@trops/dash-core 0.1.492 → 0.1.494

package/package.json

@@ -1,117 +1,121 @@
 {
-    "name": "@trops/dash-core",
-    "version": "0.1.492",
-    "description": "Core framework for Dash dashboard applications",
-    "main": "dist/index.js",
-    "module": "dist/index.esm.js",
-    "exports": {
-        ".": {
-            "import": "./dist/index.esm.js",
-            "require": "./dist/index.js"
-        },
-        "./electron": {
-            "require": "./dist/electron/index.js"
-        }
+  "name": "@trops/dash-core",
+  "version": "0.1.494",
+  "description": "Core framework for Dash dashboard applications",
+  "main": "dist/index.js",
+  "module": "dist/index.esm.js",
+  "exports": {
+    ".": {
+      "import": "./dist/index.esm.js",
+      "require": "./dist/index.js"
     },
-    "files": [
-        "dist"
-    ],
-    "scripts": {
-        "build": "npm run build:renderer && npm run build:electron",
-        "build:renderer": "rollup -c rollup.config.renderer.mjs",
-        "build:electron": "rollup -c rollup.config.electron.mjs && mkdir -p dist/mcp && cp electron/mcp/mcpServerCatalog.json dist/mcp/ && cp electron/mcp/knownExternalMcpServers.json dist/mcp/ && rm -rf dist/mcp/servers && cp -r electron/mcp/servers dist/mcp/ && node scripts/inject-secrets.js",
-        "clean": "rm -rf dist",
-        "prepublishOnly": "npm run clean && npm run build",
-        "test:mcp": "node --test electron/controller/mcpController.test.js electron/mcp/mcpServerCatalog.test.js electron/mcp/installExternalMcpTool.test.js",
-        "test:untracked-pin": "node scripts/test-untracked-sources-pin.js",
-        "check:untracked": "node scripts/check-untracked-sources.js",
-        "test": "jest --watchAll=false",
-        "prettify": "prettier --write \"src/**/*.{js,jsx,ts,tsx}\" \"electron/**/*.js\"",
-        "ci": "./scripts/ci.sh",
-        "ci:commit": "./scripts/ci.sh --commit",
-        "ci:push": "./scripts/ci.sh --push",
-        "ci:pr": "./scripts/ci.sh --pr",
-        "ci:release": "./scripts/ci.sh --release",
-        "prdize": "node scripts/prdize.js"
-    },
-    "peerDependencies": {
-        "@headlessui/react": "1.4",
-        "@heroicons/react": "^2.0.16",
-        "@trops/dash-react": ">=0.1.187",
-        "prop-types": "^15.8.1",
-        "react": "^18.2.0",
-        "react-dnd": "^16.0.1",
-        "react-dnd-html5-backend": "^16.0.1",
-        "react-dom": "^18.2.0",
-        "react-instantsearch-hooks-web": "^6.26.0",
-        "react-router-dom": "^6.3.0",
-        "tailwindcss": "^3.2.7"
-    },
-    "dependencies": {
-        "@anthropic-ai/sdk": "^0.39.0",
-        "@fortawesome/fontawesome-svg-core": "^6.1.1",
-        "@fortawesome/free-brands-svg-icons": "^6.1.1",
-        "@fortawesome/free-solid-svg-icons": "^6.1.1",
-        "@fortawesome/react-fontawesome": "^0.1.18",
-        "@modelcontextprotocol/sdk": "^1.26.0",
-        "adm-zip": "^0.5.16",
-        "algoliasearch": "^4.13.0",
-        "clsx": "^2.1.1",
-        "croner": "^10.0.1",
-        "css": "^3.0.0",
-        "csv-parser": "^3.0.0",
-        "deep-equal": "^2.2.0",
-        "electron-store": "^8.0.1",
-        "esbuild": "^0.25.12",
-        "JSONStream": "^1.3.5",
-        "live-plugin-manager": "^0.17.1",
-        "marked": "^17.0.5",
-        "minimist": "^1.2.8",
-        "node-forge": "^1.3.1",
-        "node-vibrant": "^4.0.4",
-        "objects-to-csv": "^1.3.6",
-        "openai": "^4.30.0",
-        "quickjs-emscripten": "^0.32.0",
-        "ws": "^8.19.0",
-        "xml2js": "^0.6.2",
-        "xtreamer": "^1.1.2",
-        "zod": "^3.23.8"
-    },
-    "devDependencies": {
-        "@babel/cli": "^7.22.0",
-        "@babel/core": "^7.22.0",
-        "@babel/plugin-transform-runtime": "^7.22.0",
-        "@babel/preset-env": "^7.22.0",
-        "@babel/preset-react": "^7.22.0",
-        "@babel/preset-typescript": "^7.28.5",
-        "@babel/runtime": "^7.22.0",
-        "@rollup/plugin-babel": "^6.0.0",
-        "@rollup/plugin-commonjs": "^25.0.0",
-        "@rollup/plugin-json": "^6.0.0",
-        "@rollup/plugin-node-resolve": "^15.0.0",
-        "@rollup/plugin-strip": "^3.0.0",
-        "@rollup/plugin-typescript": "^11.0.0",
-        "@testing-library/dom": "^10.4.1",
-        "@testing-library/jest-dom": "^6.9.1",
-        "@testing-library/react": "^14.0.0",
-        "@testing-library/user-event": "^14.6.1",
-        "babel-jest": "^30.2.0",
-        "jest": "^30.2.0",
-        "jest-environment-jsdom": "^30.2.0",
-        "prettier": "^3.0.0",
-        "react": "^18.2.0",
-        "react-dom": "^18.2.0",
-        "rollup": "^3.25.0",
-        "rollup-plugin-peer-deps-external": "^2.2.4",
-        "tslib": "^2.8.1",
-        "typescript": "^5.0.0"
-    },
-    "publishConfig": {
-        "access": "public"
-    },
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/trops/dash-core.git"
-    },
-    "license": "MIT"
+    "./electron": {
+      "require": "./dist/electron/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "scripts/scanWidgetManifestCli.js"
+  ],
+  "bin": {
+    "dash-scan-manifest": "scripts/scanWidgetManifestCli.js"
+  },
+  "scripts": {
+    "build": "npm run build:renderer && npm run build:electron",
+    "build:renderer": "rollup -c rollup.config.renderer.mjs",
+    "build:electron": "rollup -c rollup.config.electron.mjs && mkdir -p dist/mcp && cp electron/mcp/mcpServerCatalog.json dist/mcp/ && cp electron/mcp/knownExternalMcpServers.json dist/mcp/ && rm -rf dist/mcp/servers && cp -r electron/mcp/servers dist/mcp/ && node scripts/inject-secrets.js",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build",
+    "test:mcp": "node --test electron/controller/mcpController.test.js electron/mcp/mcpServerCatalog.test.js electron/mcp/installExternalMcpTool.test.js",
+    "test:untracked-pin": "node scripts/test-untracked-sources-pin.js",
+    "check:untracked": "node scripts/check-untracked-sources.js",
+    "test": "jest --watchAll=false",
+    "prettify": "prettier --write \"src/**/*.{js,jsx,ts,tsx}\" \"electron/**/*.js\"",
+    "ci": "./scripts/ci.sh",
+    "ci:commit": "./scripts/ci.sh --commit",
+    "ci:push": "./scripts/ci.sh --push",
+    "ci:pr": "./scripts/ci.sh --pr",
+    "ci:release": "./scripts/ci.sh --release",
+    "prdize": "node scripts/prdize.js"
+  },
+  "peerDependencies": {
+    "@headlessui/react": "1.4",
+    "@heroicons/react": "^2.0.16",
+    "@trops/dash-react": ">=0.1.187",
+    "prop-types": "^15.8.1",
+    "react": "^18.2.0",
+    "react-dnd": "^16.0.1",
+    "react-dnd-html5-backend": "^16.0.1",
+    "react-dom": "^18.2.0",
+    "react-instantsearch-hooks-web": "^6.26.0",
+    "react-router-dom": "^6.3.0",
+    "tailwindcss": "^3.2.7"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.39.0",
+    "@fortawesome/fontawesome-svg-core": "^6.1.1",
+    "@fortawesome/free-brands-svg-icons": "^6.1.1",
+    "@fortawesome/free-solid-svg-icons": "^6.1.1",
+    "@fortawesome/react-fontawesome": "^0.1.18",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "adm-zip": "^0.5.16",
+    "algoliasearch": "^4.13.0",
+    "clsx": "^2.1.1",
+    "croner": "^10.0.1",
+    "css": "^3.0.0",
+    "csv-parser": "^3.0.0",
+    "deep-equal": "^2.2.0",
+    "electron-store": "^8.0.1",
+    "esbuild": "^0.25.12",
+    "JSONStream": "^1.3.5",
+    "live-plugin-manager": "^0.17.1",
+    "marked": "^17.0.5",
+    "minimist": "^1.2.8",
+    "node-forge": "^1.3.1",
+    "node-vibrant": "^4.0.4",
+    "objects-to-csv": "^1.3.6",
+    "openai": "^4.30.0",
+    "quickjs-emscripten": "^0.32.0",
+    "ws": "^8.19.0",
+    "xml2js": "^0.6.2",
+    "xtreamer": "^1.1.2",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@babel/cli": "^7.22.0",
+    "@babel/core": "^7.22.0",
+    "@babel/plugin-transform-runtime": "^7.22.0",
+    "@babel/preset-env": "^7.22.0",
+    "@babel/preset-react": "^7.22.0",
+    "@babel/preset-typescript": "^7.28.5",
+    "@babel/runtime": "^7.22.0",
+    "@rollup/plugin-babel": "^6.0.0",
+    "@rollup/plugin-commonjs": "^25.0.0",
+    "@rollup/plugin-json": "^6.0.0",
+    "@rollup/plugin-node-resolve": "^15.0.0",
+    "@rollup/plugin-strip": "^3.0.0",
+    "@rollup/plugin-typescript": "^11.0.0",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^14.0.0",
+    "@testing-library/user-event": "^14.6.1",
+    "babel-jest": "^30.2.0",
+    "jest": "^30.2.0",
+    "jest-environment-jsdom": "^30.2.0",
+    "prettier": "^3.0.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "rollup": "^3.25.0",
+    "rollup-plugin-peer-deps-external": "^2.2.4",
+    "tslib": "^2.8.1",
+    "typescript": "^5.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/trops/dash-core.git"
+  },
+  "license": "MIT"
 }

package/scripts/scanWidgetManifestCli.js

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+/**
+ * scanWidgetManifestCli.js
+ *
+ * CLI shim around electron/utils/manifestScanner.js. Run from a widget
+ * package root to compare detected MCP usage against the package's
+ * `dash.permissions.mcp` block.
+ *
+ * Usage:
+ *   npx dash-scan-manifest                  # scan ./, print diff (default --check)
+ *   npx dash-scan-manifest <dir>            # scan <dir>
+ *   npx dash-scan-manifest --init           # write missing manifest into package.json
+ *   npx dash-scan-manifest --json           # machine-readable output
+ *
+ * Exit codes:
+ *   0  no missing entries (manifest is complete or scan found nothing)
+ *   1  scan found tool usage not declared in the manifest
+ *   2  invalid arguments / unreadable directory
+ */
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+// Find the scanner in either the repo layout (electron/) or the
+// published package layout (dist/electron/). Whichever exists wins.
+const scannerPath = (() => {
+  const distPath = path.join(
+    __dirname,
+    "..",
+    "dist",
+    "electron",
+    "utils",
+    "manifestScanner.js",
+  );
+  if (fs.existsSync(distPath)) return distPath;
+  return path.join(__dirname, "..", "electron", "utils", "manifestScanner.js");
+})();
+const { scanForMcpUsage } = require(scannerPath);
+
+function parseArgs(argv) {
+  const args = { dir: null, mode: "check", json: false };
+  for (const a of argv) {
+    if (a === "--init") args.mode = "init";
+    else if (a === "--check") args.mode = "check";
+    else if (a === "--json") args.json = true;
+    else if (a.startsWith("--")) {
+      console.error(`Unknown flag: ${a}`);
+      process.exit(2);
+    } else {
+      args.dir = a;
+    }
+  }
+  if (!args.dir) args.dir = process.cwd();
+  return args;
+}
+
+function readPackageJson(dir) {
+  const p = path.join(dir, "package.json");
+  if (!fs.existsSync(p)) return { path: p, pkg: null };
+  try {
+    return { path: p, pkg: JSON.parse(fs.readFileSync(p, "utf8")) };
+  } catch (e) {
+    console.error(`Could not read ${p}: ${e.message}`);
+    process.exit(2);
+  }
+}
+
+function getDeclaredManifest(pkg) {
+  return pkg?.dash?.permissions?.mcp || null;
+}
+
+function diff(detected, declared) {
+  // detected: { servers: { [name]: { tools[] } } }
+  // declared: { [name]: { tools[], readPaths[], writePaths[] } } | null
+  const missing = {}; // detected but not declared
+  const declaredServers = (declared && declared) || {};
+  for (const [name, entry] of Object.entries(detected.servers)) {
+    const declTools = declaredServers[name]?.tools || [];
+    const missingTools = entry.tools.filter((t) => !declTools.includes(t));
+    if (!declaredServers[name] || missingTools.length > 0) {
+      missing[name] = {
+        tools: missingTools.length > 0 ? missingTools : entry.tools,
+      };
+    }
+  }
+  return { missing };
+}
+
+function buildSyntheticManifest(detected) {
+  const out = {};
+  for (const [name, entry] of Object.entries(detected.servers)) {
+    out[name] = {
+      tools: entry.tools,
+      readPaths: [],
+      writePaths: [],
+    };
+  }
+  return out;
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const dir = path.resolve(args.dir);
+
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) {
+    console.error(`Directory not found: ${dir}`);
+    process.exit(2);
+  }
+
+  const detected = scanForMcpUsage({ dir });
+  const { path: pkgPath, pkg } = readPackageJson(dir);
+  const declared = getDeclaredManifest(pkg);
+  const d = diff(detected, declared);
+
+  if (args.json) {
+    console.log(
+      JSON.stringify(
+        {
+          dir,
+          detected: detected.servers,
+          declared: declared || null,
+          missing: d.missing,
+          warnings: detected.warnings,
+        },
+        null,
+        2,
+      ),
+    );
+    process.exit(Object.keys(d.missing).length > 0 ? 1 : 0);
+  }
+
+  if (args.mode === "init") {
+    if (!pkg) {
+      console.error(
+        `No package.json found in ${dir}. --init requires an existing package.json.`,
+      );
+      process.exit(2);
+    }
+    if (declared) {
+      console.error(
+        `package.json already declares dash.permissions.mcp. --init refuses to overwrite. Use --check to see the diff.`,
+      );
+      process.exit(2);
+    }
+    pkg.dash = pkg.dash || {};
+    pkg.dash.permissions = pkg.dash.permissions || {};
+    pkg.dash.permissions.mcp = buildSyntheticManifest(detected);
+    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    console.log(`Wrote starter manifest to ${pkgPath}.`);
+    console.log(
+      "Review the readPaths and writePaths arrays — the scanner cannot infer paths.",
+    );
+    process.exit(0);
+  }
+
+  // --check (default)
+  console.log(`Scanned: ${dir}`);
+  if (Object.keys(detected.servers).length === 0) {
+    console.log("No literal MCP usage detected.");
+  } else {
+    console.log("\nDetected MCP usage:");
+    for (const [name, entry] of Object.entries(detected.servers)) {
+      console.log(
+        `  ${name}: ${entry.tools.join(", ") || "(no literal tools)"}`,
+      );
+    }
+  }
+
+  if (detected.warnings.length > 0) {
+    console.log(
+      `\n${detected.warnings.length} dynamic call(s) — scanner could not analyze:`,
+    );
+    for (const w of detected.warnings) {
+      console.log(`  ${w.file}:${w.line}  [${w.kind}]  ${w.snippet}`);
+    }
+  }
+
+  if (declared) {
+    console.log("\nDeclared manifest:");
+    for (const [name, entry] of Object.entries(declared)) {
+      console.log(`  ${name}: ${(entry.tools || []).join(", ") || "(empty)"}`);
+    }
+  } else {
+    console.log("\nNo dash.permissions.mcp block in package.json.");
+  }
+
+  if (Object.keys(d.missing).length > 0) {
+    console.log("\nMissing in manifest:");
+    for (const [name, entry] of Object.entries(d.missing)) {
+      console.log(`  ${name}: ${entry.tools.join(", ")}`);
+    }
+    console.log(
+      "\nRun `dash-scan-manifest --init` to write a starter manifest.",
+    );
+    process.exit(1);
+  }
+  console.log("\nManifest looks complete.");
+  process.exit(0);
+}
+
+main();