@timo9378/flow2code 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.1.9] — 2026-03-05
+
+### Fixed
+- **`resolveEnvVars` backtick escaping** — Backtick and backslash characters in URLs are now escaped before wrapping in template literals, preventing template literal injection (#24)
+- **`traceLineToNode` binary search** — Replaced linear scan with sorted ranges + binary search for O(log N) source map lookups (#25)
+- **`parseReference` hyphen support** — Regex now matches node IDs containing hyphens (e.g. `node-1`) via `[\w-]+` character class (#27)
+- **Validator duplicate edge ID check** — Added step 4 to detect duplicate `edge.id` values, analogous to the existing duplicate node ID check (#28)
+- **Watch mode SIGINT cleanup** — Added `process.on('SIGINT'/'SIGTERM')` handler to close chokidar watcher and clear pending timers on shutdown (#29)
+- **Split storage colon-in-port-ID** — Edge deserialization now splits on first colon only via `indexOf`, preserving port IDs that contain colons (#30)
+
+### Removed
+- **Dead `generateFlowStateDeclaration`** — Removed unused exported function from `type-inference.ts` (zero callers) (#26)
+
+### Tests
+- Added duplicate edge ID detection test
+- Added colon-in-port-ID round-trip test
+- Test count: 413 tests / 33 test files
+
+## [0.1.8] — 2026-03-05
+
+### Security
+- **HTTP server request timeout** — Added `headersTimeout` (30s) and `requestTimeout` (60s) to prevent Slowloris-style DoS attacks (#16)
+- **Server `headersSent` guard** — Error handler now checks `res.headersSent` before writing 500 response, preventing `ERR_HTTP_HEADERS_SENT` crash (#14)
+- **Validate IR from server** — `handleDecompileTS` and `handleSelectOpenAPIFlow` now call `validateFlowIR()` before `loadIR()`, matching `handleLoadIRFromJSON` behavior (#22)
+
+### Fixed
+- **Validator iterative DFS** — Replaced recursive `dfs()` with explicit stack-based iteration to prevent stack overflow on deep graphs (5000+ nodes) (#11)
+- **`isFetchCall` AST-based detection** — Replaced `text.includes("fetch(")` string matching with proper AST walk using `CallExpression` + `Identifier` node types (#12)
+- **`hasAwaitExpression` AST walk** — Replaced `text.startsWith("await ")` fallback with recursive `forEachChild` AST traversal to detect nested awaits (#23)
+- **`trackVariableUses` strip strings** — Expression string now has string literals (`"..."`, `'...'`, `` `...` ``) stripped before identifier regex scan, preventing false-positive variable references (#13)
+- **`_nodeCounter` max ID parse** — After `loadIR`, counter is set to max numeric ID from existing node IDs (not `nodes.length`), preventing ID collisions (#15)
+- **`resolveTriggerRef` cache** — Trigger node lookup cached per IR reference, eliminating O(N) linear scan on every `$trigger` expression evaluation (#17)
+- **`$input` ambiguity warning** — `resolveInputRef` now emits `console.warn` when a node has multiple non-trigger upstream edges, identifying which source is used (#18)
+- **OpenAPI tags filter** — `handleImportOpenAPI` now implements `filter.tags` (case-insensitive match against `meta.tags`), which was previously accepted but silently ignored (#20)
+- **Clipboard fallback** — `handleExportIR` now catches clipboard write errors gracefully instead of letting promise rejection propagate (#21)
+
+### Added
+- **`createPlatformRegistry` factory** — New function for creating isolated platform registry instances, enabling safe test parallelism and concurrent compilation (#19)
+
+### Tests
+- Added iterative DFS deep graph test (5000 nodes, verifies no stack overflow)
+- Test count: 411 tests / 33 test files
+
 ## [0.1.7] — 2026-03-05
 
 ### Performance

package/dist/cli.js

@@ -162,6 +162,17 @@ function validateFlowIR(ir) {
     }
     idSet.add(node.id);
   }
+  const edgeIdSet = /* @__PURE__ */ new Set();
+  for (const edge of workingIR.edges) {
+    if (edgeIdSet.has(edge.id)) {
+      errors.push({
+        code: "DUPLICATE_EDGE_ID",
+        message: `Duplicate edge ID: ${edge.id}`,
+        edgeId: edge.id
+      });
+    }
+    edgeIdSet.add(edge.id);
+  }
   for (const edge of workingIR.edges) {
     if (!workingNodeMap.has(edge.sourceNodeId)) {
       errors.push({
@@ -218,25 +229,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -392,7 +410,7 @@ function tokenize(input) {
   return tokens;
 }
 function parseReference(ref) {
-  const match = ref.match(/^(\$?\w+)((?:\.[\w]+|\[.+?\])*)$/);
+  const match = ref.match(/^(\$?[\w-]+)((?:\.[\w]+|\[.+?\])*)$/);
   if (!match) {
     const dotIndex = ref.indexOf(".");
     const bracketIndex = ref.indexOf("[");
@@ -450,10 +468,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -469,21 +493,27 @@ function resolveInputRef(path, context) {
   );
 }
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
-var ExpressionParseError;
+var _cachedTriggerIR, _cachedTriggerId, ExpressionParseError;
 var init_expression_parser = __esm({
   "src/lib/compiler/expression-parser.ts"() {
     "use strict";
+    _cachedTriggerIR = null;
+    _cachedTriggerId = null;
     ExpressionParseError = class extends Error {
       constructor(message, expression, position) {
         super(message);
@@ -2222,13 +2252,15 @@ function sanitizeId(id) {
 function resolveEnvVars(url, context) {
   const hasEnvVar = /\$\{(\w+)\}/.test(url);
   if (hasEnvVar) {
-    return "`" + url.replace(/\$\{(\w+)\}/g, (_match, varName) => {
+    const escaped = url.replace(/\\/g, "\\\\").replace(/`/g, "\\`");
+    return "`" + escaped.replace(/\$\{(\w+)\}/g, (_match, varName) => {
       context.envVars.add(varName);
       return "${process.env." + varName + "}";
     }) + "`";
   }
   if (url.includes("${")) {
-    return "`" + url + "`";
+    const escaped = url.replace(/\\/g, "\\\\").replace(/`/g, "\\`");
+    return "`" + escaped + "`";
   }
   return `"${url}"`;
 }
@@ -2290,9 +2322,18 @@ function buildSourceMap(code, ir, filePath) {
   };
 }
 function traceLineToNode(sourceMap, line) {
-  for (const [nodeId, range] of Object.entries(sourceMap.mappings)) {
-    if (line >= range.startLine && line <= range.endLine) {
-      return { nodeId, ...range };
+  const entries = Object.entries(sourceMap.mappings).map(([nodeId, range]) => ({ nodeId, ...range })).sort((a, b) => a.startLine - b.startLine);
+  let lo = 0;
+  let hi = entries.length - 1;
+  while (lo <= hi) {
+    const mid = lo + hi >>> 1;
+    const e = entries[mid];
+    if (line < e.startLine) {
+      hi = mid - 1;
+    } else if (line > e.endLine) {
+      lo = mid + 1;
+    } else {
+      return e;
     }
   }
   return null;
@@ -2987,12 +3028,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === SyntaxKind.AwaitExpression);
+  if (node.getKind() === SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3062,7 +3109,8 @@ function inferLabel(code, varName) {
   return truncate(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();
@@ -3868,6 +3916,13 @@ function handleImportOpenAPI(body) {
         (flow) => paths.some((p) => flow.meta.name.includes(p))
       );
     }
+    if (body.filter?.tags && Array.isArray(body.filter.tags)) {
+      const tags = body.filter.tags.map((t) => t.toLowerCase());
+      filteredFlows = filteredFlows.filter((flow) => {
+        const flowTags = flow.meta.tags ?? [];
+        return flowTags.some((t) => tags.includes(t.toLowerCase()));
+      });
+    }
     return {
       status: 200,
       body: {
@@ -4128,10 +4183,14 @@ function startServer(options = {}) {
   const server = createServer((req, res) => {
     handleRequest(req, res, staticDir, projectRoot).catch((err) => {
       logger.error("Internal error:", err);
-      res.writeHead(500, { "Content-Type": "text/plain" });
-      res.end("Internal Server Error");
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "text/plain" });
+        res.end("Internal Server Error");
+      }
     });
   });
+  server.headersTimeout = 3e4;
+  server.requestTimeout = 6e4;
   const hasUI = existsSync3(join3(staticDir, "index.html"));
   server.listen(port, host, () => {
     const url = `http://localhost:${port}`;
@@ -4261,8 +4320,12 @@ function mergeIR(files) {
   }
   const edgesRaw = parse(files.edges);
   const edges = (edgesRaw ?? []).map((e) => {
-    const [sourceNodeId, sourcePortId] = e.source.split(":");
-    const [targetNodeId, targetPortId] = e.target.split(":");
+    const srcIdx = e.source.indexOf(":");
+    const tgtIdx = e.target.indexOf(":");
+    const sourceNodeId = srcIdx > 0 ? e.source.slice(0, srcIdx) : e.source;
+    const sourcePortId = srcIdx > 0 ? e.source.slice(srcIdx + 1) : "output";
+    const targetNodeId = tgtIdx > 0 ? e.target.slice(0, tgtIdx) : e.target;
+    const targetPortId = tgtIdx > 0 ? e.target.slice(tgtIdx + 1) : "input";
     return {
       id: e.id,
       sourceNodeId,
@@ -5056,6 +5119,14 @@ program.command("watch [dir]").description("Watch directory, auto-compile .flow.
   watcher.on("error", (error) => {
     console.error("\u274C Watch error:", error instanceof Error ? error.message : String(error));
   });
+  const cleanup = () => {
+    console.log("\n\u{1F6D1} Stopping watcher...");
+    for (const timer of pendingTimers.values()) clearTimeout(timer);
+    pendingTimers.clear();
+    watcher.close().then(() => process.exit(0));
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
 });
 program.command("init").description("Initialize Flow2Code in current project (Zero Pollution mode)").action(() => {
   const flow2codeDir = resolve3(".flow2code");

package/dist/compiler.cjs

@@ -238,6 +238,17 @@ function validateFlowIR(ir) {
     }
     idSet.add(node.id);
   }
+  const edgeIdSet = /* @__PURE__ */ new Set();
+  for (const edge of workingIR.edges) {
+    if (edgeIdSet.has(edge.id)) {
+      errors.push({
+        code: "DUPLICATE_EDGE_ID",
+        message: `Duplicate edge ID: ${edge.id}`,
+        edgeId: edge.id
+      });
+    }
+    edgeIdSet.add(edge.id);
+  }
   for (const edge of workingIR.edges) {
     if (!workingNodeMap.has(edge.sourceNodeId)) {
       errors.push({
@@ -294,25 +305,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -456,7 +474,7 @@ function tokenize(input) {
   return tokens;
 }
 function parseReference(ref) {
-  const match = ref.match(/^(\$?\w+)((?:\.[\w]+|\[.+?\])*)$/);
+  const match = ref.match(/^(\$?[\w-]+)((?:\.[\w]+|\[.+?\])*)$/);
   if (!match) {
     const dotIndex = ref.indexOf(".");
     const bracketIndex = ref.indexOf("[");
@@ -514,10 +532,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -532,15 +556,21 @@ function resolveInputRef(path, context) {
     `Expression parser error: Node "${context.currentNodeId}" has no input connected`
   );
 }
+var _cachedTriggerIR = null;
+var _cachedTriggerId = null;
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
@@ -2236,13 +2266,15 @@ function sanitizeId(id) {
 function resolveEnvVars(url, context) {
   const hasEnvVar = /\$\{(\w+)\}/.test(url);
   if (hasEnvVar) {
-    return "`" + url.replace(/\$\{(\w+)\}/g, (_match, varName) => {
+    const escaped = url.replace(/\\/g, "\\\\").replace(/`/g, "\\`");
+    return "`" + escaped.replace(/\$\{(\w+)\}/g, (_match, varName) => {
       context.envVars.add(varName);
       return "${process.env." + varName + "}";
     }) + "`";
   }
   if (url.includes("${")) {
-    return "`" + url + "`";
+    const escaped = url.replace(/\\/g, "\\\\").replace(/`/g, "\\`");
+    return "`" + escaped + "`";
   }
   return `"${url}"`;
 }
@@ -2304,9 +2336,18 @@ function buildSourceMap(code, ir, filePath) {
   };
 }
 function traceLineToNode(sourceMap, line) {
-  for (const [nodeId, range] of Object.entries(sourceMap.mappings)) {
-    if (line >= range.startLine && line <= range.endLine) {
-      return { nodeId, ...range };
+  const entries = Object.entries(sourceMap.mappings).map(([nodeId, range]) => ({ nodeId, ...range })).sort((a, b) => a.startLine - b.startLine);
+  let lo = 0;
+  let hi = entries.length - 1;
+  while (lo <= hi) {
+    const mid = lo + hi >>> 1;
+    const e = entries[mid];
+    if (line < e.startLine) {
+      hi = mid - 1;
+    } else if (line > e.endLine) {
+      lo = mid + 1;
+    } else {
+      return e;
     }
   }
   return null;
@@ -3041,12 +3082,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression);
+  if (node.getKind() === import_ts_morph2.SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === import_ts_morph2.SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3116,7 +3163,8 @@ function inferLabel(code, varName) {
   return truncate2(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();
@@ -3737,8 +3785,12 @@ function mergeIR(files) {
   }
   const edgesRaw = (0, import_yaml.parse)(files.edges);
   const edges = (edgesRaw ?? []).map((e) => {
-    const [sourceNodeId, sourcePortId] = e.source.split(":");
-    const [targetNodeId, targetPortId] = e.target.split(":");
+    const srcIdx = e.source.indexOf(":");
+    const tgtIdx = e.target.indexOf(":");
+    const sourceNodeId = srcIdx > 0 ? e.source.slice(0, srcIdx) : e.source;
+    const sourcePortId = srcIdx > 0 ? e.source.slice(srcIdx + 1) : "output";
+    const targetNodeId = tgtIdx > 0 ? e.target.slice(0, tgtIdx) : e.target;
+    const targetPortId = tgtIdx > 0 ? e.target.slice(tgtIdx + 1) : "input";
     return {
       id: e.id,
       sourceNodeId,