@linxiraos/pi-utils 1.1.14 → 1.1.16

package/src/which.ts

@@ -11,8 +11,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-
-type CacheKey = string | bigint | number;
+import { isFullyQualifiedPath } from "./path";
 
 // Tools shipped by Xcode / Command Line Tools that callers actually look up.
 // Keeps the set small so darwinWhich can fast-reject non-Xcode commands without
@@ -148,12 +147,12 @@ function getMacosToolPaths(): Map<string, string> {
 }
 
 // Map: cache key -> resolved binary path or null (not found)
-const toolCache = new Map<CacheKey, string | null>();
+const toolCache = new Map<string, string | null>();
 
 /**
  * Cache policy for which lookups.
  */
-export const enum WhichCachePolicy {
+export enum WhichCachePolicy {
 	/**
 	 * Use cached result if available.
 	 */
@@ -176,9 +175,15 @@ export const enum WhichCachePolicy {
 export interface WhichOptions extends Bun.WhichOptions {
 	/**
 	 * Cache policy for the lookup.
-	 * Defaults to `WhichCachePolicy.Fresh`.
+	 * Defaults to `WhichCachePolicy.Cached`.
 	 */
 	cache?: WhichCachePolicy;
+	/**
+	 * Only search absolute directory entries in PATH, ignoring relative entries
+	 * (e.g. `.` or `./bin`) and empty components to prevent resolving against
+	 * an untrusted working directory.
+	 */
+	requireAbsolutePaths?: boolean;
 }
 
 // Darwin-specific "which" shim: consult Xcode/CLT toolchain directories after $PATH.
@@ -192,6 +197,15 @@ function darwinWhich(command: string, options?: Bun.WhichOptions): string | null
 	return null;
 }
 
+function filterAbsoluteSearchPath(rawPath: string | undefined): string | null {
+	if (!rawPath) return null;
+	const safePath = rawPath
+		.split(path.delimiter)
+		.filter(dir => dir.length > 0 && isFullyQualifiedPath(dir))
+		.join(path.delimiter);
+	return safePath || null;
+}
+
 // Which function that incorporates Darwin Xcode logic if platform reports as 'darwin'.
 // Look `Bun.which` up per call rather than capturing it at import, so a `Bun.which`
 // stub installed later (the per-test seam) is honoured on every platform.
@@ -200,14 +214,14 @@ export const whichFresh =
 		? darwinWhich
 		: (command: string, options?: Bun.WhichOptions): string | null => Bun.which(command, options);
 
-// Derive stable cache key from command and lookup options
-function cacheKey(command: string, options?: Bun.WhichOptions): CacheKey {
+// Length-prefixed (command, cwd, PATH) tuple: exact, unlike the 64-bit hash
+// chain it replaced, and the length prefixes keep `("ab", "c")` and
+// `("a", "bc")` distinct without a separator that cwd/PATH could contain.
+function cacheKey(command: string, options?: Bun.WhichOptions): string {
 	if (!options) return command;
-	if (!options.cwd && !options.PATH) return command;
-	let h = Bun.hash(command);
-	if (options.cwd) h = Bun.hash(options.cwd, h);
-	if (options.PATH) h = Bun.hash(options.PATH, h);
-	return h;
+	const cwd = options?.cwd ?? "";
+	const binPath = options?.PATH ?? "";
+	return `${command.length}:${command}${cwd.length}:${cwd}${binPath.length}:${binPath}`;
 }
 
 /**
@@ -219,9 +233,16 @@ function cacheKey(command: string, options?: Bun.WhichOptions): CacheKey {
  */
 export function $which(command: string, options?: WhichOptions): string | null {
 	const cachePolicy = options?.cache ?? WhichCachePolicy.Cached;
-	const lookupOptions =
+	let lookupOptions =
 		options?.PATH !== undefined || process.env.PATH === undefined ? options : { ...options, PATH: process.env.PATH };
-	let key: CacheKey | undefined;
+
+	if (options?.requireAbsolutePaths) {
+		const safePath = filterAbsoluteSearchPath(lookupOptions?.PATH);
+		if (!safePath) return null;
+		lookupOptions = { ...lookupOptions, PATH: safePath };
+	}
+
+	let key: string | undefined;
 
 	if (cachePolicy !== WhichCachePolicy.Bypass) {
 		key = cacheKey(command, lookupOptions);
@@ -232,6 +253,9 @@ export function $which(command: string, options?: WhichOptions): string | null {
 	}
 
 	const result = whichFresh(command, lookupOptions);
+	if (result && options?.requireAbsolutePaths && !isFullyQualifiedPath(result)) {
+		return null;
+	}
 	if (key != null && cachePolicy !== WhichCachePolicy.ReadOnly) {
 		toolCache.set(key, result);
 	}

package/src/xml.ts

@@ -104,6 +104,12 @@ class XmlReader {
 				this.#readProcessingInstruction(document);
 				continue;
 			}
+			if (this.#xml.startsWith("</", this.#position)) {
+				// Stray end tag with no element open: skip it instead of parsing it as a new element,
+				// whose empty name would leave #readElement stuck on the `/`.
+				this.#skipThrough(">");
+				continue;
+			}
 			if (this.#xml[this.#position] === "<") {
 				const element = this.#readElement("");
 				this.#addValue(document, element.name, element.name, element.value, element.leaf, null);
@@ -138,6 +144,11 @@ class XmlReader {
 				this.#position++;
 				this.#skipWhitespace();
 				value = this.#readAttributeValue();
+			} else if (attributeName === "") {
+				// Markup #readName cannot consume (the stray `/` in `<a / >`): skip the character
+				// so the loop always makes progress.
+				this.#position++;
+				continue;
 			}
 			attributes.push([attributeName, value]);
 		}
@@ -153,6 +164,11 @@ class XmlReader {
 					this.#position = close < 0 ? this.#xml.length : close + 1;
 					break;
 				}
+				if (this.#xml.startsWith("</", this.#position)) {
+					// End tag for an ancestor (an unclosed `<br>` inside `<p>`, or plain mismatched
+					// markup): close this element implicitly and leave the tag to its owner.
+					break;
+				}
 				if (this.#xml.startsWith("<![CDATA[", this.#position)) {
 					const end = this.#xml.indexOf("]]>", this.#position + 9);
 					const raw = this.#xml.slice(this.#position + 9, end < 0 ? this.#xml.length : end);

package/src/yaml-config.ts

@@ -0,0 +1,8 @@
+import { YAML } from "bun";
+
+const YAML_MAPPING_HEADER_TRAILING_SPACE = /: +$/gm;
+
+/** Serialize config YAML without Bun's trailing space on block mapping headers. */
+export function stringifyYamlConfig(value: unknown): string {
+	return YAML.stringify(value, null, 2).replace(YAML_MAPPING_HEADER_TRAILING_SPACE, ":");
+}

package/dist/types/glob.d.ts

@@ -1,28 +0,0 @@
-export interface GlobPathsOptions {
-    /** Base directory for glob patterns. Defaults to getProjectDir(). */
-    cwd?: string;
-    /** Glob exclusion patterns. */
-    exclude?: string[];
-    /** Abort signal to cancel the glob. */
-    signal?: AbortSignal;
-    /** Timeout in milliseconds for the glob operation. */
-    timeoutMs?: number;
-    /** Include dotfiles when true. */
-    dot?: boolean;
-    /** Only return files (skip directories). Default: true. */
-    onlyFiles?: boolean;
-    /** Respect .gitignore files when true. Walks up directory tree to find all applicable .gitignore files. */
-    gitignore?: boolean;
-}
-/**
- * Load .gitignore patterns from a directory and its parents.
- * Walks up the directory tree to find all applicable .gitignore files.
- * Returns glob-compatible exclude patterns.
- */
-export declare function loadGitignorePatterns(baseDir: string): Promise<string[]>;
-/**
- * Resolve filesystem paths matching glob patterns with optional exclude filters.
- * Returns paths relative to the provided cwd (or getProjectDir()).
- * Errors and abort/timeouts are surfaced to the caller.
- */
-export declare function globPaths(patterns: string | string[], options?: GlobPathsOptions): Promise<string[]>;

package/src/glob.ts

@@ -1,189 +0,0 @@
-import * as path from "node:path";
-import { Glob } from "bun";
-import { getProjectDir } from "./dirs";
-
-export interface GlobPathsOptions {
-	/** Base directory for glob patterns. Defaults to getProjectDir(). */
-	cwd?: string;
-	/** Glob exclusion patterns. */
-	exclude?: string[];
-	/** Abort signal to cancel the glob. */
-	signal?: AbortSignal;
-	/** Timeout in milliseconds for the glob operation. */
-	timeoutMs?: number;
-	/** Include dotfiles when true. */
-	dot?: boolean;
-	/** Only return files (skip directories). Default: true. */
-	onlyFiles?: boolean;
-	/** Respect .gitignore files when true. Walks up directory tree to find all applicable .gitignore files. */
-	gitignore?: boolean;
-}
-
-/** Patterns always excluded (.git is never useful in glob results). */
-const ALWAYS_IGNORED = ["**/.git", "**/.git/**"];
-
-/** node_modules exclusion patterns (skipped if pattern explicitly references node_modules). */
-const NODE_MODULES_IGNORED = ["**/node_modules", "**/node_modules/**"];
-
-/**
- * Parse a single .gitignore file and return glob-compatible exclude patterns.
- * @param content - Raw content of the .gitignore file
- * @param gitignoreDir - Absolute path to the directory containing the .gitignore
- * @param baseDir - Absolute path to the glob's cwd (for relativizing rooted patterns)
- */
-function parseGitignorePatterns(content: string, gitignoreDir: string, baseDir: string): string[] {
-	const patterns: string[] = [];
-
-	for (const rawLine of content.split("\n")) {
-		const line = rawLine.trim();
-		// Skip empty lines and comments
-		if (!line || line.startsWith("#")) {
-			continue;
-		}
-		// Skip negation patterns (unsupported for simple exclude)
-		if (line.startsWith("!")) {
-			continue;
-		}
-
-		let pattern = line;
-
-		// Handle trailing slash (directory-only match)
-		// For glob exclude, we treat it as matching the dir and its contents
-		const isDirectoryOnly = pattern.endsWith("/");
-		if (isDirectoryOnly) {
-			pattern = pattern.slice(0, -1);
-		}
-
-		// Handle rooted patterns (start with /)
-		if (pattern.startsWith("/")) {
-			// Rooted pattern: relative to the .gitignore location
-			const absolutePattern = path.join(gitignoreDir, pattern.slice(1));
-			const relativeToBase = path.relative(baseDir, absolutePattern);
-			if (relativeToBase.startsWith("..")) {
-				// Pattern is outside the search directory, skip
-				continue;
-			}
-			pattern = relativeToBase.replace(/\\/g, "/");
-			if (isDirectoryOnly) {
-				patterns.push(pattern);
-				patterns.push(`${pattern}/**`);
-			} else {
-				patterns.push(pattern);
-			}
-		} else {
-			// Unrooted pattern: match anywhere in the tree
-			if (pattern.includes("/")) {
-				// Contains slash: match from any directory level
-				patterns.push(`**/${pattern}`);
-				if (isDirectoryOnly) {
-					patterns.push(`**/${pattern}/**`);
-				}
-			} else {
-				// No slash: match file/dir name anywhere
-				patterns.push(`**/${pattern}`);
-				if (isDirectoryOnly) {
-					patterns.push(`**/${pattern}/**`);
-				}
-			}
-		}
-	}
-
-	return patterns;
-}
-
-/**
- * Load .gitignore patterns from a directory and its parents.
- * Walks up the directory tree to find all applicable .gitignore files.
- * Returns glob-compatible exclude patterns.
- */
-export async function loadGitignorePatterns(baseDir: string): Promise<string[]> {
-	const patterns: string[] = [];
-	const absoluteBase = path.resolve(baseDir);
-
-	let current = absoluteBase;
-	const maxDepth = 50; // Prevent infinite loops
-
-	for (let i = 0; i < maxDepth; i++) {
-		const gitignorePath = path.join(current, ".gitignore");
-
-		try {
-			const content = await Bun.file(gitignorePath).text();
-			const filePatterns = parseGitignorePatterns(content, current, absoluteBase);
-			patterns.push(...filePatterns);
-		} catch {
-			// .gitignore doesn't exist or can't be read, continue
-		}
-
-		const parent = path.dirname(current);
-		if (parent === current) {
-			// Reached filesystem root
-			break;
-		}
-		current = parent;
-	}
-
-	return patterns;
-}
-
-/**
- * Resolve filesystem paths matching glob patterns with optional exclude filters.
- * Returns paths relative to the provided cwd (or getProjectDir()).
- * Errors and abort/timeouts are surfaced to the caller.
- */
-export async function globPaths(patterns: string | string[], options: GlobPathsOptions = {}): Promise<string[]> {
-	const { cwd, exclude, signal, timeoutMs, dot, onlyFiles = true, gitignore } = options;
-
-	// Build exclude list: always exclude .git, exclude node_modules unless pattern references it
-	const patternArray = Array.isArray(patterns) ? patterns : [patterns];
-	const mentionsNodeModules = patternArray.some(p => p.includes("node_modules"));
-
-	const baseExclude = mentionsNodeModules ? [...ALWAYS_IGNORED] : [...ALWAYS_IGNORED, ...NODE_MODULES_IGNORED];
-	let effectiveExclude = exclude ? [...baseExclude, ...exclude] : baseExclude;
-
-	if (gitignore) {
-		const gitignorePatterns = await loadGitignorePatterns(cwd ?? getProjectDir());
-		effectiveExclude = [...effectiveExclude, ...gitignorePatterns];
-	}
-
-	const base = cwd ?? getProjectDir();
-	const allResults: string[] = [];
-
-	// Combine timeout and abort signals
-	const timeoutSignal = timeoutMs ? AbortSignal.timeout(timeoutMs) : undefined;
-	const combinedSignal =
-		signal && timeoutSignal ? AbortSignal.any([signal, timeoutSignal]) : (signal ?? timeoutSignal);
-
-	for (const pattern of patternArray) {
-		const glob = new Glob(pattern);
-		const scanOptions = {
-			cwd: base,
-			dot,
-			onlyFiles,
-			throwErrorOnBrokenSymlink: false,
-		};
-
-		for await (const entry of glob.scan(scanOptions)) {
-			if (combinedSignal?.aborted) {
-				const reason = combinedSignal.reason;
-				if (reason instanceof Error) throw reason;
-				throw new DOMException("Aborted", "AbortError");
-			}
-
-			// Check exclusion patterns
-			const normalized = entry.replace(/\\/g, "/");
-			let excluded = false;
-			for (const excludePattern of effectiveExclude) {
-				const excludeGlob = new Glob(excludePattern);
-				if (excludeGlob.match(normalized)) {
-					excluded = true;
-					break;
-				}
-			}
-			if (!excluded) {
-				allResults.push(normalized);
-			}
-		}
-	}
-
-	return allResults;
-}