karajan-code 3.4.0 → 3.4.1

package/src/utils/escape-regexp.js

@@ -0,0 +1,15 @@
+/**
+ * Escape regex metacharacters so a value can be interpolated into a
+ * RegExp literally (KJC-TSK-0536 — closes Semgrep's
+ * detect-non-literal-regexp findings in one move).
+ *
+ * Use this EVERY time a variable lands inside `new RegExp(...)`. It is
+ * NOT for config-provided patterns (output-guard/perf-guard policies),
+ * which are regexes by design.
+ *
+ * @param {unknown} value - coerced to string
+ * @returns {string}
+ */
+export function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/src/utils/paths.js

@@ -9,6 +9,5 @@ export {
   getSonarComposePath,
   getOllamaComposePath,
   getWebperfDir,
-  getRunsDir,
   getPromptsDir,
 } from "@karajan/core/paths";

package/src/utils/port-occupant.js

@@ -9,6 +9,7 @@
  */
 
 import { runCommand } from "./process.js";
+import { escapeRegExp } from "./escape-regexp.js";
 
 /**
  * @typedef {Object} PortOccupant
@@ -74,7 +75,7 @@ async function detectWindows(port) {
     if (netstat.exitCode !== 0) return null;
     const line = netstat.stdout
       .split(/\r?\n/)
-      .find((l) => l.match(new RegExp(`:${port}\\s+.*LISTENING`)));
+      .find((l) => l.match(new RegExp(`:${escapeRegExp(port)}\\s+.*LISTENING`)));
     if (!line) return null;
     const parts = line.trim().split(/\s+/);
     const pid = Number(parts[parts.length - 1]) || null;

package/src/utils/project-detect.js

@@ -97,7 +97,7 @@ export async function detectTestFramework(cwd = process.cwd()) {
     try {
       if (marker.glob) {
         const entries = await fs.readdir(cwd);
-        const ext = marker.file.replace("*", "");
+        const ext = marker.file.replaceAll("*", "");
         if (entries.some((e) => e.endsWith(ext))) {
           return { hasTests: true, framework: marker.framework, language: marker.language };
         }

package/node_modules/deep-extend/CHANGELOG.md

@@ -1,46 +0,0 @@
-Changelog
-=========
-
-v0.6.0
-------
-
-- Updated "devDependencies" versions to fix vulnerability alerts
-- Dropped support of io.js and node.js v0.12.x and lower since new versions of
-  "devDependencies" couldn't work with those old node.js versions
-  (minimal supported version of node.js now is v4.0.0)
-
-v0.5.1
-------
-
-- Fix prototype pollution vulnerability (thanks to @mwakerman for the PR)
-- Avoid using deprecated Buffer API (thanks to @ChALkeR for the PR)
-
-v0.5.0
-------
-
-- Auto-testing provided by Travis CI;
-- Support older Node.JS versions (`v0.11.x` and `v0.10.x`);
-- Removed tests files from npm package.
-
-v0.4.2
-------
-
-- Fix for `null` as an argument.
-
-v0.4.1
-------
-
-- Removed test code from <b>npm</b> package
-  ([see pull request #21](https://github.com/unclechu/node-deep-extend/pull/21));
-- Increased minimal version of Node from `0.4.0` to `0.12.0`
-  (because can't run tests on lesser version anyway).
-
-v0.4.0
-------
-
-- **WARNING!** Broken backward compatibility with `v0.3.x`;
-- Fixed bug with extending arrays instead of cloning;
-- Deep cloning for arrays;
-- Check for own property;
-- Fixed some documentation issues;
-- Strict JS mode.

package/node_modules/sqlite-vec/index.cjs

@@ -1,46 +0,0 @@
-
-
-const { arch, platform } = require("node:process");
-
-
-const BASE_PACKAGE_NAME = "sqlite-vec";
-const ENTRYPOINT_BASE_NAME = "vec0";
-const supportedPlatforms = [["darwin","x64"],["linux","x64"],["darwin","arm64"],["win32","x64"],["linux","arm64"]];
-
-const invalidPlatformErrorMessage = `Unsupported platform for ${BASE_PACKAGE_NAME}, on a ${platform}-${arch} machine. Supported platforms are (${supportedPlatforms
-  .map(([p, a]) => `${p}-${a}`)
-  .join(",")}). Consult the ${BASE_PACKAGE_NAME} NPM package README for details.`;
-
-const extensionNotFoundErrorMessage = packageName => `Loadble extension for ${BASE_PACKAGE_NAME} not found. Was the ${packageName} package installed?`;
-
-function validPlatform(platform, arch) {
-  return (
-    supportedPlatforms.find(([p, a]) => platform === p && arch === a) !== undefined
-  );
-}
-function extensionSuffix(platform) {
-  if (platform === "win32") return "dll";
-  if (platform === "darwin") return "dylib";
-  return "so";
-}
-function platformPackageName(platform, arch) {
-  const os = platform === "win32" ? "windows" : platform;
-  return `${BASE_PACKAGE_NAME}-${os}-${arch}`;
-}
-
-function getLoadablePath() {
-  if (!validPlatform(platform, arch)) {
-    throw new Error(
-      invalidPlatformErrorMessage
-    );
-  }
-  const packageName = platformPackageName(platform, arch);
-  const loadablePath = require.resolve(packageName + "/" + ENTRYPOINT_BASE_NAME + "." + extensionSuffix(platform));
-  return loadablePath;
-}
-
-function load(db) {
-  db.loadExtension(getLoadablePath());
-}
-
-module.exports = {getLoadablePath, load};

package/node_modules/sqlite-vec/index.d.ts

@@ -1,17 +0,0 @@
-
-
-/**
- * TODO JSDoc
- */
-export declare function getLoadablePath(): string;
-
-
-interface Db {
-    loadExtension(file: string, entrypoint?: string | undefined): void;
-}
-
-/**
- * TODO JSDoc
- */
-export declare function load(db: Db): void;
-

package/node_modules/sqlite-vec/index.mjs

@@ -1,47 +0,0 @@
-
-
-import { fileURLToPath } from "node:url";
-import { arch, platform } from "node:process";
-
-
-const BASE_PACKAGE_NAME = "sqlite-vec";
-const ENTRYPOINT_BASE_NAME = "vec0";
-const supportedPlatforms = [["darwin","x64"],["linux","x64"],["darwin","arm64"],["win32","x64"],["linux","arm64"]];
-
-const invalidPlatformErrorMessage = `Unsupported platform for ${BASE_PACKAGE_NAME}, on a ${platform}-${arch} machine. Supported platforms are (${supportedPlatforms
-  .map(([p, a]) => `${p}-${a}`)
-  .join(",")}). Consult the ${BASE_PACKAGE_NAME} NPM package README for details.`;
-
-const extensionNotFoundErrorMessage = packageName => `Loadble extension for ${BASE_PACKAGE_NAME} not found. Was the ${packageName} package installed?`;
-
-function validPlatform(platform, arch) {
-  return (
-    supportedPlatforms.find(([p, a]) => platform === p && arch === a) !== undefined
-  );
-}
-function extensionSuffix(platform) {
-  if (platform === "win32") return "dll";
-  if (platform === "darwin") return "dylib";
-  return "so";
-}
-function platformPackageName(platform, arch) {
-  const os = platform === "win32" ? "windows" : platform;
-  return `${BASE_PACKAGE_NAME}-${os}-${arch}`;
-}
-
-function getLoadablePath() {
-  if (!validPlatform(platform, arch)) {
-    throw new Error(
-      invalidPlatformErrorMessage
-    );
-  }
-  const packageName = platformPackageName(platform, arch);
-  const loadablePath = fileURLToPath(import.meta.resolve(packageName + "/" + ENTRYPOINT_BASE_NAME + "." + extensionSuffix(platform)));
-  return loadablePath;
-}
-
-function load(db) {
-  db.loadExtension(getLoadablePath());
-}
-
-export {getLoadablePath, load};

package/node_modules/which/CHANGELOG.md

@@ -1,166 +0,0 @@
-# Changes
-
-
-## 2.0.2
-
-* Rename bin to `node-which`
-
-## 2.0.1
-
-* generate changelog and publish on version bump
-* enforce 100% test coverage
-* Promise interface
-
-## 2.0.0
-
-* Parallel tests, modern JavaScript, and drop support for node < 8
-
-## 1.3.1
-
-* update deps
-* update travis
-
-## v1.3.0
-
-* Add nothrow option to which.sync
-* update tap
-
-## v1.2.14
-
-* appveyor: drop node 5 and 0.x
-* travis-ci: add node 6, drop 0.x
-
-## v1.2.13
-
-* test: Pass missing option to pass on windows
-* update tap
-* update isexe to 2.0.0
-* neveragain.tech pledge request
-
-## v1.2.12
-
-* Removed unused require
-
-## v1.2.11
-
-* Prevent changelog script from being included in package
-
-## v1.2.10
-
-* Use env.PATH only, not env.Path
-
-## v1.2.9
-
-* fix for paths starting with ../
-* Remove unused `is-absolute` module
-
-## v1.2.8
-
-* bullet items in changelog that contain (but don't start with) #
-
-## v1.2.7
-
-* strip 'update changelog' changelog entries out of changelog
-
-## v1.2.6
-
-* make the changelog bulleted
-
-## v1.2.5
-
-* make a changelog, and keep it up to date
-* don't include tests in package
-* Properly handle relative-path executables
-* appveyor
-* Attach error code to Not Found error
-* Make tests pass on Windows
-
-## v1.2.4
-
-* Fix typo
-
-## v1.2.3
-
-* update isexe, fix regression in pathExt handling
-
-## v1.2.2
-
-* update deps, use isexe module, test windows
-
-## v1.2.1
-
-* Sometimes windows PATH entries are quoted
-* Fixed a bug in the check for group and user mode bits. This bug was introduced during refactoring for supporting strict mode.
-* doc cli
-
-## v1.2.0
-
-* Add support for opt.all and -as cli flags
-* test the bin
-* update travis
-* Allow checking for multiple programs in bin/which
-* tap 2
-
-## v1.1.2
-
-* travis
-* Refactored and fixed undefined error on Windows
-* Support strict mode
-
-## v1.1.1
-
-* test +g exes against secondary groups, if available
-* Use windows exe semantics on cygwin & msys
-* cwd should be first in path on win32, not last
-* Handle lower-case 'env.Path' on Windows
-* Update docs
-* use single-quotes
-
-## v1.1.0
-
-* Add tests, depend on is-absolute
-
-## v1.0.9
-
-* which.js: root is allowed to execute files owned by anyone
-
-## v1.0.8
-
-* don't use graceful-fs
-
-## v1.0.7
-
-* add license to package.json
-
-## v1.0.6
-
-* isc license
-
-## 1.0.5
-
-* Awful typo
-
-## 1.0.4
-
-* Test for path absoluteness properly
-* win: Allow '' as a pathext if cmd has a . in it
-
-## 1.0.3
-
-* Remove references to execPath
-* Make `which.sync()` work on Windows by honoring the PATHEXT variable.
-* Make `isExe()` always return true on Windows.
-* MIT
-
-## 1.0.2
-
-* Only files can be exes
-
-## 1.0.1
-
-* Respect the PATHEXT env for win32 support
-* should 0755 the bin
-* binary
-* guts
-* package
-* 1st