@hivecommons/promptargs 0.6.0 → 0.8.0

package/dist/ui.html

@@ -649,9 +649,19 @@
   </div>
 </div>
 
-<script>
+<script type="importmap">
+{ "imports": { "mustache": "./mustache.mjs" } }
+</script>
+<script type="module">
+// Import the canonical {{var}} grammar and iteration logic from the same
+// compiled modules the CLI runs, instead of hand-reimplementing them here
+// (see issue #69). Only splitValues/esc/escHtml stay UI-local: they encode
+// browser-only concerns (no glob/file access, HTML escaping) with no CLI
+// counterpart to drift from.
+import { parseVars, expand as sharedExpand, VAR_PATTERN } from './parser.js';
+import { cartesian as sharedCartesian, zip as sharedZip } from './iterate.js';
+
 (function () {
-  const VAR_RE = /\{\{(\w+)(?:=([^}]*))?\}\}/g;
   const DEBOUNCE_MS = 120;
 
   const PRESETS = [
@@ -726,20 +736,6 @@
   const copyBtn = document.getElementById('copy-btn');
   const modeDesc = document.getElementById('mode-desc');
 
-  function parseVarsFromTemplate(text) {
-    const seen = new Set();
-    const vars = [];
-    let m;
-    VAR_RE.lastIndex = 0;
-    while ((m = VAR_RE.exec(text)) !== null) {
-      if (!seen.has(m[1])) {
-        seen.add(m[1]);
-        vars.push({ name: m[1], defaultValue: m[2] });
-      }
-    }
-    return vars;
-  }
-
   function getRowData() {
     const rows = [];
     for (const tr of varBody.querySelectorAll('tr')) {
@@ -753,7 +749,12 @@
 
   function syncVarsFromTemplate() {
     const text = tmpl.value;
-    const parsed = parseVarsFromTemplate(text);
+    let parsed;
+    try {
+      parsed = parseVars(text);
+    } catch {
+      return; // update() reports the parse error in the preview
+    }
     const existing = getRowData();
     const existingNames = new Set(existing.map(r => r.name));
 
@@ -814,41 +815,9 @@
     return raw.split(',').map(s => s.trim()).filter(Boolean);
   }
 
-  function cartesian(arrays) {
-    if (arrays.length === 0) return [[]];
-    const first = arrays[0];
-    const rest = cartesian(arrays.slice(1));
-    const out = [];
-    for (const v of first) {
-      for (const r of rest) {
-        out.push([v, ...r]);
-      }
-    }
-    return out;
-  }
-
-  function zip(arrays) {
-    const maxLen = Math.max(...arrays.map(a => a.length), 1);
-    const out = [];
-    for (let i = 0; i < maxLen; i++) {
-      out.push(arrays.map(a => a[Math.min(i, a.length - 1)]));
-    }
-    return out;
-  }
-
-  function expand(template, values) {
-    let result = template;
-    VAR_RE.lastIndex = 0;
-    result = result.replace(VAR_RE, (match, name, def) => {
-      if (name in values) return values[name];
-      if (def !== undefined) return def;
-      return match;
-    });
-    return result;
-  }
-
   function highlightUnfilled(html) {
-    return html.replace(/\{\{(\w+)(?:=[^}]*)?\}\}/g, '<span class="unfilled">$&</span>');
+    VAR_PATTERN.lastIndex = 0;
+    return html.replace(VAR_PATTERN, '<span class="unfilled">$&</span>');
   }
 
   function update() {
@@ -879,16 +848,24 @@
     if (arrayVars.length === 0) {
       combos = [[]];
     } else if (mode === 'cross') {
-      combos = cartesian(arrayVars.map(v => v.values));
+      combos = sharedCartesian(arrayVars.map(v => v.values));
     } else {
-      combos = zip(arrayVars.map(v => v.values));
+      combos = sharedZip(arrayVars.map(v => v.values));
     }
 
     const results = [];
-    for (const combo of combos) {
-      const vals = { ...scalarValues };
-      arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
-      results.push({ values: { ...vals }, expanded: expand(text, vals) });
+    try {
+      for (const combo of combos) {
+        const vals = { ...scalarValues };
+        arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
+        results.push({ values: { ...vals }, expanded: sharedExpand(text, vals) });
+      }
+    } catch (err) {
+      previewBody.innerHTML = `<span class="preview-empty">${escHtml(err instanceof Error ? err.message : String(err))}</span>`;
+      previewCount.textContent = 'error';
+      previewCount.className = 'preview-count empty';
+      cliText.innerHTML = '<span class="dollar">$</span>promptargs';
+      return;
     }
 
     const count = results.length;
@@ -908,16 +885,25 @@
     }
     previewBody.innerHTML = html || '<span class="preview-empty">No output</span>';
 
-    // Build CLI command
+    // Build CLI command. Every value must survive a POSIX shell unchanged:
+    // a bare word is left as-is, anything else is single-quoted (the only
+    // quoting under which $, backtick, backslash and whitespace are all
+    // literal). The inlined template stays double-quoted but also escapes
+    // the characters the shell expands inside double quotes.
+    const bareWord = /^[A-Za-z0-9_@%+=:,.\/-]+$/;
+    const shellQuote = s => bareWord.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+    const dquote = s => `"${s.replace(/[\\"$`]/g, '\\$&')}"`;
     let cli = 'promptargs';
     const hasInline = !text.includes('\n') && text.length < 200;
     if (hasInline) {
-      cli += ` "${text.replace(/"/g, '\\"')}"`;
+      cli += ` ${dquote(text)}`;
     }
     for (const row of rows) {
       if (!row.values) continue;
       const prefix = row.source === 'file' ? '@' : '';
-      const val = row.source === 'glob' ? `"${row.values}"` : `${prefix}${row.values}`;
+      // Globs keep their double quotes so the CLI, not the shell, expands them;
+      // the same escaping as the template keeps the pattern itself literal.
+      const val = row.source === 'glob' ? dquote(row.values) : shellQuote(`${prefix}${row.values}`);
       cli += ` --${row.name}=${val}`;
     }
     if (mode === 'cross' && arrayVars.length > 1) {

package/dist/ui.js

@@ -2,7 +2,8 @@ import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { autodetect, AUTODETECT_VARS } from './autodetect.js';
+import { autodetect, isSensitiveEnvName, isSensitiveEnvValue, AUTODETECT_VARS } from './autodetect.js';
+import { diag, classifyError, jsonLogEnabled, logRequest } from './log.js';
 const DEFAULT_PORT = 3700;
 const OPEN_DELAY_MS = 500;
 const DIFF_PREVIEW_MAX_CHARS = 60;
@@ -18,15 +19,15 @@ const SKIP_ENV_EXACT = new Set([
     'TERM_PROGRAM_VERSION', 'TERM_SESSION_ID', 'Apple_PubSub_Socket_Render',
     'MallocNanoZone', 'ORIGINAL_XDG_CURRENT_DESKTOP', 'GIT_ASKPASS',
 ]);
-function shouldSkipEnv(key) {
+export function shouldSkipEnv(key) {
     if (SKIP_ENV_EXACT.has(key))
         return true;
     return SKIP_ENV_PREFIXES.some(p => key.startsWith(p));
 }
-function truncateValue(val, max) {
+export function truncateValue(val, max) {
     return val.length > max ? val.slice(0, max) + '...' : val;
 }
-function collectEnvVars() {
+export function collectEnvVars() {
     const git = {};
     for (const name of AUTODETECT_VARS) {
         const value = autodetect(name);
@@ -38,13 +39,31 @@ function collectEnvVars() {
     }
     const terminal = {};
     for (const [key, val] of Object.entries(process.env)) {
-        if (!val || shouldSkipEnv(key))
+        // Never embed credential-looking names or credential-shaped values in the
+        // served page.
+        if (!val || shouldSkipEnv(key) || isSensitiveEnvName(key) || isSensitiveEnvValue(val))
             continue;
         terminal[key] = truncateValue(val, ENV_VAL_PREVIEW_MAX_CHARS);
     }
     return { git, terminal };
 }
-export function startUI(port = DEFAULT_PORT) {
+export function buildUIHtml(rawHtml, envVars) {
+    // Escape "<" so env values cannot break out of the script tag (e.g. "</script>").
+    const envJson = JSON.stringify(envVars).replace(/</g, '\\u003c');
+    const envScript = `<script>window.__PROMPTARGS_ENV__ = ${envJson};</script>`;
+    // Function replacer: a replacement *string* would expand `$&`, "$`" and "$'"
+    // found in env values into surrounding raw HTML, undoing the escaping above.
+    return rawHtml.replace(/<script\b/, (match) => `${envScript}\n${match}`);
+}
+// Browser-facing modules the builder UI imports directly instead of
+// hand-reimplementing their logic (see buildUIHtml / ui.html). Serving the
+// exact compiled files means the browser runs the same code the CLI does.
+const STATIC_JS_ROUTES = {
+    '/parser.js': 'parser.js',
+    '/iterate.js': 'iterate.js',
+    '/mustache.mjs': 'mustache.mjs',
+};
+export function startUI(port = DEFAULT_PORT, options = {}) {
     const __dirname = dirname(fileURLToPath(import.meta.url));
     const htmlPath = join(__dirname, 'ui.html');
     let rawHtml;
@@ -52,34 +71,83 @@ export function startUI(port = DEFAULT_PORT) {
         rawHtml = readFileSync(htmlPath, 'utf-8');
     }
     catch {
-        console.error('UI file not found. Reinstall @hivecommons/promptargs.');
+        diag('ui_start_error', { error_class: 'not_found' }, 'UI file not found. Reinstall @hivecommons/promptargs.');
         process.exit(1);
     }
-    const envVars = collectEnvVars();
-    const envScript = `<script>window.__PROMPTARGS_ENV__ = ${JSON.stringify(envVars)};</script>`;
-    const html = rawHtml.replace('<script>', envScript + '\n<script>');
-    const server = createServer((_req, res) => {
+    const html = buildUIHtml(rawHtml, collectEnvVars());
+    // Filled once the server is bound, because port 0 means the OS picks one.
+    const ALLOWED_HOSTS = new Set();
+    let rejectedHosts = 0;
+    const server = createServer((req, res) => {
+        if (jsonLogEnabled()) {
+            const startedAt = process.hrtime.bigint();
+            res.on('finish', () => logRequest(res.statusCode, startedAt));
+        }
+        // Reject non-local Host headers to block DNS-rebinding reads of env data.
+        if (!req.headers.host || !ALLOWED_HOSTS.has(req.headers.host)) {
+            // Never log the Host header or URL: both are attacker-controlled.
+            if (rejectedHosts++ === 0) {
+                diag('ui_host_rejected', { status: 403 }, 'promptargs: rejected request with unexpected Host header (further rejections suppressed)');
+            }
+            res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+            res.end('Forbidden');
+            return;
+        }
+        const file = req.url ? STATIC_JS_ROUTES[req.url] : undefined;
+        if (file) {
+            try {
+                const js = readFileSync(join(__dirname, file), 'utf-8');
+                res.writeHead(200, { 'Content-Type': 'text/javascript; charset=utf-8' });
+                res.end(js);
+            }
+            catch (err) {
+                diag('ui_asset_error', { status: 404, error_class: classifyError(err) }, `promptargs: failed to load static asset ${req.url} (${err.code ?? 'unknown'})`);
+                res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+                res.end('Not found');
+            }
+            return;
+        }
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(html);
     });
-    server.listen(port, () => {
-        const url = `http://localhost:${port}`;
+    // Bind loopback only: the page embeds environment variables and must never
+    // be reachable from other machines on the network.
+    server.listen(port, '127.0.0.1', () => {
+        const boundPort = server.address().port;
+        ALLOWED_HOSTS.add(`localhost:${boundPort}`);
+        ALLOWED_HOSTS.add(`127.0.0.1:${boundPort}`);
+        ALLOWED_HOSTS.add(`[::1]:${boundPort}`);
+        const url = `http://localhost:${boundPort}`;
         console.log(`promptargs builder running at ${url}`);
         console.log('Press Ctrl+C to stop.\n');
-        setTimeout(() => {
-            import('node:child_process').then(({ exec }) => {
-                const cmd = process.platform === 'darwin' ? 'open' :
-                    process.platform === 'win32' ? 'start' : 'xdg-open';
-                exec(`${cmd} ${url}`);
-            });
-        }, OPEN_DELAY_MS);
+        if (options.openBrowser ?? true) {
+            setTimeout(() => {
+                import('node:child_process').then(({ exec }) => {
+                    const cmd = process.platform === 'darwin' ? 'open' :
+                        process.platform === 'win32' ? 'start' : 'xdg-open';
+                    exec(`${cmd} ${url}`, err => {
+                        if (!err)
+                            return;
+                        // Through a shell, a missing opener surfaces as exit status 127 rather than ENOENT.
+                        const why = err.code === 127 ? 'not found' : String(err.code ?? err.message);
+                        diag('ui_browser_open_failed', { error_class: classifyError(err) }, `promptargs: could not open a browser (${cmd}: ${why}); open ${url} manually`);
+                    });
+                });
+            }, OPEN_DELAY_MS);
+        }
+    });
+    server.on('close', () => {
+        if (rejectedHosts > 1) {
+            diag('ui_host_rejected_total', { count: rejectedHosts }, `promptargs: rejected ${rejectedHosts} requests with unexpected Host headers in total`);
+        }
     });
     server.on('error', (err) => {
         if (err.code === 'EADDRINUSE') {
-            console.error(`Port ${port} is in use. Try: promptargs ui --port=${port + 1}`);
+            diag('ui_start_error', { error_class: 'port_in_use' }, `Port ${port} is in use. Try: promptargs ui --port=${port + 1}`);
             process.exit(1);
         }
         throw err;
     });
+    return server;
 }
 //# sourceMappingURL=ui.js.map

package/dist/ui.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB;IAC3E,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACvE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1E,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B;IACvE,gBAAgB,EAAE,8BAA8B,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAOD,SAAS,cAAc;IACrB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,YAAY;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,uCAAuC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,GAAG,YAAY,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBACxC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;gBAChE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,aAAa,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,yCAAyC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3E,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB;IAC3E,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACvE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1E,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B;IACvE,gBAAgB,EAAE,8BAA8B,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,0EAA0E;QAC1E,eAAe;QACf,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC;YAAE,SAAS;QAChG,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IAC3D,kFAAkF;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,uCAAuC,OAAO,YAAY,CAAC;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,gBAAgB,GAA2B;IAC/C,YAAY,EAAE,WAAW;IACzB,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,YAAY,EAAE,UAA0B,EAAE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,uDAAuD,CAAC,CAAC;QAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,cAAc,EAAE,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,kEAAkE;YAClE,IAAI,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,0FAA0F,CAAC,CAAC;YACxI,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EACrE,2CAA2C,GAAG,CAAC,GAAG,KAAM,GAA6B,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;gBAC9G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACpC,MAAM,SAAS,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;QACzD,aAAa,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,oBAAoB,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACxC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;oBAChE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE;wBAC1B,IAAI,CAAC,GAAG;4BAAE,OAAO;wBACjB,oFAAoF;wBACpF,MAAM,GAAG,GAAI,GAAG,CAAC,IAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;wBAC1F,IAAI,CAAC,wBAAwB,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAChE,yCAAyC,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC;oBACnF,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,wBAAwB,aAAa,iDAAiD,CAAC,CAAC;QACnJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,QAAQ,IAAI,yCAAyC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@hivecommons/promptargs",
-  "version": "0.6.0",
-  "description": "Template arguments for AI prompts — variable substitution for Claude Code, Copilot, and more",
+  "version": "0.8.0",
+  "description": "Template arguments for AI prompts — variable substitution for Claude Code, Copilot, Goose, Bob, and more",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
     "promptargs": "dist/cli.js"
   },
   "scripts": {
-    "build": "tsc && cp src/ui.html dist/ui.html",
+    "build": "tsc && cp src/ui.html dist/ui.html && cp node_modules/mustache/mustache.mjs dist/mustache.mjs",
     "dev": "tsc --watch",
-    "test": "node --test dist/**/*.test.js",
+    "test": "node scripts/run-tests.mjs",
+    "test:coverage": "node scripts/run-tests.mjs --coverage",
     "lint": "tsc --noEmit"
   },
   "keywords": [
@@ -20,7 +21,12 @@
     "claude",
     "copilot",
     "args",
-    "cli"
+    "cli",
+    "claude-code",
+    "goose",
+    "bob",
+    "agent-skills",
+    "prompt-templates"
   ],
   "author": "hivecommons",
   "license": "Apache-2.0",
@@ -33,10 +39,14 @@
   },
   "homepage": "https://github.com/hivecommons/promptargs#readme",
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "files": [
     "dist",
+    "!dist/**/*.test.js",
+    "!dist/**/*.test.js.map",
+    "!dist/**/*.test.d.ts",
+    "!dist/ui-harness.*",
     "README.md",
     "LICENSE"
   ],

package/dist/parser.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/parser.test.js

@@ -1,56 +0,0 @@
-import { describe, it } from 'node:test';
-import assert from 'node:assert';
-import { parseVars, expand } from './parser.js';
-describe('parseVars', () => {
-    it('finds simple variables', () => {
-        const vars = parseVars('Hello {{name}}, welcome to {{place}}');
-        assert.strictEqual(vars.length, 2);
-        assert.strictEqual(vars[0].name, 'name');
-        assert.strictEqual(vars[1].name, 'place');
-    });
-    it('finds variables with defaults', () => {
-        const vars = parseVars('Be {{tone=concise}} please');
-        assert.strictEqual(vars.length, 1);
-        assert.strictEqual(vars[0].name, 'tone');
-        assert.strictEqual(vars[0].defaultValue, 'concise');
-    });
-    it('deduplicates variables', () => {
-        const vars = parseVars('{{name}} said hi to {{name}}');
-        assert.strictEqual(vars.length, 1);
-    });
-    it('returns empty for no variables', () => {
-        const vars = parseVars('No variables here');
-        assert.strictEqual(vars.length, 0);
-    });
-});
-describe('expand', () => {
-    it('substitutes values', () => {
-        const result = expand('Hello {{name}}!', { name: 'World' });
-        assert.strictEqual(result, 'Hello World!');
-    });
-    it('uses defaults when no value provided', () => {
-        const result = expand('Be {{tone=concise}}', {});
-        assert.strictEqual(result, 'Be concise');
-    });
-    it('overrides defaults with provided values', () => {
-        const result = expand('Be {{tone=concise}}', { tone: 'verbose' });
-        assert.strictEqual(result, 'Be verbose');
-    });
-    it('leaves unfilled vars as-is', () => {
-        const result = expand('Hello {{name}}', {});
-        assert.strictEqual(result, 'Hello {{name}}');
-    });
-    it('handles multiple vars', () => {
-        const result = expand('Review {{file}} for {{focus=correctness}}. Be {{tone=concise}}.', { file: 'main.go' });
-        assert.strictEqual(result, 'Review main.go for correctness. Be concise.');
-    });
-    it('handles arrays in comma-separated values', () => {
-        const result = expand('Check {{file}}', { file: 'a.go' });
-        assert.strictEqual(result, 'Check a.go');
-    });
-    it('does not HTML-escape values', () => {
-        const result = expand('{{code}}', { code: '<div class="test">' });
-        assert.strictEqual(result, '<div class="test">');
-    });
-});
-//# sourceMappingURL=parser.test.js.map

package/dist/parser.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"parser.test.js","sourceRoot":"","sources":["../src/parser.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEhD,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC/D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACvD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,MAAM,CACnB,iEAAiE,EACjE,EAAE,IAAI,EAAE,SAAS,EAAE,CACpB,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}