@nerviq/cli 1.20.0 → 1.21.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +23 -23
- package/README.md +2 -2
- package/bin/cli.js +1 -0
- package/package.json +2 -1
- package/src/activity.js +1039 -1039
- package/src/adoption-advisor.js +299 -299
- package/src/aider/config-parser.js +166 -166
- package/src/aider/context.js +6 -2
- package/src/aider/deep-review.js +316 -316
- package/src/aider/domain-packs.js +303 -303
- package/src/aider/freshness.js +93 -93
- package/src/aider/governance.js +253 -253
- package/src/aider/interactive.js +334 -334
- package/src/aider/mcp-packs.js +329 -329
- package/src/aider/patch.js +214 -214
- package/src/aider/plans.js +186 -186
- package/src/aider/premium.js +360 -360
- package/src/aider/setup.js +404 -404
- package/src/aider/techniques.js +312 -67
- package/src/analyze.js +951 -951
- package/src/anti-patterns.js +485 -485
- package/src/audit/instruction-files.js +180 -180
- package/src/audit/recommendations.js +577 -577
- package/src/auto-suggest.js +154 -154
- package/src/badge.js +13 -13
- package/src/behavioral-drift.js +801 -801
- package/src/benchmark.js +67 -67
- package/src/catalog.js +103 -103
- package/src/certification.js +128 -128
- package/src/codex/config-parser.js +183 -183
- package/src/codex/context.js +223 -223
- package/src/codex/deep-review.js +493 -493
- package/src/codex/domain-packs.js +394 -394
- package/src/codex/freshness.js +84 -84
- package/src/codex/governance.js +192 -192
- package/src/codex/interactive.js +618 -618
- package/src/codex/mcp-packs.js +914 -914
- package/src/codex/patch.js +209 -209
- package/src/codex/plans.js +251 -251
- package/src/codex/premium.js +614 -614
- package/src/codex/setup.js +591 -591
- package/src/context.js +10 -4
- package/src/continuous-ops.js +681 -681
- package/src/copilot/activity.js +309 -309
- package/src/copilot/deep-review.js +346 -346
- package/src/copilot/domain-packs.js +372 -372
- package/src/copilot/freshness.js +57 -57
- package/src/copilot/governance.js +222 -222
- package/src/copilot/interactive.js +406 -406
- package/src/copilot/mcp-packs.js +826 -826
- package/src/copilot/plans.js +253 -253
- package/src/copilot/premium.js +451 -451
- package/src/copilot/setup.js +488 -488
- package/src/cost-tracking.js +61 -61
- package/src/cursor/activity.js +301 -301
- package/src/cursor/config-parser.js +265 -265
- package/src/cursor/context.js +256 -256
- package/src/cursor/deep-review.js +334 -334
- package/src/cursor/domain-packs.js +368 -368
- package/src/cursor/freshness.js +65 -65
- package/src/cursor/governance.js +229 -229
- package/src/cursor/interactive.js +391 -391
- package/src/cursor/mcp-packs.js +828 -828
- package/src/cursor/plans.js +254 -254
- package/src/cursor/premium.js +469 -469
- package/src/cursor/setup.js +488 -488
- package/src/dashboard.js +493 -493
- package/src/deep-review.js +428 -428
- package/src/deprecation.js +98 -98
- package/src/diff-only.js +280 -280
- package/src/doctor.js +119 -119
- package/src/domain-pack-expansion.js +1033 -1033
- package/src/domain-packs.js +387 -387
- package/src/feedback.js +178 -178
- package/src/fix-engine.js +783 -783
- package/src/fix-prompts.js +122 -122
- package/src/formatters/sarif.js +115 -115
- package/src/freshness.js +74 -74
- package/src/gemini/config-parser.js +275 -275
- package/src/gemini/deep-review.js +559 -559
- package/src/gemini/domain-packs.js +393 -393
- package/src/gemini/freshness.js +66 -66
- package/src/gemini/governance.js +201 -201
- package/src/gemini/interactive.js +860 -860
- package/src/gemini/mcp-packs.js +915 -915
- package/src/gemini/plans.js +269 -269
- package/src/gemini/premium.js +760 -760
- package/src/gemini/setup.js +692 -692
- package/src/governance.js +72 -72
- package/src/harmony/add.js +68 -68
- package/src/harmony/advisor.js +333 -333
- package/src/harmony/canon.js +565 -565
- package/src/harmony/cli.js +591 -591
- package/src/harmony/drift.js +401 -401
- package/src/harmony/governance.js +313 -313
- package/src/harmony/memory.js +239 -239
- package/src/harmony/sync.js +475 -475
- package/src/harmony/watch.js +370 -370
- package/src/hook-validation.js +342 -342
- package/src/index.js +271 -271
- package/src/init.js +184 -184
- package/src/instruction-surfaces.js +185 -185
- package/src/integrations.js +144 -144
- package/src/interactive.js +118 -118
- package/src/locales/en.json +1 -1
- package/src/locales/es.json +1 -1
- package/src/mcp-packs.js +830 -830
- package/src/mcp-server.js +726 -726
- package/src/mcp-validation.js +337 -337
- package/src/nerviq-sync.json +7 -7
- package/src/opencode/config-parser.js +109 -109
- package/src/opencode/context.js +247 -247
- package/src/opencode/deep-review.js +313 -313
- package/src/opencode/domain-packs.js +262 -262
- package/src/opencode/freshness.js +66 -66
- package/src/opencode/governance.js +159 -159
- package/src/opencode/interactive.js +392 -392
- package/src/opencode/mcp-packs.js +705 -705
- package/src/opencode/patch.js +184 -184
- package/src/opencode/plans.js +231 -231
- package/src/opencode/premium.js +413 -413
- package/src/opencode/setup.js +449 -449
- package/src/opencode/techniques.js +27 -27
- package/src/operating-profile.js +574 -574
- package/src/org.js +152 -152
- package/src/permission-rules.js +218 -218
- package/src/plans.js +839 -839
- package/src/platform-change-manifest.js +86 -86
- package/src/plugins.js +110 -110
- package/src/policy-layers.js +210 -210
- package/src/profiles.js +124 -124
- package/src/prompt-injection.js +74 -74
- package/src/public-api.js +173 -173
- package/src/recommendation-rules.js +84 -84
- package/src/repo-archetype.js +386 -386
- package/src/secret-patterns.js +39 -39
- package/src/server.js +527 -527
- package/src/setup/analysis.js +607 -607
- package/src/setup/runtime.js +172 -172
- package/src/setup.js +677 -677
- package/src/shared/capabilities.js +194 -194
- package/src/source-urls.js +132 -132
- package/src/stack-checks.js +565 -565
- package/src/supplemental-checks.js +13 -13
- package/src/synergy/adaptive.js +261 -261
- package/src/synergy/compensation.js +137 -137
- package/src/synergy/evidence.js +193 -193
- package/src/synergy/learning.js +199 -199
- package/src/synergy/patterns.js +227 -227
- package/src/synergy/ranking.js +83 -83
- package/src/synergy/report.js +165 -165
- package/src/synergy/routing.js +146 -146
- package/src/techniques/api.js +407 -407
- package/src/techniques/automation.js +316 -316
- package/src/techniques/compliance.js +257 -257
- package/src/techniques/hygiene.js +294 -294
- package/src/techniques/instructions.js +243 -243
- package/src/techniques/observability.js +226 -226
- package/src/techniques/optimization.js +142 -142
- package/src/techniques/quality.js +318 -318
- package/src/techniques/security.js +237 -237
- package/src/techniques/shared.js +443 -443
- package/src/techniques/stacks.js +2294 -2294
- package/src/techniques/tools.js +106 -106
- package/src/techniques/workflow.js +413 -413
- package/src/techniques.js +81 -81
- package/src/terminology.js +73 -73
- package/src/token-estimate.js +35 -35
- package/src/usage-patterns.js +99 -99
- package/src/verification-metadata.js +145 -145
- package/src/watch.js +247 -247
- package/src/windsurf/activity.js +302 -302
- package/src/windsurf/config-parser.js +267 -267
- package/src/windsurf/context.js +120 -10
- package/src/windsurf/deep-review.js +337 -337
- package/src/windsurf/domain-packs.js +370 -370
- package/src/windsurf/freshness.js +36 -36
- package/src/windsurf/governance.js +231 -231
- package/src/windsurf/interactive.js +388 -388
- package/src/windsurf/mcp-packs.js +792 -792
- package/src/windsurf/plans.js +247 -247
- package/src/windsurf/premium.js +468 -468
- package/src/windsurf/setup.js +471 -471
- package/src/windsurf/techniques.js +155 -33
- package/src/workspace.js +375 -375
|
@@ -1,267 +1,267 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Windsurf config parser.
|
|
3
|
-
*
|
|
4
|
-
* Windsurf uses Markdown + YAML frontmatter for .windsurf/rules/*.md,
|
|
5
|
-
* and JSON for .windsurf/mcp.json and other config.
|
|
6
|
-
* Key difference from Cursor: NO MDC format — standard Markdown with YAML frontmatter.
|
|
7
|
-
* 4 activation modes: Always, Auto, Agent-Requested, Manual.
|
|
8
|
-
* 10K char rule limit per file.
|
|
9
|
-
* This module handles both formats with unified value extraction.
|
|
10
|
-
*/
|
|
11
|
-
|
|
12
|
-
// ─── JSON parsing ────────────────────────────────────────────────────────────
|
|
13
|
-
|
|
14
|
-
function tryParseJson(content) {
|
|
15
|
-
try {
|
|
16
|
-
const data = JSON.parse(content);
|
|
17
|
-
return { ok: true, data, error: null };
|
|
18
|
-
} catch (error) {
|
|
19
|
-
return { ok: false, data: null, error: error.message };
|
|
20
|
-
}
|
|
21
|
-
}
|
|
22
|
-
|
|
23
|
-
// ─── YAML frontmatter parsing (Markdown files) ─────────────────────────────
|
|
24
|
-
|
|
25
|
-
/**
|
|
26
|
-
* Parse a Windsurf rule file (YAML frontmatter delimited by --- + Markdown body).
|
|
27
|
-
* Returns { frontmatter: object|null, body: string, raw: string|null }
|
|
28
|
-
*/
|
|
29
|
-
function parseWindsurfRule(content) {
|
|
30
|
-
if (!content || typeof content !== 'string') {
|
|
31
|
-
return { frontmatter: null, body: content || '', raw: null };
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
const trimmed = content.trimStart();
|
|
35
|
-
if (!trimmed.startsWith('---')) {
|
|
36
|
-
return { frontmatter: null, body: content, raw: null };
|
|
37
|
-
}
|
|
38
|
-
|
|
39
|
-
const endIdx = trimmed.indexOf('---', 3);
|
|
40
|
-
if (endIdx === -1) {
|
|
41
|
-
return { frontmatter: null, body: content, raw: null };
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
const raw = trimmed.slice(3, endIdx).trim();
|
|
45
|
-
const body = trimmed.slice(endIdx + 3).trim();
|
|
46
|
-
const frontmatter = parseSimpleYaml(raw);
|
|
47
|
-
|
|
48
|
-
return { frontmatter, body, raw };
|
|
49
|
-
}
|
|
50
|
-
|
|
51
|
-
/**
|
|
52
|
-
* Minimal YAML parser for Windsurf rule frontmatter fields.
|
|
53
|
-
* Handles: key: value, key: [item1, item2], key: "quoted", booleans, numbers.
|
|
54
|
-
* Also handles multi-line array syntax (indented with -).
|
|
55
|
-
*/
|
|
56
|
-
function parseSimpleYaml(yamlStr) {
|
|
57
|
-
if (!yamlStr || typeof yamlStr !== 'string') return {};
|
|
58
|
-
|
|
59
|
-
const result = {};
|
|
60
|
-
const lines = yamlStr.split(/\r?\n/);
|
|
61
|
-
let currentKey = null;
|
|
62
|
-
let currentArray = null;
|
|
63
|
-
|
|
64
|
-
for (const line of lines) {
|
|
65
|
-
const trimmedLine = line.trim();
|
|
66
|
-
if (!trimmedLine || trimmedLine.startsWith('#')) continue;
|
|
67
|
-
|
|
68
|
-
// Check for multi-line array item ( - "value")
|
|
69
|
-
if (currentKey && currentArray !== null && /^\s*-\s+/.test(line)) {
|
|
70
|
-
const itemValue = trimmedLine.slice(1).trim();
|
|
71
|
-
currentArray.push(stripQuotes(itemValue));
|
|
72
|
-
continue;
|
|
73
|
-
}
|
|
74
|
-
|
|
75
|
-
// If we were collecting an array, commit it
|
|
76
|
-
if (currentKey && currentArray !== null) {
|
|
77
|
-
result[currentKey] = currentArray;
|
|
78
|
-
currentKey = null;
|
|
79
|
-
currentArray = null;
|
|
80
|
-
}
|
|
81
|
-
|
|
82
|
-
const colonIdx = trimmedLine.indexOf(':');
|
|
83
|
-
if (colonIdx === -1) continue;
|
|
84
|
-
|
|
85
|
-
const key = trimmedLine.slice(0, colonIdx).trim();
|
|
86
|
-
let value = trimmedLine.slice(colonIdx + 1).trim();
|
|
87
|
-
|
|
88
|
-
if (!key) continue;
|
|
89
|
-
|
|
90
|
-
// Parse value
|
|
91
|
-
if (value === '') {
|
|
92
|
-
// Could be start of multi-line array
|
|
93
|
-
currentKey = key;
|
|
94
|
-
currentArray = [];
|
|
95
|
-
} else if (value.startsWith('[') && value.endsWith(']')) {
|
|
96
|
-
// Inline array: [item1, item2]
|
|
97
|
-
const inner = value.slice(1, -1).trim();
|
|
98
|
-
if (!inner) {
|
|
99
|
-
result[key] = [];
|
|
100
|
-
} else {
|
|
101
|
-
result[key] = inner.split(',').map(item => {
|
|
102
|
-
const t = item.trim();
|
|
103
|
-
return stripQuotes(t);
|
|
104
|
-
});
|
|
105
|
-
}
|
|
106
|
-
} else if ((value.startsWith('"') && value.endsWith('"')) ||
|
|
107
|
-
(value.startsWith("'") && value.endsWith("'"))) {
|
|
108
|
-
result[key] = value.slice(1, -1);
|
|
109
|
-
} else if (value === 'true') {
|
|
110
|
-
result[key] = true;
|
|
111
|
-
} else if (value === 'false') {
|
|
112
|
-
result[key] = false;
|
|
113
|
-
} else if (/^-?\d+$/.test(value)) {
|
|
114
|
-
result[key] = parseInt(value, 10);
|
|
115
|
-
} else if (/^-?\d+\.\d+$/.test(value)) {
|
|
116
|
-
result[key] = parseFloat(value);
|
|
117
|
-
} else {
|
|
118
|
-
result[key] = value;
|
|
119
|
-
}
|
|
120
|
-
}
|
|
121
|
-
|
|
122
|
-
// Commit any remaining array
|
|
123
|
-
if (currentKey && currentArray !== null) {
|
|
124
|
-
result[currentKey] = currentArray;
|
|
125
|
-
}
|
|
126
|
-
|
|
127
|
-
return result;
|
|
128
|
-
}
|
|
129
|
-
|
|
130
|
-
function stripQuotes(str) {
|
|
131
|
-
if ((str.startsWith('"') && str.endsWith('"')) ||
|
|
132
|
-
(str.startsWith("'") && str.endsWith("'"))) {
|
|
133
|
-
return str.slice(1, -1);
|
|
134
|
-
}
|
|
135
|
-
return str;
|
|
136
|
-
}
|
|
137
|
-
|
|
138
|
-
// ─── Windsurf rule type detection ───────────────────────────────────────────
|
|
139
|
-
|
|
140
|
-
/**
|
|
141
|
-
* Determine the Windsurf rule activation mode from frontmatter fields.
|
|
142
|
-
*
|
|
143
|
-
* Windsurf 4 activation modes:
|
|
144
|
-
* Always: trigger: always
|
|
145
|
-
* Auto: trigger: auto, globs set
|
|
146
|
-
* Agent-Requested: trigger: agent_requested, description set
|
|
147
|
-
* Manual: trigger: manual (or no trigger field)
|
|
148
|
-
*/
|
|
149
|
-
function detectRuleType(frontmatter) {
|
|
150
|
-
if (!frontmatter) return 'manual';
|
|
151
|
-
|
|
152
|
-
const trigger = (frontmatter.trigger || '').toLowerCase().trim();
|
|
153
|
-
|
|
154
|
-
if (trigger === 'always') return 'always';
|
|
155
|
-
if (trigger === 'auto' || trigger === 'auto_attached') return 'auto';
|
|
156
|
-
if (trigger === 'agent_requested' || trigger === 'agent-requested') return 'agent-requested';
|
|
157
|
-
if (trigger === 'manual') return 'manual';
|
|
158
|
-
|
|
159
|
-
// Fallback heuristic based on fields
|
|
160
|
-
const hasGlobs = Array.isArray(frontmatter.globs)
|
|
161
|
-
? frontmatter.globs.length > 0
|
|
162
|
-
: Boolean(frontmatter.globs);
|
|
163
|
-
const hasDescription = Boolean(frontmatter.description && String(frontmatter.description).trim());
|
|
164
|
-
|
|
165
|
-
if (hasGlobs) return 'auto';
|
|
166
|
-
if (hasDescription && !hasGlobs) return 'agent-requested';
|
|
167
|
-
return 'manual';
|
|
168
|
-
}
|
|
169
|
-
|
|
170
|
-
// ─── Value extraction ────────────────────────────────────────────────────────
|
|
171
|
-
|
|
172
|
-
function getValueByPath(obj, dottedPath) {
|
|
173
|
-
if (!obj) return undefined;
|
|
174
|
-
const parts = dottedPath.split('.').filter(Boolean);
|
|
175
|
-
let cursor = obj;
|
|
176
|
-
for (const part of parts) {
|
|
177
|
-
if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
|
|
178
|
-
return undefined;
|
|
179
|
-
}
|
|
180
|
-
cursor = cursor[part];
|
|
181
|
-
}
|
|
182
|
-
return cursor;
|
|
183
|
-
}
|
|
184
|
-
|
|
185
|
-
// ─── Windsurf frontmatter validation ────────────────────────────────────────
|
|
186
|
-
|
|
187
|
-
const VALID_WINDSURF_FIELDS = new Set(['trigger', 'description', 'globs', 'name']);
|
|
188
|
-
|
|
189
|
-
/**
|
|
190
|
-
* Validate Windsurf rule file frontmatter.
|
|
191
|
-
* Returns { valid, errors, ruleType }.
|
|
192
|
-
*/
|
|
193
|
-
function validateWindsurfFrontmatter(frontmatter) {
|
|
194
|
-
if (!frontmatter) return { valid: false, errors: ['No frontmatter found'], ruleType: 'manual' };
|
|
195
|
-
|
|
196
|
-
const errors = [];
|
|
197
|
-
|
|
198
|
-
for (const key of Object.keys(frontmatter)) {
|
|
199
|
-
if (!VALID_WINDSURF_FIELDS.has(key)) {
|
|
200
|
-
errors.push(`Unknown Windsurf frontmatter field: "${key}"`);
|
|
201
|
-
}
|
|
202
|
-
}
|
|
203
|
-
|
|
204
|
-
// Validate trigger field
|
|
205
|
-
const validTriggers = ['always', 'auto', 'auto_attached', 'agent_requested', 'agent-requested', 'manual'];
|
|
206
|
-
if (frontmatter.trigger && !validTriggers.includes(String(frontmatter.trigger).toLowerCase().trim())) {
|
|
207
|
-
errors.push(`Invalid trigger value: "${frontmatter.trigger}". Must be one of: always, auto, agent_requested, manual`);
|
|
208
|
-
}
|
|
209
|
-
|
|
210
|
-
// Validate globs is an array if present
|
|
211
|
-
if (frontmatter.globs !== undefined && !Array.isArray(frontmatter.globs) && typeof frontmatter.globs !== 'string') {
|
|
212
|
-
errors.push('globs must be a string or array of strings');
|
|
213
|
-
}
|
|
214
|
-
|
|
215
|
-
// Warn on 10K char limit
|
|
216
|
-
const ruleType = detectRuleType(frontmatter);
|
|
217
|
-
|
|
218
|
-
return { valid: errors.length === 0, errors, ruleType };
|
|
219
|
-
}
|
|
220
|
-
|
|
221
|
-
// ─── MCP config validation ──────────────────────────────────────────────────
|
|
222
|
-
|
|
223
|
-
/**
|
|
224
|
-
* Count total MCP tools across all servers.
|
|
225
|
-
* Windsurf has team-level MCP whitelisting.
|
|
226
|
-
*/
|
|
227
|
-
function countMcpTools(mcpData) {
|
|
228
|
-
if (!mcpData || !mcpData.mcpServers) return 0;
|
|
229
|
-
|
|
230
|
-
let total = 0;
|
|
231
|
-
for (const server of Object.values(mcpData.mcpServers)) {
|
|
232
|
-
// Each server exposes tools; estimate ~5 per server if no explicit count
|
|
233
|
-
const toolCount = server.tools ? Object.keys(server.tools).length : 5;
|
|
234
|
-
total += toolCount;
|
|
235
|
-
}
|
|
236
|
-
return total;
|
|
237
|
-
}
|
|
238
|
-
|
|
239
|
-
/**
|
|
240
|
-
* Validate MCP env vars use proper syntax (not hardcoded secrets).
|
|
241
|
-
*/
|
|
242
|
-
function validateMcpEnvVars(mcpData) {
|
|
243
|
-
if (!mcpData || !mcpData.mcpServers) return { valid: true, hardcodedVars: [] };
|
|
244
|
-
|
|
245
|
-
const hardcodedVars = [];
|
|
246
|
-
for (const [serverName, config] of Object.entries(mcpData.mcpServers)) {
|
|
247
|
-
if (!config.env) continue;
|
|
248
|
-
for (const [key, value] of Object.entries(config.env)) {
|
|
249
|
-
if (typeof value === 'string' && !value.startsWith('${env:') && /key|token|secret|password|api/i.test(key)) {
|
|
250
|
-
hardcodedVars.push({ server: serverName, key, value: '[REDACTED]' });
|
|
251
|
-
}
|
|
252
|
-
}
|
|
253
|
-
}
|
|
254
|
-
|
|
255
|
-
return { valid: hardcodedVars.length === 0, hardcodedVars };
|
|
256
|
-
}
|
|
257
|
-
|
|
258
|
-
module.exports = {
|
|
259
|
-
tryParseJson,
|
|
260
|
-
parseWindsurfRule,
|
|
261
|
-
parseSimpleYaml,
|
|
262
|
-
detectRuleType,
|
|
263
|
-
getValueByPath,
|
|
264
|
-
validateWindsurfFrontmatter,
|
|
265
|
-
countMcpTools,
|
|
266
|
-
validateMcpEnvVars,
|
|
267
|
-
};
|
|
1
|
+
/**
|
|
2
|
+
* Windsurf config parser.
|
|
3
|
+
*
|
|
4
|
+
* Windsurf uses Markdown + YAML frontmatter for .windsurf/rules/*.md,
|
|
5
|
+
* and JSON for .windsurf/mcp.json and other config.
|
|
6
|
+
* Key difference from Cursor: NO MDC format — standard Markdown with YAML frontmatter.
|
|
7
|
+
* 4 activation modes: Always, Auto, Agent-Requested, Manual.
|
|
8
|
+
* 10K char rule limit per file.
|
|
9
|
+
* This module handles both formats with unified value extraction.
|
|
10
|
+
*/
|
|
11
|
+
|
|
12
|
+
// ─── JSON parsing ────────────────────────────────────────────────────────────
|
|
13
|
+
|
|
14
|
+
function tryParseJson(content) {
|
|
15
|
+
try {
|
|
16
|
+
const data = JSON.parse(content);
|
|
17
|
+
return { ok: true, data, error: null };
|
|
18
|
+
} catch (error) {
|
|
19
|
+
return { ok: false, data: null, error: error.message };
|
|
20
|
+
}
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
// ─── YAML frontmatter parsing (Markdown files) ─────────────────────────────
|
|
24
|
+
|
|
25
|
+
/**
|
|
26
|
+
* Parse a Windsurf rule file (YAML frontmatter delimited by --- + Markdown body).
|
|
27
|
+
* Returns { frontmatter: object|null, body: string, raw: string|null }
|
|
28
|
+
*/
|
|
29
|
+
function parseWindsurfRule(content) {
|
|
30
|
+
if (!content || typeof content !== 'string') {
|
|
31
|
+
return { frontmatter: null, body: content || '', raw: null };
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
const trimmed = content.trimStart();
|
|
35
|
+
if (!trimmed.startsWith('---')) {
|
|
36
|
+
return { frontmatter: null, body: content, raw: null };
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
const endIdx = trimmed.indexOf('---', 3);
|
|
40
|
+
if (endIdx === -1) {
|
|
41
|
+
return { frontmatter: null, body: content, raw: null };
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
const raw = trimmed.slice(3, endIdx).trim();
|
|
45
|
+
const body = trimmed.slice(endIdx + 3).trim();
|
|
46
|
+
const frontmatter = parseSimpleYaml(raw);
|
|
47
|
+
|
|
48
|
+
return { frontmatter, body, raw };
|
|
49
|
+
}
|
|
50
|
+
|
|
51
|
+
/**
|
|
52
|
+
* Minimal YAML parser for Windsurf rule frontmatter fields.
|
|
53
|
+
* Handles: key: value, key: [item1, item2], key: "quoted", booleans, numbers.
|
|
54
|
+
* Also handles multi-line array syntax (indented with -).
|
|
55
|
+
*/
|
|
56
|
+
function parseSimpleYaml(yamlStr) {
|
|
57
|
+
if (!yamlStr || typeof yamlStr !== 'string') return {};
|
|
58
|
+
|
|
59
|
+
const result = {};
|
|
60
|
+
const lines = yamlStr.split(/\r?\n/);
|
|
61
|
+
let currentKey = null;
|
|
62
|
+
let currentArray = null;
|
|
63
|
+
|
|
64
|
+
for (const line of lines) {
|
|
65
|
+
const trimmedLine = line.trim();
|
|
66
|
+
if (!trimmedLine || trimmedLine.startsWith('#')) continue;
|
|
67
|
+
|
|
68
|
+
// Check for multi-line array item ( - "value")
|
|
69
|
+
if (currentKey && currentArray !== null && /^\s*-\s+/.test(line)) {
|
|
70
|
+
const itemValue = trimmedLine.slice(1).trim();
|
|
71
|
+
currentArray.push(stripQuotes(itemValue));
|
|
72
|
+
continue;
|
|
73
|
+
}
|
|
74
|
+
|
|
75
|
+
// If we were collecting an array, commit it
|
|
76
|
+
if (currentKey && currentArray !== null) {
|
|
77
|
+
result[currentKey] = currentArray;
|
|
78
|
+
currentKey = null;
|
|
79
|
+
currentArray = null;
|
|
80
|
+
}
|
|
81
|
+
|
|
82
|
+
const colonIdx = trimmedLine.indexOf(':');
|
|
83
|
+
if (colonIdx === -1) continue;
|
|
84
|
+
|
|
85
|
+
const key = trimmedLine.slice(0, colonIdx).trim();
|
|
86
|
+
let value = trimmedLine.slice(colonIdx + 1).trim();
|
|
87
|
+
|
|
88
|
+
if (!key) continue;
|
|
89
|
+
|
|
90
|
+
// Parse value
|
|
91
|
+
if (value === '') {
|
|
92
|
+
// Could be start of multi-line array
|
|
93
|
+
currentKey = key;
|
|
94
|
+
currentArray = [];
|
|
95
|
+
} else if (value.startsWith('[') && value.endsWith(']')) {
|
|
96
|
+
// Inline array: [item1, item2]
|
|
97
|
+
const inner = value.slice(1, -1).trim();
|
|
98
|
+
if (!inner) {
|
|
99
|
+
result[key] = [];
|
|
100
|
+
} else {
|
|
101
|
+
result[key] = inner.split(',').map(item => {
|
|
102
|
+
const t = item.trim();
|
|
103
|
+
return stripQuotes(t);
|
|
104
|
+
});
|
|
105
|
+
}
|
|
106
|
+
} else if ((value.startsWith('"') && value.endsWith('"')) ||
|
|
107
|
+
(value.startsWith("'") && value.endsWith("'"))) {
|
|
108
|
+
result[key] = value.slice(1, -1);
|
|
109
|
+
} else if (value === 'true') {
|
|
110
|
+
result[key] = true;
|
|
111
|
+
} else if (value === 'false') {
|
|
112
|
+
result[key] = false;
|
|
113
|
+
} else if (/^-?\d+$/.test(value)) {
|
|
114
|
+
result[key] = parseInt(value, 10);
|
|
115
|
+
} else if (/^-?\d+\.\d+$/.test(value)) {
|
|
116
|
+
result[key] = parseFloat(value);
|
|
117
|
+
} else {
|
|
118
|
+
result[key] = value;
|
|
119
|
+
}
|
|
120
|
+
}
|
|
121
|
+
|
|
122
|
+
// Commit any remaining array
|
|
123
|
+
if (currentKey && currentArray !== null) {
|
|
124
|
+
result[currentKey] = currentArray;
|
|
125
|
+
}
|
|
126
|
+
|
|
127
|
+
return result;
|
|
128
|
+
}
|
|
129
|
+
|
|
130
|
+
function stripQuotes(str) {
|
|
131
|
+
if ((str.startsWith('"') && str.endsWith('"')) ||
|
|
132
|
+
(str.startsWith("'") && str.endsWith("'"))) {
|
|
133
|
+
return str.slice(1, -1);
|
|
134
|
+
}
|
|
135
|
+
return str;
|
|
136
|
+
}
|
|
137
|
+
|
|
138
|
+
// ─── Windsurf rule type detection ───────────────────────────────────────────
|
|
139
|
+
|
|
140
|
+
/**
|
|
141
|
+
* Determine the Windsurf rule activation mode from frontmatter fields.
|
|
142
|
+
*
|
|
143
|
+
* Windsurf 4 activation modes:
|
|
144
|
+
* Always: trigger: always
|
|
145
|
+
* Auto: trigger: auto, globs set
|
|
146
|
+
* Agent-Requested: trigger: agent_requested, description set
|
|
147
|
+
* Manual: trigger: manual (or no trigger field)
|
|
148
|
+
*/
|
|
149
|
+
function detectRuleType(frontmatter) {
|
|
150
|
+
if (!frontmatter) return 'manual';
|
|
151
|
+
|
|
152
|
+
const trigger = (frontmatter.trigger || '').toLowerCase().trim();
|
|
153
|
+
|
|
154
|
+
if (trigger === 'always') return 'always';
|
|
155
|
+
if (trigger === 'auto' || trigger === 'auto_attached') return 'auto';
|
|
156
|
+
if (trigger === 'agent_requested' || trigger === 'agent-requested') return 'agent-requested';
|
|
157
|
+
if (trigger === 'manual') return 'manual';
|
|
158
|
+
|
|
159
|
+
// Fallback heuristic based on fields
|
|
160
|
+
const hasGlobs = Array.isArray(frontmatter.globs)
|
|
161
|
+
? frontmatter.globs.length > 0
|
|
162
|
+
: Boolean(frontmatter.globs);
|
|
163
|
+
const hasDescription = Boolean(frontmatter.description && String(frontmatter.description).trim());
|
|
164
|
+
|
|
165
|
+
if (hasGlobs) return 'auto';
|
|
166
|
+
if (hasDescription && !hasGlobs) return 'agent-requested';
|
|
167
|
+
return 'manual';
|
|
168
|
+
}
|
|
169
|
+
|
|
170
|
+
// ─── Value extraction ────────────────────────────────────────────────────────
|
|
171
|
+
|
|
172
|
+
function getValueByPath(obj, dottedPath) {
|
|
173
|
+
if (!obj) return undefined;
|
|
174
|
+
const parts = dottedPath.split('.').filter(Boolean);
|
|
175
|
+
let cursor = obj;
|
|
176
|
+
for (const part of parts) {
|
|
177
|
+
if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
|
|
178
|
+
return undefined;
|
|
179
|
+
}
|
|
180
|
+
cursor = cursor[part];
|
|
181
|
+
}
|
|
182
|
+
return cursor;
|
|
183
|
+
}
|
|
184
|
+
|
|
185
|
+
// ─── Windsurf frontmatter validation ────────────────────────────────────────
|
|
186
|
+
|
|
187
|
+
const VALID_WINDSURF_FIELDS = new Set(['trigger', 'description', 'globs', 'name']);
|
|
188
|
+
|
|
189
|
+
/**
|
|
190
|
+
* Validate Windsurf rule file frontmatter.
|
|
191
|
+
* Returns { valid, errors, ruleType }.
|
|
192
|
+
*/
|
|
193
|
+
function validateWindsurfFrontmatter(frontmatter) {
|
|
194
|
+
if (!frontmatter) return { valid: false, errors: ['No frontmatter found'], ruleType: 'manual' };
|
|
195
|
+
|
|
196
|
+
const errors = [];
|
|
197
|
+
|
|
198
|
+
for (const key of Object.keys(frontmatter)) {
|
|
199
|
+
if (!VALID_WINDSURF_FIELDS.has(key)) {
|
|
200
|
+
errors.push(`Unknown Windsurf frontmatter field: "${key}"`);
|
|
201
|
+
}
|
|
202
|
+
}
|
|
203
|
+
|
|
204
|
+
// Validate trigger field
|
|
205
|
+
const validTriggers = ['always', 'auto', 'auto_attached', 'agent_requested', 'agent-requested', 'manual'];
|
|
206
|
+
if (frontmatter.trigger && !validTriggers.includes(String(frontmatter.trigger).toLowerCase().trim())) {
|
|
207
|
+
errors.push(`Invalid trigger value: "${frontmatter.trigger}". Must be one of: always, auto, agent_requested, manual`);
|
|
208
|
+
}
|
|
209
|
+
|
|
210
|
+
// Validate globs is an array if present
|
|
211
|
+
if (frontmatter.globs !== undefined && !Array.isArray(frontmatter.globs) && typeof frontmatter.globs !== 'string') {
|
|
212
|
+
errors.push('globs must be a string or array of strings');
|
|
213
|
+
}
|
|
214
|
+
|
|
215
|
+
// Warn on 10K char limit
|
|
216
|
+
const ruleType = detectRuleType(frontmatter);
|
|
217
|
+
|
|
218
|
+
return { valid: errors.length === 0, errors, ruleType };
|
|
219
|
+
}
|
|
220
|
+
|
|
221
|
+
// ─── MCP config validation ──────────────────────────────────────────────────
|
|
222
|
+
|
|
223
|
+
/**
|
|
224
|
+
* Count total MCP tools across all servers.
|
|
225
|
+
* Windsurf has team-level MCP whitelisting.
|
|
226
|
+
*/
|
|
227
|
+
function countMcpTools(mcpData) {
|
|
228
|
+
if (!mcpData || !mcpData.mcpServers) return 0;
|
|
229
|
+
|
|
230
|
+
let total = 0;
|
|
231
|
+
for (const server of Object.values(mcpData.mcpServers)) {
|
|
232
|
+
// Each server exposes tools; estimate ~5 per server if no explicit count
|
|
233
|
+
const toolCount = server.tools ? Object.keys(server.tools).length : 5;
|
|
234
|
+
total += toolCount;
|
|
235
|
+
}
|
|
236
|
+
return total;
|
|
237
|
+
}
|
|
238
|
+
|
|
239
|
+
/**
|
|
240
|
+
* Validate MCP env vars use proper syntax (not hardcoded secrets).
|
|
241
|
+
*/
|
|
242
|
+
function validateMcpEnvVars(mcpData) {
|
|
243
|
+
if (!mcpData || !mcpData.mcpServers) return { valid: true, hardcodedVars: [] };
|
|
244
|
+
|
|
245
|
+
const hardcodedVars = [];
|
|
246
|
+
for (const [serverName, config] of Object.entries(mcpData.mcpServers)) {
|
|
247
|
+
if (!config.env) continue;
|
|
248
|
+
for (const [key, value] of Object.entries(config.env)) {
|
|
249
|
+
if (typeof value === 'string' && !value.startsWith('${env:') && /key|token|secret|password|api/i.test(key)) {
|
|
250
|
+
hardcodedVars.push({ server: serverName, key, value: '[REDACTED]' });
|
|
251
|
+
}
|
|
252
|
+
}
|
|
253
|
+
}
|
|
254
|
+
|
|
255
|
+
return { valid: hardcodedVars.length === 0, hardcodedVars };
|
|
256
|
+
}
|
|
257
|
+
|
|
258
|
+
module.exports = {
|
|
259
|
+
tryParseJson,
|
|
260
|
+
parseWindsurfRule,
|
|
261
|
+
parseSimpleYaml,
|
|
262
|
+
detectRuleType,
|
|
263
|
+
getValueByPath,
|
|
264
|
+
validateWindsurfFrontmatter,
|
|
265
|
+
countMcpTools,
|
|
266
|
+
validateMcpEnvVars,
|
|
267
|
+
};
|