@reticlehq/server 2.13.1 → 2.14.0

package/dist/init/vite-config.js

@@ -1,114 +0,0 @@
-/**
- * Pure, conservative patcher for a Vite config: add the `@reticlehq/vite-plugin` import and drop
- * `reticle` into the `plugins` array. Only handles the obvious, common shape — anything ambiguous
- * bails to a `manual` result so we never half-edit a build config (a broken config is worse than a
- * documented manual step).
- */
-import { PatchKind } from './patch-kind.js';
-export const VITE_IMPORT = "import { reticle } from '@reticlehq/vite-plugin';";
-const RETICLE_MARKER = '@reticlehq/vite-plugin';
-/**
- * The `reticle(...)` call — the bridge port so the injected connect targets it.
- *
- * **`captureNetworkBodies` is OPT-IN.** It was written in by default, and the argument for that was
- * a good one: without a body, a write that answers 2xx grades `unknown / outcome_unread`, because a
- * 200 describes the transport and not the result. Measured on a real payments UI — a refund posted
- * rupees into a paise field, the server answered 200 having refunded a hundredth of it, the page
- * rendered the amount the user had typed, and every DOM-level check passed.
- *
- * That argument justifies the CAPABILITY. It does not justify the default, and the distinction is
- * what #705 is about. A healthcare workspace proxying authenticated API traffic through Vite ran
- * `init`, and on the first drive their login tokens and patient payloads were in the daemon's
- * buffer. The old comment here conceded the exact gap — "the credential classes are redacted ... but
- * an address or an email is not, and nothing here should decide that for someone silently" — and
- * then decided it for them, because writing the line into their config IS deciding. `init` is run
- * unattended by an agent; the person who knows the data is sensitive is not in the room.
- *
- * So the default is off and the ways in are all deliberate:
- *   - `reticle init --capture-bodies` writes the line, for someone who has decided
- *   - `VITE_RETICLE_CAPTURE_BODIES=1` turns it on for ONE dev-server run, no config edit
- *   - adding the option by hand, which is what the tools tell you to do
- *
- * Nothing goes quiet in exchange. Every tool that needs a body already says so when it is missing
- * and names the option — see honesty/uncaptured-bodies.ts, honesty/verified.ts, predicate-eval.ts
- * and reconcile-tools.ts — so the capability is discovered at the moment it is wanted, by the person
- * who wanted it, instead of being switched on before anyone has asked.
- */
-function reticlePluginCall(port, captureBodies) {
-    const options = [
-        ...(port === undefined ? [] : [`port: ${String(port)}`]),
-        ...(captureBodies ? ['captureNetworkBodies: true'] : []),
-    ];
-    return 0 === options.length ? 'reticle()' : `reticle({ ${options.join(', ')} })`;
-}
-/** Matches the start of a `plugins: [` array literal. */
-const PLUGINS_ARRAY = /plugins\s*:\s*\[/;
-/** Matches an ES import statement (used to place our import after the last one). */
-const IMPORT_LINE = /^import\s.+from\s+['"][^'"]+['"];?\s*$/gm;
-/**
- * The opening `{` of the exported config object — `defineConfig({`, or a bare `export default {`.
- * Used only when there is no `plugins` array to extend: the object is right there, so adding the
- * key is the same edit as extending the array, and bailing sent a user whose config merely set
- * `server.port` to a manual paste for a change we can make correctly.
- *
- * A config built by a call (`defineConfig(buildOptions())`) has no literal to extend and still
- * bails — the rule stays "only edit a shape we can see whole".
- */
-const CONFIG_OBJECT = /(export\s+default\s+(?:defineConfig\s*\(\s*)?)\{/;
-/** Alias kept so existing call sites read in Vite terms; the vocabulary is shared (see patch-kind). */
-export const VitePatchKind = PatchKind;
-const NO_PLUGINS_REASON = "couldn't find a `plugins: [...]` array to extend";
-function insertImport(source) {
-    const matches = [...source.matchAll(IMPORT_LINE)];
-    const last = matches[matches.length - 1];
-    if (last?.index === undefined) {
-        return `${VITE_IMPORT}\n${source}`;
-    }
-    const end = last.index + last[0].length;
-    return `${source.slice(0, end)}\n${VITE_IMPORT}${source.slice(end)}`;
-}
-/**
- * Insert right after the opening `[` of the plugins array, spaced the way the surrounding line is.
- *
- * A multi-line array puts a newline next, and `[reticle(), \n` leaves trailing whitespace — exactly
- * what a formatter rewrites, turning a one-line install into a diff against the user's own style. A
- * single-line array needs the space, or the result reads `[reticle(),react()]`.
- */
-function insertPlugin(source, port, captureBodies) {
-    return source.replace(PLUGINS_ARRAY, (match, _g, offset) => {
-        const next = source[offset + match.length] ?? '';
-        const separator = '' === next || /\s/.test(next) ? '' : ' ';
-        return `${match}${reticlePluginCall(port, captureBodies)},${separator}`;
-    });
-}
-/**
- * Add a whole `plugins: [reticle()]` key to a config object that has none, matching the layout of
- * the object it lands in: a multi-line object gets its own indented line, a one-liner stays inline.
- */
-function insertPluginsKey(source, port, captureBodies) {
-    return source.replace(CONFIG_OBJECT, (_match, prefix, offset) => {
-        const rest = source.slice(offset + _match.length);
-        const multiline = /^\s*\n/.test(rest);
-        const indent = /^\s*\n(\s*)\S/.exec(rest)?.[1] ?? '  ';
-        const key = `plugins: [${reticlePluginCall(port, captureBodies)}],`;
-        return multiline ? `${prefix}{\n${indent}${key}` : `${prefix}{ ${key}`;
-    });
-}
-export function patchViteConfig(source, port, captureBodies = false) {
-    if (source.includes(RETICLE_MARKER)) {
-        return { kind: VitePatchKind.ALREADY };
-    }
-    if (PLUGINS_ARRAY.test(source)) {
-        return {
-            kind: VitePatchKind.APPLY,
-            code: insertImport(insertPlugin(source, port, captureBodies)),
-        };
-    }
-    if (CONFIG_OBJECT.test(source)) {
-        return {
-            kind: VitePatchKind.APPLY,
-            code: insertImport(insertPluginsKey(source, port, captureBodies)),
-        };
-    }
-    return { kind: VitePatchKind.MANUAL, reason: NO_PLUGINS_REASON };
-}

package/dist/init/windows-quote.d.ts

@@ -1,38 +0,0 @@
-/**
- * Quote one argument for a Windows command line. Pure, and deliberately NOT platform-gated.
- *
- * The rule used to live inside a `process.platform === WINDOWS` branch in node-io.ts, which meant
- * the Windows path could not be exercised on a mac or in CI's Linux job — so it stayed wrong. A
- * pure function is most of the fix: it can be asserted anywhere, and it is.
- *
- * ## What was wrong
- *
- * ```ts
- * /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg
- * ```
- *
- * Two independent holes, both reachable from an ordinary directory path:
- *
- * 1. **Backslashes were not escaped.** `C:\Users\ada\My Projects\` became
- *    `"C:\Users\ada\My Projects\"`, whose trailing `\"` reads as an ESCAPED quote — the quoted
- *    region never closes and the rest of the line is re-parsed by cmd.exe. CodeQL flagged this one
- *    (`js/incomplete-sanitization`, high).
- * 2. **The predicate only looked for whitespace and quotes.** An argument like `foo&whoami` has
- *    neither, so it was handed to cmd.exe completely unquoted. Correct backslash escaping does
- *    nothing for that; it needs the metacharacters in the trigger.
- *
- * ## The rule implemented here
- *
- * `CommandLineToArgvW`: a run of backslashes is literal unless it precedes a `"`, in which case the
- * run is doubled and the quote escaped; a run at the very end sits before the closing quote we add,
- * so it is doubled too. Correctly-terminated quotes also neutralise cmd.exe's metacharacters, which
- * it does not interpret inside a quoted region.
- *
- * ## Known limit, stated rather than papered over
- *
- * `%VAR%` is expanded by cmd.exe even inside quotes, and no quoting prevents it — only avoiding
- * `shell: true` does, which Windows needs so `pnpm.cmd`/`npx.cmd` resolve (see `shellOpt`). That is
- * variable substitution, not command execution, and every caller here passes paths and package
- * names rather than user prose.
- */
-export declare function windowsShellArg(arg: string): string;

package/dist/init/windows-quote.js

@@ -1,70 +0,0 @@
-/**
- * Quote one argument for a Windows command line. Pure, and deliberately NOT platform-gated.
- *
- * The rule used to live inside a `process.platform === WINDOWS` branch in node-io.ts, which meant
- * the Windows path could not be exercised on a mac or in CI's Linux job — so it stayed wrong. A
- * pure function is most of the fix: it can be asserted anywhere, and it is.
- *
- * ## What was wrong
- *
- * ```ts
- * /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg
- * ```
- *
- * Two independent holes, both reachable from an ordinary directory path:
- *
- * 1. **Backslashes were not escaped.** `C:\Users\ada\My Projects\` became
- *    `"C:\Users\ada\My Projects\"`, whose trailing `\"` reads as an ESCAPED quote — the quoted
- *    region never closes and the rest of the line is re-parsed by cmd.exe. CodeQL flagged this one
- *    (`js/incomplete-sanitization`, high).
- * 2. **The predicate only looked for whitespace and quotes.** An argument like `foo&whoami` has
- *    neither, so it was handed to cmd.exe completely unquoted. Correct backslash escaping does
- *    nothing for that; it needs the metacharacters in the trigger.
- *
- * ## The rule implemented here
- *
- * `CommandLineToArgvW`: a run of backslashes is literal unless it precedes a `"`, in which case the
- * run is doubled and the quote escaped; a run at the very end sits before the closing quote we add,
- * so it is doubled too. Correctly-terminated quotes also neutralise cmd.exe's metacharacters, which
- * it does not interpret inside a quoted region.
- *
- * ## Known limit, stated rather than papered over
- *
- * `%VAR%` is expanded by cmd.exe even inside quotes, and no quoting prevents it — only avoiding
- * `shell: true` does, which Windows needs so `pnpm.cmd`/`npx.cmd` resolve (see `shellOpt`). That is
- * variable substitution, not command execution, and every caller here passes paths and package
- * names rather than user prose.
- */
-/**
- * Characters that make cmd.exe do something other than pass the text along.
- *
- * Whitespace and `"` split or delimit; the rest are the shell's control operators. An argument
- * containing any of them must be quoted, not just one containing a space.
- */
-const NEEDS_QUOTING = /[\s"&|<>^()!%,;=]/;
-export function windowsShellArg(arg) {
-    // An empty argument must still occupy a slot in argv. Unquoted it disappears entirely, silently
-    // shifting every argument after it by one.
-    if (0 === arg.length)
-        return '""';
-    if (!NEEDS_QUOTING.test(arg))
-        return arg;
-    let out = '"';
-    let backslashes = 0;
-    for (const ch of arg) {
-        if ('\\' === ch) {
-            backslashes += 1;
-            continue;
-        }
-        if ('"' === ch) {
-            // 2n+1 backslashes → n literal backslashes and an escaped quote.
-            out += '\\'.repeat(2 * backslashes + 1) + '"';
-            backslashes = 0;
-            continue;
-        }
-        out += '\\'.repeat(backslashes) + ch;
-        backslashes = 0;
-    }
-    // A trailing run sits immediately before the closing quote, so it must be doubled or it escapes it.
-    return `${out}${'\\'.repeat(2 * backslashes)}"`;
-}

package/dist/init/workspace-apps.d.ts

@@ -1,30 +0,0 @@
-import type { InitIo } from './run.js';
-/**
- * The file names that say what a directory IS, shared by everything that has to ask.
- *
- * They lived in run.ts and are read from here now because `findWorkspaceApps` moved and needs them —
- * one definition, imported in both directions of the question ("is this an app?" and "which app?").
- */
-export declare const PACKAGE_JSON = "package.json";
-export declare const PNPM_WORKSPACE = "pnpm-workspace.yaml";
-export declare const VITE_CONFIG_CANDIDATES: string[];
-export declare const NEXT_CONFIG_CANDIDATES: string[];
-interface WorkspaceSources {
-    /** Raw contents of pnpm-workspace.yaml, when present. */
-    pnpmWorkspace?: string;
-    /** The `workspaces` field of package.json — array form or the yarn/npm object form. */
-    pkgWorkspaces?: unknown;
-    /** Directory names at the repo root, used when nothing is declared. */
-    topLevelDirs?: readonly string[];
-}
-export declare function workspaceParents(sources: WorkspaceSources): string[];
-/**
- * App directories under a workspace root.
- *
- * Running `reticle init` at the repo root is what people actually do, and in a monorepo the app is a
- * directory down — so init detected "no framework", printed a wall of manual HTML instructions, and
- * would have installed the SDK into the ROOT package.json. It already walks UP for the lockfile, so
- * it knows it is in a workspace; this is the matching walk DOWN.
- */
-export declare function findWorkspaceApps(io: Pick<InitIo, 'exists' | 'readFile' | 'listDirs'>): string[];
-export {};

package/dist/init/workspace-apps.js

@@ -1,178 +0,0 @@
-import { DEV_SCRIPT_NAMES } from './dev-script.js';
-/**
- * The file names that say what a directory IS, shared by everything that has to ask.
- *
- * They lived in run.ts and are read from here now because `findWorkspaceApps` moved and needs them —
- * one definition, imported in both directions of the question ("is this an app?" and "which app?").
- */
-export const PACKAGE_JSON = 'package.json';
-export const PNPM_WORKSPACE = 'pnpm-workspace.yaml';
-export const VITE_CONFIG_CANDIDATES = [
-    'vite.config.ts',
-    'vite.config.js',
-    'vite.config.mjs',
-    'vite.config.mts',
-];
-export const NEXT_CONFIG_CANDIDATES = [
-    'next.config.mjs',
-    'next.config.js',
-    'next.config.ts',
-    'next.config.cjs',
-];
-/**
- * Which directories to look in for the app, when `reticle init` runs at a monorepo root.
- *
- * This used to be the literal list `['apps', 'packages']`. Measured on a real repo with three Next
- * apps at `web/`, `admin/` and `space/`, it found none — so the redirect never fired, init ran
- * against the root, and it reported ✓ for writing `app/reticle-dev.tsx` into a directory Next never
- * compiles. A ⚠ tells a human to act; a ✓ tells them it is handled.
- *
- * A workspace DECLARES its packages, so that declaration is used first and directory names are not
- * guessed at all. Where nothing is declared, every top-level directory is a better candidate than two
- * hardcoded ones — filtered by the usual non-source suspects, and still subject to the `looksLikeApp`
- * check that follows, so a wrong guess here costs a `package.json` read.
- */
-/** Directories that are never a workspace package, whatever the layout. */
-const NEVER_A_PACKAGE = new Set(['node_modules', 'dist', 'build', 'out', 'coverage', 'target']);
-/** `packages/*` -> `packages`; `web` -> `web`. The base directory a glob searches. */
-function globBase(pattern) {
-    const base = pattern
-        .split('/')[0]
-        ?.trim()
-        .replace(/^['"]|['"]$/g, '');
-    return base === undefined || '' === base || '.' === base || base.includes('*') ? undefined : base;
-}
-function fromPnpm(yaml) {
-    // A deliberately small reader rather than a YAML dependency: this file is a list of globs, and the
-    // only shape that matters is `- 'pattern'` under `packages:`. A malformed file yields nothing,
-    // which falls through to the top-level scan rather than failing the install.
-    const out = [];
-    let inPackages = false;
-    for (const line of yaml.split('\n')) {
-        if (/^packages\s*:/.test(line)) {
-            inPackages = true;
-            continue;
-        }
-        if (inPackages && /^\S/.test(line))
-            break;
-        const item = /^\s*-\s*(.+)$/.exec(line);
-        if (inPackages && item?.[1] !== undefined) {
-            const base = globBase(item[1]);
-            if (base !== undefined)
-                out.push(base);
-        }
-    }
-    return out;
-}
-function fromPkg(workspaces) {
-    const list = Array.isArray(workspaces)
-        ? workspaces
-        : 'object' === typeof workspaces && workspaces !== null
-            ? workspaces.packages
-            : undefined;
-    if (!Array.isArray(list))
-        return [];
-    return list
-        .filter((p) => 'string' === typeof p)
-        .map(globBase)
-        .filter((p) => p !== undefined);
-}
-export function workspaceParents(sources) {
-    const declared = [
-        ...(sources.pnpmWorkspace === undefined ? [] : fromPnpm(sources.pnpmWorkspace)),
-        ...fromPkg(sources.pkgWorkspaces),
-    ];
-    const candidates = declared.length > 0
-        ? declared
-        : (sources.topLevelDirs ?? []).filter((d) => !d.startsWith('.') && !NEVER_A_PACKAGE.has(d));
-    return [...new Set(candidates)];
-}
-/**
- * Which directories under this workspace are runnable apps.
- *
- * Moved here from run.ts, which was over the 1000-line cap and had carried a note saying it was at
- * its cohesion limit. `library-path-boundary.test.ts` had already written down that this function
- * "squats in init/ for historical reasons" — it is a general-purpose question about a repository's
- * shape, next to `workspaceParents`, which answers the other half of it.
- */
-/** Deps that mark a directory as a runnable web app even when it has no bundler config file. */
-const APP_DEPS = ['next', 'vite'];
-function hasDevScript(pkgRaw) {
-    try {
-        const parsed = JSON.parse(pkgRaw);
-        const scripts = 'object' === typeof parsed && parsed !== null
-            ? parsed.scripts
-            : undefined;
-        if ('object' !== typeof scripts || null === scripts)
-            return false;
-        const named = scripts;
-        return DEV_SCRIPT_NAMES.some((n) => 'string' === typeof named[n] && '' !== named[n]);
-    }
-    catch {
-        // A manifest that will not parse says nothing either way, and this is a filter, not a verdict.
-        return false;
-    }
-}
-function looksLikeApp(dir, io) {
-    const pkgRaw = io.readFile(`${dir}/${PACKAGE_JSON}`);
-    if (null === pkgRaw)
-        return false;
-    const configs = [...VITE_CONFIG_CANDIDATES, ...NEXT_CONFIG_CANDIDATES];
-    if (configs.some((c) => io.exists(`${dir}/${c}`)))
-        return true;
-    // `next.config` is optional in Next, so the dependency list is the other half of the signal.
-    if (APP_DEPS.some((d) => pkgRaw.includes(`"${d}"`)))
-        return true;
-    // And the honest third: an app somebody can SERVE. Asking only for a bundler missed every app
-    // built on anything else — Remix, Astro, a plain node server — and in a monorepo missing it means
-    // init never redirects, wires the ROOT, and reports ✓ for files nothing compiles.
-    //
-    // A monorepo root has no dev script by design, and a package that can only be BUILT is not the app
-    // somebody is working in, so this stays a filter rather than matching every directory.
-    return hasDevScript(pkgRaw);
-}
-/**
- * App directories under a workspace root.
- *
- * Running `reticle init` at the repo root is what people actually do, and in a monorepo the app is a
- * directory down — so init detected "no framework", printed a wall of manual HTML instructions, and
- * would have installed the SDK into the ROOT package.json. It already walks UP for the lockfile, so
- * it knows it is in a workspace; this is the matching walk DOWN.
- */
-export function findWorkspaceApps(io) {
-    const found = [];
-    // A workspace DECLARES its packages; `['apps','packages']` was a guess that missed a real repo
-    // with three Next apps at web/, admin/ and space/ — and missing them meant init ran against the
-    // root and reported ✓ for a file Next never compiles. See workspace-apps.
-    const pkgRaw = io.readFile(PACKAGE_JSON);
-    let pkgWorkspaces;
-    try {
-        const parsed = null === pkgRaw ? undefined : JSON.parse(pkgRaw);
-        pkgWorkspaces =
-            'object' === typeof parsed && parsed !== null
-                ? parsed.workspaces
-                : undefined;
-    }
-    catch {
-        pkgWorkspaces = undefined;
-    }
-    const parents = workspaceParents({
-        ...(null === io.readFile(PNPM_WORKSPACE)
-            ? {}
-            : { pnpmWorkspace: io.readFile(PNPM_WORKSPACE) ?? '' }),
-        ...(pkgWorkspaces === undefined ? {} : { pkgWorkspaces }),
-        topLevelDirs: io.listDirs('.'),
-    });
-    // A declared parent can itself BE the app (`workspaces: ["web"]`), so check both the directory and
-    // its children rather than assuming one level of nesting.
-    for (const parent of parents) {
-        if (looksLikeApp(parent, io))
-            found.push(parent);
-        for (const name of io.listDirs(parent)) {
-            const dir = `${parent}/${name}`;
-            if (looksLikeApp(dir, io))
-                found.push(dir);
-        }
-    }
-    return [...new Set(found)];
-}

package/dist/project/remember-project.d.ts

@@ -1,24 +0,0 @@
-/**
- * Record where this project lives, so a daemon started somewhere else can still find it.
- *
- * Called at the end of `init`, which is the one moment both halves are known for certain: the
- * directory being initialised, and the projectId that was just written into its `.reticle.json`.
- *
- * Deliberately runs on EVERY init, not only the first. Most init runs report "already wired", and a
- * re-run in a re-cloned or moved checkout is exactly when the remembered path has gone stale — so
- * the run that would have been a no-op is the one that repairs the entry.
- *
- * Every failure is swallowed. This is a cache that makes a later resolution better; a read-only home
- * directory, a full disk or a hand-mangled file must not turn a successful init into a failed one.
- * The user's project is wired either way, and `init`'s report is the first thing a new user reads.
- */
-/** The sync filesystem seam `init` already carries. Narrowed to what this needs. */
-export interface RegistryIo {
-    readFile(path: string): string | null;
-    writeFile(path: string, content: string): void;
-    exists(path: string): boolean;
-    homeDir(): string;
-}
-/** The `projectId` a `.reticle.json` declares, or undefined when it declares none we can use. */
-export declare function projectIdOf(configSource: string | null): string | undefined;
-export declare function rememberProjectOnDisk(io: RegistryIo, projectId: string, directory: string, now: number): boolean;

package/dist/project/remember-project.js

@@ -1,40 +0,0 @@
-import { join } from 'node:path';
-import { PROJECT_REGISTRY_FILE, ReticleDir, emptyProjectRegistry, parseProjectRegistry, rememberProject, } from '@reticlehq/core';
-/** The `projectId` a `.reticle.json` declares, or undefined when it declares none we can use. */
-export function projectIdOf(configSource) {
-    if (null === configSource || 0 === configSource.length)
-        return undefined;
-    try {
-        const parsed = JSON.parse(configSource);
-        if ('object' !== typeof parsed || null === parsed || Array.isArray(parsed))
-            return undefined;
-        const id = parsed['projectId'];
-        return 'string' === typeof id && id.length > 0 ? id : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function rememberProjectOnDisk(io, projectId, directory, now) {
-    if (0 === projectId.length || 0 === directory.length)
-        return false;
-    try {
-        const path = join(io.homeDir(), ReticleDir.ROOT, PROJECT_REGISTRY_FILE);
-        const existing = io.exists(path) ? io.readFile(path) : null;
-        const registry = null === existing ? emptyProjectRegistry() : parseProjectRegistry(safeJson(existing));
-        const next = rememberProject(registry, projectId, directory, now);
-        io.writeFile(path, `${JSON.stringify(next, null, 2)}\n`);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function safeJson(raw) {
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}