@tarunspandit/codexflow 0.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (92) hide show
  1. package/AGENTS.example.md +18 -0
  2. package/CHANGELOG.md +311 -0
  3. package/CHATGPT_PROMPT.md +12 -0
  4. package/CODEX_PROMPT.md +12 -0
  5. package/CONTRIBUTING.md +51 -0
  6. package/DOMAIN_SETUP.md +241 -0
  7. package/FAQ.md +327 -0
  8. package/FAQ_ZH.md +279 -0
  9. package/LICENSE +21 -0
  10. package/NOTICE +9 -0
  11. package/PUBLIC_LAUNCH_CHECKLIST.md +111 -0
  12. package/README.md +287 -0
  13. package/README_ZH.md +461 -0
  14. package/SECURITY.md +145 -0
  15. package/config.example.env +31 -0
  16. package/dist/analysis/cache.js +27 -0
  17. package/dist/analysis/cache.js.map +1 -0
  18. package/dist/analysis/classify.js +102 -0
  19. package/dist/analysis/classify.js.map +1 -0
  20. package/dist/analysis/extract.js +139 -0
  21. package/dist/analysis/extract.js.map +1 -0
  22. package/dist/analysis/graph.js +22 -0
  23. package/dist/analysis/graph.js.map +1 -0
  24. package/dist/analysis/impact.js +167 -0
  25. package/dist/analysis/impact.js.map +1 -0
  26. package/dist/analysis/index.js +215 -0
  27. package/dist/analysis/index.js.map +1 -0
  28. package/dist/analysis/inventory.js +51 -0
  29. package/dist/analysis/inventory.js.map +1 -0
  30. package/dist/analysis/providers.js +24 -0
  31. package/dist/analysis/providers.js.map +1 -0
  32. package/dist/analysis/rank.js +27 -0
  33. package/dist/analysis/rank.js.map +1 -0
  34. package/dist/analysis/types.js +8 -0
  35. package/dist/analysis/types.js.map +1 -0
  36. package/dist/bashOps.js +233 -0
  37. package/dist/bashOps.js.map +1 -0
  38. package/dist/capabilitiesOps.js +365 -0
  39. package/dist/capabilitiesOps.js.map +1 -0
  40. package/dist/codexSessions.js +379 -0
  41. package/dist/codexSessions.js.map +1 -0
  42. package/dist/config.js +289 -0
  43. package/dist/config.js.map +1 -0
  44. package/dist/fsOps.js +286 -0
  45. package/dist/fsOps.js.map +1 -0
  46. package/dist/gitOps.js +79 -0
  47. package/dist/gitOps.js.map +1 -0
  48. package/dist/guard.js +198 -0
  49. package/dist/guard.js.map +1 -0
  50. package/dist/http.js +1671 -0
  51. package/dist/http.js.map +1 -0
  52. package/dist/proContext.js +274 -0
  53. package/dist/proContext.js.map +1 -0
  54. package/dist/profileStore.js +89 -0
  55. package/dist/profileStore.js.map +1 -0
  56. package/dist/projectCatalog.js +134 -0
  57. package/dist/projectCatalog.js.map +1 -0
  58. package/dist/redact.js +73 -0
  59. package/dist/redact.js.map +1 -0
  60. package/dist/searchOps.js +186 -0
  61. package/dist/searchOps.js.map +1 -0
  62. package/dist/server.js +2502 -0
  63. package/dist/server.js.map +1 -0
  64. package/dist/stdio.js +36 -0
  65. package/dist/stdio.js.map +1 -0
  66. package/dist/toolCardWidget.js +1155 -0
  67. package/dist/toolCardWidget.js.map +1 -0
  68. package/dist/workspaceOps.js +229 -0
  69. package/dist/workspaceOps.js.map +1 -0
  70. package/docs/.nojekyll +1 -0
  71. package/docs/favicon.svg +5 -0
  72. package/docs/index.html +638 -0
  73. package/docs/og.png +0 -0
  74. package/docs/script.js +80 -0
  75. package/docs/star.svg +11 -0
  76. package/docs/styles.css +1229 -0
  77. package/docs/zh.html +436 -0
  78. package/package.json +94 -0
  79. package/scripts/analysis-cli-smoke.mjs +81 -0
  80. package/scripts/analysis-smoke.mjs +179 -0
  81. package/scripts/clean.mjs +6 -0
  82. package/scripts/cli-smoke.mjs +168 -0
  83. package/scripts/codexflow.mjs +4375 -0
  84. package/scripts/doctor-smoke.mjs +90 -0
  85. package/scripts/execute-handoff-smoke.mjs +1110 -0
  86. package/scripts/http-smoke.mjs +812 -0
  87. package/scripts/pro-apply.mjs +141 -0
  88. package/scripts/pro-bundle.mjs +121 -0
  89. package/scripts/pro-smoke.mjs +95 -0
  90. package/scripts/settings-smoke.mjs +756 -0
  91. package/scripts/smoke.mjs +1194 -0
  92. package/scripts/stress.mjs +835 -0
package/dist/gitOps.js ADDED
@@ -0,0 +1,79 @@
1
+ import { spawnSync } from "node:child_process";
2
+ import { redactSensitiveText } from "./redact.js";
3
+ function runGit(workspace, args, maxOutputBytes) {
4
+ const result = spawnSync("git", args, {
5
+ cwd: workspace.root,
6
+ encoding: "utf8",
7
+ maxBuffer: maxOutputBytes,
8
+ env: { ...process.env, NO_COLOR: "1" }
9
+ });
10
+ if (result.error) {
11
+ return `git unavailable or failed: ${result.error.message}`;
12
+ }
13
+ if (result.status !== 0) {
14
+ const stderr = result.stderr?.trim() || "";
15
+ const stdout = result.stdout?.trim() || "";
16
+ return stderr || stdout || `git exited with status ${result.status}`;
17
+ }
18
+ return redactSensitiveText(result.stdout.trim() || "(no output)");
19
+ }
20
+ function isGitFailure(output) {
21
+ const trimmed = output.trim().toLowerCase();
22
+ return (trimmed.startsWith("fatal:") ||
23
+ trimmed.startsWith("error:") ||
24
+ trimmed.startsWith("git unavailable or failed:") ||
25
+ trimmed.startsWith("git exited with status") ||
26
+ trimmed.startsWith("usage: git ") ||
27
+ trimmed.includes("not a git repository"));
28
+ }
29
+ function outputLines(output) {
30
+ return output.trim() === "(no output)" ? [] : output.split("\n").map((line) => line.trim()).filter(Boolean);
31
+ }
32
+ export function gitStatus(config, workspace, guard, filePath, staged = false) {
33
+ const args = staged ? ["diff", "--cached", "--name-status"] : ["status", "--short", "--branch"];
34
+ if (filePath?.trim()) {
35
+ if (!guard)
36
+ return "path-scoped git status requires a path guard";
37
+ const resolved = guard.resolve(workspace, filePath);
38
+ args.push("--", resolved.relPath);
39
+ }
40
+ return runGit(workspace, args, config.maxOutputBytes);
41
+ }
42
+ export function gitDiff(config, guard, workspace, filePath, staged = false) {
43
+ const args = ["diff", "--no-color", "--no-ext-diff", "--no-textconv"];
44
+ if (staged)
45
+ args.push("--staged");
46
+ if (filePath?.trim()) {
47
+ const resolved = guard.resolve(workspace, filePath);
48
+ args.push("--", resolved.relPath);
49
+ }
50
+ return runGit(workspace, args, config.maxOutputBytes);
51
+ }
52
+ export function gitDiffStatus(config, guard, workspace, filePath, staged = false) {
53
+ const args = ["diff", "--name-status"];
54
+ if (staged)
55
+ args.push("--staged");
56
+ const untrackedArgs = ["ls-files", "--others", "--exclude-standard"];
57
+ if (filePath?.trim()) {
58
+ const resolved = guard.resolve(workspace, filePath);
59
+ args.push("--", resolved.relPath);
60
+ untrackedArgs.push("--", resolved.relPath);
61
+ }
62
+ const diffStatus = runGit(workspace, args, config.maxOutputBytes);
63
+ if (staged || isGitFailure(diffStatus))
64
+ return diffStatus;
65
+ const untracked = runGit(workspace, untrackedArgs, config.maxOutputBytes);
66
+ if (isGitFailure(untracked))
67
+ return diffStatus;
68
+ const lines = [...outputLines(diffStatus), ...outputLines(untracked).map((line) => `?? ${line}`)];
69
+ return lines.length ? lines.join("\n") : "(no output)";
70
+ }
71
+ export function gitLog(config, workspace, maxCount = 8) {
72
+ const count = Math.max(1, Math.min(Math.floor(maxCount), 30));
73
+ return runGit(workspace, ["log", `--max-count=${count}`, "--oneline", "--decorate"], config.maxOutputBytes);
74
+ }
75
+ export function assertGitCleanEnoughForWrite(_workspace) {
76
+ // Reserved for future policy hooks. The first version allows writes and returns diffs.
77
+ return;
78
+ }
79
+ //# sourceMappingURL=gitOps.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"gitOps.js","sourceRoot":"","sources":["../src/gitOps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,SAAS,MAAM,CAAC,SAAoB,EAAE,IAAc,EAAE,cAAsB;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACpC,GAAG,EAAE,SAAS,CAAC,IAAI;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,cAAc;QACzB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;KACvC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,8BAA8B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3C,OAAO,MAAM,IAAI,MAAM,IAAI,0BAA0B,MAAM,CAAC,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC5B,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC5B,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;QAChD,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAC5C,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAuB,EAAE,SAAoB,EAAE,KAAiB,EAAE,QAAiB,EAAE,MAAM,GAAG,KAAK;IAC3H,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAChG,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,8CAA8C,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAuB,EAAE,KAAgB,EAAE,SAAoB,EAAE,QAAiB,EAAE,MAAM,GAAG,KAAK;IACxH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAuB,EAAE,KAAgB,EAAE,SAAoB,EAAE,QAAiB,EAAE,MAAM,GAAG,KAAK;IAC9H,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,IAAI,YAAY,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAuB,EAAE,SAAoB,EAAE,QAAQ,GAAG,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAqB;IAChE,uFAAuF;IACvF,OAAO;AACT,CAAC"}
package/dist/guard.js ADDED
@@ -0,0 +1,198 @@
1
+ import fs from "node:fs";
2
+ import { createHash } from "node:crypto";
3
+ import fsp from "node:fs/promises";
4
+ import os from "node:os";
5
+ import path from "node:path";
6
+ import { minimatch } from "minimatch";
7
+ import { expandHome } from "./config.js";
8
+ export class CodexFlowError extends Error {
9
+ constructor(message) {
10
+ super(message);
11
+ this.name = "CodexFlowError";
12
+ }
13
+ }
14
+ export function isSubpath(child, parent) {
15
+ const relative = path.relative(parent, child);
16
+ return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
17
+ }
18
+ export function normalizeRelPath(relPath) {
19
+ const normalized = relPath.split(path.sep).join("/");
20
+ if (normalized === "")
21
+ return ".";
22
+ return normalized;
23
+ }
24
+ export function displayPath(absPath, root) {
25
+ const rel = path.relative(root, absPath) || ".";
26
+ return normalizeRelPath(rel);
27
+ }
28
+ function workspaceIdForRoot(realRoot) {
29
+ return `ws_${createHash("sha256").update(realRoot).digest("hex").slice(0, 24)}`;
30
+ }
31
+ function maybeRealpath(existingPath) {
32
+ try {
33
+ return fs.realpathSync(existingPath);
34
+ }
35
+ catch {
36
+ return undefined;
37
+ }
38
+ }
39
+ function closestExistingParent(absPath) {
40
+ let current = path.resolve(absPath);
41
+ while (!fs.existsSync(current)) {
42
+ const parent = path.dirname(current);
43
+ if (parent === current)
44
+ break;
45
+ current = parent;
46
+ }
47
+ return current;
48
+ }
49
+ export class WorkspaceManager {
50
+ config;
51
+ workspaces = new Map();
52
+ constructor(config) {
53
+ this.config = config;
54
+ }
55
+ defaultWorkspace() {
56
+ const existing = [...this.workspaces.values()].find((workspace) => workspace.root === this.config.defaultRoot);
57
+ return existing ?? this.openWorkspace(this.config.defaultRoot);
58
+ }
59
+ openWorkspace(rootInput) {
60
+ const requested = rootInput?.trim() ? expandHome(rootInput.trim()) : this.config.defaultRoot;
61
+ const resolved = path.resolve(requested);
62
+ if (!fs.existsSync(resolved)) {
63
+ throw new CodexFlowError(`Workspace root does not exist: ${resolved}`);
64
+ }
65
+ const stat = fs.statSync(resolved);
66
+ if (!stat.isDirectory()) {
67
+ throw new CodexFlowError(`Workspace root is not a directory: ${resolved}`);
68
+ }
69
+ const realRoot = fs.realpathSync(resolved);
70
+ const allowed = this.config.allowedRoots.some((allowedRoot) => isSubpath(realRoot, allowedRoot));
71
+ if (!allowed) {
72
+ throw new CodexFlowError(`Workspace root is outside allowed roots: ${realRoot}\nAllowed roots:\n${this.config.allowedRoots.map((r) => `- ${r}`).join("\n")}`);
73
+ }
74
+ const existing = [...this.workspaces.values()].find((workspace) => workspace.root === realRoot);
75
+ if (existing)
76
+ return existing;
77
+ const id = workspaceIdForRoot(realRoot);
78
+ const workspace = { id, root: realRoot, openedAt: new Date().toISOString() };
79
+ this.workspaces.set(id, workspace);
80
+ return workspace;
81
+ }
82
+ getWorkspace(id) {
83
+ if (!id)
84
+ return this.defaultWorkspace();
85
+ const workspace = this.workspaces.get(id);
86
+ if (!workspace) {
87
+ throw new CodexFlowError(`Unknown workspace_id: ${id}. Call open_workspace first.`);
88
+ }
89
+ return workspace;
90
+ }
91
+ listWorkspaces() {
92
+ return [...this.workspaces.values()];
93
+ }
94
+ }
95
+ export class PathGuard {
96
+ config;
97
+ constructor(config) {
98
+ this.config = config;
99
+ }
100
+ isBlockedRelativePath(relPath) {
101
+ const rel = normalizeRelPath(relPath).replace(/^\.\//, "");
102
+ if (!rel || rel === ".")
103
+ return false;
104
+ return this.config.blockedGlobs.some((glob) => minimatch(rel, glob, { dot: true, nocase: false, matchBase: false }) ||
105
+ minimatch(path.basename(rel), glob, { dot: true, nocase: false, matchBase: true }));
106
+ }
107
+ assertNotBlocked(relPath) {
108
+ if (this.isBlockedRelativePath(relPath)) {
109
+ throw new CodexFlowError(`Path is blocked by safety rules: ${relPath}`);
110
+ }
111
+ }
112
+ resolve(workspace, inputPath = ".", options = {}) {
113
+ const expanded = expandHome(inputPath || ".");
114
+ const candidate = path.isAbsolute(expanded) ? expanded : path.join(workspace.root, expanded);
115
+ let absPath = path.resolve(candidate);
116
+ const realTarget = maybeRealpath(absPath);
117
+ let relPath = displayPath(absPath, workspace.root);
118
+ if (!isSubpath(absPath, workspace.root)) {
119
+ if (realTarget && isSubpath(realTarget, workspace.root)) {
120
+ absPath = realTarget;
121
+ relPath = displayPath(realTarget, workspace.root);
122
+ }
123
+ else if (options.forWrite) {
124
+ const parent = closestExistingParent(path.dirname(absPath));
125
+ const realParent = maybeRealpath(parent);
126
+ if (!realParent || !isSubpath(realParent, workspace.root)) {
127
+ throw new CodexFlowError(`Path escapes workspace root: ${inputPath}`);
128
+ }
129
+ absPath = path.resolve(realParent, path.relative(parent, absPath));
130
+ relPath = displayPath(absPath, workspace.root);
131
+ }
132
+ else {
133
+ throw new CodexFlowError(`Path escapes workspace root: ${inputPath}`);
134
+ }
135
+ }
136
+ this.assertNotBlocked(relPath);
137
+ if (realTarget) {
138
+ if (!isSubpath(realTarget, workspace.root)) {
139
+ throw new CodexFlowError(`Path resolves outside workspace root through a symlink: ${inputPath}`);
140
+ }
141
+ const realRel = displayPath(realTarget, workspace.root);
142
+ this.assertNotBlocked(realRel);
143
+ }
144
+ if (options.forWrite) {
145
+ try {
146
+ if (fs.lstatSync(absPath).isSymbolicLink()) {
147
+ throw new CodexFlowError(`Refusing to write through a symlink: ${inputPath}`);
148
+ }
149
+ }
150
+ catch (error) {
151
+ if (error instanceof CodexFlowError)
152
+ throw error;
153
+ }
154
+ const parent = closestExistingParent(path.dirname(absPath));
155
+ const realParent = maybeRealpath(parent);
156
+ if (realParent && !isSubpath(realParent, workspace.root)) {
157
+ throw new CodexFlowError(`Write path resolves through a parent outside the workspace: ${inputPath}`);
158
+ }
159
+ if (realParent) {
160
+ const realParentRel = displayPath(realParent, workspace.root);
161
+ this.assertNotBlocked(realParentRel);
162
+ }
163
+ }
164
+ return { absPath, relPath };
165
+ }
166
+ async assertTextFile(absPath, maxBytes) {
167
+ const stat = await fsp.stat(absPath);
168
+ if (!stat.isFile()) {
169
+ throw new CodexFlowError(`Not a file: ${absPath}`);
170
+ }
171
+ if (stat.size > maxBytes) {
172
+ throw new CodexFlowError(`File is too large (${stat.size} bytes). Limit: ${maxBytes} bytes.`);
173
+ }
174
+ if (stat.size === 0)
175
+ return;
176
+ const handle = await fsp.open(absPath, "r");
177
+ try {
178
+ const sample = Buffer.alloc(Math.min(64 * 1024, stat.size));
179
+ let offset = 0;
180
+ while (offset < stat.size) {
181
+ const { bytesRead } = await handle.read(sample, 0, sample.length, offset);
182
+ if (bytesRead === 0)
183
+ break;
184
+ if (sample.subarray(0, bytesRead).includes(0)) {
185
+ throw new CodexFlowError("Refusing to read binary file.");
186
+ }
187
+ offset += bytesRead;
188
+ }
189
+ }
190
+ finally {
191
+ await handle.close();
192
+ }
193
+ }
194
+ }
195
+ export function userHome() {
196
+ return os.homedir();
197
+ }
198
+ //# sourceMappingURL=guard.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC;IAChD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB;IACzC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM;QAC9B,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,gBAAgB;IAGE;IAFZ,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE3D,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAExD,gBAAgB;QACd,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/G,OAAO,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,aAAa,CAAC,SAAkB;QAC9B,MAAM,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,cAAc,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,4CAA4C,QAAQ,qBAAqB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpI,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAChG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,EAAW;QACtB,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,cAAc,CAAC,yBAAyB,EAAE,8BAA8B,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAExD,qBAAqB,CAAC,OAAe;QACnC,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5C,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACpE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACnF,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,IAAI,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,cAAc,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAoB,EAAE,SAAS,GAAG,GAAG,EAAE,UAAkC,EAAE;QACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAEnD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,IAAI,UAAU,IAAI,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,GAAG,UAAU,CAAC;gBACrB,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,cAAc,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,cAAc,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,cAAc,CAAC,2DAA2D,SAAS,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC3C,MAAM,IAAI,cAAc,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,cAAc;oBAAE,MAAM,KAAK,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,cAAc,CAAC,+DAA+D,SAAS,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,aAAa,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9D,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,QAAgB;QACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,cAAc,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CAAC,sBAAsB,IAAI,CAAC,IAAI,mBAAmB,QAAQ,SAAS,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC1E,IAAI,SAAS,KAAK,CAAC;oBAAE,MAAM;gBAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,cAAc,CAAC,+BAA+B,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC;YACtB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;AACtB,CAAC"}