@hivecommons/promptargs 0.6.0 → 0.7.0

package/dist/ui.html

@@ -649,9 +649,19 @@
   </div>
 </div>
 
-<script>
+<script type="importmap">
+{ "imports": { "mustache": "./mustache.mjs" } }
+</script>
+<script type="module">
+// Import the canonical {{var}} grammar and iteration logic from the same
+// compiled modules the CLI runs, instead of hand-reimplementing them here
+// (see issue #69). Only splitValues/esc/escHtml stay UI-local: they encode
+// browser-only concerns (no glob/file access, HTML escaping) with no CLI
+// counterpart to drift from.
+import { parseVars, expand as sharedExpand, VAR_PATTERN } from './parser.js';
+import { cartesian as sharedCartesian, zip as sharedZip } from './iterate.js';
+
 (function () {
-  const VAR_RE = /\{\{(\w+)(?:=([^}]*))?\}\}/g;
   const DEBOUNCE_MS = 120;
 
   const PRESETS = [
@@ -726,20 +736,6 @@
   const copyBtn = document.getElementById('copy-btn');
   const modeDesc = document.getElementById('mode-desc');
 
-  function parseVarsFromTemplate(text) {
-    const seen = new Set();
-    const vars = [];
-    let m;
-    VAR_RE.lastIndex = 0;
-    while ((m = VAR_RE.exec(text)) !== null) {
-      if (!seen.has(m[1])) {
-        seen.add(m[1]);
-        vars.push({ name: m[1], defaultValue: m[2] });
-      }
-    }
-    return vars;
-  }
-
   function getRowData() {
     const rows = [];
     for (const tr of varBody.querySelectorAll('tr')) {
@@ -753,7 +749,7 @@
 
   function syncVarsFromTemplate() {
     const text = tmpl.value;
-    const parsed = parseVarsFromTemplate(text);
+    const parsed = parseVars(text);
     const existing = getRowData();
     const existingNames = new Set(existing.map(r => r.name));
 
@@ -814,41 +810,9 @@
     return raw.split(',').map(s => s.trim()).filter(Boolean);
   }
 
-  function cartesian(arrays) {
-    if (arrays.length === 0) return [[]];
-    const first = arrays[0];
-    const rest = cartesian(arrays.slice(1));
-    const out = [];
-    for (const v of first) {
-      for (const r of rest) {
-        out.push([v, ...r]);
-      }
-    }
-    return out;
-  }
-
-  function zip(arrays) {
-    const maxLen = Math.max(...arrays.map(a => a.length), 1);
-    const out = [];
-    for (let i = 0; i < maxLen; i++) {
-      out.push(arrays.map(a => a[Math.min(i, a.length - 1)]));
-    }
-    return out;
-  }
-
-  function expand(template, values) {
-    let result = template;
-    VAR_RE.lastIndex = 0;
-    result = result.replace(VAR_RE, (match, name, def) => {
-      if (name in values) return values[name];
-      if (def !== undefined) return def;
-      return match;
-    });
-    return result;
-  }
-
   function highlightUnfilled(html) {
-    return html.replace(/\{\{(\w+)(?:=[^}]*)?\}\}/g, '<span class="unfilled">$&</span>');
+    VAR_PATTERN.lastIndex = 0;
+    return html.replace(VAR_PATTERN, '<span class="unfilled">$&</span>');
   }
 
   function update() {
@@ -879,16 +843,16 @@
     if (arrayVars.length === 0) {
       combos = [[]];
     } else if (mode === 'cross') {
-      combos = cartesian(arrayVars.map(v => v.values));
+      combos = sharedCartesian(arrayVars.map(v => v.values));
     } else {
-      combos = zip(arrayVars.map(v => v.values));
+      combos = sharedZip(arrayVars.map(v => v.values));
     }
 
     const results = [];
     for (const combo of combos) {
       const vals = { ...scalarValues };
       arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
-      results.push({ values: { ...vals }, expanded: expand(text, vals) });
+      results.push({ values: { ...vals }, expanded: sharedExpand(text, vals) });
     }
 
     const count = results.length;
@@ -908,16 +872,25 @@
     }
     previewBody.innerHTML = html || '<span class="preview-empty">No output</span>';
 
-    // Build CLI command
+    // Build CLI command. Every value must survive a POSIX shell unchanged:
+    // a bare word is left as-is, anything else is single-quoted (the only
+    // quoting under which $, backtick, backslash and whitespace are all
+    // literal). The inlined template stays double-quoted but also escapes
+    // the characters the shell expands inside double quotes.
+    const bareWord = /^[A-Za-z0-9_@%+=:,.\/-]+$/;
+    const shellQuote = s => bareWord.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+    const dquote = s => `"${s.replace(/[\\"$`]/g, '\\$&')}"`;
     let cli = 'promptargs';
     const hasInline = !text.includes('\n') && text.length < 200;
     if (hasInline) {
-      cli += ` "${text.replace(/"/g, '\\"')}"`;
+      cli += ` ${dquote(text)}`;
     }
     for (const row of rows) {
       if (!row.values) continue;
       const prefix = row.source === 'file' ? '@' : '';
-      const val = row.source === 'glob' ? `"${row.values}"` : `${prefix}${row.values}`;
+      // Globs keep their double quotes so the CLI, not the shell, expands them;
+      // the same escaping as the template keeps the pattern itself literal.
+      const val = row.source === 'glob' ? dquote(row.values) : shellQuote(`${prefix}${row.values}`);
       cli += ` --${row.name}=${val}`;
     }
     if (mode === 'cross' && arrayVars.length > 1) {

package/dist/ui.js

@@ -2,7 +2,7 @@ import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { autodetect, AUTODETECT_VARS } from './autodetect.js';
+import { autodetect, isSensitiveEnvName, isSensitiveEnvValue, AUTODETECT_VARS } from './autodetect.js';
 const DEFAULT_PORT = 3700;
 const OPEN_DELAY_MS = 500;
 const DIFF_PREVIEW_MAX_CHARS = 60;
@@ -18,15 +18,15 @@ const SKIP_ENV_EXACT = new Set([
     'TERM_PROGRAM_VERSION', 'TERM_SESSION_ID', 'Apple_PubSub_Socket_Render',
     'MallocNanoZone', 'ORIGINAL_XDG_CURRENT_DESKTOP', 'GIT_ASKPASS',
 ]);
-function shouldSkipEnv(key) {
+export function shouldSkipEnv(key) {
     if (SKIP_ENV_EXACT.has(key))
         return true;
     return SKIP_ENV_PREFIXES.some(p => key.startsWith(p));
 }
-function truncateValue(val, max) {
+export function truncateValue(val, max) {
     return val.length > max ? val.slice(0, max) + '...' : val;
 }
-function collectEnvVars() {
+export function collectEnvVars() {
     const git = {};
     for (const name of AUTODETECT_VARS) {
         const value = autodetect(name);
@@ -38,13 +38,29 @@ function collectEnvVars() {
     }
     const terminal = {};
     for (const [key, val] of Object.entries(process.env)) {
-        if (!val || shouldSkipEnv(key))
+        // Never embed credential-looking names or credential-shaped values in the
+        // served page.
+        if (!val || shouldSkipEnv(key) || isSensitiveEnvName(key) || isSensitiveEnvValue(val))
             continue;
         terminal[key] = truncateValue(val, ENV_VAL_PREVIEW_MAX_CHARS);
     }
     return { git, terminal };
 }
-export function startUI(port = DEFAULT_PORT) {
+export function buildUIHtml(rawHtml, envVars) {
+    // Escape "<" so env values cannot break out of the script tag (e.g. "</script>").
+    const envJson = JSON.stringify(envVars).replace(/</g, '\\u003c');
+    const envScript = `<script>window.__PROMPTARGS_ENV__ = ${envJson};</script>`;
+    return rawHtml.replace('<script>', envScript + '\n<script>');
+}
+// Browser-facing modules the builder UI imports directly instead of
+// hand-reimplementing their logic (see buildUIHtml / ui.html). Serving the
+// exact compiled files means the browser runs the same code the CLI does.
+const STATIC_JS_ROUTES = {
+    '/parser.js': 'parser.js',
+    '/iterate.js': 'iterate.js',
+    '/mustache.mjs': 'mustache.mjs',
+};
+export function startUI(port = DEFAULT_PORT, options = {}) {
     const __dirname = dirname(fileURLToPath(import.meta.url));
     const htmlPath = join(__dirname, 'ui.html');
     let rawHtml;
@@ -55,24 +71,50 @@ export function startUI(port = DEFAULT_PORT) {
         console.error('UI file not found. Reinstall @hivecommons/promptargs.');
         process.exit(1);
     }
-    const envVars = collectEnvVars();
-    const envScript = `<script>window.__PROMPTARGS_ENV__ = ${JSON.stringify(envVars)};</script>`;
-    const html = rawHtml.replace('<script>', envScript + '\n<script>');
-    const server = createServer((_req, res) => {
+    const html = buildUIHtml(rawHtml, collectEnvVars());
+    const ALLOWED_HOSTS = new Set([
+        `localhost:${port}`,
+        `127.0.0.1:${port}`,
+        `[::1]:${port}`,
+    ]);
+    const server = createServer((req, res) => {
+        // Reject non-local Host headers to block DNS-rebinding reads of env data.
+        if (!req.headers.host || !ALLOWED_HOSTS.has(req.headers.host)) {
+            res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+            res.end('Forbidden');
+            return;
+        }
+        const file = req.url ? STATIC_JS_ROUTES[req.url] : undefined;
+        if (file) {
+            try {
+                const js = readFileSync(join(__dirname, file), 'utf-8');
+                res.writeHead(200, { 'Content-Type': 'text/javascript; charset=utf-8' });
+                res.end(js);
+            }
+            catch {
+                res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+                res.end('Not found');
+            }
+            return;
+        }
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(html);
     });
-    server.listen(port, () => {
+    // Bind loopback only: the page embeds environment variables and must never
+    // be reachable from other machines on the network.
+    server.listen(port, '127.0.0.1', () => {
         const url = `http://localhost:${port}`;
         console.log(`promptargs builder running at ${url}`);
         console.log('Press Ctrl+C to stop.\n');
-        setTimeout(() => {
-            import('node:child_process').then(({ exec }) => {
-                const cmd = process.platform === 'darwin' ? 'open' :
-                    process.platform === 'win32' ? 'start' : 'xdg-open';
-                exec(`${cmd} ${url}`);
-            });
-        }, OPEN_DELAY_MS);
+        if (options.openBrowser ?? true) {
+            setTimeout(() => {
+                import('node:child_process').then(({ exec }) => {
+                    const cmd = process.platform === 'darwin' ? 'open' :
+                        process.platform === 'win32' ? 'start' : 'xdg-open';
+                    exec(`${cmd} ${url}`);
+                });
+            }, OPEN_DELAY_MS);
+        }
     });
     server.on('error', (err) => {
         if (err.code === 'EADDRINUSE') {
@@ -81,5 +123,6 @@ export function startUI(port = DEFAULT_PORT) {
         }
         throw err;
     });
+    return server;
 }
 //# sourceMappingURL=ui.js.map

package/dist/ui.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB;IAC3E,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACvE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1E,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B;IACvE,gBAAgB,EAAE,8BAA8B,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAOD,SAAS,cAAc;IACrB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,YAAY;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,uCAAuC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,GAAG,YAAY,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBACxC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;gBAChE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,aAAa,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,yCAAyC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvG,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB;IAC3E,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACvE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1E,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B;IACvE,gBAAgB,EAAE,8BAA8B,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,0EAA0E;QAC1E,eAAe;QACf,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC;YAAE,SAAS;QAChG,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IAC3D,kFAAkF;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,uCAAuC,OAAO,YAAY,CAAC;IAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,GAAG,YAAY,CAAC,CAAC;AAC/D,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,gBAAgB,GAA2B;IAC/C,YAAY,EAAE,WAAW;IACzB,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,YAAY,EAAE,UAA0B,EAAE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,aAAa,IAAI,EAAE;QACnB,aAAa,IAAI,EAAE;QACnB,SAAS,IAAI,EAAE;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,0EAA0E;QAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACpC,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACxC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;oBAChE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;gBACxB,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,yCAAyC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/ui.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ui.test.js

@@ -0,0 +1,283 @@
+import test from 'node:test';
+import assert from 'node:assert';
+import { get } from 'node:http';
+import { createServer as createNetServer } from 'node:net';
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { buildUIHtml, collectEnvVars, shouldSkipEnv, startUI, truncateValue, } from './ui.js';
+test('shouldSkipEnv filters noisy shell and tooling variables', () => {
+    assert.equal(shouldSkipEnv('HOME'), true);
+    assert.equal(shouldSkipEnv('npm_config_cache'), true);
+    assert.equal(shouldSkipEnv('VSCODE_PID'), true);
+    assert.equal(shouldSkipEnv('PROMPTARGS_VISIBLE'), false);
+});
+test('truncateValue shortens long values and leaves short values unchanged', () => {
+    assert.equal(truncateValue('short', 10), 'short');
+    assert.equal(truncateValue('abcdefghijklmnopqrstuvwxyz', 8), 'abcdefgh...');
+});
+test('collectEnvVars includes terminal env values without skipped keys', () => {
+    const savedVisible = process.env['PROMPTARGS_TEST_VISIBLE'];
+    const savedHome = process.env['HOME'];
+    process.env['PROMPTARGS_TEST_VISIBLE'] = 'visible-value';
+    process.env['HOME'] = 'hidden-home';
+    try {
+        const env = collectEnvVars();
+        assert.equal(env.terminal['PROMPTARGS_TEST_VISIBLE'], 'visible-value');
+        assert.equal(env.terminal['HOME'], undefined);
+    }
+    finally {
+        if (savedVisible === undefined)
+            delete process.env['PROMPTARGS_TEST_VISIBLE'];
+        else
+            process.env['PROMPTARGS_TEST_VISIBLE'] = savedVisible;
+        if (savedHome === undefined)
+            delete process.env['HOME'];
+        else
+            process.env['HOME'] = savedHome;
+    }
+});
+test('collectEnvVars omits credential-looking names and credential-shaped values', () => {
+    const keys = ['PROMPTARGS_TEST_SIGNING_KEY', 'PROMPTARGS_TEST_DB_URL', 'PROMPTARGS_TEST_PLAIN'];
+    const saved = Object.fromEntries(keys.map(k => [k, process.env[k]]));
+    process.env['PROMPTARGS_TEST_SIGNING_KEY'] = 'sig';
+    process.env['PROMPTARGS_TEST_DB_URL'] = 'postgres://app:hunter2@db.internal/app';
+    process.env['PROMPTARGS_TEST_PLAIN'] = 'plain';
+    try {
+        const env = collectEnvVars();
+        assert.equal(env.terminal['PROMPTARGS_TEST_SIGNING_KEY'], undefined);
+        assert.equal(env.terminal['PROMPTARGS_TEST_DB_URL'], undefined);
+        assert.equal(env.terminal['PROMPTARGS_TEST_PLAIN'], 'plain');
+    }
+    finally {
+        for (const k of keys) {
+            if (saved[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = saved[k];
+        }
+    }
+});
+test('buildUIHtml escapes env JSON so values cannot escape the script tag', () => {
+    const html = buildUIHtml('<html><head><script></script></head></html>', {
+        git: {},
+        terminal: { PROMPTARGS_TEST: '</script><script>alert(1)</script>' },
+    });
+    assert.match(html, /window\.__PROMPTARGS_ENV__/);
+    assert.doesNotMatch(html, /<\/script><script>alert\(1\)<\/script>/);
+    assert.match(html, /\\u003c\/script>\\u003cscript>alert\(1\)\\u003c\/script>/);
+});
+test('startUI binds a server that rejects non-local Host headers', async () => {
+    const server = startUI(0, { openBrowser: false });
+    await onceListening(server);
+    const { port } = server.address();
+    try {
+        const allowed = await request(port, '127.0.0.1:0');
+        assert.equal(allowed.statusCode, 200);
+        assert.match(allowed.body, /window\.__PROMPTARGS_ENV__/);
+        const forbidden = await request(port, 'evil.example');
+        assert.equal(forbidden.statusCode, 403);
+        assert.equal(forbidden.body, 'Forbidden');
+    }
+    finally {
+        await closeServer(server);
+    }
+});
+test('startUI serves the parser/iterate/mustache modules the browser imports', async () => {
+    const server = startUI(0, { openBrowser: false });
+    await onceListening(server);
+    const { port } = server.address();
+    try {
+        const parser = await request(port, '127.0.0.1:0', '/parser.js');
+        assert.equal(parser.statusCode, 200);
+        assert.match(parser.contentType ?? '', /text\/javascript/);
+        assert.match(parser.body, /export function parseVars/);
+        assert.match(parser.body, /export const VAR_PATTERN/);
+        const iterate = await request(port, '127.0.0.1:0', '/iterate.js');
+        assert.equal(iterate.statusCode, 200);
+        assert.match(iterate.body, /export function cartesian/);
+        assert.match(iterate.body, /export function zip/);
+        const mustache = await request(port, '127.0.0.1:0', '/mustache.mjs');
+        assert.equal(mustache.statusCode, 200);
+        assert.match(mustache.body, /export default mustache/);
+        const missing = await request(port, '127.0.0.1:0', '/does-not-exist.js');
+        assert.equal(missing.statusCode, 200);
+        assert.match(missing.body, /window\.__PROMPTARGS_ENV__/);
+    }
+    finally {
+        await closeServer(server);
+    }
+});
+test('startUI answers 404 for a static route whose backing file is missing', () => {
+    // Copy the compiled ui.js (plus its one local dep) into a directory
+    // without parser.js/iterate.js/mustache.mjs, so requesting a known static
+    // route hits the readFileSync catch branch.
+    const __dirnameUi = dirname(fileURLToPath(import.meta.url));
+    const dir = mkdtempSync(join(tmpdir(), 'promptargs-ui-static-'));
+    try {
+        for (const f of ['ui.js', 'ui.html', 'autodetect.js']) {
+            copyFileSync(join(__dirnameUi, f), join(dir, f));
+        }
+        writeFileSync(join(dir, 'package.json'), '{"type":"module"}');
+        // Intentionally omit parser.js/iterate.js/mustache.mjs so the route 404s.
+        const script = `
+      import { get } from 'node:http';
+      import(${JSON.stringify(pathToFileURL(join(dir, 'ui.js')).href)})
+        .then(m => {
+          const server = m.startUI(0, { openBrowser: false });
+          server.once('listening', () => {
+            const { port } = server.address();
+            get({
+              hostname: '127.0.0.1', port, path: '/parser.js',
+              headers: { Host: '127.0.0.1:0' },
+            }, res => {
+              process.stdout.write('STATUS:' + res.statusCode);
+              server.close(() => process.exit(0));
+            });
+          });
+        });
+    `;
+        const res = spawnSync(process.execPath, ['--input-type=module', '-e', script], {
+            encoding: 'utf-8',
+            timeout: 15000,
+        });
+        assert.match(res.stdout, /STATUS:404/, res.stderr);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+function onceListening(server) {
+    if (server.listening)
+        return Promise.resolve();
+    return new Promise(resolve => server.once('listening', resolve));
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close(err => err ? reject(err) : resolve());
+    });
+}
+function request(port, host, path = '/') {
+    return new Promise((resolve, reject) => {
+        const req = get({
+            hostname: '127.0.0.1',
+            port,
+            path,
+            headers: { Host: host },
+        }, res => {
+            let body = '';
+            res.setEncoding('utf8');
+            res.on('data', chunk => { body += chunk; });
+            res.on('end', () => resolve({
+                statusCode: res.statusCode ?? 0,
+                body,
+                contentType: res.headers['content-type'],
+            }));
+        });
+        req.on('error', reject);
+    });
+}
+// startUI exits the process on fatal errors, so those branches are
+// exercised in a child node process rather than in-process.
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function runStartUI(uiModulePath, port) {
+    const script = `
+    import(${JSON.stringify(pathToFileURL(uiModulePath).href)})
+      .then(m => m.startUI(${port}, { openBrowser: false }));
+  `;
+    const res = spawnSync(process.execPath, ['--input-type=module', '-e', script], {
+        encoding: 'utf-8',
+        timeout: 15000,
+    });
+    return { status: res.status, stderr: res.stderr };
+}
+test('startUI exits 1 with a port hint when the port is in use', async () => {
+    const blocker = createNetServer();
+    await new Promise(resolve => blocker.listen(0, '127.0.0.1', resolve));
+    const { port } = blocker.address();
+    try {
+        const res = runStartUI(join(__dirname, 'ui.js'), port);
+        assert.strictEqual(res.status, 1);
+        assert.match(res.stderr, new RegExp(`Port ${port} is in use`));
+        assert.match(res.stderr, new RegExp(`--port=${port + 1}`));
+    }
+    finally {
+        await new Promise(resolve => blocker.close(resolve));
+    }
+});
+test('startUI exits 1 with a reinstall hint when ui.html is missing', () => {
+    // Copy the compiled module (and its one local dep) somewhere without
+    // ui.html so the readFileSync catch branch runs.
+    const dir = mkdtempSync(join(tmpdir(), 'promptargs-ui-test-'));
+    try {
+        copyFileSync(join(__dirname, 'ui.js'), join(dir, 'ui.js'));
+        copyFileSync(join(__dirname, 'autodetect.js'), join(dir, 'autodetect.js'));
+        // Node 18 has no ESM syntax detection; mark the temp dir as ESM.
+        writeFileSync(join(dir, 'package.json'), '{"type":"module"}');
+        const res = runStartUI(join(dir, 'ui.js'), 0);
+        assert.strictEqual(res.status, 1);
+        assert.match(res.stderr, /UI file not found\. Reinstall @hivecommons\/promptargs\./);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test('startUI schedules a browser open by default', () => {
+    // openBrowser defaults to true; run in a child with an empty PATH so the
+    // platform open command is a harmless shell failure, never a real browser.
+    const script = `
+    import(${JSON.stringify(pathToFileURL(join(__dirname, 'ui.js')).href)})
+      .then(m => {
+        const server = m.startUI(0);
+        setTimeout(() => server.close(() => process.exit(0)), 900);
+      });
+  `;
+    const res = spawnSync(process.execPath, ['--input-type=module', '-e', script], {
+        encoding: 'utf-8',
+        timeout: 15000,
+        env: { ...process.env, PATH: '' },
+    });
+    assert.strictEqual(res.status, 0);
+    assert.match(res.stdout, /promptargs builder running at http:\/\/localhost:\d+/);
+});
+test('browser open picks the right command for each platform', () => {
+    // The darwin/win32 arms of the open-command ternary never run on Linux CI;
+    // force each platform value in a child and let the command fail on PATH=''.
+    for (const platform of ['darwin', 'win32', 'linux']) {
+        const script = `
+      Object.defineProperty(process, 'platform', { value: ${JSON.stringify(platform)} });
+      import(${JSON.stringify(pathToFileURL(join(__dirname, 'ui.js')).href)})
+        .then(m => {
+          const server = m.startUI(0);
+          setTimeout(() => server.close(() => process.exit(0)), 900);
+        });
+    `;
+        const res = spawnSync(process.execPath, ['--input-type=module', '-e', script], {
+            encoding: 'utf-8',
+            timeout: 15000,
+            env: { ...process.env, PATH: '' },
+        });
+        assert.strictEqual(res.status, 0, `platform ${platform}: ${res.stderr}`);
+        assert.match(res.stdout, /promptargs builder running at http:\/\/localhost:\d+/);
+    }
+});
+test('startUI rethrows non-EADDRINUSE server errors', async (t) => {
+    // Only run where binding port 1 really fails with EACCES; containers with
+    // ip_unprivileged_port_start=0 (or root) can bind it and would hang instead.
+    const probeErr = await new Promise(resolve => {
+        const probe = createNetServer();
+        probe.once('error', err => resolve(err));
+        probe.listen(1, '127.0.0.1', () => probe.close(() => resolve(null)));
+    });
+    if (probeErr?.code !== 'EACCES') {
+        t.skip('binding port 1 did not fail with EACCES');
+        return;
+    }
+    const res = runStartUI(join(__dirname, 'ui.js'), 1);
+    assert.notStrictEqual(res.status, 0);
+    assert.match(res.stderr, /EACCES/);
+    assert.doesNotMatch(res.stderr, /is in use/);
+});
+//# sourceMappingURL=ui.test.js.map

package/dist/ui.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.test.js","sourceRoot":"","sources":["../src/ui.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,WAAW,EACX,cAAc,EACd,aAAa,EACb,OAAO,EACP,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,eAAe,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,eAAe,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;;YACzE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,YAAY,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;YACnD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACvC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,IAAI,GAAG,CAAC,6BAA6B,EAAE,wBAAwB,EAAE,uBAAuB,CAAU,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,GAAG,KAAK,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,wCAAwC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,IAAI,GAAG,WAAW,CAAC,6CAA6C,EAAE;QACtE,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,EAAE,eAAe,EAAE,oCAAoC,EAAE;KACpE,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACjD,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,0DAA0D,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,oEAAoE;IACpE,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC9D,0EAA0E;QAE1E,MAAM,MAAM,GAAG;;eAEJ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;;;;;;;;;;;;;KAchE,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;YAC7E,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,MAAkC;IACvD,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,MAAkC;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,GAAG;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC;YACd,QAAQ,EAAE,WAAW;YACrB,IAAI;YACJ,IAAI;YACJ,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACxB,EAAE,GAAG,CAAC,EAAE;YACP,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC;gBAC1B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC/B,IAAI;gBACJ,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;aACzC,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,4DAA4D;AAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU,CAAC,YAAoB,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG;aACJ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;6BAChC,IAAI;GAC9B,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;QAC7E,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,EAAiB,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;QAC3E,iEAAiE;QACjE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,MAAM,GAAG;aACJ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;;;;GAKtE,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;QAC7E,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;KAClC,CAAC,CAAC;IACH,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;AACnF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,2EAA2E;IAC3E,4EAA4E;IAC5E,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG;4DACyC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;eACrE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;;;;KAKtE,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;YAC7E,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;IACnF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC9D,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAA+B,OAAO,CAAC,EAAE;QACzE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAA4B,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivecommons/promptargs",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Template arguments for AI prompts — variable substitution for Claude Code, Copilot, and more",
   "type": "module",
   "main": "dist/index.js",
@@ -8,9 +8,10 @@
     "promptargs": "dist/cli.js"
   },
   "scripts": {
-    "build": "tsc && cp src/ui.html dist/ui.html",
+    "build": "tsc && cp src/ui.html dist/ui.html && cp node_modules/mustache/mustache.mjs dist/mustache.mjs",
     "dev": "tsc --watch",
-    "test": "node --test dist/**/*.test.js",
+    "test": "node scripts/run-tests.mjs",
+    "test:coverage": "node scripts/run-tests.mjs --coverage",
     "lint": "tsc --noEmit"
   },
   "keywords": [