@intincrab/updiff 0.0.0-stage → 0.1.1

package/dist/plist.js

@@ -0,0 +1,196 @@
+import { run } from "./exec.js";
+const TOKEN_RE = /<!--[\s\S]*?-->|<\?[\s\S]*?\?>|<!DOCTYPE[^>]*>|<(\/?)([A-Za-z][\w.-]*)[^>]*?(\/?)>|([^<]+)/g;
+function tokenize(xml) {
+    const tokens = [];
+    for (const m of xml.matchAll(TOKEN_RE)) {
+        if (m[2]) {
+            const kind = m[1] ? 'close' : m[3] ? 'empty' : 'open';
+            tokens.push({ kind, name: m[2], text: '' });
+        }
+        else if (m[4] !== undefined) {
+            tokens.push({ kind: 'text', name: '', text: m[4] });
+        }
+    }
+    return tokens;
+}
+export function decodeEntities(text) {
+    return text.replace(/&(#x[0-9a-fA-F]+|#\d+|lt|gt|amp|quot|apos);/g, (_, e) => {
+        switch (e) {
+            case 'lt':
+                return '<';
+            case 'gt':
+                return '>';
+            case 'amp':
+                return '&';
+            case 'quot':
+                return '"';
+            case 'apos':
+                return "'";
+            default:
+                return String.fromCodePoint(e.startsWith('#x') ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10));
+        }
+    });
+}
+class Parser {
+    i = 0;
+    tokens;
+    constructor(tokens) {
+        this.tokens = tokens;
+    }
+    next() {
+        // Whitespace between elements carries no meaning in a plist.
+        while (this.i < this.tokens.length) {
+            const t = this.tokens[this.i++];
+            if (t.kind === 'text' && t.text.trim() === '')
+                continue;
+            return t;
+        }
+        return undefined;
+    }
+    readText(name) {
+        let text = '';
+        while (this.i < this.tokens.length) {
+            const t = this.tokens[this.i++];
+            if (t.kind === 'text')
+                text += t.text;
+            else if (t.kind === 'close' && t.name === name)
+                return decodeEntities(text);
+            else
+                throw new Error(`Unexpected <${t.name}> inside <${name}>`);
+        }
+        throw new Error(`Unterminated <${name}>`);
+    }
+    parseDocument() {
+        const first = this.next();
+        if (!first)
+            return undefined;
+        if (first.kind === 'open' && first.name === 'plist') {
+            const inner = this.next();
+            if (!inner || (inner.kind === 'close' && inner.name === 'plist'))
+                return undefined;
+            return this.parseValue(inner);
+        }
+        if (first.kind === 'empty' && first.name === 'plist')
+            return undefined;
+        return this.parseValue(first);
+    }
+    parseValue(t) {
+        if (t.kind === 'empty') {
+            switch (t.name) {
+                case 'true':
+                    return true;
+                case 'false':
+                    return false;
+                case 'dict':
+                    return {};
+                case 'array':
+                    return [];
+                case 'string':
+                case 'data':
+                case 'date':
+                    return '';
+                default:
+                    throw new Error(`Unsupported empty element <${t.name}/>`);
+            }
+        }
+        if (t.kind !== 'open')
+            throw new Error(`Expected a value, got ${t.kind} ${t.name || t.text.trim()}`);
+        switch (t.name) {
+            case 'string':
+            case 'date':
+                return this.readText(t.name);
+            case 'data':
+                return `data:${this.readText('data').replace(/\s+/g, '')}`;
+            case 'integer':
+            case 'real':
+                return Number(this.readText(t.name).trim());
+            case 'dict': {
+                const out = {};
+                for (;;) {
+                    const k = this.next();
+                    if (!k)
+                        throw new Error('Unterminated <dict>');
+                    if (k.kind === 'close' && k.name === 'dict')
+                        return out;
+                    let key = '';
+                    if (k.kind === 'open' && k.name === 'key')
+                        key = this.readText('key');
+                    else if (!(k.kind === 'empty' && k.name === 'key'))
+                        throw new Error(`Expected <key>, got <${k.name}>`);
+                    const v = this.next();
+                    if (!v)
+                        throw new Error(`Missing value for key ${key}`);
+                    out[key] = this.parseValue(v);
+                }
+            }
+            case 'array': {
+                const out = [];
+                for (;;) {
+                    const v = this.next();
+                    if (!v)
+                        throw new Error('Unterminated <array>');
+                    if (v.kind === 'close' && v.name === 'array')
+                        return out;
+                    out.push(this.parseValue(v));
+                }
+            }
+            default:
+                throw new Error(`Unsupported element <${t.name}>`);
+        }
+    }
+}
+/** Parses an XML property list. Returns undefined for an empty document. */
+export function parsePlistXml(xml) {
+    return new Parser(tokenize(xml)).parseDocument();
+}
+/** Reads a plist in any format (XML, binary or JSON) through `plutil`. */
+export async function readPlistFile(path) {
+    const res = await run('/usr/bin/plutil', ['-convert', 'xml1', '-o', '-', path]);
+    if (res.code !== 0)
+        return undefined;
+    const value = parsePlistXml(res.stdout);
+    return isDict(value) ? value : undefined;
+}
+export function isDict(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+export function str(v) {
+    return typeof v === 'string' ? v : typeof v === 'number' ? String(v) : undefined;
+}
+function escapeXml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+function serialize(v, indent) {
+    if (typeof v === 'string')
+        return `${indent}<string>${escapeXml(v)}</string>`;
+    if (typeof v === 'boolean')
+        return `${indent}<${v}/>`;
+    if (typeof v === 'number')
+        return Number.isInteger(v) ? `${indent}<integer>${v}</integer>` : `${indent}<real>${v}</real>`;
+    if (Array.isArray(v)) {
+        if (v.length === 0)
+            return `${indent}<array/>`;
+        return [`${indent}<array>`, ...v.map((x) => serialize(x, indent + '\t')), `${indent}</array>`].join('\n');
+    }
+    const keys = Object.keys(v);
+    if (keys.length === 0)
+        return `${indent}<dict/>`;
+    const lines = [`${indent}<dict>`];
+    for (const k of keys) {
+        lines.push(`${indent}\t<key>${escapeXml(k)}</key>`);
+        lines.push(serialize(v[k], indent + '\t'));
+    }
+    lines.push(`${indent}</dict>`);
+    return lines.join('\n');
+}
+/** Serialises a value as an XML property list. */
+export function toPlistXml(v) {
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        serialize(v, ''),
+        '</plist>',
+        '',
+    ].join('\n');
+}

package/dist/report.js

@@ -0,0 +1,124 @@
+import { registrableDomain } from "./hosts.js";
+import { formatBytes } from "./util.js";
+export const HOSTNAME_CAVEAT = 'A hostname found in the code is not proof that the app connects to it. It shows what the code mentions: endpoints, links and sometimes dead code.';
+const SEVERITY_LABEL = { high: 'High', notable: 'Notable', info: 'Info' };
+const CHANGE_MARK = { added: '+', removed: '-', changed: '~' };
+const plain = { bold: (s) => s, dim: (s) => s, sev: (_, s) => s };
+const ansi = {
+    bold: (s) => `\x1b[1m${s}\x1b[22m`,
+    dim: (s) => `\x1b[2m${s}\x1b[22m`,
+    sev: (sev, s) => `\x1b[${sev === 'high' ? 31 : sev === 'notable' ? 33 : 36}m${s}\x1b[39m`,
+};
+function clip(s, max) {
+    return s.length > max ? `${s.slice(0, max - 1)}… (${s.length - max + 1} more characters; use --format md or json for all)` : s;
+}
+export function renderText(report, options = {}) {
+    const p = options.color ? ansi : plain;
+    const max = options.full ? Infinity : 400;
+    const lines = [];
+    lines.push(p.bold(`${report.app.name}  ${report.from.version} (${report.from.build}) → ${report.to.version} (${report.to.build})`));
+    lines.push(p.dim(`${report.app.bundleId}`));
+    lines.push(`${p.sev('high', `${report.counts.high} high`)} · ${p.sev('notable', `${report.counts.notable} notable`)} · ${p.sev('info', `${report.counts.info} info`)}`);
+    if (report.identical) {
+        lines.push('', 'No changes: both sides have the same sealed contents.');
+        return lines.join('\n') + '\n';
+    }
+    for (const sev of ['high', 'notable', 'info']) {
+        const group = report.findings.filter((f) => f.severity === sev);
+        if (!group.length)
+            continue;
+        lines.push('', p.sev(sev, p.bold(SEVERITY_LABEL[sev].toUpperCase())));
+        for (const f of group) {
+            lines.push(`  ${p.sev(sev, CHANGE_MARK[f.change])} ${f.title}`);
+            if (f.detail)
+                lines.push(`      ${clip(f.detail, max)}`);
+            if (f.where?.length)
+                lines.push(p.dim(`      at ${f.where.join(', ')}`));
+        }
+    }
+    if (report.findings.some((f) => f.category === 'host'))
+        lines.push('', p.dim(HOSTNAME_CAVEAT));
+    return lines.join('\n') + '\n';
+}
+function mdEscape(s) {
+    return s.replace(/([\\`*_[\]<>|])/g, '\\$1');
+}
+export function renderMarkdown(report) {
+    const lines = [];
+    lines.push(`# ${mdEscape(report.app.name)}: ${report.from.version} → ${report.to.version}`, '');
+    lines.push(`\`${report.app.bundleId}\` · build ${report.from.build} → ${report.to.build}`, '');
+    lines.push(`| | From | To |`, `|---|---|---|`);
+    lines.push(`| Snapshot | ${report.from.takenAt} | ${report.to.takenAt} |`);
+    lines.push(`| Path | \`${report.from.path}\` | \`${report.to.path}\` |`, '');
+    lines.push(`**${report.counts.high} high · ${report.counts.notable} notable · ${report.counts.info} info**`, '');
+    if (report.identical) {
+        lines.push('No changes: both sides have the same sealed contents.', '');
+        return lines.join('\n');
+    }
+    for (const sev of ['high', 'notable', 'info']) {
+        const group = report.findings.filter((f) => f.severity === sev);
+        if (!group.length)
+            continue;
+        lines.push(`## ${SEVERITY_LABEL[sev]}`, '');
+        for (const f of group) {
+            lines.push(`- ${CHANGE_MARK[f.change] === '+' ? 'Added' : CHANGE_MARK[f.change] === '-' ? 'Removed' : 'Changed'}: **${mdEscape(f.title)}**`);
+            if (f.detail)
+                lines.push(`  ${mdEscape(f.detail)}`);
+            if (f.where?.length)
+                lines.push(`  <sub>${f.where.map((w) => `\`${w}\``).join(', ')}</sub>`);
+        }
+        lines.push('');
+    }
+    if (report.findings.some((f) => f.category === 'host'))
+        lines.push(`> ${HOSTNAME_CAVEAT}`, '');
+    lines.push('<sub>Generated by updiff. Static inspection only: the app was not run.</sub>', '');
+    return lines.join('\n');
+}
+export function renderJson(value) {
+    return JSON.stringify(value, null, 2) + '\n';
+}
+const KIND_PLURAL = {
+    main: 'main executable',
+    helperApp: 'helper apps',
+    xpcService: 'XPC services',
+    appExtension: 'app extensions',
+    loginItem: 'login items',
+    privilegedHelper: 'privileged helpers',
+    systemExtension: 'system extensions',
+    framework: 'frameworks',
+    plugin: 'plug-in bundles',
+    executable: 'other executables',
+    nativeModule: 'native Node modules',
+};
+export function renderScan(s, options = {}) {
+    const p = options.color ? ansi : plain;
+    const main = s.code.find((c) => c.kind === 'main');
+    const lines = [];
+    lines.push(p.bold(`${s.app.name} ${s.app.version} (${s.app.build})`), p.dim(`${s.app.bundleId} · ${s.app.path}`), '');
+    const sig = s.signing;
+    lines.push(`Signing        ${sig.status}${sig.teamId ? `, team ${sig.teamId}` : ''}${sig.authorities[0] ? ` (${sig.authorities[0]})` : ''}${sig.hardenedRuntime ? ', hardened runtime' : ', no hardened runtime'}`);
+    const ents = Object.keys(main?.entitlements ?? {});
+    const sandboxed = main?.entitlements?.['com.apple.security.app-sandbox'] === true;
+    lines.push(`Sandbox        ${sandboxed ? 'yes' : 'no'}`);
+    lines.push(`Entitlements   ${ents.length ? ents.join(', ') : 'none'}`);
+    const privacy = Object.keys(s.info.privacyUsage);
+    lines.push(`Privacy asks   ${privacy.length ? privacy.map((k) => k.replace(/^NS/, '').replace(/UsageDescription$/, '')).join(', ') : 'none'}`);
+    lines.push(`URL schemes    ${s.info.urlSchemes.length ? s.info.urlSchemes.join(', ') : 'none'}`);
+    if (s.info.sparkleFeedUrl)
+        lines.push(`Update feed    ${s.info.sparkleFeedUrl}`);
+    const counts = new Map();
+    for (const c of s.code)
+        if (c.kind !== 'main')
+            counts.set(c.kind, (counts.get(c.kind) ?? 0) + 1);
+    lines.push(`Nested code    ${counts.size ? [...counts].map(([k, n]) => `${n} ${KIND_PLURAL[k]}`).join(', ') : 'none'}`);
+    lines.push(`Background     ${s.backgroundItems.length ? s.backgroundItems.map((b) => `${b.label ?? b.file}${b.program ? ` → ${b.program}` : ''}`).join(', ') : 'none'}`);
+    if (s.electron) {
+        lines.push(`Electron       ${s.electron.electronVersion ?? 'version unknown'}${s.electron.appSource ? `, code in ${s.electron.appSource}` : ''}, ${Object.keys(s.electron.packages).length} bundled npm packages`);
+    }
+    const domains = new Set(Object.keys(s.hosts).map(registrableDomain));
+    lines.push(`Hostnames      ${Object.keys(s.hosts).length} hosts across ${domains.size} domains`);
+    lines.push(p.dim(`Scanned ${s.stats.filesScanned} files (${formatBytes(s.stats.bytesScanned)}) of ${s.app.fileCount} (${formatBytes(s.app.sizeBytes)}) in ${(s.stats.scanMs / 1000).toFixed(1)} s${s.stats.deep ? ', deep' : ''}`));
+    for (const w of s.stats.warnings)
+        lines.push(p.sev('notable', `warning: ${w}`));
+    return lines.join('\n') + '\n';
+}

package/dist/store.js

@@ -0,0 +1,92 @@
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+function safe(s) {
+    return s.replace(/[^A-Za-z0-9._-]+/g, '_').slice(0, 80) || '_';
+}
+export function defaultHome() {
+    return process.env.UPDIFF_HOME || join(homedir(), '.updiff');
+}
+export class Store {
+    home;
+    constructor(home = defaultHome()) {
+        this.home = home;
+    }
+    get snapshotsDir() {
+        return join(this.home, 'snapshots');
+    }
+    get reportsDir() {
+        return join(this.home, 'reports');
+    }
+    async save(s) {
+        const dir = join(this.snapshotsDir, safe(s.app.bundleId));
+        await mkdir(dir, { recursive: true });
+        const file = join(dir, `${s.takenAt.replace(/[:.]/g, '-')}__${safe(s.app.version)}__${safe(s.app.build)}.json`);
+        await writeFile(file, JSON.stringify(s));
+        return file;
+    }
+    async load(file) {
+        const s = JSON.parse(await readFile(file, 'utf8'));
+        if (!s.app?.bundleId || !s.fingerprint)
+            throw new Error(`${file} is not an updiff snapshot`);
+        return s;
+    }
+    async bundleIds() {
+        try {
+            const dirents = await readdir(this.snapshotsDir, { withFileTypes: true });
+            return dirents.filter((d) => d.isDirectory()).map((d) => d.name).sort();
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Snapshots of one app, oldest first. */
+    async list(bundleId) {
+        const dir = join(this.snapshotsDir, safe(bundleId));
+        let names;
+        try {
+            names = (await readdir(dir)).filter((n) => n.endsWith('.json')).sort();
+        }
+        catch {
+            return [];
+        }
+        return names.map((n) => {
+            const [stamp = '', version = '', build = ''] = n.slice(0, -5).split('__');
+            return { file: join(dir, n), bundleId, takenAt: stamp, version, build };
+        });
+    }
+    /** The newest `count` snapshots of one app, newest first. */
+    async latest(bundleId, count = 1) {
+        const list = await this.list(bundleId);
+        const picked = list.slice(-count).reverse();
+        return Promise.all(picked.map((p) => this.load(p.file)));
+    }
+    /** Finds a stored app by bundle id or by name, ignoring case. */
+    async resolveBundleId(query) {
+        const ids = await this.bundleIds();
+        const q = query.toLowerCase();
+        const exact = ids.find((id) => id.toLowerCase() === q || id.toLowerCase() === safe(query).toLowerCase());
+        if (exact)
+            return exact;
+        for (const id of ids) {
+            const [latest] = await this.latest(id, 1);
+            if (latest && latest.app.name.toLowerCase() === q.replace(/\.app$/, ''))
+                return id;
+        }
+        return undefined;
+    }
+    async prune(bundleId, keep) {
+        const list = await this.list(bundleId);
+        const drop = list.slice(0, Math.max(0, list.length - keep));
+        await Promise.all(drop.map((d) => rm(d.file, { force: true })));
+        return drop.length;
+    }
+    async saveReport(bundleId, fromVersion, toVersion, ext, content) {
+        const dir = join(this.reportsDir, safe(bundleId));
+        await mkdir(dir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const file = join(dir, `${stamp}__${safe(fromVersion)}__to__${safe(toVersion)}.${ext}`);
+        await writeFile(file, content);
+        return file;
+    }
+}

package/dist/types.js

@@ -0,0 +1 @@
+export const SNAPSHOT_SCHEMA = 1;

package/dist/util.js

@@ -0,0 +1,39 @@
+/** Runs `fn` over `items` with at most `limit` calls in flight, keeping order. */
+export async function mapLimit(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i], i);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return out;
+}
+export function sortedUnique(values) {
+    return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+export function formatBytes(n) {
+    const units = ['B', 'KB', 'MB', 'GB'];
+    let v = Math.abs(n);
+    let u = 0;
+    while (v >= 1024 && u < units.length - 1) {
+        v /= 1024;
+        u++;
+    }
+    return `${n < 0 ? '-' : ''}${u === 0 ? v : v.toFixed(1)} ${units[u]}`;
+}
+/** Stable JSON for comparing plist values. */
+export function stableJson(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stableJson).join(',')}]`;
+    if (v && typeof v === 'object') {
+        const o = v;
+        return `{${Object.keys(o)
+            .sort()
+            .map((k) => `${JSON.stringify(k)}:${stableJson(o[k])}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(v);
+}

package/dist/version.js

@@ -0,0 +1,2 @@
+export const TOOL_NAME = 'updiff';
+export const TOOL_VERSION = '0.1.1';

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@intincrab/updiff",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "See what a macOS app update actually changed: entitlements, privacy prompts, background items, helpers, bundled packages and hostnames.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/intincrab/updiff.git"
+  },
+  "homepage": "https://github.com/intincrab/updiff#readme",
+  "bugs": {
+    "url": "https://github.com/intincrab/updiff/issues"
+  },
+  "type": "module",
+  "bin": {
+    "updiff": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "os": [
+    "darwin"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/cli.js",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test --test-concurrency=1 test/*.test.ts",
+    "start": "node src/cli.ts",
+    "ledger": "node ledger/src/cli.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "@electron/asar": "^3.4.1",
+    "@types/node": "^24.19.2",
+    "typescript": "^5.9.3"
+  },
+  "keywords": [
+    "macos",
+    "security",
+    "privacy",
+    "entitlements",
+    "codesign",
+    "electron",
+    "diff",
+    "app-updates",
+    "cli"
+  ],
+  "author": "Ajay Chauhan",
+  "publishConfig": {
+    "access": "public"
+  }
+}