@nerviq/cli 1.20.1 → 1.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (181) hide show
  1. package/LICENSE +23 -23
  2. package/README.md +2 -2
  3. package/package.json +1 -1
  4. package/src/activity.js +1039 -1039
  5. package/src/adoption-advisor.js +299 -299
  6. package/src/aider/config-parser.js +166 -166
  7. package/src/aider/context.js +4 -1
  8. package/src/aider/deep-review.js +316 -316
  9. package/src/aider/domain-packs.js +303 -303
  10. package/src/aider/freshness.js +93 -93
  11. package/src/aider/governance.js +253 -253
  12. package/src/aider/interactive.js +334 -334
  13. package/src/aider/mcp-packs.js +329 -329
  14. package/src/aider/patch.js +214 -214
  15. package/src/aider/plans.js +186 -186
  16. package/src/aider/premium.js +360 -360
  17. package/src/aider/setup.js +404 -404
  18. package/src/aider/techniques.js +312 -67
  19. package/src/analyze.js +951 -951
  20. package/src/anti-patterns.js +485 -485
  21. package/src/audit/instruction-files.js +180 -180
  22. package/src/audit/recommendations.js +577 -577
  23. package/src/auto-suggest.js +154 -154
  24. package/src/badge.js +13 -13
  25. package/src/behavioral-drift.js +801 -801
  26. package/src/benchmark.js +67 -67
  27. package/src/catalog.js +103 -103
  28. package/src/certification.js +128 -128
  29. package/src/codex/config-parser.js +183 -183
  30. package/src/codex/context.js +223 -223
  31. package/src/codex/deep-review.js +493 -493
  32. package/src/codex/domain-packs.js +394 -394
  33. package/src/codex/freshness.js +84 -84
  34. package/src/codex/governance.js +192 -192
  35. package/src/codex/interactive.js +618 -618
  36. package/src/codex/mcp-packs.js +914 -914
  37. package/src/codex/patch.js +209 -209
  38. package/src/codex/plans.js +251 -251
  39. package/src/codex/premium.js +614 -614
  40. package/src/codex/setup.js +591 -591
  41. package/src/continuous-ops.js +681 -681
  42. package/src/copilot/activity.js +309 -309
  43. package/src/copilot/deep-review.js +346 -346
  44. package/src/copilot/domain-packs.js +372 -372
  45. package/src/copilot/freshness.js +57 -57
  46. package/src/copilot/governance.js +222 -222
  47. package/src/copilot/interactive.js +406 -406
  48. package/src/copilot/mcp-packs.js +826 -826
  49. package/src/copilot/plans.js +253 -253
  50. package/src/copilot/premium.js +451 -451
  51. package/src/copilot/setup.js +488 -488
  52. package/src/cost-tracking.js +61 -61
  53. package/src/cursor/activity.js +301 -301
  54. package/src/cursor/config-parser.js +265 -265
  55. package/src/cursor/context.js +256 -256
  56. package/src/cursor/deep-review.js +334 -334
  57. package/src/cursor/domain-packs.js +368 -368
  58. package/src/cursor/freshness.js +65 -65
  59. package/src/cursor/governance.js +229 -229
  60. package/src/cursor/interactive.js +391 -391
  61. package/src/cursor/mcp-packs.js +828 -828
  62. package/src/cursor/plans.js +254 -254
  63. package/src/cursor/premium.js +469 -469
  64. package/src/cursor/setup.js +488 -488
  65. package/src/dashboard.js +493 -493
  66. package/src/deep-review.js +428 -428
  67. package/src/deprecation.js +98 -98
  68. package/src/diff-only.js +280 -280
  69. package/src/doctor.js +119 -119
  70. package/src/domain-pack-expansion.js +1033 -1033
  71. package/src/domain-packs.js +387 -387
  72. package/src/feedback.js +178 -178
  73. package/src/fix-engine.js +783 -783
  74. package/src/fix-prompts.js +122 -122
  75. package/src/formatters/sarif.js +115 -115
  76. package/src/freshness.js +74 -74
  77. package/src/gemini/config-parser.js +275 -275
  78. package/src/gemini/deep-review.js +559 -559
  79. package/src/gemini/domain-packs.js +393 -393
  80. package/src/gemini/freshness.js +66 -66
  81. package/src/gemini/governance.js +201 -201
  82. package/src/gemini/interactive.js +860 -860
  83. package/src/gemini/mcp-packs.js +915 -915
  84. package/src/gemini/plans.js +269 -269
  85. package/src/gemini/premium.js +760 -760
  86. package/src/gemini/setup.js +692 -692
  87. package/src/governance.js +72 -72
  88. package/src/harmony/add.js +68 -68
  89. package/src/harmony/advisor.js +333 -333
  90. package/src/harmony/canon.js +565 -565
  91. package/src/harmony/cli.js +591 -591
  92. package/src/harmony/drift.js +401 -401
  93. package/src/harmony/governance.js +313 -313
  94. package/src/harmony/memory.js +239 -239
  95. package/src/harmony/sync.js +475 -475
  96. package/src/harmony/watch.js +370 -370
  97. package/src/hook-validation.js +342 -342
  98. package/src/index.js +271 -271
  99. package/src/init.js +184 -184
  100. package/src/instruction-surfaces.js +185 -185
  101. package/src/integrations.js +144 -144
  102. package/src/interactive.js +118 -118
  103. package/src/locales/en.json +1 -1
  104. package/src/locales/es.json +1 -1
  105. package/src/mcp-packs.js +830 -830
  106. package/src/mcp-server.js +726 -726
  107. package/src/mcp-validation.js +337 -337
  108. package/src/nerviq-sync.json +7 -7
  109. package/src/opencode/config-parser.js +109 -109
  110. package/src/opencode/context.js +247 -247
  111. package/src/opencode/deep-review.js +313 -313
  112. package/src/opencode/domain-packs.js +262 -262
  113. package/src/opencode/freshness.js +66 -66
  114. package/src/opencode/governance.js +159 -159
  115. package/src/opencode/interactive.js +392 -392
  116. package/src/opencode/mcp-packs.js +705 -705
  117. package/src/opencode/patch.js +184 -184
  118. package/src/opencode/plans.js +231 -231
  119. package/src/opencode/premium.js +413 -413
  120. package/src/opencode/setup.js +449 -449
  121. package/src/opencode/techniques.js +27 -27
  122. package/src/operating-profile.js +574 -574
  123. package/src/org.js +152 -152
  124. package/src/permission-rules.js +218 -218
  125. package/src/plans.js +839 -839
  126. package/src/platform-change-manifest.js +86 -86
  127. package/src/plugins.js +110 -110
  128. package/src/policy-layers.js +210 -210
  129. package/src/profiles.js +124 -124
  130. package/src/prompt-injection.js +74 -74
  131. package/src/public-api.js +173 -173
  132. package/src/recommendation-rules.js +84 -84
  133. package/src/repo-archetype.js +386 -386
  134. package/src/secret-patterns.js +39 -39
  135. package/src/server.js +527 -527
  136. package/src/setup/analysis.js +607 -607
  137. package/src/setup/runtime.js +172 -172
  138. package/src/setup.js +677 -677
  139. package/src/shared/capabilities.js +194 -194
  140. package/src/source-urls.js +132 -132
  141. package/src/stack-checks.js +565 -565
  142. package/src/supplemental-checks.js +13 -13
  143. package/src/synergy/adaptive.js +261 -261
  144. package/src/synergy/compensation.js +137 -137
  145. package/src/synergy/evidence.js +193 -193
  146. package/src/synergy/learning.js +199 -199
  147. package/src/synergy/patterns.js +227 -227
  148. package/src/synergy/ranking.js +83 -83
  149. package/src/synergy/report.js +165 -165
  150. package/src/synergy/routing.js +146 -146
  151. package/src/techniques/api.js +407 -407
  152. package/src/techniques/automation.js +316 -316
  153. package/src/techniques/compliance.js +257 -257
  154. package/src/techniques/hygiene.js +294 -294
  155. package/src/techniques/instructions.js +243 -243
  156. package/src/techniques/observability.js +226 -226
  157. package/src/techniques/optimization.js +142 -142
  158. package/src/techniques/quality.js +318 -318
  159. package/src/techniques/security.js +237 -237
  160. package/src/techniques/shared.js +443 -443
  161. package/src/techniques/stacks.js +2294 -2294
  162. package/src/techniques/tools.js +106 -106
  163. package/src/techniques/workflow.js +413 -413
  164. package/src/techniques.js +81 -81
  165. package/src/terminology.js +73 -73
  166. package/src/token-estimate.js +35 -35
  167. package/src/usage-patterns.js +99 -99
  168. package/src/verification-metadata.js +145 -145
  169. package/src/watch.js +247 -247
  170. package/src/windsurf/activity.js +302 -302
  171. package/src/windsurf/config-parser.js +267 -267
  172. package/src/windsurf/deep-review.js +337 -337
  173. package/src/windsurf/domain-packs.js +370 -370
  174. package/src/windsurf/freshness.js +36 -36
  175. package/src/windsurf/governance.js +231 -231
  176. package/src/windsurf/interactive.js +388 -388
  177. package/src/windsurf/mcp-packs.js +792 -792
  178. package/src/windsurf/plans.js +247 -247
  179. package/src/windsurf/premium.js +468 -468
  180. package/src/windsurf/setup.js +471 -471
  181. package/src/workspace.js +375 -375
@@ -1,267 +1,267 @@
1
- /**
2
- * Windsurf config parser.
3
- *
4
- * Windsurf uses Markdown + YAML frontmatter for .windsurf/rules/*.md,
5
- * and JSON for .windsurf/mcp.json and other config.
6
- * Key difference from Cursor: NO MDC format — standard Markdown with YAML frontmatter.
7
- * 4 activation modes: Always, Auto, Agent-Requested, Manual.
8
- * 10K char rule limit per file.
9
- * This module handles both formats with unified value extraction.
10
- */
11
-
12
- // ─── JSON parsing ────────────────────────────────────────────────────────────
13
-
14
- function tryParseJson(content) {
15
- try {
16
- const data = JSON.parse(content);
17
- return { ok: true, data, error: null };
18
- } catch (error) {
19
- return { ok: false, data: null, error: error.message };
20
- }
21
- }
22
-
23
- // ─── YAML frontmatter parsing (Markdown files) ─────────────────────────────
24
-
25
- /**
26
- * Parse a Windsurf rule file (YAML frontmatter delimited by --- + Markdown body).
27
- * Returns { frontmatter: object|null, body: string, raw: string|null }
28
- */
29
- function parseWindsurfRule(content) {
30
- if (!content || typeof content !== 'string') {
31
- return { frontmatter: null, body: content || '', raw: null };
32
- }
33
-
34
- const trimmed = content.trimStart();
35
- if (!trimmed.startsWith('---')) {
36
- return { frontmatter: null, body: content, raw: null };
37
- }
38
-
39
- const endIdx = trimmed.indexOf('---', 3);
40
- if (endIdx === -1) {
41
- return { frontmatter: null, body: content, raw: null };
42
- }
43
-
44
- const raw = trimmed.slice(3, endIdx).trim();
45
- const body = trimmed.slice(endIdx + 3).trim();
46
- const frontmatter = parseSimpleYaml(raw);
47
-
48
- return { frontmatter, body, raw };
49
- }
50
-
51
- /**
52
- * Minimal YAML parser for Windsurf rule frontmatter fields.
53
- * Handles: key: value, key: [item1, item2], key: "quoted", booleans, numbers.
54
- * Also handles multi-line array syntax (indented with -).
55
- */
56
- function parseSimpleYaml(yamlStr) {
57
- if (!yamlStr || typeof yamlStr !== 'string') return {};
58
-
59
- const result = {};
60
- const lines = yamlStr.split(/\r?\n/);
61
- let currentKey = null;
62
- let currentArray = null;
63
-
64
- for (const line of lines) {
65
- const trimmedLine = line.trim();
66
- if (!trimmedLine || trimmedLine.startsWith('#')) continue;
67
-
68
- // Check for multi-line array item ( - "value")
69
- if (currentKey && currentArray !== null && /^\s*-\s+/.test(line)) {
70
- const itemValue = trimmedLine.slice(1).trim();
71
- currentArray.push(stripQuotes(itemValue));
72
- continue;
73
- }
74
-
75
- // If we were collecting an array, commit it
76
- if (currentKey && currentArray !== null) {
77
- result[currentKey] = currentArray;
78
- currentKey = null;
79
- currentArray = null;
80
- }
81
-
82
- const colonIdx = trimmedLine.indexOf(':');
83
- if (colonIdx === -1) continue;
84
-
85
- const key = trimmedLine.slice(0, colonIdx).trim();
86
- let value = trimmedLine.slice(colonIdx + 1).trim();
87
-
88
- if (!key) continue;
89
-
90
- // Parse value
91
- if (value === '') {
92
- // Could be start of multi-line array
93
- currentKey = key;
94
- currentArray = [];
95
- } else if (value.startsWith('[') && value.endsWith(']')) {
96
- // Inline array: [item1, item2]
97
- const inner = value.slice(1, -1).trim();
98
- if (!inner) {
99
- result[key] = [];
100
- } else {
101
- result[key] = inner.split(',').map(item => {
102
- const t = item.trim();
103
- return stripQuotes(t);
104
- });
105
- }
106
- } else if ((value.startsWith('"') && value.endsWith('"')) ||
107
- (value.startsWith("'") && value.endsWith("'"))) {
108
- result[key] = value.slice(1, -1);
109
- } else if (value === 'true') {
110
- result[key] = true;
111
- } else if (value === 'false') {
112
- result[key] = false;
113
- } else if (/^-?\d+$/.test(value)) {
114
- result[key] = parseInt(value, 10);
115
- } else if (/^-?\d+\.\d+$/.test(value)) {
116
- result[key] = parseFloat(value);
117
- } else {
118
- result[key] = value;
119
- }
120
- }
121
-
122
- // Commit any remaining array
123
- if (currentKey && currentArray !== null) {
124
- result[currentKey] = currentArray;
125
- }
126
-
127
- return result;
128
- }
129
-
130
- function stripQuotes(str) {
131
- if ((str.startsWith('"') && str.endsWith('"')) ||
132
- (str.startsWith("'") && str.endsWith("'"))) {
133
- return str.slice(1, -1);
134
- }
135
- return str;
136
- }
137
-
138
- // ─── Windsurf rule type detection ───────────────────────────────────────────
139
-
140
- /**
141
- * Determine the Windsurf rule activation mode from frontmatter fields.
142
- *
143
- * Windsurf 4 activation modes:
144
- * Always: trigger: always
145
- * Auto: trigger: auto, globs set
146
- * Agent-Requested: trigger: agent_requested, description set
147
- * Manual: trigger: manual (or no trigger field)
148
- */
149
- function detectRuleType(frontmatter) {
150
- if (!frontmatter) return 'manual';
151
-
152
- const trigger = (frontmatter.trigger || '').toLowerCase().trim();
153
-
154
- if (trigger === 'always') return 'always';
155
- if (trigger === 'auto' || trigger === 'auto_attached') return 'auto';
156
- if (trigger === 'agent_requested' || trigger === 'agent-requested') return 'agent-requested';
157
- if (trigger === 'manual') return 'manual';
158
-
159
- // Fallback heuristic based on fields
160
- const hasGlobs = Array.isArray(frontmatter.globs)
161
- ? frontmatter.globs.length > 0
162
- : Boolean(frontmatter.globs);
163
- const hasDescription = Boolean(frontmatter.description && String(frontmatter.description).trim());
164
-
165
- if (hasGlobs) return 'auto';
166
- if (hasDescription && !hasGlobs) return 'agent-requested';
167
- return 'manual';
168
- }
169
-
170
- // ─── Value extraction ────────────────────────────────────────────────────────
171
-
172
- function getValueByPath(obj, dottedPath) {
173
- if (!obj) return undefined;
174
- const parts = dottedPath.split('.').filter(Boolean);
175
- let cursor = obj;
176
- for (const part of parts) {
177
- if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
178
- return undefined;
179
- }
180
- cursor = cursor[part];
181
- }
182
- return cursor;
183
- }
184
-
185
- // ─── Windsurf frontmatter validation ────────────────────────────────────────
186
-
187
- const VALID_WINDSURF_FIELDS = new Set(['trigger', 'description', 'globs', 'name']);
188
-
189
- /**
190
- * Validate Windsurf rule file frontmatter.
191
- * Returns { valid, errors, ruleType }.
192
- */
193
- function validateWindsurfFrontmatter(frontmatter) {
194
- if (!frontmatter) return { valid: false, errors: ['No frontmatter found'], ruleType: 'manual' };
195
-
196
- const errors = [];
197
-
198
- for (const key of Object.keys(frontmatter)) {
199
- if (!VALID_WINDSURF_FIELDS.has(key)) {
200
- errors.push(`Unknown Windsurf frontmatter field: "${key}"`);
201
- }
202
- }
203
-
204
- // Validate trigger field
205
- const validTriggers = ['always', 'auto', 'auto_attached', 'agent_requested', 'agent-requested', 'manual'];
206
- if (frontmatter.trigger && !validTriggers.includes(String(frontmatter.trigger).toLowerCase().trim())) {
207
- errors.push(`Invalid trigger value: "${frontmatter.trigger}". Must be one of: always, auto, agent_requested, manual`);
208
- }
209
-
210
- // Validate globs is an array if present
211
- if (frontmatter.globs !== undefined && !Array.isArray(frontmatter.globs) && typeof frontmatter.globs !== 'string') {
212
- errors.push('globs must be a string or array of strings');
213
- }
214
-
215
- // Warn on 10K char limit
216
- const ruleType = detectRuleType(frontmatter);
217
-
218
- return { valid: errors.length === 0, errors, ruleType };
219
- }
220
-
221
- // ─── MCP config validation ──────────────────────────────────────────────────
222
-
223
- /**
224
- * Count total MCP tools across all servers.
225
- * Windsurf has team-level MCP whitelisting.
226
- */
227
- function countMcpTools(mcpData) {
228
- if (!mcpData || !mcpData.mcpServers) return 0;
229
-
230
- let total = 0;
231
- for (const server of Object.values(mcpData.mcpServers)) {
232
- // Each server exposes tools; estimate ~5 per server if no explicit count
233
- const toolCount = server.tools ? Object.keys(server.tools).length : 5;
234
- total += toolCount;
235
- }
236
- return total;
237
- }
238
-
239
- /**
240
- * Validate MCP env vars use proper syntax (not hardcoded secrets).
241
- */
242
- function validateMcpEnvVars(mcpData) {
243
- if (!mcpData || !mcpData.mcpServers) return { valid: true, hardcodedVars: [] };
244
-
245
- const hardcodedVars = [];
246
- for (const [serverName, config] of Object.entries(mcpData.mcpServers)) {
247
- if (!config.env) continue;
248
- for (const [key, value] of Object.entries(config.env)) {
249
- if (typeof value === 'string' && !value.startsWith('${env:') && /key|token|secret|password|api/i.test(key)) {
250
- hardcodedVars.push({ server: serverName, key, value: '[REDACTED]' });
251
- }
252
- }
253
- }
254
-
255
- return { valid: hardcodedVars.length === 0, hardcodedVars };
256
- }
257
-
258
- module.exports = {
259
- tryParseJson,
260
- parseWindsurfRule,
261
- parseSimpleYaml,
262
- detectRuleType,
263
- getValueByPath,
264
- validateWindsurfFrontmatter,
265
- countMcpTools,
266
- validateMcpEnvVars,
267
- };
1
+ /**
2
+ * Windsurf config parser.
3
+ *
4
+ * Windsurf uses Markdown + YAML frontmatter for .windsurf/rules/*.md,
5
+ * and JSON for .windsurf/mcp.json and other config.
6
+ * Key difference from Cursor: NO MDC format — standard Markdown with YAML frontmatter.
7
+ * 4 activation modes: Always, Auto, Agent-Requested, Manual.
8
+ * 10K char rule limit per file.
9
+ * This module handles both formats with unified value extraction.
10
+ */
11
+
12
+ // ─── JSON parsing ────────────────────────────────────────────────────────────
13
+
14
+ function tryParseJson(content) {
15
+ try {
16
+ const data = JSON.parse(content);
17
+ return { ok: true, data, error: null };
18
+ } catch (error) {
19
+ return { ok: false, data: null, error: error.message };
20
+ }
21
+ }
22
+
23
+ // ─── YAML frontmatter parsing (Markdown files) ─────────────────────────────
24
+
25
+ /**
26
+ * Parse a Windsurf rule file (YAML frontmatter delimited by --- + Markdown body).
27
+ * Returns { frontmatter: object|null, body: string, raw: string|null }
28
+ */
29
+ function parseWindsurfRule(content) {
30
+ if (!content || typeof content !== 'string') {
31
+ return { frontmatter: null, body: content || '', raw: null };
32
+ }
33
+
34
+ const trimmed = content.trimStart();
35
+ if (!trimmed.startsWith('---')) {
36
+ return { frontmatter: null, body: content, raw: null };
37
+ }
38
+
39
+ const endIdx = trimmed.indexOf('---', 3);
40
+ if (endIdx === -1) {
41
+ return { frontmatter: null, body: content, raw: null };
42
+ }
43
+
44
+ const raw = trimmed.slice(3, endIdx).trim();
45
+ const body = trimmed.slice(endIdx + 3).trim();
46
+ const frontmatter = parseSimpleYaml(raw);
47
+
48
+ return { frontmatter, body, raw };
49
+ }
50
+
51
+ /**
52
+ * Minimal YAML parser for Windsurf rule frontmatter fields.
53
+ * Handles: key: value, key: [item1, item2], key: "quoted", booleans, numbers.
54
+ * Also handles multi-line array syntax (indented with -).
55
+ */
56
+ function parseSimpleYaml(yamlStr) {
57
+ if (!yamlStr || typeof yamlStr !== 'string') return {};
58
+
59
+ const result = {};
60
+ const lines = yamlStr.split(/\r?\n/);
61
+ let currentKey = null;
62
+ let currentArray = null;
63
+
64
+ for (const line of lines) {
65
+ const trimmedLine = line.trim();
66
+ if (!trimmedLine || trimmedLine.startsWith('#')) continue;
67
+
68
+ // Check for multi-line array item ( - "value")
69
+ if (currentKey && currentArray !== null && /^\s*-\s+/.test(line)) {
70
+ const itemValue = trimmedLine.slice(1).trim();
71
+ currentArray.push(stripQuotes(itemValue));
72
+ continue;
73
+ }
74
+
75
+ // If we were collecting an array, commit it
76
+ if (currentKey && currentArray !== null) {
77
+ result[currentKey] = currentArray;
78
+ currentKey = null;
79
+ currentArray = null;
80
+ }
81
+
82
+ const colonIdx = trimmedLine.indexOf(':');
83
+ if (colonIdx === -1) continue;
84
+
85
+ const key = trimmedLine.slice(0, colonIdx).trim();
86
+ let value = trimmedLine.slice(colonIdx + 1).trim();
87
+
88
+ if (!key) continue;
89
+
90
+ // Parse value
91
+ if (value === '') {
92
+ // Could be start of multi-line array
93
+ currentKey = key;
94
+ currentArray = [];
95
+ } else if (value.startsWith('[') && value.endsWith(']')) {
96
+ // Inline array: [item1, item2]
97
+ const inner = value.slice(1, -1).trim();
98
+ if (!inner) {
99
+ result[key] = [];
100
+ } else {
101
+ result[key] = inner.split(',').map(item => {
102
+ const t = item.trim();
103
+ return stripQuotes(t);
104
+ });
105
+ }
106
+ } else if ((value.startsWith('"') && value.endsWith('"')) ||
107
+ (value.startsWith("'") && value.endsWith("'"))) {
108
+ result[key] = value.slice(1, -1);
109
+ } else if (value === 'true') {
110
+ result[key] = true;
111
+ } else if (value === 'false') {
112
+ result[key] = false;
113
+ } else if (/^-?\d+$/.test(value)) {
114
+ result[key] = parseInt(value, 10);
115
+ } else if (/^-?\d+\.\d+$/.test(value)) {
116
+ result[key] = parseFloat(value);
117
+ } else {
118
+ result[key] = value;
119
+ }
120
+ }
121
+
122
+ // Commit any remaining array
123
+ if (currentKey && currentArray !== null) {
124
+ result[currentKey] = currentArray;
125
+ }
126
+
127
+ return result;
128
+ }
129
+
130
+ function stripQuotes(str) {
131
+ if ((str.startsWith('"') && str.endsWith('"')) ||
132
+ (str.startsWith("'") && str.endsWith("'"))) {
133
+ return str.slice(1, -1);
134
+ }
135
+ return str;
136
+ }
137
+
138
+ // ─── Windsurf rule type detection ───────────────────────────────────────────
139
+
140
+ /**
141
+ * Determine the Windsurf rule activation mode from frontmatter fields.
142
+ *
143
+ * Windsurf 4 activation modes:
144
+ * Always: trigger: always
145
+ * Auto: trigger: auto, globs set
146
+ * Agent-Requested: trigger: agent_requested, description set
147
+ * Manual: trigger: manual (or no trigger field)
148
+ */
149
+ function detectRuleType(frontmatter) {
150
+ if (!frontmatter) return 'manual';
151
+
152
+ const trigger = (frontmatter.trigger || '').toLowerCase().trim();
153
+
154
+ if (trigger === 'always') return 'always';
155
+ if (trigger === 'auto' || trigger === 'auto_attached') return 'auto';
156
+ if (trigger === 'agent_requested' || trigger === 'agent-requested') return 'agent-requested';
157
+ if (trigger === 'manual') return 'manual';
158
+
159
+ // Fallback heuristic based on fields
160
+ const hasGlobs = Array.isArray(frontmatter.globs)
161
+ ? frontmatter.globs.length > 0
162
+ : Boolean(frontmatter.globs);
163
+ const hasDescription = Boolean(frontmatter.description && String(frontmatter.description).trim());
164
+
165
+ if (hasGlobs) return 'auto';
166
+ if (hasDescription && !hasGlobs) return 'agent-requested';
167
+ return 'manual';
168
+ }
169
+
170
+ // ─── Value extraction ────────────────────────────────────────────────────────
171
+
172
+ function getValueByPath(obj, dottedPath) {
173
+ if (!obj) return undefined;
174
+ const parts = dottedPath.split('.').filter(Boolean);
175
+ let cursor = obj;
176
+ for (const part of parts) {
177
+ if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
178
+ return undefined;
179
+ }
180
+ cursor = cursor[part];
181
+ }
182
+ return cursor;
183
+ }
184
+
185
+ // ─── Windsurf frontmatter validation ────────────────────────────────────────
186
+
187
+ const VALID_WINDSURF_FIELDS = new Set(['trigger', 'description', 'globs', 'name']);
188
+
189
+ /**
190
+ * Validate Windsurf rule file frontmatter.
191
+ * Returns { valid, errors, ruleType }.
192
+ */
193
+ function validateWindsurfFrontmatter(frontmatter) {
194
+ if (!frontmatter) return { valid: false, errors: ['No frontmatter found'], ruleType: 'manual' };
195
+
196
+ const errors = [];
197
+
198
+ for (const key of Object.keys(frontmatter)) {
199
+ if (!VALID_WINDSURF_FIELDS.has(key)) {
200
+ errors.push(`Unknown Windsurf frontmatter field: "${key}"`);
201
+ }
202
+ }
203
+
204
+ // Validate trigger field
205
+ const validTriggers = ['always', 'auto', 'auto_attached', 'agent_requested', 'agent-requested', 'manual'];
206
+ if (frontmatter.trigger && !validTriggers.includes(String(frontmatter.trigger).toLowerCase().trim())) {
207
+ errors.push(`Invalid trigger value: "${frontmatter.trigger}". Must be one of: always, auto, agent_requested, manual`);
208
+ }
209
+
210
+ // Validate globs is an array if present
211
+ if (frontmatter.globs !== undefined && !Array.isArray(frontmatter.globs) && typeof frontmatter.globs !== 'string') {
212
+ errors.push('globs must be a string or array of strings');
213
+ }
214
+
215
+ // Warn on 10K char limit
216
+ const ruleType = detectRuleType(frontmatter);
217
+
218
+ return { valid: errors.length === 0, errors, ruleType };
219
+ }
220
+
221
+ // ─── MCP config validation ──────────────────────────────────────────────────
222
+
223
+ /**
224
+ * Count total MCP tools across all servers.
225
+ * Windsurf has team-level MCP whitelisting.
226
+ */
227
+ function countMcpTools(mcpData) {
228
+ if (!mcpData || !mcpData.mcpServers) return 0;
229
+
230
+ let total = 0;
231
+ for (const server of Object.values(mcpData.mcpServers)) {
232
+ // Each server exposes tools; estimate ~5 per server if no explicit count
233
+ const toolCount = server.tools ? Object.keys(server.tools).length : 5;
234
+ total += toolCount;
235
+ }
236
+ return total;
237
+ }
238
+
239
+ /**
240
+ * Validate MCP env vars use proper syntax (not hardcoded secrets).
241
+ */
242
+ function validateMcpEnvVars(mcpData) {
243
+ if (!mcpData || !mcpData.mcpServers) return { valid: true, hardcodedVars: [] };
244
+
245
+ const hardcodedVars = [];
246
+ for (const [serverName, config] of Object.entries(mcpData.mcpServers)) {
247
+ if (!config.env) continue;
248
+ for (const [key, value] of Object.entries(config.env)) {
249
+ if (typeof value === 'string' && !value.startsWith('${env:') && /key|token|secret|password|api/i.test(key)) {
250
+ hardcodedVars.push({ server: serverName, key, value: '[REDACTED]' });
251
+ }
252
+ }
253
+ }
254
+
255
+ return { valid: hardcodedVars.length === 0, hardcodedVars };
256
+ }
257
+
258
+ module.exports = {
259
+ tryParseJson,
260
+ parseWindsurfRule,
261
+ parseSimpleYaml,
262
+ detectRuleType,
263
+ getValueByPath,
264
+ validateWindsurfFrontmatter,
265
+ countMcpTools,
266
+ validateMcpEnvVars,
267
+ };