@tokentop/ttop 0.2.2 → 0.3.0

package/src/plugins/sandbox-guard.test.ts

@@ -1,37 +1,34 @@
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import {
   deepFreeze,
   getActivePluginGuard,
   installGlobalFetchGuard,
   runInPluginGuard,
-} from './sandbox-guard.ts';
-import { PluginPermissionError } from './types/base.ts';
+} from "./sandbox-guard.ts";
+import { PluginPermissionError } from "./types/base.ts";
 
 const originalFetch = globalThis.fetch;
 const fetchCalls: string[] = [];
 
 const mockFetch: typeof fetch = Object.assign(
   (input: string | URL | Request, _init?: RequestInit): Promise<Response> => {
-    const url = typeof input === 'string'
-      ? input
-      : input instanceof URL
-        ? input.toString()
-        : input.url;
+    const url =
+      typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
     fetchCalls.push(url);
-    return Promise.resolve(new Response('ok', { status: 200 }));
+    return Promise.resolve(new Response("ok", { status: 200 }));
   },
   { preconnect: originalFetch.preconnect },
 );
 
-describe('deepFreeze', () => {
-  test('freezes a plain object', () => {
+describe("deepFreeze", () => {
+  test("freezes a plain object", () => {
     const obj = { a: 1 };
     deepFreeze(obj);
 
     expect(Object.isFrozen(obj)).toBe(true);
   });
 
-  test('freezes nested objects recursively', () => {
+  test("freezes nested objects recursively", () => {
     const obj = {
       top: {
         child: {
@@ -47,19 +44,19 @@ describe('deepFreeze', () => {
     expect(Object.isFrozen(obj.top.child)).toBe(true);
   });
 
-  test('returns the same reference', () => {
+  test("returns the same reference", () => {
     const obj = { nested: { value: 1 } };
     const frozen = deepFreeze(obj);
 
     expect(frozen).toBe(obj);
   });
 
-  test('handles null and undefined gracefully', () => {
+  test("handles null and undefined gracefully", () => {
     expect(deepFreeze(null)).toBeNull();
     expect(deepFreeze(undefined)).toBeUndefined();
   });
 
-  test('handles circular references without infinite loop', () => {
+  test("handles circular references without infinite loop", () => {
     const obj: { self?: unknown; nested: { parent?: unknown } } = {
       nested: {},
     };
@@ -73,7 +70,7 @@ describe('deepFreeze', () => {
     expect(Object.isFrozen(obj.nested)).toBe(true);
   });
 
-  test('handles already-frozen objects', () => {
+  test("handles already-frozen objects", () => {
     const obj = Object.freeze({ already: true });
 
     const frozen = deepFreeze(obj);
@@ -83,44 +80,44 @@ describe('deepFreeze', () => {
   });
 });
 
-describe('runInPluginGuard and getActivePluginGuard', () => {
-  test('returns undefined outside guard', () => {
+describe("runInPluginGuard and getActivePluginGuard", () => {
+  test("returns undefined outside guard", () => {
     expect(getActivePluginGuard()).toBeUndefined();
   });
 
-  test('returns plugin context inside guard', () => {
-    const context = runInPluginGuard('plugin-a', {}, () => getActivePluginGuard());
+  test("returns plugin context inside guard", () => {
+    const context = runInPluginGuard("plugin-a", {}, () => getActivePluginGuard());
 
     expect(context).toBeDefined();
-    expect(context?.pluginId).toBe('plugin-a');
+    expect(context?.pluginId).toBe("plugin-a");
   });
 
-  test('preserves context across async/await', async () => {
-    const context = await runInPluginGuard('plugin-async', {}, async () => {
+  test("preserves context across async/await", async () => {
+    const context = await runInPluginGuard("plugin-async", {}, async () => {
       await Promise.resolve();
       return getActivePluginGuard();
     });
 
     expect(context).toBeDefined();
-    expect(context?.pluginId).toBe('plugin-async');
+    expect(context?.pluginId).toBe("plugin-async");
   });
 
-  test('nested guards use the innermost context', () => {
-    const contexts = runInPluginGuard('outer-plugin', {}, () => {
+  test("nested guards use the innermost context", () => {
+    const contexts = runInPluginGuard("outer-plugin", {}, () => {
       const outerBefore = getActivePluginGuard();
-      const inner = runInPluginGuard('inner-plugin', {}, () => getActivePluginGuard());
+      const inner = runInPluginGuard("inner-plugin", {}, () => getActivePluginGuard());
       const outerAfter = getActivePluginGuard();
 
       return { outerBefore, inner, outerAfter };
     });
 
-    expect(contexts.outerBefore?.pluginId).toBe('outer-plugin');
-    expect(contexts.inner?.pluginId).toBe('inner-plugin');
-    expect(contexts.outerAfter?.pluginId).toBe('outer-plugin');
+    expect(contexts.outerBefore?.pluginId).toBe("outer-plugin");
+    expect(contexts.inner?.pluginId).toBe("inner-plugin");
+    expect(contexts.outerAfter?.pluginId).toBe("outer-plugin");
   });
 });
 
-describe('installGlobalFetchGuard', () => {
+describe("installGlobalFetchGuard", () => {
   beforeAll(() => {
     globalThis.fetch = mockFetch;
     installGlobalFetchGuard();
@@ -130,62 +127,62 @@ describe('installGlobalFetchGuard', () => {
     globalThis.fetch = originalFetch;
   });
 
-  test('outside guard, fetch calls pass through', async () => {
+  test("outside guard, fetch calls pass through", async () => {
     fetchCalls.length = 0;
 
-    const response = await fetch('https://outside-guard.example');
+    const response = await fetch("https://outside-guard.example");
 
     expect(response.status).toBe(200);
     expect(fetchCalls).toHaveLength(1);
-    expect(fetchCalls[0]).toContain('outside-guard.example');
+    expect(fetchCalls[0]).toContain("outside-guard.example");
   });
 
-  test('inside guard with no network permission throws PluginPermissionError', () => {
+  test("inside guard with no network permission throws PluginPermissionError", () => {
     expect(() => {
-      runInPluginGuard('plugin-no-network', {}, () => {
-        void fetch('https://blocked.example');
+      runInPluginGuard("plugin-no-network", {}, () => {
+        void fetch("https://blocked.example");
       });
     }).toThrow(PluginPermissionError);
   });
 
-  test('inside guard with allowedDomains blocks unlisted domains', () => {
+  test("inside guard with allowedDomains blocks unlisted domains", () => {
     expect(() => {
       runInPluginGuard(
-        'plugin-allowlist',
+        "plugin-allowlist",
         {
           network: {
             enabled: true,
-            allowedDomains: ['allowed.example'],
+            allowedDomains: ["allowed.example"],
           },
         },
         () => {
-          void fetch('https://not-allowed.example/path');
+          void fetch("https://not-allowed.example/path");
         },
       );
     }).toThrow(PluginPermissionError);
   });
 
-  test('inside guard with allowedDomains allows listed domains and subdomains', async () => {
+  test("inside guard with allowedDomains allows listed domains and subdomains", async () => {
     fetchCalls.length = 0;
 
     const response = await runInPluginGuard(
-      'plugin-allowlist',
+      "plugin-allowlist",
       {
         network: {
           enabled: true,
-          allowedDomains: ['allowed.example'],
+          allowedDomains: ["allowed.example"],
         },
       },
       async () => {
-        const rootResponse = await fetch('https://allowed.example/path');
-        await fetch('https://api.allowed.example/path');
+        const rootResponse = await fetch("https://allowed.example/path");
+        await fetch("https://api.allowed.example/path");
         return rootResponse;
       },
     );
 
     expect(response.status).toBe(200);
     expect(fetchCalls).toHaveLength(2);
-    expect(fetchCalls[0]).toContain('allowed.example/path');
-    expect(fetchCalls[1]).toContain('api.allowed.example/path');
+    expect(fetchCalls[0]).toContain("allowed.example/path");
+    expect(fetchCalls[1]).toContain("api.allowed.example/path");
   });
 });

package/src/plugins/sandbox-guard.ts

@@ -11,9 +11,9 @@
  * 2. **Deep-freeze** — prevents plugins from mutating the PluginContext.
  */
 
-import { AsyncLocalStorage } from 'async_hooks';
-import { PluginPermissionError, type PluginPermissions } from './types/base.ts';
-import { createPluginLogger } from './sandbox.ts';
+import { AsyncLocalStorage } from "async_hooks";
+import { createPluginLogger } from "./sandbox.ts";
+import { PluginPermissionError, type PluginPermissions } from "./types/base.ts";
 
 // ---------------------------------------------------------------------------
 // Plugin execution context (AsyncLocalStorage)
@@ -68,10 +68,7 @@ export function installGlobalFetchGuard(): void {
   const originalFetch = globalThis.fetch;
 
   const guardedFetch: typeof fetch = Object.assign(
-    function guardedFetch(
-      input: string | URL | Request,
-      init?: RequestInit,
-    ): Promise<Response> {
+    function guardedFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {
       const guard = pluginGuardStorage.getStore();
 
       if (!guard) {
@@ -82,34 +79,32 @@ export function installGlobalFetchGuard(): void {
 
       if (!permissions.network?.enabled) {
         const log = createPluginLogger(pluginId);
-        log.error('Network access blocked — plugin has not declared network permissions');
-        throw new PluginPermissionError(
-          pluginId,
-          'network',
-          'Network access not permitted',
-        );
+        log.error("Network access blocked — plugin has not declared network permissions");
+        throw new PluginPermissionError(pluginId, "network", "Network access not permitted");
       }
 
       const allowedDomains = permissions.network.allowedDomains;
       if (allowedDomains && allowedDomains.length > 0) {
-        const url = typeof input === 'string'
-          ? new URL(input)
-          : input instanceof URL
-            ? input
-            : new URL(input.url);
+        const url =
+          typeof input === "string"
+            ? new URL(input)
+            : input instanceof URL
+              ? input
+              : new URL(input.url);
 
         const isAllowed = allowedDomains.some(
-          (domain) =>
-            url.hostname === domain || url.hostname.endsWith(`.${domain}`),
+          (domain) => url.hostname === domain || url.hostname.endsWith(`.${domain}`),
         );
 
         if (!isAllowed) {
           const log = createPluginLogger(pluginId);
-          log.error(`Network blocked: domain "${url.hostname}" not in allowlist [${allowedDomains.join(', ')}]`);
+          log.error(
+            `Network blocked: domain "${url.hostname}" not in allowlist [${allowedDomains.join(", ")}]`,
+          );
           throw new PluginPermissionError(
             pluginId,
-            'network',
-            `Domain "${url.hostname}" not in allowlist: ${allowedDomains.join(', ')}`,
+            "network",
+            `Domain "${url.hostname}" not in allowlist: ${allowedDomains.join(", ")}`,
           );
         }
       }
@@ -136,7 +131,7 @@ const frozenObjects = new WeakSet<object>();
  */
 export function deepFreeze<T>(obj: T): T {
   if (obj === null || obj === undefined) return obj;
-  if (typeof obj !== 'object') return obj;
+  if (typeof obj !== "object") return obj;
 
   const o = obj as object;
 
@@ -146,7 +141,7 @@ export function deepFreeze<T>(obj: T): T {
   Object.freeze(o);
 
   for (const value of Object.values(o)) {
-    if (value !== null && typeof value === 'object') {
+    if (value !== null && typeof value === "object") {
       deepFreeze(value);
     }
   }

package/src/plugins/sandbox.ts

@@ -1,22 +1,18 @@
 import {
-  PluginPermissionError,
-  type PluginPermissions,
   type PluginHttpClient,
   type PluginLogger,
-} from './types/index.ts';
+  PluginPermissionError,
+  type PluginPermissions,
+} from "./types/index.ts";
 
 export function createSandboxedHttpClient(
   pluginId: string,
-  permissions: PluginPermissions
+  permissions: PluginPermissions,
 ): PluginHttpClient {
   return {
     async fetch(url: string, init?: RequestInit): Promise<Response> {
       if (!permissions.network?.enabled) {
-        throw new PluginPermissionError(
-          pluginId,
-          'network',
-          'Network access not permitted'
-        );
+        throw new PluginPermissionError(pluginId, "network", "Network access not permitted");
       }
 
       const urlObj = new URL(url);
@@ -24,16 +20,14 @@ export function createSandboxedHttpClient(
 
       if (allowedDomains && allowedDomains.length > 0) {
         const isAllowed = allowedDomains.some(
-          (domain) =>
-            urlObj.hostname === domain ||
-            urlObj.hostname.endsWith(`.${domain}`)
+          (domain) => urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`),
         );
 
         if (!isAllowed) {
           throw new PluginPermissionError(
             pluginId,
-            'network',
-            `Domain "${urlObj.hostname}" not in allowlist: ${allowedDomains.join(', ')}`
+            "network",
+            `Domain "${urlObj.hostname}" not in allowlist: ${allowedDomains.join(", ")}`,
           );
         }
       }
@@ -49,17 +43,17 @@ export function createPluginLogger(pluginId: string): PluginLogger {
   return {
     debug(message: string, data?: Record<string, unknown>) {
       if (process.env.DEBUG) {
-        console.debug(prefix, message, data ?? '');
+        console.debug(prefix, message, data ?? "");
       }
     },
     info(message: string, data?: Record<string, unknown>) {
-      console.info(prefix, message, data ?? '');
+      console.info(prefix, message, data ?? "");
     },
     warn(message: string, data?: Record<string, unknown>) {
-      console.warn(prefix, message, data ?? '');
+      console.warn(prefix, message, data ?? "");
     },
     error(message: string, data?: Record<string, unknown>) {
-      console.error(prefix, message, data ?? '');
+      console.error(prefix, message, data ?? "");
     },
   };
 }
@@ -67,22 +61,18 @@ export function createPluginLogger(pluginId: string): PluginLogger {
 export function validateEnvAccess(
   pluginId: string,
   permissions: PluginPermissions,
-  varName: string
+  varName: string,
 ): void {
   if (!permissions.env?.read) {
-    throw new PluginPermissionError(
-      pluginId,
-      'env',
-      'Environment variable access not permitted'
-    );
+    throw new PluginPermissionError(pluginId, "env", "Environment variable access not permitted");
   }
 
   const allowedVars = permissions.env.vars;
   if (allowedVars && allowedVars.length > 0 && !allowedVars.includes(varName)) {
     throw new PluginPermissionError(
       pluginId,
-      'env',
-      `Environment variable "${varName}" not in allowlist`
+      "env",
+      `Environment variable "${varName}" not in allowlist`,
     );
   }
 }
@@ -91,48 +81,36 @@ export function validateFilesystemAccess(
   pluginId: string,
   permissions: PluginPermissions,
   path: string,
-  mode: 'read' | 'write'
+  mode: "read" | "write",
 ): void {
   const fsPerms = permissions.filesystem;
 
   if (!fsPerms) {
-    throw new PluginPermissionError(
-      pluginId,
-      'filesystem',
-      'Filesystem access not permitted'
-    );
+    throw new PluginPermissionError(pluginId, "filesystem", "Filesystem access not permitted");
   }
 
-  if (mode === 'read' && !fsPerms.read) {
-    throw new PluginPermissionError(
-      pluginId,
-      'filesystem',
-      'Filesystem read access not permitted'
-    );
+  if (mode === "read" && !fsPerms.read) {
+    throw new PluginPermissionError(pluginId, "filesystem", "Filesystem read access not permitted");
   }
 
-  if (mode === 'write' && !fsPerms.write) {
+  if (mode === "write" && !fsPerms.write) {
     throw new PluginPermissionError(
       pluginId,
-      'filesystem',
-      'Filesystem write access not permitted'
+      "filesystem",
+      "Filesystem write access not permitted",
     );
   }
 
   const allowedPaths = fsPerms.paths;
   if (allowedPaths && allowedPaths.length > 0) {
-    const normalizedPath = path.replace(/^~/, process.env.HOME ?? '');
+    const normalizedPath = path.replace(/^~/, process.env.HOME ?? "");
     const isAllowed = allowedPaths.some((allowed) => {
-      const normalizedAllowed = allowed.replace(/^~/, process.env.HOME ?? '');
+      const normalizedAllowed = allowed.replace(/^~/, process.env.HOME ?? "");
       return normalizedPath.startsWith(normalizedAllowed);
     });
 
     if (!isAllowed) {
-      throw new PluginPermissionError(
-        pluginId,
-        'filesystem',
-        `Path "${path}" not in allowlist`
-      );
+      throw new PluginPermissionError(pluginId, "filesystem", `Path "${path}" not in allowlist`);
     }
   }
 }

package/src/plugins/themes/catppuccin-latte.ts

@@ -1,45 +1,45 @@
-import type { ThemePlugin } from '../types/theme.ts';
+import type { ThemePlugin } from "../types/theme.ts";
 
 export const catppuccinLatteTheme: ThemePlugin = {
   apiVersion: 2,
-  id: 'catppuccin-latte',
-  type: 'theme',
-  name: 'Catppuccin Latte',
-  family: 'catppuccin',
-  version: '1.0.0',
+  id: "catppuccin-latte",
+  type: "theme",
+  name: "Catppuccin Latte",
+  family: "catppuccin",
+  version: "1.0.0",
   permissions: {},
 
-  colorScheme: 'light',
+  colorScheme: "light",
 
   colors: {
-    background: '#eff1f5',
-    foreground: '#e6e9ef',
-    text: '#4c4f69',
-    textMuted: '#6c6f85',
-    textSubtle: '#9ca0b0',
-    primary: '#1e66f5',
-    secondary: '#8839ef',
-    accent: '#179299',
-    success: '#40a02b',
-    warning: '#df8e1d',
-    error: '#d20f39',
-    info: '#04a5e5',
-    border: '#bcc0cc',
-    borderMuted: '#ccd0da',
-    selection: '#dce0e8',
-    highlight: '#e6e9ef',
-    gaugeBackground: '#ccd0da',
-    gaugeFill: '#1e66f5',
-    gaugeWarning: '#df8e1d',
-    gaugeDanger: '#d20f39',
+    background: "#eff1f5",
+    foreground: "#e6e9ef",
+    text: "#4c4f69",
+    textMuted: "#6c6f85",
+    textSubtle: "#9ca0b0",
+    primary: "#1e66f5",
+    secondary: "#8839ef",
+    accent: "#179299",
+    success: "#40a02b",
+    warning: "#df8e1d",
+    error: "#d20f39",
+    info: "#04a5e5",
+    border: "#bcc0cc",
+    borderMuted: "#ccd0da",
+    selection: "#dce0e8",
+    highlight: "#e6e9ef",
+    gaugeBackground: "#ccd0da",
+    gaugeFill: "#1e66f5",
+    gaugeWarning: "#df8e1d",
+    gaugeDanger: "#d20f39",
   },
 
   components: {
     header: {
-      background: '#e6e9ef',
+      background: "#e6e9ef",
     },
     statusBar: {
-      background: '#dce0e8',
+      background: "#dce0e8",
     },
   },
 };

package/src/plugins/themes/catppuccin-mocha.ts

@@ -1,45 +1,45 @@
-import type { ThemePlugin } from '../types/theme.ts';
+import type { ThemePlugin } from "../types/theme.ts";
 
 export const catppuccinMochaTheme: ThemePlugin = {
   apiVersion: 2,
-  id: 'catppuccin-mocha',
-  type: 'theme',
-  name: 'Catppuccin Mocha',
-  family: 'catppuccin',
-  version: '1.0.0',
+  id: "catppuccin-mocha",
+  type: "theme",
+  name: "Catppuccin Mocha",
+  family: "catppuccin",
+  version: "1.0.0",
   permissions: {},
 
-  colorScheme: 'dark',
+  colorScheme: "dark",
 
   colors: {
-    background: '#1e1e2e',
-    foreground: '#313244',
-    text: '#cdd6f4',
-    textMuted: '#a6adc8',
-    textSubtle: '#6c7086',
-    primary: '#89b4fa',
-    secondary: '#cba6f7',
-    accent: '#94e2d5',
-    success: '#a6e3a1',
-    warning: '#f9e2af',
-    error: '#f38ba8',
-    info: '#89dceb',
-    border: '#45475a',
-    borderMuted: '#313244',
-    selection: '#45475a',
-    highlight: '#313244',
-    gaugeBackground: '#313244',
-    gaugeFill: '#89b4fa',
-    gaugeWarning: '#f9e2af',
-    gaugeDanger: '#f38ba8',
+    background: "#1e1e2e",
+    foreground: "#313244",
+    text: "#cdd6f4",
+    textMuted: "#a6adc8",
+    textSubtle: "#6c7086",
+    primary: "#89b4fa",
+    secondary: "#cba6f7",
+    accent: "#94e2d5",
+    success: "#a6e3a1",
+    warning: "#f9e2af",
+    error: "#f38ba8",
+    info: "#89dceb",
+    border: "#45475a",
+    borderMuted: "#313244",
+    selection: "#45475a",
+    highlight: "#313244",
+    gaugeBackground: "#313244",
+    gaugeFill: "#89b4fa",
+    gaugeWarning: "#f9e2af",
+    gaugeDanger: "#f38ba8",
   },
 
   components: {
     header: {
-      background: '#181825',
+      background: "#181825",
     },
     statusBar: {
-      background: '#11111b',
+      background: "#11111b",
     },
   },
 };