i18ntk 1.10.2 → 2.0.3

package/runtime/index.js

@@ -5,6 +5,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const SecurityUtils = require('../utils/security');
 
 let configManager = null;
 try { configManager = require('../utils/config-manager'); } catch (_) { /* optional */ }
@@ -27,7 +28,7 @@ function stripBOMAndComments(s) {
 }
 
 function readJsonSafe(file) {
-  const raw = fs.readFileSync(file, 'utf8');
+  const raw = SecurityUtils.safeReadFileSync(file, path.dirname(file), 'utf8');
   return JSON.parse(stripBOMAndComments(raw));
 }
 
@@ -85,7 +86,7 @@ function listJsonFilesRecursively(dir) {
   const stack = [dir];
   while (stack.length) {
     const d = stack.pop();
-    if (!fs.existsSync(d)) continue;
+    if (!SecurityUtils.safeExistsSync(d)) continue;
     for (const entry of fs.readdirSync(d, { withFileTypes: true })) {
       const full = path.join(d, entry.name);
       if (entry.isDirectory()) {
@@ -104,7 +105,7 @@ function readLanguageFromBase(baseDir, lang) {
   const langDir = path.join(baseDir, lang);
 
   // Prefer folder if exists, otherwise single file
-  if (fs.existsSync(langDir) && fs.statSync(langDir).isDirectory()) {
+  if (SecurityUtils.safeExistsSync(langDir) && fs.statSync(langDir).isDirectory()) {
     const files = listJsonFilesRecursively(langDir);
     for (const file of files) {
       try {
@@ -114,7 +115,7 @@ function readLanguageFromBase(baseDir, lang) {
         // Skip unreadable/invalid files
       }
     }
-  } else if (fs.existsSync(langFile) && fs.statSync(langFile).isFile()) {
+  } else if (SecurityUtils.safeExistsSync(langFile) && fs.statSync(langFile).isFile()) {
     try {
       const data = readJsonSafe(langFile);
       if (data && typeof data === 'object') deepMerge(merged, data);
@@ -203,7 +204,7 @@ function getLanguage() {
 function getAvailableLanguages() {
   const langs = new Set();
   if (!state.baseDir) state.baseDir = resolveBaseDir();
-  if (!fs.existsSync(state.baseDir)) return ['en'];
+  if (!SecurityUtils.safeExistsSync(state.baseDir)) return ['en'];
   for (const entry of fs.readdirSync(state.baseDir, { withFileTypes: true })) {
     if (entry.isFile() && entry.name.toLowerCase().endsWith('.json')) {
       langs.add(entry.name.replace(/\.json$/i, ''));
@@ -211,7 +212,7 @@ function getAvailableLanguages() {
       // language folder convention
       const lang = entry.name;
       const idx = path.join(state.baseDir, lang, `${lang}.json`);
-      if (fs.existsSync(idx)) langs.add(lang);
+      if (SecurityUtils.safeExistsSync(idx)) langs.add(lang);
       else langs.add(lang); // be permissive
     }
   }

package/scripts/build-lite.js

@@ -54,7 +54,7 @@ class LiteBuild {
   }
 
   async cleanBuildDir() {
-    if (fs.existsSync(this.buildDir)) {
+    if (SecurityUtils.safeExistsSync(this.buildDir)) {
       fs.rmSync(this.buildDir, { recursive: true, force: true });
     }
     fs.mkdirSync(this.buildDir, { recursive: true });
@@ -65,7 +65,7 @@ class LiteBuild {
       'main',
       'utils',
       'settings',
-      'ui-locales/en',
+      'resources/i18n/ui-locales/en',
       'scripts'
     ];
 
@@ -77,7 +77,7 @@ class LiteBuild {
   async copyEssentialFiles() {
     const essentialFiles = [
       // Main CLI scripts
-      { src: 'main/i18ntk-manage.js', dest: 'main/i18ntk-manage.js' },
+      { src: 'main/manage/index.js', dest: 'main/manage/index.js' },
       { src: 'main/i18ntk-init.js', dest: 'main/i18ntk-init.js' },
       { src: 'main/i18ntk-analyze.js', dest: 'main/i18ntk-analyze.js' },
       { src: 'main/i18ntk-validate.js', dest: 'main/i18ntk-validate.js' },
@@ -106,17 +106,17 @@ class LiteBuild {
       const srcPath = path.join(this.projectRoot, src);
       const destPath = path.join(this.buildDir, dest);
       
-      if (fs.existsSync(srcPath)) {
+      if (SecurityUtils.safeExistsSync(srcPath)) {
         fs.copyFileSync(srcPath, destPath);
       }
     });
   }
 
   async copyEnglishLocale() {
-    const enLocaleDir = path.join(this.projectRoot, 'ui-locales', 'en');
-    const destDir = path.join(this.buildDir, 'ui-locales', 'en');
+    const enLocaleDir = path.join(this.projectRoot, 'resources', 'i18n', 'ui-locales', 'en');
+    const destDir = path.join(this.buildDir, 'resources', 'i18n', 'ui-locales', 'en');
     
-    if (fs.existsSync(enLocaleDir)) {
+    if (SecurityUtils.safeExistsSync(enLocaleDir)) {
       const files = fs.readdirSync(enLocaleDir);
       files.forEach(file => {
         if (file.endsWith('.json')) {
@@ -137,7 +137,7 @@ class LiteBuild {
       main: this.packageJson.main,
       bin: this.packageJson.bin,
       scripts: {
-        start: 'node main/i18ntk-manage.js',
+        start: 'node main/manage/index.js',
         analyze: 'node main/i18ntk-analyze.js',
         validate: 'node main/i18ntk-validate.js'
       },
@@ -150,7 +150,7 @@ class LiteBuild {
       homepage: this.packageJson.homepage
     };
 
-    fs.writeFileSync(
+    SecurityUtils.safeWriteFileSync(
       path.join(this.buildDir, 'package.json'),
       JSON.stringify(litePackageJson, null, 2)
     );
@@ -167,12 +167,12 @@ docs/
 .i18ntk/
 
 # Non-English locales
-ui-locales/es/
-ui-locales/fr/
-ui-locales/de/
-ui-locales/ja/
-ui-locales/ru/
-ui-locales/zh/
+resources/i18n/ui-locales/es/
+resources/i18n/ui-locales/fr/
+resources/i18n/ui-locales/de/
+resources/i18n/ui-locales/ja/
+resources/i18n/ui-locales/ru/
+resources/i18n/ui-locales/zh/
 
 # Debug and test files
 *.test.js
@@ -205,7 +205,7 @@ Thumbs.db
 .DS_Store
 `;
 
-    fs.writeFileSync(
+    SecurityUtils.safeWriteFileSync(
       path.join(this.buildDir, '.npmignore'),
       npmIgnoreContent.trim()
     );
@@ -225,7 +225,7 @@ Thumbs.db
       }
     };
 
-    fs.writeFileSync(
+    SecurityUtils.safeWriteFileSync(
       path.join(this.buildDir, 'build-report.json'),
       JSON.stringify(report, null, 2)
     );

package/scripts/deprecate-versions.js

@@ -12,13 +12,25 @@
  */
 
 const { execSync } = require('child_process');
-const fs = require('fs');
 const path = require('path');
+const SecurityUtils = require('../utils/security');
 
 // Configuration
 const CONFIG_FILE = path.join(__dirname, '..', 'deprecation-config.json');
 const packageJsonPath = path.join(__dirname, '..', 'package.json');
-const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+
+// Securely read package.json
+const packageJsonContent = SecurityUtils.safeReadFileSync(packageJsonPath, path.dirname(packageJsonPath), 'utf8');
+if (!packageJsonContent) {
+  console.error('❌ Failed to read package.json');
+  process.exit(1);
+}
+
+const packageJson = SecurityUtils.safeParseJSON(packageJsonContent);
+if (!packageJson) {
+  console.error('❌ Failed to parse package.json');
+  process.exit(1);
+}
 
 const deprecationMessage = '⚠️  DEPRECATED: This version contains security vulnerabilities and missing features. Please upgrade to i18ntk@1.10.0 for: 🔒 Zero shell access security, 🚀 97% performance improvement, 🐍 Python framework support, and 🛡️ PIN protection. Run: npm install i18ntk@latest';
 
@@ -27,11 +39,16 @@ const defaultVersionsToDeprecate = packageJson.versionInfo.deprecations;
 
 // Load admin configuration if available
 function loadAdminConfig() {
-  if (fs.existsSync(CONFIG_FILE)) {
+  if (SecurityUtils.safeExistsSync(CONFIG_FILE, path.dirname(CONFIG_FILE))) {
     try {
-      const config = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
-      console.log('📋 Using admin configuration from deprecation-config.json');
-      return config;
+      const configContent = SecurityUtils.safeReadFileSync(CONFIG_FILE, path.dirname(CONFIG_FILE), 'utf8');
+      if (configContent) {
+        const config = SecurityUtils.safeParseJSON(configContent);
+        if (config) {
+          console.log('📋 Using admin configuration from deprecation-config.json');
+          return config;
+        }
+      }
     } catch (error) {
       console.warn('⚠️  Could not read admin config, using defaults:', error.message);
     }

package/scripts/export-translations.js

@@ -8,13 +8,13 @@ const { loadTranslations, t } = require('../utils/i18n-helper');
 loadTranslations('en');
 
 // Configuration
-const SOURCE_DIR = path.join(__dirname, '..', 'ui-locales');
+const SOURCE_DIR = path.join(__dirname, '..', 'resources', 'i18n', 'ui-locales');
 const TARGET_LANGUAGES = ['de', 'fr', 'es', 'ru', 'ja', 'zh'];
 
 function createLanguageTemplate(lang) {
   const langDir = path.join(SOURCE_DIR, lang);
   
-  if (!fs.existsSync(langDir)) {
+  if (!SecurityUtils.safeExistsSync(langDir)) {
     fs.mkdirSync(langDir, { recursive: true });
     console.log(t('exportTranslations.createdDirectory', { dir: langDir }));
   }
@@ -31,10 +31,10 @@ function createLanguageTemplate(lang) {
     const sourceFile = path.join(enDir, file);
     const targetFile = path.join(langDir, file);
     
-    if (!fs.existsSync(targetFile)) {
-      const sourceContent = JSON.parse(fs.readFileSync(sourceFile, 'utf8'));
+    if (!SecurityUtils.safeExistsSync(targetFile)) {
+      const sourceContent = JSON.parse(SecurityUtils.safeReadFileSync(sourceFile, path.dirname(sourceFile), 'utf8'));
       const templateContent = createTemplateFromEnglish(sourceContent);
-      fs.writeFileSync(targetFile, JSON.stringify(templateContent, null, 2));
+      SecurityUtils.safeWriteFileSync(targetFile, JSON.stringify(templateContent, null, 2));
       console.log(t('exportTranslations.createdTemplate', { lang, file }));
     } else {
       console.log(t('exportTranslations.skippedExisting', { lang, file }));

package/scripts/fix-all-i18n.js

@@ -19,7 +19,7 @@ const argv = Object.fromEntries(
 );
 
 const SOURCE_DIR   = path.resolve(argv['source-dir'] || './');
-const I18N_DIR     = path.resolve(argv['i18n-dir']   || './ui-locales');
+const I18N_DIR     = path.resolve(argv['i18n-dir']   || './resources/i18n/ui-locales');
 const LANGS        = (argv.languages || 'en,de,es,fr,ru,ja,zh').split(',').map(s => s.trim());
 const WRITE        = !!argv.write;
 const PRUNE_EXTRAS = !!argv['prune-extras'];
@@ -36,8 +36,8 @@ const KEY_PATTERNS = [
 
 const EXCLUDE_DIRS = new Set(['node_modules', '.git', path.basename(I18N_DIR)]);
 
-function readUTF8(p) { try { return fs.readFileSync(p, 'utf8'); } catch { return null; } }
-function writeJSON(p, obj) { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, JSON.stringify(obj, null, 2) + '\n', 'utf8'); }
+function readUTF8(p) { try { return SecurityUtils.safeReadFileSync(p, path.dirname(p), 'utf8'); } catch { return null; } }
+function writeJSON(p, obj) { fs.mkdirSync(path.dirname(p), { recursive: true }); SecurityUtils.safeWriteFileSync(p, JSON.stringify(obj, null, 2) + '\n', 'utf8'); }
 function isDir(p) { try { return fs.statSync(p).isDirectory(); } catch { return false; } }
 function isFile(p) { try { return fs.statSync(p).isFile(); } catch { return false; } }
 

package/scripts/fix-and-purify-i18n.js

@@ -15,6 +15,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const SecurityUtils = require('../utils/security');
 
 // ---------------- CLI ARGUMENTS ----------------
 const argv = Object.fromEntries(
@@ -45,11 +46,11 @@ const COUNTRY_CODES = { de: 'DE', es: 'ES', fr: 'FR', ru: 'RU', ja: 'JA', zh: 'Z
 
 // ---------------- HELPERS ----------------
 function readUTF8(p) {
-  try { return fs.readFileSync(p, 'utf8'); } catch { return null; }
+  try { return SecurityUtils.safeReadFileSync(p, path.dirname(p), 'utf8'); } catch { return null; }
 }
 function writeJSON(p, obj) {
   fs.mkdirSync(path.dirname(p), { recursive: true });
-  fs.writeFileSync(p, JSON.stringify(obj, null, 2) + '\n', 'utf8');
+  SecurityUtils.safeWriteFileSync(p, JSON.stringify(obj, null, 2) + '\n', 'utf8');
 }
 function isDir(p) { try { return fs.statSync(p).isDirectory(); } catch { return false; } }
 function isFile(p) { try { return fs.statSync(p).isFile(); } catch { return false; } }

package/scripts/fix-locale-control-chars.js

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+/**
+ * Fix control characters in locale files
+ * Removes problematic newlines and other control chars from JSON strings
+ */
+const fs = require('fs');
+const path = require('path');
+const SecurityUtils = require('../utils/security');
+
+const uiLocalesDirs = [
+  path.join(__dirname, '..', 'ui-locales'),
+  path.join(__dirname, '..', 'resources', 'i18n', 'ui-locales')
+];
+
+function sanitizeValue(value) {
+  if (typeof value === 'string') {
+    // Remove/escape control characters but keep the structure
+    // Replace literal newlines/tabs with spaces, but preserve intended structure
+    return value
+      .replace(/[\u0000-\u0008\u000B-\u000C\u000E-\u001F]/g, '') // Remove other control chars
+      .replace(/\u000A/g, ' ')  // Replace newlines with space
+      .replace(/\u000D/g, '')   // Remove carriage returns
+      .trim();
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeValue);
+  }
+  if (value && typeof value === 'object') {
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+      result[k] = sanitizeValue(v);
+    }
+    return result;
+  }
+  return value;
+}
+
+function fixFile(filePath) {
+  try {
+    const baseDir = path.dirname(filePath);
+    const raw = SecurityUtils.safeReadFileSync(filePath, baseDir, 'utf8');
+    if (!raw) {
+      console.error(`✗ Error reading ${path.basename(filePath)}`);
+      return false;
+    }
+    
+    const data = SecurityUtils.safeParseJSON(raw);
+    if (!data) {
+      console.error(`✗ Error parsing ${path.basename(filePath)}`);
+      return false;
+    }
+    
+    const locale = path.basename(filePath, '.json');
+    
+    // Sanitize all values
+    const sanitized = sanitizeValue(data);
+    
+    // Write back with proper formatting using SecurityUtils
+    const success = SecurityUtils.safeWriteFileSync(
+      filePath,
+      JSON.stringify(sanitized, null, 2) + '\n',
+      baseDir,
+      'utf8'
+    );
+    
+    if (success) {
+      console.log(`  ✓ Fixed ${locale}.json`);
+      return true;
+    } else {
+      console.error(`  ✗ Error writing ${path.basename(filePath)}`);
+      return false;
+    }
+  } catch (error) {
+    console.error(`✗ Error fixing ${path.basename(filePath)}: ${error.message}`);
+    return false;
+  }
+}
+
+function main() {
+  console.log('Fixing control characters in locale files...\n');
+  
+  let fixed = 0;
+  let failed = 0;
+  
+  for (const uiLocalesDir of uiLocalesDirs) {
+    if (!SecurityUtils.safeExistsSync(uiLocalesDir)) {
+      console.log(`ℹ️  Skipping ${uiLocalesDir} (does not exist)\n`);
+      continue;
+    }
+    
+    console.log(`Processing: ${uiLocalesDir}`);
+    const files = SecurityUtils.safeReaddirSync(uiLocalesDir, path.dirname(uiLocalesDir))
+      .filter(f => f.endsWith('.json'))
+      .map(f => path.join(uiLocalesDir, f));
+    
+    for (const file of files) {
+      if (fixFile(file)) {
+        fixed++;
+      } else {
+        failed++;
+      }
+    }
+    console.log();
+  }
+  
+  console.log(`\nFixed ${fixed} file(s)${failed ? `, ${failed} failed` : ''}`);
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+main();

package/scripts/lint-locales.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Simple locale lint:
+ * - flags control characters in any locale string
+ * - en locale: ensures a small set of CLI strings stay plain ASCII (catches mojibake)
+ */
+const fs = require('fs');
+const path = require('path');
+const SecurityUtils = require('../utils/security');
+
+const uiLocalesDir = path.join(__dirname, '..', 'ui-locales');
+const asciiOnlyKeys = new Set([
+  'ui.autoDetectedI18nDirectory',
+  'ui.executingCommand',
+  'ui.unknownCommand',
+  'ui.errorExecutingCommand',
+  'ui.errorLoadingTranslationFile',
+  'ui.errorSavingLanguagePreference',
+  'ui.noActiveReadlineInterface',
+  'ui.uiLanguageUpdated',
+  'menu.invalidChoice',
+  'menu.returning',
+  'menu.invalidOption',
+  'menu.nonInteractiveModeWarning',
+  'menu.useDirectExecution',
+  'menu.useHelpForCommands',
+  'menu.autoDetectedI18nDirectory'
+]);
+
+function walk(value, pathParts, onString) {
+  if (typeof value === 'string') {
+    onString(value, pathParts.join('.'));
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, idx) => walk(item, pathParts.concat(idx), onString));
+    return;
+  }
+  if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) {
+      walk(v, pathParts.concat(k), onString);
+    }
+  }
+}
+
+function lintFile(filePath) {
+  const raw = SecurityUtils.safeReadFileSync(filePath, path.dirname(filePath), 'utf8');
+  if (!raw) {
+    return [`${path.basename(filePath, '.json')}: unable to read locale file`];
+  }
+  const data = JSON.parse(raw);
+  const locale = path.basename(filePath, '.json');
+  const issues = [];
+
+  walk(data, [], (str, keyPath) => {
+    if (/[\u0000-\u001F]/.test(str)) {
+      issues.push(`${locale}: control char in ${keyPath}`);
+    }
+    if (locale === 'en' && asciiOnlyKeys.has(keyPath) && /[^\x20-\x7E]/.test(str)) {
+      issues.push(`${locale}: non-ASCII in ${keyPath} -> "${str}"`);
+    }
+  });
+
+  return issues;
+}
+
+function main() {
+  const files = fs.readdirSync(uiLocalesDir).filter(f => f.endsWith('.json'));
+  const allIssues = files.flatMap(f => lintFile(path.join(uiLocalesDir, f)));
+
+  if (allIssues.length) {
+    console.error('Locale lint failed:');
+    allIssues.forEach(msg => console.error(` - ${msg}`));
+    process.exit(1);
+  }
+
+  console.log('Locale lint passed.');
+}
+
+main();

package/scripts/locale-optimizer.js

@@ -21,7 +21,7 @@ const { getGlobalReadline } = require('../utils/cli');
 
 class LocaleOptimizer {
   constructor() {
-    this.uiLocalesDir = path.join(__dirname, '..', 'ui-locales');
+    this.uiLocalesDir = path.join(__dirname, '..', 'resources', 'i18n', 'ui-locales');
     this.allLocales = ['en', 'de', 'es', 'fr', 'ja', 'ru', 'zh'];
     this.backupDir = path.join(__dirname, '..', 'backups', 'locales');
     this.rl = getGlobalReadline();
@@ -139,7 +139,7 @@ class LocaleOptimizer {
     console.log(`   Keeping: ${keepList.join(', ').toUpperCase()}`);
     
     // Create backup directory
-    if (!fs.existsSync(this.backupDir)) {
+    if (!SecurityUtils.safeExistsSync(this.backupDir)) {
       fs.mkdirSync(this.backupDir, { recursive: true });
     }
     
@@ -151,7 +151,7 @@ class LocaleOptimizer {
       const filePath = path.join(this.uiLocalesDir, `${locale}.json`);
       const backupPath = path.join(this.backupDir, `${locale}.json`);
       
-      if (!keepList.includes(locale) && fs.existsSync(filePath)) {
+      if (!keepList.includes(locale) && SecurityUtils.safeExistsSync(filePath)) {
         // Backup the file
         fs.copyFileSync(filePath, backupPath);
         
@@ -173,7 +173,7 @@ class LocaleOptimizer {
       
       // Create warning file
       const warningPath = path.join(this.backupDir, 'REMOVED_LOCALES.txt');
-      fs.writeFileSync(warningPath, `Removed locales: ${removedLocales.join(',')}\nRestore with: node scripts/locale-optimizer.js --restore`);
+      SecurityUtils.safeWriteFileSync(warningPath, `Removed locales: ${removedLocales.join(',')}\nRestore with: node scripts/locale-optimizer.js --restore`);
     }
     
     const savedKB = (savedSpace / 1024).toFixed(1);
@@ -189,7 +189,7 @@ class LocaleOptimizer {
   restoreLocales() {
     console.log('🔄 Restoring locales from backup...');
     
-    if (!fs.existsSync(this.backupDir)) {
+    if (!SecurityUtils.safeExistsSync(this.backupDir)) {
       console.log('   ❌ No backup directory found');
       return;
     }
@@ -348,7 +348,7 @@ class LocaleOptimizer {
   getAvailableLocales() {
     return this.allLocales.filter(locale => {
       const filePath = path.join(this.uiLocalesDir, `${locale}.json`);
-      return fs.existsSync(filePath);
+      return SecurityUtils.safeExistsSync(filePath);
     });
   }
 
@@ -357,7 +357,7 @@ class LocaleOptimizer {
    */
   getLocaleSize(locale) {
     const filePath = path.join(this.uiLocalesDir, `${locale}.json`);
-    if (fs.existsSync(filePath)) {
+    if (SecurityUtils.safeExistsSync(filePath)) {
       return fs.statSync(filePath).size / 1024;
     }
     return 0;
@@ -380,7 +380,7 @@ class LocaleOptimizer {
     
     this.allLocales.forEach(locale => {
       const filePath = path.join(this.uiLocalesDir, `${locale}.json`);
-      if (fs.existsSync(filePath)) {
+      if (SecurityUtils.safeExistsSync(filePath)) {
         activeLocales.push(locale);
       }
     });