@hongmaple0820/scale-engine 0.25.0 → 0.27.0

package/dist/tools/SafeCommandRunner.js

@@ -0,0 +1,83 @@
+import { execa } from 'execa';
+const SHELL_META = new Set(['|', '&', ';', '<', '>', '`', '$', '(', ')']);
+export function parseCommandLine(command) {
+    const tokens = [];
+    let current = '';
+    let quote = null;
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index];
+        if (quote) {
+            if (char === quote) {
+                quote = null;
+            }
+            else if (quote === '"' && char === '\\' && index + 1 < command.length) {
+                index += 1;
+                current += command[index];
+            }
+            else {
+                current += char;
+            }
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (current) {
+                tokens.push(current);
+                current = '';
+            }
+            continue;
+        }
+        if (char === '\\' && index + 1 < command.length) {
+            index += 1;
+            current += command[index];
+            continue;
+        }
+        if (SHELL_META.has(char)) {
+            throw new Error(`Shell metacharacter "${char}" is not allowed in verification commands. Use package scripts or set SCALE_ALLOW_SHELL_COMMANDS=1 for a trusted local run.`);
+        }
+        current += char;
+    }
+    if (quote)
+        throw new Error('Unterminated quote in command');
+    if (current)
+        tokens.push(current);
+    if (tokens.length === 0)
+        throw new Error('Command is empty');
+    return { file: tokens[0], args: tokens.slice(1) };
+}
+export async function runSafeCommand(command, options = {}) {
+    const allowShell = options.allowShell || process.env.SCALE_ALLOW_SHELL_COMMANDS === '1';
+    const execaOptions = {
+        cwd: options.cwd,
+        timeout: options.timeout,
+        reject: false,
+    };
+    const result = allowShell
+        ? await execa(command, { ...execaOptions, shell: true })
+        : await runWithoutShell(command, execaOptions);
+    return {
+        exitCode: result.exitCode ?? 1,
+        stdout: commandOutputToString(result.stdout),
+        stderr: commandOutputToString(result.stderr),
+    };
+}
+function commandOutputToString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value === undefined || value === null)
+        return '';
+    if (value instanceof Uint8Array)
+        return new TextDecoder().decode(value);
+    return String(value);
+}
+async function runWithoutShell(command, options) {
+    const parsed = parseCommandLine(command);
+    return execa(parsed.file, parsed.args, {
+        ...options,
+        shell: false,
+    });
+}
+//# sourceMappingURL=SafeCommandRunner.js.map

package/dist/tools/SafeCommandRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SafeCommandRunner.js","sourceRoot":"","sources":["../../src/tools/SafeCommandRunner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAgB,MAAM,OAAO,CAAA;AAE3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAmBzE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAqB,IAAI,CAAA;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAE3B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;iBAAM,IAAI,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBACxE,KAAK,IAAI,CAAC,CAAA;gBACV,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,IAAI,CAAA;YACjB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,GAAG,IAAI,CAAA;YACZ,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,GAAG,EAAE,CAAA;YACd,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,CAAA;YACV,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAA;YACzB,SAAQ;QACV,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,6HAA6H,CAAC,CAAA;QAC5K,CAAC;QAED,OAAO,IAAI,IAAI,CAAA;IACjB,CAAC;IAED,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC3D,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAE5D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,UAA8B,EAAE;IACpF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG,CAAA;IACvF,MAAM,YAAY,GAAY;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,KAAK;KACd,CAAA;IAED,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxD,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAEhD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;QAC9B,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IACpD,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACvE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,OAAgB;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QACrC,GAAG,OAAO;QACV,KAAK,EAAE,KAAK;KACb,CAAC,CAAA;AACJ,CAAC"}

package/dist/workflow/EngineeringStandards.js

@@ -644,21 +644,21 @@ function standardsSettlementMarkdown(taskId, doctor) {
     const findings = doctor.findings.length
         ? doctor.findings.map(finding => `| ${finding.severity.toUpperCase()} | ${finding.ruleId} | ${escapeCell(finding.path)} | ${finding.line ?? ''} | ${escapeCell(finding.message)} |`).join('\n')
         : '| OK | no-findings |  |  | No engineering standards findings. |';
-    return `
-## SCALE Engineering Standards Settlement - ${new Date().toISOString()}
-
-Task: ${taskId ?? 'unspecified'}
-Status: ${doctor.ok ? 'passed' : 'blocked'}
-
-| Metric | Value |
-| --- | ---: |
-| Files scanned | ${doctor.scan.summary.filesScanned} |
-| Total findings | ${doctor.scan.summary.totalFindings} |
-| Blocking findings | ${doctor.scan.summary.blockingFindings} |
-
-| Severity | Rule | Path | Line | Message |
-| --- | --- | --- | ---: | --- |
-${findings}
+    return `
+## SCALE Engineering Standards Settlement - ${new Date().toISOString()}
+
+Task: ${taskId ?? 'unspecified'}
+Status: ${doctor.ok ? 'passed' : 'blocked'}
+
+| Metric | Value |
+| --- | ---: |
+| Files scanned | ${doctor.scan.summary.filesScanned} |
+| Total findings | ${doctor.scan.summary.totalFindings} |
+| Blocking findings | ${doctor.scan.summary.blockingFindings} |
+
+| Severity | Rule | Path | Line | Message |
+| --- | --- | --- | ---: | --- |
+${findings}
 `;
 }
 function baselineEntriesFromFindings(findings, reason) {
@@ -762,53 +762,53 @@ function legacyDebtMarkdown(options) {
     const truncated = options.findings.length > detailLimit
         ? `\n\nDetail rows truncated to ${detailLimit} of ${options.findings.length}. The baseline file contains the complete machine-readable list.\n`
         : '';
-    return `# SCALE Engineering Standards Legacy Debt Classification
-
-Generated: ${new Date().toISOString()}
-Task: ${options.taskId ?? 'unspecified'}
-Baseline written: ${options.wroteBaseline ? 'yes' : 'no'}
-Baseline path: ${options.baselinePath}
-Baseline entries: ${options.baselineEntries.length}
-
-## Summary
-
-| Metric | Value |
-| --- | ---: |
-| Files scanned | ${options.debt.filesScanned} |
-| Total findings | ${options.debt.totalFindings} |
-| Blocking findings | ${options.debt.blockingFindings} |
-| Warnings | ${options.debt.bySeverity.warn} |
-| Info | ${options.debt.bySeverity.info} |
-
-## By Category
-
-| Category | Total | Blocking | Warn | Info |
-| --- | ---: | ---: | ---: | ---: |
-${categories}
-
-## By Scope
-
-| Scope | Total | Blocking | Warn | Info |
-| --- | ---: | ---: | ---: | ---: |
-${scopes}
-
-## By Rule
-
-| Rule | Category | Total | Blocking | Warn | Info |
-| --- | --- | ---: | ---: | ---: | ---: |
-${rules}
-
-## Top Files
-
-| Path | Total | Blocking | Warn | Info |
-| --- | ---: | ---: | ---: | ---: |
-${files}
-
-## Finding Details
-
-| Severity | Category | Rule | Path | Line | Message |
-| --- | --- | --- | --- | ---: | --- |
-${details}${truncated}
+    return `# SCALE Engineering Standards Legacy Debt Classification
+
+Generated: ${new Date().toISOString()}
+Task: ${options.taskId ?? 'unspecified'}
+Baseline written: ${options.wroteBaseline ? 'yes' : 'no'}
+Baseline path: ${options.baselinePath}
+Baseline entries: ${options.baselineEntries.length}
+
+## Summary
+
+| Metric | Value |
+| --- | ---: |
+| Files scanned | ${options.debt.filesScanned} |
+| Total findings | ${options.debt.totalFindings} |
+| Blocking findings | ${options.debt.blockingFindings} |
+| Warnings | ${options.debt.bySeverity.warn} |
+| Info | ${options.debt.bySeverity.info} |
+
+## By Category
+
+| Category | Total | Blocking | Warn | Info |
+| --- | ---: | ---: | ---: | ---: |
+${categories}
+
+## By Scope
+
+| Scope | Total | Blocking | Warn | Info |
+| --- | ---: | ---: | ---: | ---: |
+${scopes}
+
+## By Rule
+
+| Rule | Category | Total | Blocking | Warn | Info |
+| --- | --- | ---: | ---: | ---: | ---: |
+${rules}
+
+## Top Files
+
+| Path | Total | Blocking | Warn | Info |
+| --- | ---: | ---: | ---: | ---: |
+${files}
+
+## Finding Details
+
+| Severity | Category | Rule | Path | Line | Message |
+| --- | --- | --- | --- | ---: | --- |
+${details}${truncated}
 `;
 }
 function summarizeStandards(filesScanned, findings) {

package/dist/workflow/GovernanceTemplatePacks.d.ts

@@ -1,6 +1,6 @@
 import type { GovernanceMode } from './GovernanceTemplates.js';
 import type { VerificationService } from './VerificationProfile.js';
-export type GovernancePackId = 'standard' | 'project-scaffold' | 'moe-workspace' | 'resource-governance' | 'go-service-matrix' | 'node-library' | 'frontend-app';
+export type GovernancePackId = 'standard' | 'project-scaffold' | 'scale-engine-repo' | 'moe-workspace' | 'resource-governance' | 'go-service-matrix' | 'node-library' | 'frontend-app';
 export interface GovernanceGeneratedFile {
     path: string;
     kind: 'doc' | 'template' | 'script' | 'config';