@nexusbloom/cli 0.3.4 → 0.9.0

package/src/jsonish.js

@@ -0,0 +1,213 @@
+/**
+ * jsonish.js — A small, non-evaluating parser for JavaScript object literals.
+ *
+ * Tool manifests are object literals written in source files, so they use
+ * unquoted keys, single quotes, trailing commas and comments — none of which
+ * `JSON.parse` accepts. The previous implementation recovered from that by
+ * calling `new Function(...)`, which evaluates manifest text that arrived over
+ * the network. This parser reads the literal instead of running it.
+ *
+ * Supports: objects, arrays, strings (single/double quoted, escapes),
+ * numbers (including exponents and hex), true/false/null, unquoted identifier
+ * keys, trailing commas, and // and block comments.
+ *
+ * Returns `undefined` when the text is not a single complete literal.
+ */
+
+/**
+ * @param {string} text
+ * @returns {any|undefined} the parsed value, or undefined if unparseable
+ */
+export function parseJsonish(text) {
+  if (typeof text !== "string") return undefined;
+  const p = new Parser(text);
+  try {
+    const value = p.parseValue();
+    p.skipTrivia();
+    // Trailing junk means this was not one clean literal.
+    return p.atEnd() ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+class Parser {
+  constructor(src) {
+    this.src = src;
+    this.i = 0;
+  }
+
+  atEnd() {
+    return this.i >= this.src.length;
+  }
+
+  error(msg) {
+    const err = new Error(`${msg} at offset ${this.i}`);
+    err.isParseError = true;
+    throw err;
+  }
+
+  peek() {
+    return this.src[this.i];
+  }
+
+  /** Skip whitespace and both comment styles. */
+  skipTrivia() {
+    for (;;) {
+      const c = this.src[this.i];
+      if (c === undefined) return;
+      if (c === " " || c === "\t" || c === "\n" || c === "\r" || c === "\f" || c === "\v") {
+        this.i++;
+        continue;
+      }
+      if (c === "/" && this.src[this.i + 1] === "/") {
+        while (this.i < this.src.length && this.src[this.i] !== "\n") this.i++;
+        continue;
+      }
+      if (c === "/" && this.src[this.i + 1] === "*") {
+        const end = this.src.indexOf("*/", this.i + 2);
+        this.i = end === -1 ? this.src.length : end + 2;
+        continue;
+      }
+      return;
+    }
+  }
+
+  parseValue() {
+    this.skipTrivia();
+    const c = this.peek();
+    if (c === undefined) this.error("Unexpected end of input");
+    if (c === "{") return this.parseObject();
+    if (c === "[") return this.parseArray();
+    if (c === '"' || c === "'") return this.parseString();
+    return this.parsePrimitive();
+  }
+
+  parseObject() {
+    const out = {};
+    this.i++; // {
+    for (;;) {
+      this.skipTrivia();
+      if (this.peek() === "}") {
+        this.i++;
+        return out;
+      }
+      if (this.atEnd()) this.error("Unterminated object");
+
+      const key = this.parseKey();
+      this.skipTrivia();
+      if (this.peek() !== ":") this.error(`Expected ':' after key "${key}"`);
+      this.i++;
+      out[key] = this.parseValue();
+
+      this.skipTrivia();
+      const c = this.peek();
+      if (c === ",") {
+        this.i++;
+        continue;
+      }
+      if (c === "}") {
+        this.i++;
+        return out;
+      }
+      this.error("Expected ',' or '}'");
+    }
+  }
+
+  parseKey() {
+    const c = this.peek();
+    if (c === '"' || c === "'") return this.parseString();
+    // Unquoted identifier key: letter, _ or $ start, then word characters.
+    const start = this.i;
+    if (!/[A-Za-z_$]/.test(c || "")) this.error("Invalid object key");
+    while (this.i < this.src.length && /[A-Za-z0-9_$]/.test(this.src[this.i])) this.i++;
+    return this.src.slice(start, this.i);
+  }
+
+  parseArray() {
+    const out = [];
+    this.i++; // [
+    for (;;) {
+      this.skipTrivia();
+      if (this.peek() === "]") {
+        this.i++;
+        return out;
+      }
+      if (this.atEnd()) this.error("Unterminated array");
+
+      out.push(this.parseValue());
+      this.skipTrivia();
+      const c = this.peek();
+      if (c === ",") {
+        this.i++;
+        continue;
+      }
+      if (c === "]") {
+        this.i++;
+        return out;
+      }
+      this.error("Expected ',' or ']'");
+    }
+  }
+
+  parseString() {
+    const quote = this.src[this.i++];
+    let out = "";
+    while (this.i < this.src.length) {
+      const c = this.src[this.i++];
+      if (c === "\\") {
+        const esc = this.src[this.i++];
+        switch (esc) {
+          case "n": out += "\n"; break;
+          case "t": out += "\t"; break;
+          case "r": out += "\r"; break;
+          case "b": out += "\b"; break;
+          case "f": out += "\f"; break;
+          case "v": out += "\v"; break;
+          case "0": out += "\0"; break;
+          case "u": {
+            const hex = this.src.slice(this.i, this.i + 4);
+            if (!/^[0-9a-fA-F]{4}$/.test(hex)) this.error("Bad \\u escape");
+            out += String.fromCharCode(parseInt(hex, 16));
+            this.i += 4;
+            break;
+          }
+          case "x": {
+            const hex = this.src.slice(this.i, this.i + 2);
+            if (!/^[0-9a-fA-F]{2}$/.test(hex)) this.error("Bad \\x escape");
+            out += String.fromCharCode(parseInt(hex, 16));
+            this.i += 2;
+            break;
+          }
+          // Line continuation
+          case "\n": break;
+          default: out += esc;
+        }
+        continue;
+      }
+      if (c === quote) return out;
+      if (c === "\n") this.error("Unterminated string");
+      out += c;
+    }
+    this.error("Unterminated string");
+  }
+
+  parsePrimitive() {
+    const start = this.i;
+    while (this.i < this.src.length && /[^,}\]\s]/.test(this.src[this.i])) this.i++;
+    const raw = this.src.slice(start, this.i);
+    if (!raw) this.error("Expected a value");
+
+    if (raw === "true") return true;
+    if (raw === "false") return false;
+    if (raw === "null") return null;
+
+    if (/^[+-]?(?:0[xX][0-9a-fA-F]+|(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?)$/.test(raw)) {
+      return Number(raw);
+    }
+
+    // Identifiers that JS would evaluate (Infinity, undefined, functions) are
+    // rejected rather than guessed at — a manifest should not need them.
+    this.error(`Unsupported literal "${raw}"`);
+  }
+}

package/src/list.js

@@ -1,17 +1,18 @@
 /**
  * list.js — `nxb list` command.
  *
- * Simple paginated tool listing.  Clean lines, no fancy backgrounds, no tables.
+ * Paginated tool listing. Long lists are always paired with a search option.
  *
- *   nxb list                 — interactive pagination (10/page, prev/next)
- *   nxb list -s ssl          — filter + paginated
- *   nxb list --json          — raw JSON
- *   nxb list --no-interactive— single dump
+ *   nxb list                  — interactive pagination (20/page)
+ *   nxb list -s ssl           — filter + paginate
+ *   nxb list --json           — raw JSON
+ *   nxb list --no-interactive — single dump
  */
 
 import chalk from "chalk";
-import { fetchTools } from "./tools.js";
+import { fetchTools, rankTools } from "./tools.js";
 import { paginate, paginateInteractive, PAGE_SIZE } from "./ui.js";
+import { diagnoseEmptyCatalogue } from "./diagnostics.js";
 
 function renderToolsPage(result) {
   if (result.total === 0) {
@@ -35,33 +36,31 @@ function renderToolsPage(result) {
 export async function listAction(opts = {}) {
   const { search, json: jsonMode, interactive = true, force = false, offline = false } = opts;
 
-  let tools = await fetchTools({ force, offline });
-  let filtered = tools;
-
-  if (search) {
-    const q = search.toLowerCase();
-    filtered = tools.filter(
-      (t) =>
-        (t.slug || "").includes(q) ||
-        (t.name || "").toLowerCase().includes(q) ||
-        (t.short_description || t.description || "").toLowerCase().includes(q) ||
-        (t.category || "").includes(q) ||
-        (t.tags || []).some((tg) => tg.toLowerCase().includes(q))
-    );
+  const tools = await fetchTools({ force, offline });
+  if (!tools || tools.length === 0) {
+    return diagnoseEmptyCatalogue({ offline, jsonMode, source: "catalogue" });
   }
+  const filtered = search ? rankTools(tools, search) : tools;
 
   if (jsonMode) {
     console.log(JSON.stringify({ tools: filtered }, null, 2));
     return;
   }
 
+  const hint = search
+    ? ""
+    : tools.length > PAGE_SIZE
+      ? chalk.dim(`\n  Tip: narrow this down with  nxb list -s <query>   (or  nxb search <query>)\n`)
+      : "";
+
   if (!interactive) {
     if (filtered.length === 0) {
-      console.log(chalk.yellow("  No tools found."));
+      console.log(chalk.yellow(search ? `  No tools matching "${search}".` : "  No tools found."));
       return;
     }
     const result = paginate(filtered, filtered.length, 1);
-    console.log(chalk.bold(`\n  NexusBloom Tools  (${filtered.length} available)\n`));
+    console.log(chalk.bold(`\n  NexusBloom Tools  (${filtered.length} available)`));
+    console.log(hint);
     renderToolsPage(result);
     console.log();
     return;
@@ -72,10 +71,17 @@ export async function listAction(opts = {}) {
     PAGE_SIZE,
     (result) => {
       console.clear();
-      console.log(chalk.bold(`\n  NexusBloom Tools  (${result.total} · page ${result.page}/${result.totalPages})\n`));
+      const title = search
+        ? `NexusBloom Tools  (${result.total} matching "${search}")`
+        : `NexusBloom Tools  (${result.total} · page ${result.page}/${result.totalPages})`;
+      console.log(chalk.bold(`\n  ${title}\n`));
+      console.log(hint);
       renderToolsPage(result);
+      if (search && result.totalPages > 1) {
+        console.log(chalk.dim(`\n  Refine with:  nxb list -s <query>`));
+      }
     },
-    {}
+    { interactive }
   );
 }
 

package/src/paths.js

@@ -1,8 +1,14 @@
 /**
  * paths.js — Centralised filesystem paths for the nxb CLI.
  *
- * Keeps config + cache locations in one place so every module can share them
- * without duplicating the XDG / home-directory logic.
+ * Config and cache both live under XDG base directories so they survive
+ * `npm update -g` / reinstalls and are never written inside the installed
+ * package (which is often root-owned and wiped on upgrade).
+ *
+ *   config : $XDG_CONFIG_HOME/nexusbloom/config.json      (mode 0600 — secrets)
+ *   cache  : $XDG_CACHE_HOME/nexusbloom/                 (mode 0700)
+ *            ├── tools-list.json      flat catalogue snapshot
+ *            └── tools/<slug>.json    per-tool v2 source snapshot
  */
 
 import fs from "fs";
@@ -12,31 +18,51 @@ import { fileURLToPath } from "url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+const xdg = (envVar, fallback) => {
+  const base = process.env[envVar];
+  return base && base.trim() ? path.resolve(base) : path.join(os.homedir(), fallback);
+};
+
 // ─── Config (nxb config) ──────────────────────────────────────────────────────
-export const CONFIG_DIR = path.join(
-  process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"),
-  "nexusbloom"
-);
+export const CONFIG_DIR = path.join(xdg("XDG_CONFIG_HOME", ".config"), "nexusbloom");
 export const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 
-// ─── Tool list cache (offline tool catalogue) ─────────────────────────────────
-// Stored under ~/.cache/nexusbloom/tools.json — a flat snapshot of every tool
-// so `nxb list` / `nxb abbr` work without a network round-trip.
-export const CACHE_DIR = path.resolve(__dirname, "../.cache");
+// ─── Cache (tool catalogue + tool source) ─────────────────────────────────────
+export const CACHE_DIR = path.join(xdg("XDG_CACHE_HOME", ".cache"), "nexusbloom");
 export const TOOLS_CACHE_DIR = path.join(CACHE_DIR, "tools");
 export const TOOLS_LIST_CACHE_PATH = path.join(CACHE_DIR, "tools-list.json");
 
-// ─── Local tool source cache (for --local execution) ──────────────────────────
-export const TOOL_SOURCE_CACHE_DIR = TOOLS_CACHE_DIR;
+// ─── Saved pipelines ─────────────────────────────────────────────────────────
+export const PIPELINES_DIR = path.join(CONFIG_DIR, "pipelines");
+
+// Legacy location — older versions cached inside the installed package dir,
+// so it can be root-owned and is wiped by every `npm update -g`.
+// Only used by `nxb cache clear` to remove the stale copy.
+export const LEGACY_CACHE_DIR = path.resolve(__dirname, "../.cache");
 
-export function ensureDir(dir) {
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+export function ensureDir(dir, mode) {
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode });
+  // mkdir's `mode` is masked by umask and ignored if the dir already exists,
+  // so tighten an existing directory explicitly.
+  if (mode !== undefined) {
+    try {
+      fs.chmodSync(dir, mode);
+    } catch {
+      /* best effort (non-POSIX fs) */
+    }
+  }
 }
 
 export function ensureConfigDir() {
-  ensureDir(CONFIG_DIR);
+  // 0700 — config.json holds the API key.
+  ensureDir(CONFIG_DIR, 0o700);
+}
+
+export function ensurePipelinesDir() {
+  ensureDir(PIPELINES_DIR, 0o700);
 }
 
 export function ensureCacheDir() {
-  ensureDir(TOOLS_CACHE_DIR);
+  ensureDir(CACHE_DIR, 0o700);
+  ensureDir(TOOLS_CACHE_DIR, 0o700);
 }