@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/profiles/env-store.js

@@ -1,162 +1,2 @@
-// The profile-owned env store: `<profileRoot(profileId)>/env.json` — a 0600
-// map of env-var name -> value a profile owns explicitly. `buildBrokerEnv`
-// (`core/runtime/spawn-env.ts`) reads it straight off disk and injects the
-// values directly into every broker launched under that profile, independent
-// of the daemon's own ambient `process.env` or any `.envrc`/`.env` a node's
-// cwd might carry. Setting a value here IS the consent to cross the spawn
-// boundary — no matching `spawnEnv.allow` entry is needed, because these
-// values never pass through the host-env allowlist in the first place; they
-// are a separate, always-injected source. Never surface a stored VALUE
-// outside this file's own readers — `listProfileEnvNames` returns names only,
-// and no caller should log or echo what `readProfileEnvVars` returns.
-import { existsSync, readFileSync, renameSync, writeFileSync, chmodSync } from 'node:fs';
-import { join } from 'node:path';
-import { loadExactProfileManifest, profileRoot, withProfileManifestLock } from './manifest.js';
-import { ensureDir } from '../fs-utils.js';
-import { notFound, usage } from '../errors.js';
-const ENV_FILE = 'env.json';
-/** crtr's own identity/routing env names — reserved so a stored profile value
- *  can never redirect a broker to a different canvas home/db/socket dir or
- *  masquerade as its own process identity. `HOME` is reserved alongside the
- *  `CRTR_*` family because crtr has no independent authoritative scope root
- *  yet; every path in `core/canvas/paths.ts` ultimately derives from it.
- *  Enforced at write (`setProfileEnvVar` throws below) AND defensively at
- *  read (`readStoreUnlocked`, which every reader — list/set/remove/inject —
- *  goes through), so even a reserved name that reached disk some other way
- *  (hand-edited file, a pre-reservation write) is uniformly invisible rather
- *  than trusted. */
-const RESERVED_ENV_PREFIX = 'CRTR_';
-const RESERVED_ENV_EXACT_NAMES = new Set(['HOME']);
-export function isReservedEnvName(name) {
-    return name.startsWith(RESERVED_ENV_PREFIX) || RESERVED_ENV_EXACT_NAMES.has(name);
-}
-/** NUL is the one byte no OS accepts in an env value — Node's own `spawn`
- *  rejects it synchronously and echoes the full value in the thrown error, so
- *  it must never reach storage or a spawn call. */
-function hasNulByte(value) {
-    return value.includes('\0');
-}
-function envPath(profileId) {
-    return join(profileRoot(profileId), ENV_FILE);
-}
-/** Reads env.json into a null-prototype, sanitized own-property map.
- *  Null-prototype so a stored name like `__proto__` is a plain own data
- *  property instead of silently colliding with the inherited accessor on an
- *  ordinary object (which would make `in`/assignment lie about what's
- *  actually stored — `created`/`removed` would misreport, and the value
- *  would never actually persist). Sanitized — dropping any non-string,
- *  NUL-containing, or reserved-name entry — because this file may have been
- *  hand-edited or written by a version that predates these guards, and every
- *  reader (list/set/remove/inject) shares this one function, so a bad
- *  on-disk entry is uniformly invisible instead of leaking into one path but
- *  not another. Never throws: a corrupt file degrades to empty, matching the
- *  prior behavior. */
-function readStoreUnlocked(profileId) {
-    const p = envPath(profileId);
-    const vars = Object.create(null);
-    if (!existsSync(p))
-        return { vars };
-    try {
-        const parsed = JSON.parse(readFileSync(p, 'utf8'));
-        for (const [name, value] of Object.entries(parsed.vars ?? {})) {
-            if (typeof value !== 'string')
-                continue;
-            if (hasNulByte(value))
-                continue;
-            if (isReservedEnvName(name))
-                continue;
-            vars[name] = value;
-        }
-    }
-    catch {
-        // Corrupt/unparseable file: degrade to whatever was sanitized so far
-        // (empty, since the loop above never ran).
-    }
-    return { vars };
-}
-/** Writes env.json directly (never via `fs-utils`' generic writers, which
- *  have no mode control) so the file is created 0600 from the first byte,
- *  then `chmodSync`s belt-and-suspenders in case it pre-existed with looser
- *  permissions — the same shape as `core/secrets.ts`. Atomic via tmp+rename. */
-function writeStoreAtomic(profileId, store) {
-    const p = envPath(profileId);
-    ensureDir(profileRoot(profileId));
-    const tmp = `${p}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;
-    writeFileSync(tmp, JSON.stringify(store, null, 2) + '\n', { mode: 0o600 });
-    chmodSync(tmp, 0o600);
-    renameSync(tmp, p);
-}
-function requireProfileExists(profileId) {
-    try {
-        loadExactProfileManifest(profileId);
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.startsWith('profile not found:'))
-            throw notFound(`profile not found: ${profileId}`, { received: profileId });
-        throw error;
-    }
-}
-/** Every stored variable NAME for a profile, sorted. Never returns values. */
-export function listProfileEnvNames(profileId) {
-    return Object.keys(readStoreUnlocked(profileId).vars).sort();
-}
-/** Set one variable, replacing any prior value under the same name. Holds the
- *  same per-profile lock manifest mutations use (`withProfileManifestLock`),
- *  so a concurrent `profile delete` can never race a write into an
- *  about-to-vanish profile dir — whichever runs first wins the lock, and the
- *  loser either sees `not_found` (delete-then-set) or removes the file right
- *  back out from under a just-written value (set-then-delete, via
- *  `deleteProfile`'s recursive rm of the whole profile root). Returns whether
- *  the name was newly added (`true`) or replaced an existing value (`false`). */
-export function setProfileEnvVar(profileId, name, value) {
-    if (isReservedEnvName(name)) {
-        throw usage(`env var name is reserved by crtr: ${name}`, {
-            received: name,
-            field: 'name',
-            next: 'crtr identity/routing names (CRTR_* and HOME) cannot be stored in a profile env store — a stored value under one of these names could redirect a broker to a different canvas home. Choose a different name.',
-        });
-    }
-    if (hasNulByte(value)) {
-        throw usage('env var value contains a NUL byte, which no OS accepts in an environment variable', {
-            field: 'value',
-            next: 'Remove NUL bytes from the piped value and retry.',
-        });
-    }
-    return withProfileManifestLock(profileId, () => {
-        requireProfileExists(profileId);
-        const store = readStoreUnlocked(profileId);
-        const created = !Object.hasOwn(store.vars, name);
-        store.vars[name] = value;
-        writeStoreAtomic(profileId, store);
-        return created;
-    });
-}
-/** Remove one variable. Returns whether it was present. */
-export function removeProfileEnvVar(profileId, name) {
-    return withProfileManifestLock(profileId, () => {
-        requireProfileExists(profileId);
-        const store = readStoreUnlocked(profileId);
-        if (!Object.hasOwn(store.vars, name))
-            return false;
-        delete store.vars[name];
-        writeStoreAtomic(profileId, store);
-        return true;
-    });
-}
-/** Every stored `{name: value}` for a profile — the ONLY function that
- *  returns raw values, called exclusively by `buildBrokerEnv`
- *  (`core/runtime/spawn-env.ts`) to inject them directly into a launched
- *  broker's env. Never throws: a stale/invalid/deleted profile id is a
- *  hot-path no-op (mirrors `readRawProfileConfig` in `core/config.ts`),
- *  because broker-env resolution must never fail a launch over a bad profile
- *  id. */
-export function readProfileEnvVars(profileId) {
-    if (profileId === null || profileId === '')
-        return {};
-    try {
-        return { ...readStoreUnlocked(profileId).vars };
-    }
-    catch {
-        return {};
-    }
-}
+var d=Object.defineProperty;var n=(e,t)=>d(e,"name",{value:t,configurable:!0});import{existsSync as y,readFileSync as p,renameSync as S,writeFileSync as O,chmodSync as R}from"node:fs";import{join as b}from"node:path";import{loadExactProfileManifest as w,profileRoot as a,withProfileManifestLock as u}from"./manifest.js";import{ensureDir as N}from"../fs-utils.js";import{notFound as x,usage as f}from"../errors.js";const P="env.json",V="CRTR_",_=new Set(["HOME"]);function v(e){return e.startsWith(V)||_.has(e)}n(v,"isReservedEnvName");function m(e){return e.includes("\0")}n(m,"hasNulByte");function l(e){return b(a(e),P)}n(l,"envPath");function i(e){const t=l(e),r=Object.create(null);if(!y(t))return{vars:r};try{const o=JSON.parse(p(t,"utf8"));for(const[s,c]of Object.entries(o.vars??{}))typeof c=="string"&&(m(c)||v(s)||(r[s]=c))}catch{}return{vars:r}}n(i,"readStoreUnlocked");function h(e,t){const r=l(e);N(a(e));const o=`${r}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;O(o,JSON.stringify(t,null,2)+`
+`,{mode:384}),R(o,384),S(o,r)}n(h,"writeStoreAtomic");function E(e){try{w(e)}catch(t){throw t instanceof Error&&t.message.startsWith("profile not found:")?x(`profile not found: ${e}`,{received:e}):t}}n(E,"requireProfileExists");function C(e){return Object.keys(i(e).vars).sort()}n(C,"listProfileEnvNames");function L(e,t,r){if(v(t))throw f(`env var name is reserved by crtr: ${t}`,{received:t,field:"name",next:"crtr identity/routing names (CRTR_* and HOME) cannot be stored in a profile env store \u2014 a stored value under one of these names could redirect a broker to a different canvas home. Choose a different name."});if(m(r))throw f("env var value contains a NUL byte, which no OS accepts in an environment variable",{field:"value",next:"Remove NUL bytes from the piped value and retry."});return u(e,()=>{E(e);const o=i(e),s=!Object.hasOwn(o.vars,t);return o.vars[t]=r,h(e,o),s})}n(L,"setProfileEnvVar");function A(e,t){return u(e,()=>{E(e);const r=i(e);return Object.hasOwn(r.vars,t)?(delete r.vars[t],h(e,r),!0):!1})}n(A,"removeProfileEnvVar");function D(e){if(e===null||e==="")return{};try{return{...i(e).vars}}catch{return{}}}n(D,"readProfileEnvVars");export{v as isReservedEnvName,C as listProfileEnvNames,D as readProfileEnvVars,A as removeProfileEnvVar,L as setProfileEnvVar};

package/dist/core/profiles/fuzzy-match.js

@@ -1,92 +1 @@
-// Fuzzy matching for a user-TYPED profile operand. Pure — no fs, no manifest
-// reads — so the resolution policy is testable on its own and `manifest.ts`
-// stays the sole owner of path safety and manifest IO.
-//
-// This exists because nobody remembers a profile's exact registered name, let
-// alone its `<slug>-<8hex>` id. `crtr --profile crout` should run the `crouter`
-// profile instead of failing with a list the user then has to read and retype.
-/** Case-, space-, and punctuation-insensitive comparison key. "My Profile",
- *  "my-profile", and "myprofile" all collapse to the same key, so the common
- *  near-miss (wrong separator, wrong case) resolves in the first tier. */
-function normalize(value) {
-    return value.toLowerCase().replace(/[^a-z0-9]/g, '');
-}
-/** The generated id's `-<8 hex>` suffix carries no meaning to a human typing a
- *  profile, so match against the slug alone as well as the whole id. */
-function idSlug(profileId) {
-    return profileId.replace(/-[0-9a-f]{8}$/, '');
-}
-/** Every string a human might plausibly have been aiming at for one profile. */
-function haystacks(candidate) {
-    const keys = [normalize(candidate.name), normalize(idSlug(candidate.profileId)), normalize(candidate.profileId)];
-    return keys.filter((key, index) => key !== '' && keys.indexOf(key) === index);
-}
-function levenshtein(a, b) {
-    if (a === b)
-        return 0;
-    if (a.length === 0)
-        return b.length;
-    if (b.length === 0)
-        return a.length;
-    let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
-    for (let i = 1; i <= a.length; i += 1) {
-        const current = [i];
-        for (let j = 1; j <= b.length; j += 1) {
-            const substitution = previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1);
-            current[j] = Math.min(current[j - 1] + 1, previous[j] + 1, substitution);
-        }
-        previous = current;
-    }
-    return previous[b.length];
-}
-/** Tiers, strongest first. They are ordered by how confidently a human meant
- *  this profile, NOT by string similarity — a prefix the user stopped typing is
- *  a stronger signal than a one-character edit that happens to score well. */
-const TIER_NORMALIZED_EQUAL = 0;
-const TIER_PREFIX = 1;
-const TIER_CONTAINS = 2;
-const TIER_TYPO = 3;
-function scoreOne(needle, candidate) {
-    let best = null;
-    for (const hay of haystacks(candidate)) {
-        const distance = levenshtein(needle, hay);
-        let tier = null;
-        if (needle === hay)
-            tier = TIER_NORMALIZED_EQUAL;
-        else if (hay.startsWith(needle))
-            tier = TIER_PREFIX;
-        else if (hay.includes(needle) || needle.includes(hay))
-            tier = TIER_CONTAINS;
-        // A typo budget that scales with length: one edit for a short name, more
-        // for a long one. Without the floor, a 3-character name would tolerate
-        // nothing; without the scaling, two unrelated long names would collide.
-        else if (distance <= Math.max(1, Math.floor(hay.length / 3)))
-            tier = TIER_TYPO;
-        if (tier === null)
-            continue;
-        if (best === null || tier < best.tier || (tier === best.tier && distance < best.distance)) {
-            best = { candidate, tier, distance };
-        }
-    }
-    return best;
-}
-/** Resolve a typed operand against the profiles on this host. Returns a single
- *  match only when it is unambiguously the best one: the strongest tier any
- *  candidate reached, and within it the single lowest edit distance. A genuine
- *  tie is reported rather than guessed, because silently running under the
- *  wrong profile is worse than one more prompt. */
-export function fuzzyMatchProfile(operand, candidates) {
-    const needle = normalize(operand);
-    if (needle === '')
-        return { match: null, tied: [] };
-    const scored = candidates.map((c) => scoreOne(needle, c)).filter((s) => s !== null);
-    if (scored.length === 0)
-        return { match: null, tied: [] };
-    const bestTier = Math.min(...scored.map((s) => s.tier));
-    const inTier = scored.filter((s) => s.tier === bestTier);
-    const bestDistance = Math.min(...inTier.map((s) => s.distance));
-    const winners = inTier.filter((s) => s.distance === bestDistance);
-    if (winners.length === 1)
-        return { match: winners[0].candidate, tied: [] };
-    return { match: null, tied: winners.map((s) => s.candidate) };
-}
+var a=Object.defineProperty;var o=(t,i)=>a(t,"name",{value:i,configurable:!0});function c(t){return t.toLowerCase().replace(/[^a-z0-9]/g,"")}o(c,"normalize");function h(t){return t.replace(/-[0-9a-f]{8}$/,"")}o(h,"idSlug");function m(t){const i=[c(t.name),c(h(t.profileId)),c(t.profileId)];return i.filter((r,e)=>r!==""&&i.indexOf(r)===e)}o(m,"haystacks");function g(t,i){if(t===i)return 0;if(t.length===0)return i.length;if(i.length===0)return t.length;let r=Array.from({length:i.length+1},(e,s)=>s);for(let e=1;e<=t.length;e+=1){const s=[e];for(let n=1;n<=i.length;n+=1){const u=r[n-1]+(t[e-1]===i[n-1]?0:1);s[n]=Math.min(s[n-1]+1,r[n]+1,u)}r=s}return r[i.length]}o(g,"levenshtein");const d=0,p=1,I=2,T=3;function E(t,i){let r=null;for(const e of m(i)){const s=g(t,e);let n=null;t===e?n=d:e.startsWith(t)?n=p:e.includes(t)||t.includes(e)?n=I:s<=Math.max(1,Math.floor(e.length/3))&&(n=T),n!==null&&(r===null||n<r.tier||n===r.tier&&s<r.distance)&&(r={candidate:i,tier:n,distance:s})}return r}o(E,"scoreOne");function R(t,i){const r=c(t);if(r==="")return{match:null,tied:[]};const e=i.map(l=>E(r,l)).filter(l=>l!==null);if(e.length===0)return{match:null,tied:[]};const s=Math.min(...e.map(l=>l.tier)),n=e.filter(l=>l.tier===s),u=Math.min(...n.map(l=>l.distance)),f=n.filter(l=>l.distance===u);return f.length===1?{match:f[0].candidate,tied:[]}:{match:null,tied:f.map(l=>l.candidate)}}o(R,"fuzzyMatchProfile");export{R as fuzzyMatchProfile};