arcane-os 0.1.0-dev.5

package/runtime/arcane/modules/AIResponseURLPolicy.js

@@ -0,0 +1,626 @@
+import {marked} from './Marked.min.js';
+
+const BARE_HTTP_URL_PATTERN=/\bhttps?:\/\/[^\s<>\[\]"'`]+/giu;
+const BARE_WWW_URL_PATTERN=/\bwww\.[^\s<>\[\]"'`]+/giu;
+const BARE_EMAIL_PATTERN=/\b[A-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?(?:\.[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?)+\b/giu;
+const HTML_LINK_ATTRIBUTE_PATTERN=/\b(?:href|src|action|formaction|poster|data)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/giu;
+const HTML_SRCSET_ATTRIBUTE_PATTERN=/\bsrcset\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/giu;
+const CSS_URL_PATTERN=/\burl\(\s*(?:"([^"]*)"|'([^']*)'|([^)]*))\s*\)/giu;
+const MARKDOWN_AUTOLINK_PATTERN=/<((?:[a-z][a-z0-9+.-]{1,31}):[^<>\s]+|[^<>\s@]+@[^<>\s@]+\.[^<>\s@]+)>/giu;
+const MARKDOWN_ESCAPED_PUNCTUATION_PATTERN=
+    /\\([!"#$%&'()*+,\-./:;<=>?@\[\]\\^_`{|}~])/gu;
+const RENDERED_BLOCK_BOUNDARY_PATTERN=
+    /<\/?(?:address|article|aside|blockquote|br|caption|dd|details|dialog|div|dl|dt|fieldset|figcaption|figure|footer|form|h[1-6]|header|hr|li|main|nav|ol|p|pre|section|summary|table|tbody|td|tfoot|th|thead|tr|ul)\b[^>]*>/giu;
+const RENDERED_TAG_PATTERN=/<[^>]*>/gu;
+const INVISIBLE_FORMATTING_PATTERN=/\p{Default_Ignorable_Code_Point}+/gu;
+const INVISIBLE_TEXT_CONTROL_PATTERN=
+    /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]+/gu;
+
+function decodeNamedCharacterReference(match,name){
+    const normalized=String(name).toLowerCase();
+    const values={
+        af:'\u2061',
+        amp:'&',
+        applyfunction:'\u2061',
+        apos:"'",
+        ast:'*',
+        bsol:'\\',
+        colon:':',
+        comma:',',
+        commat:'@',
+        dollar:'$',
+        equals:'=',
+        excl:'!',
+        gt:'>',
+        ic:'\u2063',
+        invisiblecomma:'\u2063',
+        invisibletimes:'\u2062',
+        it:'\u2062',
+        lpar:'(',
+        lrm:'\u200e',
+        lt:'<',
+        lowbar:'_',
+        negativemediumspace:'\u200b',
+        negativethickspace:'\u200b',
+        negativethinspace:'\u200b',
+        negativeverythinspace:'\u200b',
+        nobreak:'\u2060',
+        num:'#',
+        percnt:'%',
+        period:'.',
+        plus:'+',
+        quest:'?',
+        quot:'"',
+        rlm:'\u200f',
+        rpar:')',
+        semi:';',
+        shy:'\u00ad',
+        sol:'/',
+        vert:'|',
+        zerowidthspace:'\u200b',
+        zwj:'\u200d',
+        zwnj:'\u200c'
+    };
+
+    return Object.hasOwn(values,normalized)?values[normalized]:match;
+}
+
+function decodeNumericCharacterReference(match,hexadecimal,decimal){
+    const raw=hexadecimal||decimal;
+    const radix=hexadecimal?16:10;
+    const codePoint=Number.parseInt(raw,radix);
+
+    if(
+        !Number.isInteger(codePoint)
+        ||codePoint<1
+        ||codePoint>0x10FFFF
+        ||(codePoint>=0xD800&&codePoint<=0xDFFF)
+    ){
+        return match;
+    }
+
+    return String.fromCodePoint(codePoint);
+}
+
+function decodeHTMLCharacterReferences(value=''){
+    return String(value).replace(
+        /&(?:(af|amp|applyfunction|apos|ast|bsol|colon|comma|commat|dollar|equals|excl|gt|ic|invisiblecomma|invisibletimes|it|lpar|lrm|lt|lowbar|negativemediumspace|negativethickspace|negativethinspace|negativeverythinspace|nobreak|num|percnt|period|plus|quest|quot|rlm|rpar|semi|shy|sol|vert|zerowidthspace|zwj|zwnj);|#x([0-9a-f]+);?|#([0-9]+);?)/gi,
+        function decodeOneCharacterReference(match,name,hexadecimal,decimal){
+            return name
+                ?decodeNamedCharacterReference(match,name)
+                :decodeNumericCharacterReference(
+                    match,
+                    hexadecimal,
+                    decimal
+                );
+        }
+    );
+}
+
+function countCharacter(value,character){
+    let count=0;
+
+    for(const candidate of value){
+        if(candidate===character){
+            count++;
+        }
+    }
+
+    return count;
+}
+
+function trimUnbalancedClosingCharacters(value=''){
+    let result=String(value);
+    const pairs=[
+        ['(',')'],
+        ['[',']'],
+        ['{','}']
+    ];
+
+    for(const [opening,closing] of pairs){
+        while(
+            result.endsWith(closing)
+            &&countCharacter(result,closing)>countCharacter(result,opening)
+        ){
+            result=result.slice(0,-1);
+        }
+    }
+
+    return result;
+}
+
+function trimBareLinkCandidate(value=''){
+    let result=decodeHTMLCharacterReferences(value).trim();
+
+    result=trimUnbalancedClosingCharacters(result);
+    while(/[.,;:!?]$/u.test(result)){
+        result=result.slice(0,-1);
+        result=trimUnbalancedClosingCharacters(result);
+    }
+
+    return result;
+}
+
+function normalizeAIResponseLink(value='',{bare=false}={}){
+    let result=bare
+        ?trimBareLinkCandidate(value)
+        :decodeHTMLCharacterReferences(value).trim();
+
+    if(result.startsWith('<')&&result.endsWith('>')){
+        result=result.slice(1,-1).trim();
+    }
+
+    if(/^mailto:/iu.test(result)){
+        return `mailto:${result.slice(7)}`;
+    }
+    if(/^tel:/iu.test(result)){
+        return `tel:${result.slice(4)}`;
+    }
+
+    return result;
+}
+
+function normalizeMarkdownDestination(value=''){
+    return String(value).replace(
+        MARKDOWN_ESCAPED_PUNCTUATION_PATTERN,
+        '$1'
+    );
+}
+
+function extractMarkdownInlineDestination(text='',openingIndex=0){
+    let index=openingIndex+2;
+
+    while(index<text.length&&/\s/u.test(text[index])){
+        index++;
+    }
+
+    if(index>=text.length){
+        return null;
+    }
+
+    if(text[index]==='<'){
+        const end=text.indexOf('>',index+1);
+
+        if(end<0){
+            return null;
+        }
+
+        return {
+            value:text.slice(index+1,end),
+            start:index+1,
+            end
+        };
+    }
+
+    const start=index;
+    let nestedParentheses=0;
+
+    while(index<text.length){
+        const character=text[index];
+
+        if(character==='\\'&&index+1<text.length){
+            index+=2;
+            continue;
+        }
+        if(/\s/u.test(character)&&nestedParentheses===0){
+            break;
+        }
+        if(character==='('){
+            nestedParentheses++;
+        }else if(character===')'){
+            if(nestedParentheses===0){
+                break;
+            }
+            nestedParentheses--;
+        }
+        index++;
+    }
+
+    if(index===start){
+        return null;
+    }
+
+    return {
+        value:text.slice(start,index),
+        start,
+        end:index
+    };
+}
+
+function extractSrcsetCandidates(value=''){
+    const candidates=[];
+
+    for(const entry of String(value).split(',')){
+        const candidate=entry.trim().split(/\s+/u)[0];
+
+        if(candidate){
+            candidates.push(candidate);
+        }
+    }
+
+    return candidates;
+}
+
+function extractMarkdownReferenceDestinations(text=''){
+    const source=String(text);
+    const destinations=[];
+    let lineStart=0;
+
+    while(lineStart<source.length){
+        let lineEnd=source.indexOf('\n',lineStart);
+
+        if(lineEnd<0){
+            lineEnd=source.length;
+        }
+
+        let index=lineStart;
+        let indentation=0;
+        while(index<lineEnd&&source[index]===' '&&indentation<4){
+            index++;
+            indentation++;
+        }
+
+        if(indentation<=3&&source[index]==='['){
+            index++;
+
+            while(index<lineEnd){
+                if(source[index]==='\\'&&index+1<lineEnd){
+                    index+=2;
+                    continue;
+                }
+                if(source[index]===']'){
+                    break;
+                }
+                index++;
+            }
+
+            if(source[index]===']'&&source[index+1]===':'){
+                index+=2;
+                while(index<lineEnd&&/[ \t]/u.test(source[index])){
+                    index++;
+                }
+
+                if(index>=lineEnd||source[index]==='\r'){
+                    const continuationStart=lineEnd+1;
+                    let continuationIndex=continuationStart;
+
+                    while(
+                        continuationIndex<source.length
+                        &&/[ \t]/u.test(source[continuationIndex])
+                    ){
+                        continuationIndex++;
+                    }
+
+                    if(continuationIndex>continuationStart){
+                        index=continuationIndex;
+                        lineEnd=source.indexOf('\n',index);
+                        if(lineEnd<0){
+                            lineEnd=source.length;
+                        }
+                    }
+                }
+
+                if(index<lineEnd&&source[index]!=='\r'){
+                    const start=source[index]==='<'?index+1:index;
+                    let end=start;
+
+                    if(source[index]==='<'){
+                        end=source.indexOf('>',start);
+                        if(end<0||end>lineEnd){
+                            end=start;
+                        }
+                    }else{
+                        while(end<lineEnd&&!/\s/u.test(source[end])){
+                            end++;
+                        }
+                    }
+
+                    if(end>start){
+                        destinations.push({
+                            value:source.slice(start,end),
+                            start,
+                            end
+                        });
+                    }
+                }
+            }
+        }
+
+        lineStart=lineEnd+1;
+    }
+
+    return destinations;
+}
+
+function extractRenderedMarkdownLinks(text=''){
+    const rendered=marked.parse(String(text),{
+        async:false,
+        gfm:true,
+        pedantic:false
+    });
+    const links=[];
+
+    for(const match of rendered.matchAll(HTML_LINK_ATTRIBUTE_PATTERN)){
+        links.push({
+            value:match[1]??match[2]??match[3]??'',
+            start:match.index||0,
+            kind:'rendered-html-attribute'
+        });
+    }
+
+    for(const match of rendered.matchAll(HTML_SRCSET_ATTRIBUTE_PATTERN)){
+        const value=match[1]??match[2]??match[3]??'';
+
+        for(const candidate of extractSrcsetCandidates(value)){
+            links.push({
+                value:candidate,
+                start:match.index||0,
+                kind:'rendered-html-srcset'
+            });
+        }
+    }
+
+    const visibleText=decodeHTMLCharacterReferences(
+        rendered
+            .replace(RENDERED_BLOCK_BOUNDARY_PATTERN,' ')
+            .replace(RENDERED_TAG_PATTERN,'')
+    )
+        .replace(INVISIBLE_FORMATTING_PATTERN,'')
+        .replace(INVISIBLE_TEXT_CONTROL_PATTERN,'');
+    const visibleWebRanges=[];
+
+    function isInsideVisibleWebRange(index){
+        return visibleWebRanges.some(function containsVisibleIndex(range){
+            return index>=range.start&&index<range.end;
+        });
+    }
+
+    for(const match of visibleText.matchAll(BARE_HTTP_URL_PATTERN)){
+        const start=match.index||0;
+
+        visibleWebRanges.push({start,end:start+match[0].length});
+        links.push({
+            value:match[0],
+            start,
+            kind:'rendered-visible-http',
+            bare:true
+        });
+    }
+
+    for(const match of visibleText.matchAll(BARE_WWW_URL_PATTERN)){
+        const start=match.index||0;
+
+        if(isInsideVisibleWebRange(start)){
+            continue;
+        }
+        visibleWebRanges.push({start,end:start+match[0].length});
+        links.push({
+            value:`http://${match[0]}`,
+            start,
+            kind:'rendered-visible-www',
+            bare:true
+        });
+    }
+
+    for(const match of visibleText.matchAll(BARE_EMAIL_PATTERN)){
+        const start=match.index||0;
+
+        if(isInsideVisibleWebRange(start)){
+            continue;
+        }
+        links.push({
+            value:`mailto:${match[0]}`,
+            start,
+            kind:'rendered-visible-email',
+            bare:false
+        });
+    }
+
+    return links;
+}
+
+/**
+ * Returns both authored URL-like text and destinations produced by the same
+ * Markdown parser used by Arcane chat. Values stay exact after renderer-level
+ * entity and escape decoding; URL canonicalization would weaken provenance.
+ */
+function extractAIResponseLinks(text=''){
+    const source=String(text);
+    const links=[];
+    const seen=new Set();
+    const webRanges=[];
+    const structuredRanges=[];
+
+    function addCandidate(
+        value,
+        start=0,
+        kind='unknown',
+        bare=false,
+        allowEmpty=false
+    ){
+        const normalized=normalizeAIResponseLink(value,{bare});
+
+        if((!normalized&&!allowEmpty)||seen.has(normalized)){
+            return false;
+        }
+
+        seen.add(normalized);
+        links.push(Object.freeze({value:normalized,start,kind}));
+        return true;
+    }
+
+    function isInsideWebRange(index){
+        return webRanges.some(function containsIndex(range){
+            return index>=range.start&&index<range.end;
+        });
+    }
+
+    function isInsideStructuredRange(index){
+        return structuredRanges.some(function containsIndex(range){
+            return index>=range.start&&index<range.end;
+        });
+    }
+
+    function addStructuredCandidate(value,start,end,kind){
+        structuredRanges.push({start,end});
+        return addCandidate(value,start,kind,false);
+    }
+
+    let markdownIndex=source.indexOf('](');
+    while(markdownIndex>=0){
+        const destination=extractMarkdownInlineDestination(
+            source,
+            markdownIndex
+        );
+
+        if(destination){
+            addStructuredCandidate(
+                normalizeMarkdownDestination(destination.value),
+                destination.start,
+                destination.end,
+                'markdown-inline',
+            );
+        }
+        markdownIndex=source.indexOf('](',markdownIndex+2);
+    }
+
+    for(const destination of extractMarkdownReferenceDestinations(source)){
+        addStructuredCandidate(
+            normalizeMarkdownDestination(destination.value),
+            destination.start,
+            destination.end,
+            'markdown-reference',
+        );
+    }
+
+    for(const match of source.matchAll(MARKDOWN_AUTOLINK_PATTERN)){
+        const value=match[1].includes('@')&&!/^[a-z][a-z0-9+.-]*:/iu.test(match[1])
+            ?`mailto:${match[1]}`
+            :match[1];
+
+        const start=(match.index||0)+1;
+
+        addStructuredCandidate(
+            value,
+            start,
+            start+match[1].length,
+            'markdown-autolink'
+        );
+    }
+
+    for(const match of source.matchAll(HTML_LINK_ATTRIBUTE_PATTERN)){
+        const value=match[1]??match[2]??match[3]??'';
+        const offset=match[0].indexOf(value);
+
+        const start=(match.index||0)+Math.max(0,offset);
+
+        addStructuredCandidate(
+            value,
+            start,
+            start+value.length,
+            'html-attribute',
+        );
+    }
+
+    for(const match of source.matchAll(HTML_SRCSET_ATTRIBUTE_PATTERN)){
+        const value=match[1]??match[2]??match[3]??'';
+        const offset=(match.index||0)+Math.max(0,match[0].indexOf(value));
+
+        structuredRanges.push({start:offset,end:offset+value.length});
+
+        for(const candidate of extractSrcsetCandidates(value)){
+            addCandidate(candidate,offset,'html-srcset',false);
+        }
+    }
+
+    for(const match of source.matchAll(CSS_URL_PATTERN)){
+        const value=match[1]??match[2]??match[3]??'';
+        const offset=match[0].indexOf(value);
+        const start=(match.index||0)+Math.max(0,offset);
+
+        addStructuredCandidate(
+            value,
+            start,
+            start+value.length,
+            'css-url'
+        );
+    }
+
+    for(const match of source.matchAll(BARE_HTTP_URL_PATTERN)){
+        const raw=match[0];
+        const start=match.index||0;
+
+        webRanges.push({start,end:start+raw.length});
+        if(!isInsideStructuredRange(start)){
+            addCandidate(raw,start,'bare-http',true);
+        }
+    }
+
+    for(const match of source.matchAll(BARE_WWW_URL_PATTERN)){
+        const start=match.index||0;
+
+        if(!isInsideWebRange(start)&&!isInsideStructuredRange(start)){
+            addCandidate(`http://${match[0]}`,start,'bare-www',true);
+        }
+    }
+
+    for(const match of source.matchAll(BARE_EMAIL_PATTERN)){
+        const start=match.index||0;
+
+        if(!isInsideWebRange(start)&&!isInsideStructuredRange(start)){
+            addCandidate(`mailto:${match[0]}`,start,'bare-email',false);
+        }
+    }
+
+    for(const renderedLink of extractRenderedMarkdownLinks(source)){
+        addCandidate(
+            renderedLink.value,
+            source.length+renderedLink.start,
+            renderedLink.kind,
+            renderedLink.bare===true,
+            true
+        );
+    }
+
+    links.sort(function sortLinksByPosition(left,right){
+        return left.start-right.start||left.value.localeCompare(right.value);
+    });
+
+    return Object.freeze(links);
+}
+
+function normalizeAllowedLinks(allowedLinks=[]){
+    const normalized=new Set();
+
+    for(const value of allowedLinks||[]){
+        const link=normalizeAIResponseLink(value);
+
+        if(link){
+            normalized.add(link);
+        }
+    }
+
+    return normalized;
+}
+
+function auditAIResponseLinks(text='',allowedLinks=[]){
+    const links=extractAIResponseLinks(text);
+    const allowed=normalizeAllowedLinks(allowedLinks);
+    const unsupportedLinks=links.filter(function isUnsupported(link){
+        return !allowed.has(link.value);
+    });
+
+    return Object.freeze({
+        ok:unsupportedLinks.length===0,
+        links,
+        unsupportedLinks:Object.freeze(unsupportedLinks),
+        allowedLinks:Object.freeze(Array.from(allowed))
+    });
+}
+
+export {
+    auditAIResponseLinks,
+    decodeHTMLCharacterReferences,
+    extractAIResponseLinks,
+    normalizeAIResponseLink
+};

package/runtime/arcane/modules/AnsiText.js

@@ -0,0 +1,53 @@
+const ANSI_PATTERN=/\x1b\[([0-9;?]*)([ -\/]*)([@-~])/g;
+const COLORS=['black','red','green','yellow','blue','magenta','cyan','white'];
+
+function freshStyle(){ return {bold:false,dim:false,italic:false,underline:false,inverse:false,foreground:null,background:null}; }
+function snapshot(style){ return Object.freeze({...style}); }
+
+function applyCodes(style,raw=''){
+    const codes=(raw?raw.split(';'):['0']).map(value=>Number(value||0));
+    for(let index=0;index<codes.length;index+=1){
+        const code=codes[index];
+        if(code===0) Object.assign(style,freshStyle());
+        else if(code===1) style.bold=true;
+        else if(code===2) style.dim=true;
+        else if(code===3) style.italic=true;
+        else if(code===4) style.underline=true;
+        else if(code===7) style.inverse=true;
+        else if(code===22){style.bold=false;style.dim=false;}
+        else if(code===23) style.italic=false;
+        else if(code===24) style.underline=false;
+        else if(code===27) style.inverse=false;
+        else if(code===39) style.foreground=null;
+        else if(code===49) style.background=null;
+        else if(code>=30&&code<=37) style.foreground=COLORS[code-30];
+        else if(code>=40&&code<=47) style.background=COLORS[code-40];
+        else if(code>=90&&code<=97) style.foreground=`bright-${COLORS[code-90]}`;
+        else if(code>=100&&code<=107) style.background=`bright-${COLORS[code-100]}`;
+        else if((code===38||code===48)&&codes[index+1]===5&&Number.isInteger(codes[index+2])){
+            style[code===38?'foreground':'background']=`index-${Math.max(0,Math.min(255,codes[index+2]))}`;
+            index+=2;
+        }
+    }
+}
+
+export function parseAnsi(input=''){
+    const text=String(input??'');
+    const tokens=[];
+    const style=freshStyle();
+    let cursor=0;
+    let match;
+    ANSI_PATTERN.lastIndex=0;
+    while((match=ANSI_PATTERN.exec(text))){
+        if(match.index>cursor) tokens.push(Object.freeze({text:text.slice(cursor,match.index),style:snapshot(style)}));
+        if(match[3]==='m') applyCodes(style,match[1]);
+        cursor=ANSI_PATTERN.lastIndex;
+    }
+    if(cursor<text.length) tokens.push(Object.freeze({text:text.slice(cursor),style:snapshot(style)}));
+    return Object.freeze(tokens);
+}
+
+export function stripAnsi(input=''){
+    ANSI_PATTERN.lastIndex=0;
+    return String(input??'').replace(ANSI_PATTERN,'');
+}

package/runtime/arcane/modules/ApiModelDatabase.js

@@ -0,0 +1,25 @@
+import ApiModelRecord from '../entities/ApiModelRecord.js';
+
+function event(type,detail){return new CustomEvent(type,{detail});}
+function endpoint(value){const url=new URL(String(value||''));if(!['http:','https:'].includes(url.protocol))throw new TypeError('API model endpoints must use HTTP or HTTPS.');return url.href;}
+function appendParameters(url,parameters={}){for(const [key,value] of Object.entries(parameters||{})){if(value===undefined||value===null||value==='')continue;url.searchParams.set(key,Array.isArray(value)?value.join(','):String(value));}return url;}
+function publicEndpoint(url){const safe=new URL(url);for(const key of [...safe.searchParams.keys()])if(/(?:auth|key|password|secret|token)/i.test(key))safe.searchParams.set(key,'[redacted]');return safe.href;}
+
+export default class ApiModelDatabase extends EventTarget{
+    constructor({endpoint:source,parser=value=>value,fetchImpl=globalThis.fetch,cache=null,request={}}={}){super();this.endpoint=endpoint(source);if(typeof parser!=='function')throw new TypeError('API model parser must be a function.');if(typeof fetchImpl!=='function')throw new TypeError('API model fetch implementation must be a function.');this.parser=parser;this.fetchImpl=fetchImpl;this.cache=cache;this.request={...request};this.latest=null;}
+    setEndpoint(value){this.endpoint=endpoint(value);return this.endpoint;}
+    async fetch(parameters={},context={}){
+        const url=appendParameters(new URL(this.endpoint),parameters);const visibleEndpoint=publicEndpoint(url);const requestId=globalThis.crypto?.randomUUID?.()||`${Date.now()}-${Math.random().toString(16).slice(2)}`;
+        this.dispatchEvent(event('api-model-request',{requestId,endpoint:visibleEndpoint}));
+        try{
+            const response=await this.fetchImpl(url,{method:'GET',...this.request,headers:{Accept:'application/json',...(this.request.headers||{})}});const raw=await response.json();
+            if(!response.ok)throw new Error(raw?.reason||raw?.error||`API request failed (${response.status}).`);
+            const value=await this.parser(raw,{context,endpoint:url.href,response:{status:response.status,headers:response.headers}});const record=new ApiModelRecord({endpoint:visibleEndpoint,value,metadata:{requestId,status:response.status}});this.latest=record;
+            if(this.cache?.set)await this.cache.set(visibleEndpoint,record.toJSON());
+            this.dispatchEvent(event('api-model-success',{requestId,record}));return record;
+        }catch(error){this.dispatchEvent(event('api-model-error',{requestId,endpoint:visibleEndpoint,error}));throw error;}
+    }
+    async cached(parameters={}){const url=appendParameters(new URL(this.endpoint),parameters);if(!this.cache?.get)return null;const value=await this.cache.get(publicEndpoint(url));return value?new ApiModelRecord(value):null;}
+}
+
+export {appendParameters,publicEndpoint};