@iowarp/clio-coder 0.3.3 → 0.3.6

package/dist/chunk-FYYLNIL5.js

@@ -0,0 +1,313 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  isProjectVerifierCheckId
+} from "./chunk-UL3WSD3F.js";
+import {
+  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+  resolveSafeCwd
+} from "./chunk-VEZEGCGW.js";
+import {
+  require_dist
+} from "./chunk-APJ265NV.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/tools/verify/catalog.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+// src/domains/evidence/ordering.ts
+init_esm_shims();
+function compareCodepoints(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+// src/tools/verify/catalog.ts
+var PROJECT_VERIFIER_CATALOG_RELATIVE_PATH = ".clio-coder/verifiers.yaml";
+var PROJECT_VERIFIER_CATALOG_VERSION = 1;
+var PROJECT_VERIFIER_CATALOG_CAPS = Object.freeze({
+  fileBytes: 256 * 1024,
+  checks: 128,
+  idBytes: 64,
+  descriptionBytes: 512,
+  argvEntries: 64,
+  argumentBytes: 4096,
+  cwdBytes: 512,
+  timeoutMs: 9e5,
+  tags: 16,
+  tagBytes: 32
+});
+var ROOT_FIELDS = /* @__PURE__ */ new Set(["version", "checks"]);
+var CHECK_FIELDS = /* @__PURE__ */ new Set(["id", "description", "command", "cwd", "timeoutMs", "tags"]);
+var TAG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+var SHELL_EXECUTABLES = /* @__PURE__ */ new Set([
+  "bash",
+  "cmd",
+  "command.com",
+  "dash",
+  "fish",
+  "ksh",
+  "powershell",
+  "pwsh",
+  "sh",
+  "tcsh",
+  "zsh"
+]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+function catalogDiagnostic(message) {
+  return { ok: false, reason: `${PROJECT_VERIFIER_CATALOG_RELATIVE_PATH}: ${message}` };
+}
+function unknownFields(record, allowed) {
+  return Object.keys(record).filter((key) => !allowed.has(key)).sort(compareCodepoints);
+}
+function relativeCwd(workspaceRoot, resolved) {
+  const relative = path.relative(workspaceRoot, resolved);
+  return relative.length === 0 ? "." : relative.split(path.sep).join("/");
+}
+function safelyResolveCatalogCwd(rawCwd, workspaceRoot, location) {
+  if (path.isAbsolute(rawCwd) || path.win32.isAbsolute(rawCwd)) {
+    return new Error(`${location} must be repository-relative; absolute cwd '${rawCwd}' is not allowed`);
+  }
+  let resolved;
+  try {
+    resolved = resolveSafeCwd(rawCwd, workspaceRoot);
+  } catch {
+    return new Error(`${location} escapes the workspace root: '${rawCwd}'`);
+  }
+  let realCwd;
+  try {
+    const cwdStat = statSync(resolved);
+    if (!cwdStat.isDirectory()) return new Error(`${location} is not a directory: '${rawCwd}'`);
+    const realRoot = realpathSync(workspaceRoot);
+    realCwd = realpathSync(resolved);
+    resolveSafeCwd(realCwd, realRoot);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("escapes workspace root")) {
+      return new Error(`${location} escapes the workspace root through a symbolic link: '${rawCwd}'`);
+    }
+    return new Error(`${location} cannot be resolved as a repository directory: '${rawCwd}' (${message})`);
+  }
+  return { declared: relativeCwd(workspaceRoot, resolved), execution: realCwd };
+}
+function resolveProjectVerifierExecutionCwd(rawCwd, workspaceRoot) {
+  const resolution = safelyResolveCatalogCwd(rawCwd, workspaceRoot, "project check cwd");
+  return resolution instanceof Error ? resolution : resolution.execution;
+}
+function validateId(value, location) {
+  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
+  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.idBytes) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.idBytes}-byte cap`);
+  }
+  if (!isProjectVerifierCheckId(value)) {
+    return new Error(`${location} must match /^[a-z0-9][a-z0-9._:-]*$/`);
+  }
+  if (value === "frontend") return new Error(`${location} uses reserved built-in check id 'frontend'`);
+  return value;
+}
+function validateDescription(value, location) {
+  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
+  if (value.trim() !== value || hasControlCharacter(value)) {
+    return new Error(`${location} must be trimmed, single-line text without control characters`);
+  }
+  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes}-byte cap`);
+  }
+  return value;
+}
+function validateCommand(value, location) {
+  if (!Array.isArray(value) || value.length === 0) {
+    return new Error(`${location} must be a non-empty argv string array; shell command strings are not allowed`);
+  }
+  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.argvEntries) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argvEntries}-entry cap`);
+  }
+  const command = [];
+  for (const [index, entry] of value.entries()) {
+    const entryLocation = `${location}[${index}]`;
+    if (typeof entry !== "string" || entry.length === 0) {
+      return new Error(`${entryLocation} must be a non-empty string`);
+    }
+    if (entry.includes("\0")) return new Error(`${entryLocation} must not contain a NUL byte`);
+    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes) {
+      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes}-byte cap`);
+    }
+    command.push(entry);
+  }
+  const executable = command[0] ?? "";
+  if (/\s/u.test(executable)) {
+    return new Error(`${location}[0] must be one executable token, not a shell command string`);
+  }
+  const executableName = path.basename(executable).toLowerCase().replace(/\.exe$/u, "");
+  if (SHELL_EXECUTABLES.has(executableName)) {
+    return new Error(`${location}[0] may not invoke shell executable '${executable}'`);
+  }
+  return command;
+}
+function validateTimeout(value, location) {
+  if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) {
+    return new Error(`${location} must be a positive integer number of milliseconds`);
+  }
+  if (value > PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs}ms cap`);
+  }
+  return value;
+}
+function validateTags(value, location) {
+  if (!Array.isArray(value)) return new Error(`${location} must be an array of bounded tag strings`);
+  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.tags) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tags}-tag cap`);
+  }
+  const tags = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, entry] of value.entries()) {
+    const entryLocation = `${location}[${index}]`;
+    if (typeof entry !== "string" || entry.length === 0) {
+      return new Error(`${entryLocation} must be a non-empty string`);
+    }
+    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.tagBytes) {
+      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tagBytes}-byte cap`);
+    }
+    if (!TAG_PATTERN.test(entry)) return new Error(`${entryLocation} must match /^[a-z0-9][a-z0-9._-]*$/`);
+    if (seen.has(entry)) return new Error(`${location} contains duplicate tag '${entry}'`);
+    seen.add(entry);
+    tags.push(entry);
+  }
+  return tags;
+}
+function sourcePathInsideWorkspace(catalogPath, workspaceRoot) {
+  try {
+    const realRoot = realpathSync(workspaceRoot);
+    const realCatalogPath = realpathSync(catalogPath);
+    resolveSafeCwd(realCatalogPath, realRoot);
+    return realCatalogPath;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return new Error(`catalog file must resolve inside the workspace root (${message})`);
+  }
+}
+function loadProjectVerifierCatalog(workspaceRoot) {
+  const catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH);
+  if (!existsSync(catalogPath)) return { ok: true, source: null };
+  const safeSourcePath = sourcePathInsideWorkspace(catalogPath, workspaceRoot);
+  if (safeSourcePath instanceof Error) return catalogDiagnostic(safeSourcePath.message);
+  let text;
+  try {
+    const stats = statSync(safeSourcePath);
+    if (!stats.isFile()) return catalogDiagnostic("catalog path must be a regular file");
+    if (stats.size > PROJECT_VERIFIER_CATALOG_CAPS.fileBytes) {
+      return catalogDiagnostic(`file exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.fileBytes}-byte cap`);
+    }
+    text = readFileSync(safeSourcePath, "utf8");
+  } catch (error) {
+    return catalogDiagnostic(`cannot read catalog (${error instanceof Error ? error.message : String(error)})`);
+  }
+  return parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath);
+}
+function parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH)) {
+  const document = (0, import_yaml.parseDocument)(text, { prettyErrors: false, strict: true, uniqueKeys: true });
+  if (document.errors.length > 0) {
+    return catalogDiagnostic(`invalid YAML: ${document.errors.map((error) => error.message).join("; ")}`);
+  }
+  let parsed;
+  try {
+    parsed = document.toJS({ maxAliasCount: 0 });
+  } catch (error) {
+    return catalogDiagnostic(`invalid YAML: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!isRecord(parsed)) return catalogDiagnostic("root must be an object with version and checks fields");
+  const rootUnknown = unknownFields(parsed, ROOT_FIELDS);
+  if (rootUnknown.length > 0) return catalogDiagnostic(`root has unknown field(s): ${rootUnknown.join(", ")}`);
+  if (!Object.hasOwn(parsed, "version")) return catalogDiagnostic("root.version is required");
+  if (parsed.version !== PROJECT_VERIFIER_CATALOG_VERSION) {
+    return catalogDiagnostic(
+      `unsupported version ${JSON.stringify(parsed.version)}; supported version is ${PROJECT_VERIFIER_CATALOG_VERSION}`
+    );
+  }
+  if (!Object.hasOwn(parsed, "checks")) return catalogDiagnostic("root.checks is required");
+  if (!Array.isArray(parsed.checks)) return catalogDiagnostic("root.checks must be an array");
+  if (parsed.checks.length > PROJECT_VERIFIER_CATALOG_CAPS.checks) {
+    return catalogDiagnostic(`root.checks exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.checks}-check cap`);
+  }
+  const sourceRef = { kind: "project-catalog", path: catalogPath };
+  const checks = [];
+  const ids = /* @__PURE__ */ new Map();
+  for (const [index, value] of parsed.checks.entries()) {
+    const location = `checks[${index}]`;
+    if (!isRecord(value)) return catalogDiagnostic(`${location} must be an object`);
+    const checkUnknown = unknownFields(value, CHECK_FIELDS);
+    if (checkUnknown.length > 0) {
+      return catalogDiagnostic(`${location} has unknown field(s): ${checkUnknown.join(", ")}`);
+    }
+    for (const field of CHECK_FIELDS) {
+      if (!Object.hasOwn(value, field)) return catalogDiagnostic(`${location}.${field} is required`);
+    }
+    const id = validateId(value.id, `${location}.id`);
+    if (id instanceof Error) return catalogDiagnostic(id.message);
+    const duplicateIndex = ids.get(id);
+    if (duplicateIndex !== void 0) {
+      return catalogDiagnostic(`${location}.id duplicates '${id}' from checks[${duplicateIndex}].id`);
+    }
+    const description = validateDescription(value.description, `${location}.description`);
+    if (description instanceof Error) return catalogDiagnostic(description.message);
+    const command = validateCommand(value.command, `${location}.command`);
+    if (command instanceof Error) return catalogDiagnostic(command.message);
+    if (typeof value.cwd !== "string" || value.cwd.length === 0) {
+      return catalogDiagnostic(`${location}.cwd must be a non-empty repository-relative string`);
+    }
+    if (value.cwd.includes("\0")) return catalogDiagnostic(`${location}.cwd must not contain a NUL byte`);
+    if (utf8Bytes(value.cwd) > PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes) {
+      return catalogDiagnostic(`${location}.cwd exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes}-byte cap`);
+    }
+    const cwdResolution = safelyResolveCatalogCwd(value.cwd, workspaceRoot, `${location}.cwd`);
+    if (cwdResolution instanceof Error) return catalogDiagnostic(cwdResolution.message);
+    const cwd = cwdResolution.declared;
+    const timeoutMs = validateTimeout(value.timeoutMs, `${location}.timeoutMs`);
+    if (timeoutMs instanceof Error) return catalogDiagnostic(timeoutMs.message);
+    const tags = validateTags(value.tags, `${location}.tags`);
+    if (tags instanceof Error) return catalogDiagnostic(tags.message);
+    ids.set(id, index);
+    checks.push({ id, description, command, cwd, timeoutMs, tags, source: { ...sourceRef } });
+  }
+  checks.sort((left, right) => compareCodepoints(left.id, right.id));
+  return { ok: true, source: { ...sourceRef, checks } };
+}
+function packageDeclaredCheck(id, packagePath, cwd, tags) {
+  return {
+    id,
+    description: `Run package.json script '${id}'.`,
+    command: ["npm", "run", id],
+    cwd,
+    timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+    tags,
+    source: { kind: "package.json", path: packagePath }
+  };
+}
+
+export {
+  compareCodepoints,
+  PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
+  PROJECT_VERIFIER_CATALOG_VERSION,
+  PROJECT_VERIFIER_CATALOG_CAPS,
+  resolveProjectVerifierExecutionCwd,
+  loadProjectVerifierCatalog,
+  parseProjectVerifierCatalogText,
+  packageDeclaredCheck
+};
+//# sourceMappingURL=chunk-FYYLNIL5.js.map

package/dist/{chunk-OQ33BKR3.js → chunk-G7MUEIGA.js}

@@ -37,6 +37,7 @@ var BusChannels = {
   ContextActivity: "context.activity",
   ContextWarning: "context.warning",
   ContextPruned: "context.pruned",
+  ContextRecalled: "context.recalled",
   AgentStatusChanged: "agent.status.changed",
   RunAborted: "run.aborted",
   BudgetAlert: "budget.alert",
@@ -62,66 +63,8 @@ function isRunAbortedPayload(value) {
   return true;
 }
 
-// src/core/shared-bus.ts
-init_esm_shims();
-
-// src/core/event-bus.ts
-init_esm_shims();
-function reportListenerError(channel, error) {
-  const message = error instanceof Error ? error.stack ?? error.message : String(error);
-  console.error(`[clio:event-bus] Listener crashed on ${channel}: ${message}`);
-}
-function createSafeEventBus() {
-  const registry = /* @__PURE__ */ new Map();
-  const deliver = (channel, payload) => {
-    const ls = registry.get(channel);
-    if (!ls) return;
-    for (const listener of [...ls]) {
-      try {
-        const result = listener(payload);
-        if (result && typeof result.then === "function") {
-          result.catch((error) => reportListenerError(channel, error));
-        }
-      } catch (error) {
-        reportListenerError(channel, error);
-      }
-    }
-  };
-  const bus = {
-    emit(channel, payload) {
-      deliver(channel, payload);
-    },
-    on(channel, listener) {
-      const set = registry.get(channel) ?? /* @__PURE__ */ new Set();
-      set.add(listener);
-      registry.set(channel, set);
-      return () => {
-        const current = registry.get(channel);
-        if (!current) return;
-        current.delete(listener);
-        if (current.size === 0) registry.delete(channel);
-      };
-    },
-    listeners(channel) {
-      return [...registry.get(channel) ?? []];
-    },
-    clear() {
-      registry.clear();
-    }
-  };
-  return bus;
-}
-
-// src/core/shared-bus.ts
-var sharedBus = null;
-function getSharedBus() {
-  if (!sharedBus) sharedBus = createSafeEventBus();
-  return sharedBus;
-}
-
 export {
   BusChannels,
-  isRunAbortedPayload,
-  getSharedBus
+  isRunAbortedPayload
 };
-//# sourceMappingURL=chunk-OQ33BKR3.js.map
+//# sourceMappingURL=chunk-G7MUEIGA.js.map