@mmerterden/multi-agent-toolkit-mcp 3.9.0 → 3.12.0

package/tools/code-intel/swift.js

@@ -0,0 +1,249 @@
+/**
+ * swift.js  -  sourcekit-lsp, and an honest account of what it can answer.
+ *
+ * CAPABILITY IS NOT CAPABILITY. `initialize` returns `referencesProvider: true`
+ * whether or not references will ever be non-empty. Measured on this machine:
+ * against a package root, `textDocument/references` answered `[]` at 694ms and
+ * `[3]` at 5.8s, with nothing changed in between except that the background
+ * index had finished. Against a real 658-file package with dependencies it was
+ * still `[]` at 70s, having spent that time resolving and fetching. So the
+ * useful question is never "does the server say it supports references" but
+ * "has the index for this root settled", and that is what `indexReport` answers
+ * and what the reference tools wait on.
+ *
+ * WORKSPACE ROOT decides everything else. sourcekit-lsp takes its compiler
+ * arguments from a build system, and which one it finds determines whether the
+ * answers are semantic or a guess. The resolution order below is by strength of
+ * evidence, and whichever one matched is returned in every result, because a
+ * caller reading "0 references" deserves to know it came from a fallback.
+ *
+ * @module tools/code-intel/swift
+ */
+
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { dirname, join, basename } from "node:path";
+import { homedir } from "node:os";
+import { execFileSync } from "node:child_process";
+
+/** Directories a root walk must not climb into or count. */
+const SKIP_DIRS = new Set([".git", ".build", "build", "DerivedData", "Pods", "node_modules"]);
+
+let cachedBin;
+
+/**
+ * Where sourcekit-lsp is.
+ *
+ * PATH before `xcrun` on purpose: it is what lets a test put a fake server on
+ * PATH and have it used, and on a real machine `/usr/bin/sourcekit-lsp` is on
+ * PATH anyway. `SOURCEKIT_LSP_PATH` wins over both.
+ */
+export function resolveSwiftBin() {
+  if (cachedBin !== undefined) return cachedBin;
+  const explicit = process.env.SOURCEKIT_LSP_PATH;
+  if (explicit && existsSync(explicit)) return (cachedBin = explicit);
+  const onPath = which("sourcekit-lsp");
+  if (onPath) return (cachedBin = onPath);
+  try {
+    const found = execFileSync("xcrun", ["--find", "sourcekit-lsp"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 10000,
+    }).trim();
+    if (found && existsSync(found)) return (cachedBin = found);
+  } catch {
+    /* no Xcode */
+  }
+  return (cachedBin = null);
+}
+
+function which(cmd) {
+  try {
+    const p = execFileSync("/usr/bin/which", [cmd], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5000,
+    }).trim();
+    return p && existsSync(p) ? p : null;
+  } catch {
+    return null;
+  }
+}
+
+/** For tests, which change PATH between cases. */
+export function resetSwiftBinCache() {
+  cachedBin = undefined;
+}
+
+/**
+ * The strongest build-settings source at or above `file`.
+ *
+ * @returns {{root: string, source: string}}
+ */
+export function resolveWorkspaceRoot(file, explicitRoot) {
+  if (explicitRoot) return { root: explicitRoot, source: classify(explicitRoot) };
+  let dir = statSafe(file)?.isDirectory() ? file : dirname(file);
+  const seen = [];
+  for (let i = 0; i < 40 && dir && dir !== "/"; i++) {
+    seen.push(dir);
+    const s = classify(dir);
+    if (s !== "none") return { root: dir, source: s };
+    dir = dirname(dir);
+  }
+  const git = gitRoot(file);
+  if (git) return { root: git, source: "fallback" };
+  return { root: seen[0] || dirname(file), source: "fallback" };
+}
+
+function classify(dir) {
+  if (existsSync(join(dir, "buildServer.json"))) return "buildServer";
+  if (existsSync(join(dir, "Package.swift"))) return "swiftpm";
+  if (existsSync(join(dir, "compile_commands.json"))) return "compilationDatabase";
+  if (existsSync(join(dir, "compile_flags.txt"))) return "compilationDatabase";
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return "none";
+  }
+  if (entries.some((e) => e.endsWith(".xcworkspace") || e.endsWith(".xcodeproj"))) return "xcode";
+  return "none";
+}
+
+function statSafe(p) {
+  try {
+    return statSync(p);
+  } catch {
+    return null;
+  }
+}
+
+function gitRoot(file) {
+  try {
+    return execFileSync("git", ["-C", dirname(file), "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5000,
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What an answer from this root is worth, before any question is asked.
+ *
+ * `semantic` is the headline: true when cross-file answers can be trusted,
+ * false when the server will still reply but from fallback arguments. Nothing
+ * here starts a server - it is the tool a caller runs BECAUSE something is
+ * missing, so it must never be the thing that fails.
+ */
+export function indexReport(root, source) {
+  const spm = [
+    join(root, ".build", "index-build"),
+    join(root, ".build", "index-store"),
+  ].filter(existsSync);
+  const derived = derivedDataStore(root);
+  const built = spm.length > 0 || Boolean(derived);
+
+  const semantic = source === "swiftpm" || source === "buildServer" || source === "compilationDatabase";
+  const report = {
+    root,
+    buildSettingsSource: source,
+    semantic,
+    indexStore: derived || spm[0] || null,
+    indexBuilt: built,
+    remedy: [],
+  };
+  if (derived) {
+    const units = countUnits(join(derived, "v5", "units"));
+    if (units) {
+      report.unitCount = units.count;
+      report.newestUnit = new Date(units.newest).toISOString();
+    }
+  }
+  if (source === "xcode") {
+    report.remedy.push(
+      "This root is an Xcode project with no buildServer.json, so sourcekit-lsp falls back to default compiler arguments: cross-module answers and diagnostics will be wrong rather than missing. `brew install xcode-build-server && xcode-build-server config -project <X>.xcodeproj -scheme <S>` fixes it. Nothing here writes that file for you.",
+    );
+  }
+  if (source === "fallback") {
+    report.remedy.push(
+      "No build system was found at or above this file. Point --workspace_root at the package or project root.",
+    );
+  }
+  if (semantic && !built) {
+    report.remedy.push(
+      "No index on disk yet. The first cross-file question builds one in the background; on a package with dependencies that is minutes, not seconds.",
+    );
+  }
+  return report;
+}
+
+/**
+ * Xcode writes its index under DerivedData, in `<name>-<hash>`.
+ *
+ * `<name>` is the PROJECT's name, not the directory's, and the two differ often
+ * enough that assuming they match is the failure mode this whole file exists to
+ * avoid. Measured on a checkout whose directory name and `.xcodeproj` name had
+ * nothing in common: reported as having no index at all, while an 18,205-unit
+ * store sat under the project's name, and the remedy printed underneath told
+ * the caller to build one. So the candidate names come from the project and
+ * workspace files in the root, with the directory name last.
+ *
+ * Several folders can share a prefix - the same project checked out twice. The
+ * newest store wins, because the question being asked is about freshness.
+ */
+function derivedDataStore(root) {
+  const dd = join(homedir(), "Library", "Developer", "Xcode", "DerivedData");
+  let entries;
+  try {
+    entries = readdirSync(dd);
+  } catch {
+    return null;
+  }
+  const names = new Set([basename(root)]);
+  try {
+    for (const e of readdirSync(root)) {
+      const m = /^(.+)\.(xcodeproj|xcworkspace)$/.exec(e);
+      if (m) names.add(m[1]);
+    }
+  } catch {
+    /* unreadable root: the directory name is still a candidate */
+  }
+  let best = null;
+  for (const c of entries) {
+    const dash = c.lastIndexOf("-");
+    if (dash <= 0 || !names.has(c.slice(0, dash))) continue;
+    const store = join(dd, c, "Index.noindex", "DataStore");
+    if (!existsSync(store)) continue;
+    const s = statSafe(join(store, "v5", "units")) || statSafe(store);
+    const at = s ? s.mtimeMs : 0;
+    if (!best || at > best.at) best = { store, at };
+  }
+  return best ? best.store : null;
+}
+
+/**
+ * How many index units there are, and when one was last written.
+ *
+ * Freshness is taken from the DIRECTORY's mtime, not from a sample of the files
+ * in it. A store here holds 34,380 units: stat-ing all of them costs 1.8s, and
+ * stat-ing the first 200 of a readdir costs nothing but answers about an
+ * arbitrary 200 - directory order is a hash, not a timeline, so the number it
+ * produces is the newest of whichever units happened to come first. It was
+ * correct on the measured store by luck and nothing made that visible. A unit
+ * is written as a new file, which bumps the directory, so one syscall answers
+ * exactly: measured at 2ms from the true maximum over all 34,380.
+ */
+function countUnits(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return null;
+  }
+  const s = statSafe(dir);
+  return { count: entries.length, newest: s ? s.mtimeMs : Date.now() };
+}
+
+export { SKIP_DIRS };

package/tools/ios-app-store-audit/context.js

@@ -3,14 +3,22 @@
  * 18 rules consume. Direct port of XCArchiveParser.swift +
  * InfoPlistParser.swift + PrivacyManifestParser.swift + EntitlementParser.swift.
  *
- * Plist parsing is delegated to `plutil -convert json` (system binary on
- * macOS, ships with the OS) - more reliable than any Node `plist` package
- * across the long tail of Apple plist quirks (binary plists, XML-with-DTD,
- * mixed array/dict roots).
+ * Plist parsing prefers `plutil -convert json` (system binary on macOS, ships
+ * with the OS) - more reliable than any Node `plist` package across the long
+ * tail of Apple plist quirks (binary plists, XML-with-DTD, mixed array/dict
+ * roots).
+ *
+ * When plutil is absent it falls back to a small XML reader, and when even that
+ * cannot apply - a binary plist off macOS - it records the miss rather than
+ * returning an empty object. That distinction is the whole point: every rule
+ * reads `infoPlist`, so a silent `{}` makes an unreadable archive audit exactly
+ * like a compliant one, and the tool answers PASS because it saw nothing. It
+ * shipped that way; a run with no plutil on PATH reported zero violations on a
+ * deliberately non-compliant fixture.
  */
 
 import { execSync } from "child_process";
-import { existsSync, readdirSync, statSync } from "fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { shq } from "./models.js";
 import { join, basename } from "path";
 
@@ -23,16 +31,159 @@ function run(cmd) {
   }
 }
 
-/** Parse a binary or XML plist file into a JS object via `plutil`. */
+/** True when the `plutil` binary is on PATH. Probed once. */
+let _hasPlutil = null;
+export function hasPlutil() {
+  if (_hasPlutil === null) _hasPlutil = run("command -v plutil") !== "";
+  return _hasPlutil;
+}
+
+/**
+ * Plists this process could not read, as absolute paths. A rule that finds
+ * nothing in an unread plist is not evidence of compliance, and runAudit turns
+ * a non-empty list into a finding rather than letting the verdict stand.
+ */
+export const unreadablePlists = new Set();
+
+/**
+ * Empty the record. runAudit calls this before it parses anything, so the set
+ * describes the run being reported and not every run this process has done.
+ */
+export function resetUnreadablePlists() {
+  unreadablePlists.clear();
+}
+
+/** Decode the XML entities a plist can carry. */
+function unescapeXml(s) {
+  return s
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&#(\d+);/g, (_, d) => String.fromCharCode(Number(d)))
+    .replace(/&amp;/g, "&");
+}
+
+/**
+ * Minimal XML-plist reader for hosts without plutil.
+ *
+ * Deliberately small: it handles the element set an Info.plist, an entitlements
+ * file and a PrivacyInfo.xcprivacy actually use. It is not a general plist
+ * implementation and makes no attempt at binary plists - those return null and
+ * are recorded as unreadable, which is the honest answer.
+ *
+ * @param {string} xml
+ * @returns {object|Array|null}
+ */
+export function parseXmlPlist(xml) {
+  // <!DOCTYPE ...> and <?xml ...?> carry nothing we need and complicate the scan.
+  const body = xml.replace(/<\?xml[^>]*\?>/g, "").replace(/<!DOCTYPE[^>]*>/g, "");
+  const tokens = body.match(/<\/?[A-Za-z]+(?:\s[^>]*)?\/?>|[^<]+/g);
+  if (!tokens) return null;
+  let i = 0;
+
+  const next = () => tokens[i++];
+  const peek = () => tokens[i];
+
+  function readValue(tag) {
+    switch (tag) {
+      case "dict": {
+        const out = {};
+        for (;;) {
+          const t = peek();
+          if (t === undefined || t === "</dict>") {
+            next();
+            return out;
+          }
+          if (t === "<key>") {
+            next();
+            const k = unescapeXml(String(next() ?? "").trim());
+            next(); // </key>
+            const vt = String(next() ?? "").trim();
+            out[k] = readValue(vt.replace(/^<|\/?>$/g, "").split(/\s/)[0]);
+          } else {
+            next();
+          }
+        }
+      }
+      case "array": {
+        const out = [];
+        for (;;) {
+          const t = peek();
+          if (t === undefined || t === "</array>") {
+            next();
+            return out;
+          }
+          const vt = String(next() ?? "").trim();
+          if (!vt.startsWith("<")) continue;
+          out.push(readValue(vt.replace(/^<|\/?>$/g, "").split(/\s/)[0]));
+        }
+      }
+      case "string":
+      case "data":
+      case "date": {
+        const raw = peek() !== undefined && !String(peek()).startsWith("<") ? String(next()) : "";
+        if (String(peek() ?? "").startsWith("</")) next();
+        return unescapeXml(raw);
+      }
+      case "integer":
+      case "real": {
+        const raw = peek() !== undefined && !String(peek()).startsWith("<") ? String(next()) : "0";
+        if (String(peek() ?? "").startsWith("</")) next();
+        return Number(raw.trim());
+      }
+      case "true":
+        return true;
+      case "false":
+        return false;
+      default:
+        return null;
+    }
+  }
+
+  for (;;) {
+    const t = next();
+    if (t === undefined) return null;
+    const s = String(t).trim();
+    if (!s.startsWith("<plist")) continue;
+    for (;;) {
+      const u = next();
+      if (u === undefined) return null;
+      const v = String(u).trim();
+      if (!v.startsWith("<")) continue;
+      return readValue(v.replace(/^<|\/?>$/g, "").split(/\s/)[0]);
+    }
+  }
+}
+
+/** Parse a binary or XML plist file into a JS object. */
 export function parsePlist(plistPath) {
   if (!existsSync(plistPath)) return null;
-  const json = run(`plutil -convert json -o - ${shq(plistPath)} 2>/dev/null`);
-  if (!json) return null;
+  if (hasPlutil()) {
+    const json = run(`plutil -convert json -o - ${shq(plistPath)} 2>/dev/null`);
+    if (json) {
+      try {
+        return JSON.parse(json);
+      } catch {
+        /* fall through to the XML reader */
+      }
+    }
+  }
+  let raw;
   try {
-    return JSON.parse(json);
+    raw = readFileSync(plistPath, "utf-8");
   } catch {
+    unreadablePlists.add(plistPath);
+    return null;
+  }
+  // A binary plist starts with the magic "bplist"; there is no reading it here.
+  if (raw.startsWith("bplist")) {
+    unreadablePlists.add(plistPath);
     return null;
   }
+  const parsed = parseXmlPlist(raw);
+  if (parsed === null) unreadablePlists.add(plistPath);
+  return parsed;
 }
 
 /** Recursively measure total size of a directory in bytes. */

package/tools/ios-app-store-audit/index.js

@@ -21,7 +21,7 @@
  * the rest of the scan.
  */
 
-import { parseArchive } from "./context.js";
+import { hasPlutil, parseArchive, resetUnreadablePlists, unreadablePlists } from "./context.js";
 import { compareSeverity } from "./models.js";
 
 // ---------- Rule registry --------------------------------------------------
@@ -93,6 +93,7 @@ function resolveRuleSelection(rules) {
  * @returns {Promise<object>} structured audit report
  */
 export async function runAudit({ archivePath, rules = "all", options = {} } = {}) {
+  resetUnreadablePlists();
   const ctx = parseArchive(archivePath);
 
   const selectedIDs = new Set(resolveRuleSelection(rules));
@@ -134,6 +135,25 @@ export async function runAudit({ archivePath, rules = "all", options = {} } = {}
     }
   }
 
+  // A rule that found nothing in a plist nobody could read has not measured
+  // anything, and the audit must not let that reach the caller as compliance.
+  // Every rule reads infoPlist, so one unread plist can silence all eighteen:
+  // the tool answered PASS on a deliberately non-compliant fixture the first
+  // time it ran on a host without plutil. Reported as an error so the verdict
+  // is not PASS, with the cause named - this is the tool's reach, not the
+  // archive's fault.
+  const unreadable = [...unreadablePlists].sort();
+  if (unreadable.length > 0) {
+    violations.push({
+      ruleID: "archive-readable",
+      severity: "error",
+      message: `${unreadable.length} plist(s) could not be read, so the rules below them measured nothing: ${unreadable.join(", ")}`,
+      suggestion: hasPlutil()
+        ? "The files are present but neither plutil nor the XML reader could parse them. Re-export the archive, or open an issue with one of the files attached."
+        : "Binary plists need `plutil`, which ships with macOS. Run this audit on macOS, or convert the archive's plists to XML first (`plutil -convert xml1`).",
+    });
+  }
+
   // Sort: error → warning → info, then by ruleID alphabetically inside each.
   violations.sort((a, b) => {
     const c = compareSeverity(b.severity, a.severity);
@@ -156,6 +176,9 @@ export async function runAudit({ archivePath, rules = "all", options = {} } = {}
     app: ctx.appName,
     rulesRun: ranIDs,
     rulesSkipped: skippedIDs,
+    // Explicit, so a caller can tell "clean" from "could not look".
+    measurable: unreadable.length === 0,
+    unreadablePlists: unreadable,
     summary,
     verdict,
     violations,

package/tools/offload/index.js

@@ -58,15 +58,35 @@ function pruneEntries(dir, { keepFiles, keepDays, now, keep, match }) {
         }
       })
       .filter(Boolean)
-      .sort((a, b) => b.mtime - a.mtime);
-
-    for (let i = 0; i < entries.length; i++) {
-      if (keepSet.has(resolve(entries[i].full))) continue;
-      const tooOld = entries[i].mtime < cutoff;
-      const tooMany = i >= keepFiles;
-      if (!tooOld && !tooMany) continue;
+      // Name as the tie-break, because mtime ties are not a corner case. APFS
+      // records nanoseconds, so five files written in a loop have five distinct
+      // stamps; ext4 on a CI runner records one, so they have the same stamp and
+      // "the newest" is whatever order readdir happened to return. Without this
+      // the retained set differs per filesystem.
+      .sort((a, b) => b.mtime - a.mtime || (a.full < b.full ? 1 : a.full > b.full ? -1 : 0));
+
+    // keepFiles is the size of the directory after the prune, not the size of
+    // the part of it retention got to decide. A promised file is one of the
+    // survivors, so it takes one of the slots - reserved up front rather than
+    // counted as the loop reaches it, because otherwise the answer depends on
+    // where that file happens to sort. It used to be neither: a keepSet entry
+    // was skipped without consuming anything, so keepFiles: 1 plus one promised
+    // file left TWO files behind. On APFS the promised file is genuinely the
+    // newest and sorted first, which hid it; on a filesystem whose mtimes tie it
+    // sorted anywhere and the directory kept a stale file forever.
+    const reserved = entries.filter((e) => keepSet.has(resolve(e.full))).length;
+    const budget = Math.max(0, keepFiles - reserved);
+    let kept = 0;
+    for (const entry of entries) {
+      if (keepSet.has(resolve(entry.full))) continue;
+      const tooOld = entry.mtime < cutoff;
+      const tooMany = kept >= budget;
+      if (!tooOld && !tooMany) {
+        kept++;
+        continue;
+      }
       try {
-        rmSync(entries[i].full, { recursive: true, force: true });
+        rmSync(entry.full, { recursive: true, force: true });
         removed++;
       } catch {
         // A file another process holds open is skipped, not fatal.