lurqrun 0.1.6 → 0.1.8

package/dist/chunk-XBQA4I36.js

@@ -0,0 +1,92 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/fix/domains.ts
+init_esm_shims();
+var DOMAIN_SCAN_LIMIT = 2e4;
+var DOMAINS = {
+  /** Variables the code reads that no .env file declares. No key, no network. */
+  env: async (root, opts) => {
+    const { envFindings } = await import("./env-UN6KGZ7S.js");
+    const plan = envFindings(root, { limit: opts.limit ?? DOMAIN_SCAN_LIMIT });
+    return { findings: plan.findings, truncated: plan.truncated };
+  },
+  /**
+   * Model identifiers the provider has retired or put an end date on.
+   *
+   * Reads source only — no network, no key, no arguments. That is why it runs
+   * by default: the check costs nothing the scan is not already paying, and
+   * the failure it catches is one nothing else in the toolchain can see.
+   */
+  model: async (root, opts) => {
+    const { modelFindings } = await import("./model-ASMZWLM7.js");
+    const plan = modelFindings(root, { limit: opts.limit ?? DOMAIN_SCAN_LIMIT });
+    return { findings: plan.findings, truncated: plan.truncated };
+  },
+  /**
+   * Renames the package itself proves, the manifest ranges an upgrade leaves
+   * stale, and a brief for everything that needs judgement.
+   *
+   * Reads the two published versions from npm, so it needs the network but no
+   * API key — the same contract `check-upgrade` advertises.
+   */
+  package: async (root, opts) => {
+    const targets = opts.upgrade ?? [];
+    if (targets.length === 0) {
+      return {
+        findings: [],
+        skipped: "no upgrades given. Pass `upgrade` with the versions to assess, or run `lurq fix` in the project to have them worked out from the index."
+      };
+    }
+    const { scanReferences } = await import("./references-I6Y4BSRR.js");
+    const { checkUpgrade } = await import("./upgrade-FS26DJGG.js");
+    const { renamePlan } = await import("./rename-OS6JYBZQ.js");
+    const { manifestFindings } = await import("./manifest-ENMIC54B.js");
+    const stats = { files: 0, truncated: false };
+    const refs = scanReferences(root, { limit: opts.limit ?? DOMAIN_SCAN_LIMIT, stats });
+    const report = await checkUpgrade(targets, refs, { rootDir: root });
+    return {
+      findings: [...renamePlan(report).findings, ...manifestFindings(root, targets).findings],
+      truncated: stats.truncated
+    };
+  }
+};
+var AVAILABLE = ["env", "model", "package"];
+var SOURCE_DOMAINS = AVAILABLE.filter((d) => d !== "package");
+async function runDomains(opts = {}) {
+  const root = opts.dir?.trim() || process.cwd();
+  const wanted = opts.domains?.length ? opts.domains : AVAILABLE;
+  const findings = [];
+  const ran = [];
+  const skipped = [];
+  let truncated = false;
+  for (const domain of wanted) {
+    const run = DOMAINS[domain];
+    if (!run) {
+      skipped.push({ domain, reason: `lurq has no detector for the ${domain} domain yet` });
+      continue;
+    }
+    try {
+      const result = await run(root, opts);
+      if (result.skipped) {
+        skipped.push({ domain, reason: result.skipped });
+        continue;
+      }
+      findings.push(...result.findings);
+      if (result.truncated) truncated = true;
+      ran.push(domain);
+    } catch (err) {
+      skipped.push({ domain, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return { root, ran, skipped, findings, truncated };
+}
+
+export {
+  DOMAIN_SCAN_LIMIT,
+  AVAILABLE,
+  SOURCE_DOMAINS,
+  runDomains
+};

package/dist/chunk-XGOV6KV4.js

@@ -0,0 +1,413 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  classifyServer,
+  mcpConfigPaths
+} from "./chunk-63MUJNZL.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcpScan/redact.ts
+init_esm_shims();
+var SHAPES = [
+  /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+  /\bxox[abpors]-[A-Za-z0-9-]{10,}/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+  /\blurq_(?:live|test)_[A-Za-z0-9_-]{16,}/g,
+  /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g
+];
+var BEARER = /\b(Bearer|Basic|token)\s+[A-Za-z0-9._~+/=-]{12,}/gi;
+var REDACTED = "[redacted]";
+function looksLikeSecret(value) {
+  return SHAPES.some((re) => {
+    re.lastIndex = 0;
+    const m = re.exec(value);
+    return m !== null && m.index === 0 && m[0].length === value.length;
+  });
+}
+function scrub(text, secrets = []) {
+  let out = text;
+  for (const s of secrets) if (s && out.includes(s)) out = out.split(s).join(REDACTED);
+  for (const re of SHAPES) out = out.replace(re, REDACTED);
+  return out.replace(BEARER, `$1 ${REDACTED}`);
+}
+function scrubDeep(value, secrets = []) {
+  if (typeof value === "string") return scrub(value, secrets);
+  if (Array.isArray(value)) return value.map((v) => scrubDeep(v, secrets));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[scrub(k, secrets)] = scrubDeep(v, secrets);
+    }
+    return out;
+  }
+  return value;
+}
+
+// src/mcpScan/config.ts
+init_esm_shims();
+import { createHash } from "crypto";
+import { existsSync, readFileSync, realpathSync } from "fs";
+import { homedir } from "os";
+import { basename, isAbsolute, join, relative, resolve } from "path";
+var MIN_SECRET_LENGTH = 6;
+var SECRET_FLAG = /^--?(?:api[-_]?key|token|access[-_]?token|auth|password|secret|pat|key)$/i;
+var SECRET_NAME = /(key|token|secret|password|passwd|auth|cookie|credential|session|pat)\b/i;
+var strings = (v) => Array.isArray(v) ? v.filter((a) => typeof a === "string") : [];
+var record = (v) => {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return {};
+  const out = {};
+  for (const [k, val] of Object.entries(v)) {
+    if (typeof val === "string") out[k] = val;
+    else if (typeof val === "number" || typeof val === "boolean") out[k] = String(val);
+  }
+  return out;
+};
+function expandVars(value, env, missing) {
+  return value.replace(/\$\{([^}]+)\}/g, (whole, body) => {
+    if (body.startsWith("input:")) {
+      missing.add(body);
+      return whole;
+    }
+    const expr = body.startsWith("env:") ? body.slice(4) : body;
+    const [name, fallback] = expr.split(":-", 2);
+    const v = env[name.trim()];
+    if (v !== void 0 && v !== "") return v;
+    if (fallback !== void 0) return fallback;
+    missing.add(name.trim());
+    return "";
+  });
+}
+var sha = (s) => createHash("sha256").update(s).digest("hex");
+function hostPath(url) {
+  try {
+    const u = new URL(url);
+    return `${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return url.split("?")[0].slice(0, 200);
+  }
+}
+function splitPypi(spec) {
+  const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?(?:(?:==|@)(\d[^\s,;]*))?/.exec(spec);
+  if (!m) return { name: spec, version: null };
+  return { name: m[1].toLowerCase().replace(/_/g, "-"), version: m[2] ?? null };
+}
+function splitImage(image) {
+  const noDigest = image.split("@")[0];
+  const lastColon = noDigest.lastIndexOf(":");
+  const hasTag = lastColon > noDigest.lastIndexOf("/");
+  const name = hasTag ? noDigest.slice(0, lastColon) : noDigest;
+  const tag = hasTag ? noDigest.slice(lastColon + 1) : null;
+  return { name: name.toLowerCase(), version: tag && /^v?\d/.test(tag) ? tag : null };
+}
+var DOCKER_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-e",
+  "--env",
+  "-v",
+  "--volume",
+  "-p",
+  "--publish",
+  "--name",
+  "--network",
+  "-w",
+  "--workdir",
+  "--env-file",
+  "-u",
+  "--user",
+  "--mount",
+  "--entrypoint",
+  "--platform"
+]);
+function identify(alias, command, args, url) {
+  if (url) return { kind: "remote", registry: "remote", packageName: null, pinnedVersion: null };
+  let cmd = command ?? "";
+  let rest = args;
+  if (/^cmd(\.exe)?$/i.test(basename(cmd)) && /^\/c$/i.test(rest[0] ?? "")) {
+    cmd = rest[1] ?? "";
+    rest = rest.slice(2);
+  }
+  const bin = basename(cmd).replace(/\.(cmd|exe)$/i, "");
+  const base = classifyServer(alias, { command: bin, args: rest });
+  if (base.kind === "npm-stdio" && base.packageName) {
+    return {
+      kind: base.kind,
+      registry: "npm",
+      packageName: base.packageName,
+      pinnedVersion: base.version
+    };
+  }
+  if (bin === "uvx" || bin === "pipx" || bin === "uv") {
+    let tokens = rest;
+    if (bin === "pipx" && tokens[0] === "run") tokens = tokens.slice(1);
+    if (bin === "uv" && tokens[0] === "tool" && tokens[1] === "run") tokens = tokens.slice(2);
+    const from = tokens.indexOf("--from");
+    const spec = from >= 0 ? tokens[from + 1] : tokens.find((t, i) => !t.startsWith("-") && tokens[i - 1] !== "--python");
+    if (spec) {
+      const { name, version } = splitPypi(spec);
+      return {
+        kind: "other-registry",
+        registry: "pypi",
+        packageName: name,
+        pinnedVersion: version
+      };
+    }
+  }
+  if ((bin === "docker" || bin === "podman") && rest[0] === "run") {
+    for (let i = 1; i < rest.length; i++) {
+      const a = rest[i];
+      if (DOCKER_VALUE_FLAGS.has(a)) {
+        i++;
+        continue;
+      }
+      if (a.startsWith("-")) continue;
+      const { name, version } = splitImage(a);
+      return {
+        kind: "other-registry",
+        registry: "docker",
+        packageName: name,
+        pinnedVersion: version
+      };
+    }
+  }
+  return { kind: base.kind, registry: "local", packageName: null, pinnedVersion: null };
+}
+function serverKeyFor(registry, packageName, url, alias) {
+  if (registry === "remote" && url) return `remote:${hostPath(url)}`;
+  if (packageName && registry !== "local" && registry !== "remote")
+    return `${registry}:${packageName}`;
+  return `local:${alias}`;
+}
+function collectSecrets(args, env, headers) {
+  const found = /* @__PURE__ */ new Set();
+  const add = (v) => {
+    if (!v || v.length < MIN_SECRET_LENGTH) return;
+    found.add(v);
+    const bearer = /^(?:bearer|token|basic)\s+(.+)$/i.exec(v);
+    if (bearer?.[1] && bearer[1].length >= MIN_SECRET_LENGTH) found.add(bearer[1]);
+  };
+  for (const [k, v] of Object.entries(env)) if (SECRET_NAME.test(k) || looksLikeSecret(v)) add(v);
+  for (const v of Object.values(headers)) add(v);
+  args.forEach((a, i) => {
+    if (looksLikeSecret(a)) add(a);
+    const eq = /^(--?[A-Za-z-_]+)=(.+)$/.exec(a);
+    if (eq && SECRET_FLAG.test(eq[1])) add(eq[2]);
+    if (SECRET_FLAG.test(a)) add(args[i + 1]);
+    const kv = /^([A-Z][A-Z0-9_]+)=(.+)$/.exec(a);
+    if (kv && SECRET_NAME.test(kv[1])) add(kv[2]);
+  });
+  return [...found].sort((a, b) => b.length - a.length);
+}
+function fingerprintConfig(spec, secrets, root, home) {
+  const normPath = (a) => {
+    let out = a;
+    if (root && out.startsWith(root)) out = `<project>${out.slice(root.length)}`;
+    if (home && out.startsWith(home)) out = `~${out.slice(home.length)}`;
+    return out;
+  };
+  const args = spec.args.map((a) => {
+    if (secrets.includes(a)) return "<secret>";
+    const kv = /^([A-Za-z-_][A-Za-z0-9-_]*)=(.*)$/.exec(a);
+    if (kv && secrets.includes(kv[2])) return `${kv[1]}=<secret>`;
+    if (spec.packageName && spec.registry === "npm" && a.startsWith(spec.packageName))
+      return spec.packageName;
+    if (spec.packageName && spec.registry === "pypi" && splitPypi(a).name === spec.packageName) {
+      return spec.packageName;
+    }
+    if (spec.packageName && spec.registry === "docker" && splitImage(a).name === spec.packageName) {
+      return spec.packageName;
+    }
+    return normPath(a);
+  });
+  const shape = {
+    t: spec.transport,
+    c: spec.command ? basename(spec.command) : null,
+    a: args,
+    e: Object.keys(spec.env).sort(),
+    h: Object.keys(spec.headers).map((h) => h.toLowerCase()).sort(),
+    u: spec.url ? hostPath(spec.url) : null
+  };
+  return sha(JSON.stringify(shape)).slice(0, 16);
+}
+function transportOf(raw, url, file) {
+  const declared = typeof raw.type === "string" ? raw.type : typeof raw.transport === "string" ? raw.transport : "";
+  const t = declared.toLowerCase().replace(/[-_]/g, "");
+  if (t === "stdio") return "stdio";
+  if (t === "sse") return "sse";
+  if (t === "http" || t === "streamablehttp") return "http";
+  if (typeof raw.httpUrl === "string") return "http";
+  if (url) {
+    return basename(file) === "settings.json" && file.includes(".gemini") ? "sse" : "auto";
+  }
+  return "stdio";
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var canonicalPath = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return resolve(p);
+  }
+};
+function claudeProject(home, root) {
+  const cfg = readJson(join(home, ".claude.json"));
+  const projects = cfg?.projects;
+  if (!projects) return null;
+  const want = canonicalPath(root);
+  for (const [path, state] of Object.entries(projects)) {
+    if (path === root || canonicalPath(path) === want) return state;
+  }
+  return null;
+}
+function readServerConfigs(root, opts = {}) {
+  const abs = resolve(root);
+  const home = opts.home ?? homedir();
+  const env = opts.env ?? process.env;
+  const filesRead = [];
+  const notes = [];
+  const rel = (p) => isAbsolute(p) && p.startsWith(abs) ? relative(abs, p) || "." : p.replace(home, "~");
+  const project = claudeProject(home, abs);
+  const approved = new Set(strings(project?.enabledMcpjsonServers));
+  const rejected = new Set(strings(project?.disabledMcpjsonServers));
+  const approveAll = project?.enableAllProjectMcpServers === true;
+  const entries = [];
+  for (const path of mcpConfigPaths(abs, home)) {
+    const inProject = path.startsWith(abs + "/") || path.startsWith(abs + "\\");
+    if (opts.projectOnly && !inProject) continue;
+    if (!existsSync(path)) continue;
+    const cfg = readJson(path);
+    if (!cfg || typeof cfg !== "object") {
+      notes.push(`could not parse ${rel(path)}`);
+      continue;
+    }
+    let found = 0;
+    for (const section of ["mcpServers", "servers"]) {
+      const block = cfg[section];
+      if (!block || typeof block !== "object") continue;
+      for (const [alias, raw] of Object.entries(block)) {
+        if (!raw || typeof raw !== "object") continue;
+        entries.push({
+          alias,
+          raw,
+          file: path,
+          section,
+          scope: inProject ? "project" : "user"
+        });
+        found++;
+      }
+    }
+    if (found) filesRead.push(rel(path));
+  }
+  if (!opts.projectOnly && project?.mcpServers && typeof project.mcpServers === "object") {
+    for (const [alias, raw] of Object.entries(project.mcpServers)) {
+      if (!raw || typeof raw !== "object") continue;
+      entries.push({
+        alias,
+        raw,
+        file: join(home, ".claude.json"),
+        section: `projects[${abs}].mcpServers`,
+        scope: "local"
+      });
+    }
+  }
+  const byKey = /* @__PURE__ */ new Map();
+  for (const { alias, raw, file, section, scope } of entries) {
+    const missing = /* @__PURE__ */ new Set();
+    const x = (v) => expandVars(v, env, missing);
+    const rawUrl = typeof raw.httpUrl === "string" ? raw.httpUrl : typeof raw.url === "string" ? raw.url : typeof raw.serverUrl === "string" ? raw.serverUrl : null;
+    const url = rawUrl ? x(rawUrl) : null;
+    const command = typeof raw.command === "string" ? x(raw.command) : null;
+    const args = strings(raw.args).map(x);
+    const envVars = Object.fromEntries(Object.entries(record(raw.env)).map(([k, v]) => [k, x(v)]));
+    const headers = Object.fromEntries(
+      Object.entries(record(raw.headers)).map(([k, v]) => [k, x(v)])
+    );
+    const cwd = typeof raw.cwd === "string" ? resolve(abs, x(raw.cwd)) : null;
+    const transport = transportOf(raw, url, file);
+    if (!url && !command) {
+      notes.push(`${rel(file)}: server "${alias}" has neither a command nor a url`);
+      continue;
+    }
+    const id = identify(alias, command, args, url);
+    const secrets = collectSecrets(args, envVars, headers);
+    const serverKey = serverKeyFor(id.registry, id.packageName, url, alias);
+    const configFingerprint = fingerprintConfig(
+      {
+        transport,
+        command,
+        args,
+        env: envVars,
+        headers,
+        url,
+        registry: id.registry,
+        packageName: id.packageName
+      },
+      secrets,
+      abs,
+      home
+    );
+    let trusted = true;
+    let trustReason = scope === "project" ? "approved" : "your own configuration";
+    if (scope === "project") {
+      const isMcpJson = basename(file) === ".mcp.json";
+      if (isMcpJson && rejected.has(alias)) {
+        trusted = false;
+        trustReason = "you declined this server in Claude Code";
+      } else if (opts.trustProject) {
+        trustReason = "trusted with --trust-project";
+      } else if (isMcpJson && (approveAll || approved.has(alias))) {
+        trustReason = "approved in Claude Code";
+      } else {
+        trusted = false;
+        trustReason = `committed to the repository (${rel(file)}) and not approved; pass --trust-project to launch it`;
+      }
+    }
+    const spec = {
+      alias,
+      transport,
+      command,
+      args,
+      env: envVars,
+      cwd,
+      url,
+      headers,
+      ...id,
+      serverKey,
+      configFingerprint,
+      scope,
+      trusted,
+      trustReason,
+      unresolved: [...missing].sort(),
+      disabled: raw.disabled === true || raw.enabled === false,
+      secrets,
+      sources: [{ file: rel(file), section }]
+    };
+    const key = `${serverKey}#${configFingerprint}`;
+    const seen = byKey.get(key);
+    if (seen) {
+      seen.sources.push(...spec.sources);
+      if (spec.trusted && !seen.trusted) {
+        seen.trusted = true;
+        seen.trustReason = spec.trustReason;
+      }
+      seen.disabled &&= spec.disabled;
+      continue;
+    }
+    byKey.set(key, spec);
+  }
+  return { root: abs, servers: [...byKey.values()], filesRead, notes };
+}
+
+export {
+  scrub,
+  scrubDeep,
+  readServerConfigs
+};