+} from "./index-pkscjnj5.js";
+import"./index-nnwp92tk.js";
+export {
+  renderTemplatePreview,
+  renderTemplate,
+  parseTemplateVars,
+  isTemplate,
+  extractTemplateVars
+};

package/dist/chunks/template-ke972qqe.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  extractTemplateVars,
+  isTemplate,
+  parseTemplateVars,
+  renderTemplate,
+  renderTemplatePreview
+} from "./index-pkscjnj5.js";
+import"./index-bsan4c16.js";
+export {
+  renderTemplatePreview,
+  renderTemplate,
+  parseTemplateVars,
+  isTemplate,
+  extractTemplateVars
+};