memorydetective 1.8.0 → 1.9.0

package/dist/runtime/redact.js

@@ -0,0 +1,146 @@
+/**
+ * Redact sensitive substrings from tool responses before they leave the
+ * MCP boundary.
+ *
+ * Tool outputs frequently include filesystem paths (with the user's home
+ * directory in them), token-shaped strings, hostnames, IP addresses, and
+ * bundle identifiers. None of those are useful to an AI agent reasoning
+ * about an iOS leak, and all of them are footguns when the output ends
+ * up in a Slack message, a PR comment, or a screenshot. This module
+ * scrubs them at the formatter boundary so by-default outputs are safe
+ * to share without manual sweeping.
+ *
+ * Three modes are selected via the `MEMORYDETECTIVE_REDACTION` env var:
+ *
+ * - `balanced` (default): home-directory absolute paths become `~/...`,
+ *   common secret-shaped tokens (AWS keys, GitHub PATs, Stripe secrets,
+ *   Slack tokens, Bearer auth) are masked. Hostnames, IPs, bundle IDs,
+ *   process names, and class names are preserved (they are usually
+ *   useful for debugging).
+ *
+ * - `strict`: everything in `balanced`, plus hostnames, IPv4 addresses,
+ *   and bundle identifiers. Use when the output is going to be pasted
+ *   into a public artifact (issue tracker, blog post, social) and you
+ *   want a wide safety margin.
+ *
+ * - `off`: no redaction. Default behavior is preserved for legacy
+ *   workflows and for local-only debugging where the noise is genuinely
+ *   helpful. The startup banner logs the active mode so an operator
+ *   running `off` knows the responses are unfiltered.
+ *
+ * Redaction is structural: the value passed in keeps its shape (same
+ * object keys, same array lengths, same scalar types), only string
+ * leaves are rewritten. Numbers, booleans, null/undefined, and dates
+ * pass through unchanged.
+ */
+import os from "node:os";
+const TOKEN_PATTERNS = [
+    // AWS access key id (AKIA + 16 chars)
+    { re: /\bAKIA[0-9A-Z]{16}\b/g, keepPrefix: 4 },
+    // GitHub classic PAT
+    { re: /\bghp_[A-Za-z0-9]{36,}\b/g, keepPrefix: 4 },
+    // GitHub fine-grained PAT
+    { re: /\bgithub_pat_[A-Za-z0-9_]+\b/g, keepPrefix: 11 },
+    // Stripe live + test secret
+    { re: /\bsk_(?:live|test)_[A-Za-z0-9]{20,}\b/g, keepPrefix: 8 },
+    // Slack tokens
+    { re: /\bxox[bpoasr]-[A-Za-z0-9-]+\b/g, keepPrefix: 5 },
+    // Bearer auth tokens
+    { re: /\bBearer\s+[A-Za-z0-9._\-]{20,}\b/gi, keepPrefix: 7 },
+];
+// Hostnames: 1+ labels followed by a TLD (2+ alpha chars). Excludes the
+// .swift / .ts / .js / .json / .trace / .memgraph "extensions" we see in
+// paths, since those would false-positive otherwise.
+const HOST_PATTERN = /\b(?!(?:[A-Za-z0-9-]+)\.(?:swift|ts|js|json|trace|memgraph|md|yaml|yml|html|png|jpg|jpeg|gif|m4v|mp4|mov|css|sh|py|rb|go|rs|c|cpp|h|hpp|m|mm|plist|xcframework|xcconfig|xcassets)\b)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}\b/gi;
+const IP_PATTERN = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
+const BUNDLE_ID_PATTERN = /\bcom\.[a-z0-9_-]+(?:\.[a-z0-9_-]+)+\b/gi;
+/**
+ * Pure: read the active redaction mode from an env-like object.
+ * Defaults to `balanced` when unset or set to an unrecognized value.
+ *
+ * Threaded as a parameter for testability; production callers omit it
+ * and get `process.env`.
+ */
+export function getRedactionMode(env = process.env) {
+    const raw = (env.MEMORYDETECTIVE_REDACTION ?? "balanced").toLowerCase();
+    if (raw === "off" || raw === "strict" || raw === "balanced") {
+        return raw;
+    }
+    return "balanced";
+}
+/**
+ * Pure: scrub a single string per the active mode. `off` returns the
+ * input unchanged; the other modes apply the rules described in the
+ * module doc.
+ *
+ * Threaded `homeDir` for testability so unit tests can pass a fake
+ * `/Users/test/` without depending on the real home directory.
+ */
+export function redactString(input, mode, homeDir = os.homedir()) {
+    if (mode === "off")
+        return input;
+    let result = input;
+    // Home dir collapse first so subsequent host/IP rules don't mistakenly
+    // grab parts of paths.
+    if (homeDir && homeDir.length > 1 && result.includes(homeDir)) {
+        result = result.split(homeDir).join("~");
+    }
+    // Always mask token-shaped secrets, even in `balanced`.
+    for (const { re, keepPrefix } of TOKEN_PATTERNS) {
+        result = result.replace(re, (match) => match.slice(0, keepPrefix) + "***REDACTED***");
+    }
+    if (mode === "strict") {
+        result = result.replace(BUNDLE_ID_PATTERN, "***BUNDLE_ID***");
+        result = result.replace(IP_PATTERN, "***IP***");
+        result = result.replace(HOST_PATTERN, "***HOST***");
+    }
+    return result;
+}
+/**
+ * Pure: recursively redact strings inside an arbitrary JSON-shaped
+ * value. Object key names are preserved unchanged (they are part of
+ * the schema, not data); only string VALUES and string ARRAY items
+ * are scrubbed.
+ *
+ * Non-string scalars (number, boolean, null) pass through. Functions,
+ * symbols, and other non-JSON values are returned as-is.
+ */
+export function redact(value, mode, homeDir = os.homedir()) {
+    if (mode === "off")
+        return value;
+    if (value == null)
+        return value;
+    if (typeof value === "string")
+        return redactString(value, mode, homeDir);
+    if (typeof value === "number" || typeof value === "boolean")
+        return value;
+    if (Array.isArray(value)) {
+        return value.map((v) => redact(v, mode, homeDir));
+    }
+    if (typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = redact(v, mode, homeDir);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Side-effecting: log the active redaction mode once per server
+ * startup so an operator running with `off` knows the responses
+ * are unfiltered.
+ */
+let advisoryLogged = false;
+export function maybeLogRedactionModeOnce(mode, writer = (line) => process.stderr.write(line)) {
+    if (advisoryLogged)
+        return;
+    writer(`[memorydetective] redaction mode: ${mode}. ` +
+        `Set MEMORYDETECTIVE_REDACTION to balanced (default), strict, or off.\n`);
+    advisoryLogged = true;
+}
+/** Test-only: reset the once-per-instance log flag. */
+export function resetRedactionAdvisoryFlagForTests() {
+    advisoryLogged = false;
+}
+//# sourceMappingURL=redact.js.map

package/dist/runtime/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/runtime/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAIzB,MAAM,cAAc,GAA8C;IAChE,sCAAsC;IACtC,EAAE,EAAE,EAAE,uBAAuB,EAAE,UAAU,EAAE,CAAC,EAAE;IAC9C,qBAAqB;IACrB,EAAE,EAAE,EAAE,2BAA2B,EAAE,UAAU,EAAE,CAAC,EAAE;IAClD,0BAA0B;IAC1B,EAAE,EAAE,EAAE,+BAA+B,EAAE,UAAU,EAAE,EAAE,EAAE;IACvD,4BAA4B;IAC5B,EAAE,EAAE,EAAE,wCAAwC,EAAE,UAAU,EAAE,CAAC,EAAE;IAC/D,eAAe;IACf,EAAE,EAAE,EAAE,gCAAgC,EAAE,UAAU,EAAE,CAAC,EAAE;IACvD,qBAAqB;IACrB,EAAE,EAAE,EAAE,qCAAqC,EAAE,UAAU,EAAE,CAAC,EAAE;CAC7D,CAAC;AAEF,wEAAwE;AACxE,yEAAyE;AACzE,qDAAqD;AACrD,MAAM,YAAY,GAChB,8OAA8O,CAAC;AAEjP,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,yBAAyB,IAAI,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,IAAmB,EACnB,UAAkB,EAAE,CAAC,OAAO,EAAE;IAE9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,uEAAuE;IACvE,uBAAuB;IACvB,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,wDAAwD;IACxD,KAAK,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,cAAc,EAAE,CAAC;QAChD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CACpB,KAAc,EACd,IAAmB,EACnB,UAAkB,EAAE,CAAC,OAAO,EAAE;IAE9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,MAAM,UAAU,yBAAyB,CACvC,IAAmB,EACnB,SAAiC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IAErE,IAAI,cAAc;QAAE,OAAO;IAC3B,MAAM,CACJ,qCAAqC,IAAI,IAAI;QAC3C,wEAAwE,CAC3E,CAAC;IACF,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kCAAkC;IAChD,cAAc,GAAG,KAAK,CAAC;AACzB,CAAC"}

package/dist/runtime/responseFormatter.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Shared response formatter for MCP tool outputs.
+ *
+ * Tools can declare `outputFormat?: "markdown" | "json" | "both"` (defaults to
+ * `"json"`, preserving v1.8 behavior). When the caller asks for a different
+ * shape, the registration wrapper in `src/index.ts` calls
+ * {@link formatMcpResponse} to produce the actual response content.
+ *
+ * Two audiences are served at once:
+ *   - **AI agents** (the typical caller) want raw JSON they can parse and chain
+ *     into the next call without re-reasoning.
+ *   - **Humans reading the same response** (the typical second audience: the
+ *     dev pasting the result into a PR comment, a Slack thread, or a Jira
+ *     ticket) want a markdown view that highlights the key fields.
+ *
+ * `outputFormat: "both"` returns BOTH content items in a single response, so a
+ * client can display the markdown to the user AND parse the JSON for the
+ * agent loop without an extra round-trip.
+ */
+import { z } from "zod";
+export declare const outputFormatField: z.ZodOptional<z.ZodEnum<["markdown", "json", "both"]>>;
+export type OutputFormat = z.infer<typeof outputFormatField>;
+export interface McpContentItem {
+    type: "text";
+    text: string;
+}
+/**
+ * Shape of the MCP tool response. Matches the SDK's expected type
+ * (which has an open index signature for arbitrary extension fields like
+ * `_meta`); we model it explicitly here so the formatter's return type
+ * can flow through `server.registerTool` without a cast.
+ */
+export interface McpResponse {
+    content: McpContentItem[];
+    [key: string]: unknown;
+}
+/**
+ * Pure: shape the MCP response based on the caller's `outputFormat`.
+ *
+ * For `json` and `both`, the JSON is `JSON.stringify(result, null, 2)`. For
+ * `markdown` and `both`, the markdown is rendered via {@link renderAsMarkdown}.
+ */
+export declare function formatMcpResponse(result: unknown, toolName: string, format: OutputFormat | undefined): McpResponse;
+/**
+ * Pure: render an arbitrary JSON-shaped value as markdown.
+ *
+ * The rendering is intentionally generic: it does not have per-tool
+ * templates. A `# Tool name` header, a `## Key` for each top-level field, and
+ * smart formatting for arrays of objects (tables when the rows share a
+ * schema) and scalars. Per-tool overrides can land in v1.9.1+ if any
+ * specific tool's output deserves a more curated view.
+ *
+ * Exposed for tests.
+ */
+export declare function renderAsMarkdown(value: unknown, toolName: string): string;

package/dist/runtime/responseFormatter.js

@@ -0,0 +1,200 @@
+/**
+ * Shared response formatter for MCP tool outputs.
+ *
+ * Tools can declare `outputFormat?: "markdown" | "json" | "both"` (defaults to
+ * `"json"`, preserving v1.8 behavior). When the caller asks for a different
+ * shape, the registration wrapper in `src/index.ts` calls
+ * {@link formatMcpResponse} to produce the actual response content.
+ *
+ * Two audiences are served at once:
+ *   - **AI agents** (the typical caller) want raw JSON they can parse and chain
+ *     into the next call without re-reasoning.
+ *   - **Humans reading the same response** (the typical second audience: the
+ *     dev pasting the result into a PR comment, a Slack thread, or a Jira
+ *     ticket) want a markdown view that highlights the key fields.
+ *
+ * `outputFormat: "both"` returns BOTH content items in a single response, so a
+ * client can display the markdown to the user AND parse the JSON for the
+ * agent loop without an extra round-trip.
+ */
+import { z } from "zod";
+import { getRedactionMode, redact } from "./redact.js";
+export const outputFormatField = z
+    .enum(["markdown", "json", "both"])
+    .optional()
+    .describe("Response format. Omitted or `json` (default, preserves v1.8 behavior) returns JSON.stringify of the result. `markdown` renders a human-readable view of the same data. `both` returns both content items in one response, so a client can display markdown to the user and parse JSON for the agent loop without a second call.");
+/**
+ * Pure: shape the MCP response based on the caller's `outputFormat`.
+ *
+ * For `json` and `both`, the JSON is `JSON.stringify(result, null, 2)`. For
+ * `markdown` and `both`, the markdown is rendered via {@link renderAsMarkdown}.
+ */
+export function formatMcpResponse(result, toolName, format) {
+    const mode = format ?? "json";
+    // Redaction happens at the structured-value level so both the JSON
+    // and the markdown views are scrubbed consistently. `off` short-circuits
+    // and returns the input unchanged; `balanced` (default) masks home-dir
+    // paths and common secret-shaped tokens; `strict` also masks hostnames,
+    // IPs, and bundle identifiers. See src/runtime/redact.ts.
+    const redacted = redact(result, getRedactionMode());
+    const json = JSON.stringify(redacted, null, 2);
+    if (mode === "json") {
+        return { content: [{ type: "text", text: json }] };
+    }
+    const markdown = renderAsMarkdown(redacted, toolName);
+    if (mode === "markdown") {
+        return { content: [{ type: "text", text: markdown }] };
+    }
+    // "both": markdown first so a UI that picks content[0] gets the readable
+    // view, then JSON so an agent looking for the structured data finds it
+    // without having to parse the markdown.
+    return {
+        content: [
+            { type: "text", text: markdown },
+            { type: "text", text: json },
+        ],
+    };
+}
+/**
+ * Pure: render an arbitrary JSON-shaped value as markdown.
+ *
+ * The rendering is intentionally generic: it does not have per-tool
+ * templates. A `# Tool name` header, a `## Key` for each top-level field, and
+ * smart formatting for arrays of objects (tables when the rows share a
+ * schema) and scalars. Per-tool overrides can land in v1.9.1+ if any
+ * specific tool's output deserves a more curated view.
+ *
+ * Exposed for tests.
+ */
+export function renderAsMarkdown(value, toolName) {
+    const lines = [`# ${toolName}`, ""];
+    if (value == null || typeof value !== "object") {
+        lines.push(formatScalar(value));
+        return lines.join("\n");
+    }
+    const obj = value;
+    for (const [key, val] of Object.entries(obj)) {
+        lines.push(`## ${key}`);
+        lines.push("");
+        lines.push(formatValue(val, 0));
+        lines.push("");
+    }
+    return lines.join("\n").trim() + "\n";
+}
+function formatValue(value, depth) {
+    if (value == null)
+        return "_(null)_";
+    if (typeof value === "string")
+        return value || "_(empty)_";
+    if (typeof value === "number" || typeof value === "boolean")
+        return formatScalar(value);
+    if (Array.isArray(value))
+        return formatArray(value, depth);
+    if (typeof value === "object")
+        return formatObject(value, depth);
+    return String(value);
+}
+function formatArray(arr, depth) {
+    if (arr.length === 0)
+        return "_(empty array)_";
+    // Table if all entries are objects with a shared key set.
+    if (arr.length > 0 &&
+        arr.every((e) => e != null && typeof e === "object" && !Array.isArray(e))) {
+        const objects = arr;
+        const cols = collectCommonKeys(objects);
+        if (cols.length > 0 && cols.length <= 8) {
+            const header = `| ${cols.join(" | ")} |`;
+            const sep = `| ${cols.map(() => "---").join(" | ")} |`;
+            const rows = objects.slice(0, 50).map((o) => {
+                const cells = cols.map((c) => formatCell(o[c]));
+                return `| ${cells.join(" | ")} |`;
+            });
+            const tail = objects.length > 50 ? `\n_(${objects.length - 50} more rows omitted)_` : "";
+            return [header, sep, ...rows].join("\n") + tail;
+        }
+    }
+    // Otherwise bullet list of scalars / mixed.
+    return arr
+        .slice(0, 50)
+        .map((e) => `- ${formatCell(e)}`)
+        .join("\n");
+}
+function formatObject(obj, depth) {
+    const entries = Object.entries(obj);
+    if (entries.length === 0)
+        return "_(empty object)_";
+    if (depth >= 2) {
+        // Deeply nested: collapse to inline JSON to keep the markdown tidy.
+        return "```json\n" + JSON.stringify(obj, null, 2) + "\n```";
+    }
+    return entries
+        .map(([k, v]) => `- **${k}**: ${formatInline(v, depth + 1)}`)
+        .join("\n");
+}
+function formatInline(value, depth) {
+    if (value == null)
+        return "_(null)_";
+    if (typeof value === "string")
+        return value || "_(empty)_";
+    if (typeof value === "number" || typeof value === "boolean")
+        return formatScalar(value);
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return "_(empty array)_";
+        if (value.length <= 5 && value.every((e) => typeof e !== "object" || e == null)) {
+            return `[${value.map((e) => formatCell(e)).join(", ")}]`;
+        }
+        return `\n${formatArray(value, depth)}`;
+    }
+    if (typeof value === "object") {
+        return `\n${formatObject(value, depth)}`;
+    }
+    return String(value);
+}
+function formatScalar(value) {
+    if (value == null)
+        return "_(null)_";
+    if (typeof value === "boolean")
+        return value ? "`true`" : "`false`";
+    if (typeof value === "number")
+        return `\`${value}\``;
+    return String(value);
+}
+function formatCell(value) {
+    if (value == null)
+        return "_";
+    if (typeof value === "string") {
+        // Escape pipes for table safety, truncate long strings.
+        const escaped = value.replace(/\|/g, "\\|");
+        return escaped.length > 80 ? escaped.slice(0, 77) + "..." : escaped;
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+        return formatScalar(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.length}]`;
+    if (typeof value === "object") {
+        // Compact inline JSON, truncated.
+        const s = JSON.stringify(value);
+        return s.length > 60 ? s.slice(0, 57) + "..." : s;
+    }
+    return String(value);
+}
+function collectCommonKeys(objects) {
+    // Use the keys of the FIRST object as the column set, filtered to those
+    // present in at least half of the rows. Keeps the table compact when rows
+    // have optional fields.
+    if (objects.length === 0)
+        return [];
+    const firstKeys = Object.keys(objects[0]);
+    const threshold = Math.ceil(objects.length / 2);
+    return firstKeys.filter((k) => {
+        let hits = 0;
+        for (const o of objects) {
+            if (Object.prototype.hasOwnProperty.call(o, k))
+                hits += 1;
+        }
+        return hits >= threshold;
+    });
+}
+//# sourceMappingURL=responseFormatter.js.map

package/dist/runtime/responseFormatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responseFormatter.js","sourceRoot":"","sources":["../../src/runtime/responseFormatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,QAAQ,EAAE;KACV,QAAQ,CACP,iUAAiU,CAClU,CAAC;AAoBJ;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAe,EACf,QAAgB,EAChB,MAAgC;IAEhC,MAAM,IAAI,GAAiB,MAAM,IAAI,MAAM,CAAC;IAC5C,mEAAmE;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,wCAAwC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAa,CAAC,KAAK,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,IAAI,WAAW,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACzD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAgC,EAAE,KAAK,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,GAAc,EAAE,KAAa;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC/C,0DAA0D;IAC1D,IACE,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,KAAK,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAC/D,EACD,CAAC;QACD,MAAM,OAAO,GAAG,GAAgC,CAAC;QACjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChD,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAClD,CAAC;IACH,CAAC;IACD,4CAA4C;IAC5C,OAAO,GAAG;SACP,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACpD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,oEAAoE;QACpE,OAAO,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,IAAI,WAAW,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACzD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YAChF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3D,CAAC;QACD,OAAO,KAAK,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,YAAY,CAAC,KAAgC,EAAE,KAAK,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,wDAAwD;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,kCAAkC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAkC;IAC3D,wEAAwE;IACxE,0EAA0E;IAC1E,wBAAwB;IACxB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/securityFlags.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Security and resource-limit flags read from the environment.
+ *
+ * These flags exist to make memorydetective safer to install in shared
+ * setups (CI runners, teammate's machine, automation pipelines) by
+ * gating operations that can execute arbitrary local programs, bound
+ * recording durations so an unattended agent does not pile up
+ * multi-GB traces, and centralize where `.trace` bundles get written
+ * by default so cleanup is predictable.
+ *
+ * The flags are read from `process.env` lazily (each tool call calls
+ * `getSecurityFlags()` fresh). Defaults preserve the v1.8 behavior
+ * for every existing caller; the new behavior is opt-in via the env
+ * var.
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH=1`: gates
+ *   `bootAndLaunchForLeakInvestigation`. Without it, the tool returns
+ *   `ok: false` with an explanation. With it, the tool runs normally.
+ *   Default is OFF because that tool executes `xcodebuild` and
+ *   `xcrun simctl launch`, which are "run arbitrary local program"
+ *   in a trusted-input sense.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS=300` (default 300): caps
+ *   `durationSec` for `recordTimeProfile`. A caller asking for a
+ *   recording longer than this gets a clear error rather than the
+ *   tool silently agreeing to a 10-minute trace.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT=<path>` (default
+ *   `~/Library/Application Support/memorydetective/traces`):
+ *   directory where `.trace` bundles are written when the caller
+ *   provides a relative `output` path. Absolute `output` paths
+ *   bypass this default, preserving existing behavior. Also used by
+ *   the upcoming `cleanup_traces` tool as the default scan path.
+ */
+export interface SecurityFlags {
+    allowLaunch: boolean;
+    maxRecordingSeconds: number;
+    traceRoot: string;
+}
+export declare const DEFAULT_MAX_RECORDING_SECONDS = 300;
+export declare function defaultTraceRoot(homeDir?: string): string;
+/**
+ * Pure: read the security flags from an env-like object. Threaded as
+ * a parameter for testability; production callers omit it and get
+ * `process.env`.
+ *
+ * Parse rules:
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH` is truthy only when the value is
+ *   literally `"1"`. Any other value (including `"true"` and `"yes"`)
+ *   leaves it off, to keep the gate explicit.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS` accepts a positive
+ *   integer string; anything else (missing, zero, negative, NaN)
+ *   falls back to the default 300. The cap is bounded at 3600s (1h)
+ *   to prevent obviously-bad configs from disabling the gate via
+ *   absurd values.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT` accepts any non-empty string; empty
+ *   or missing values fall back to the default location.
+ */
+export declare function getSecurityFlags(env?: Readonly<Record<string, string | undefined>>, homeDir?: string): SecurityFlags;
+/**
+ * Build the error message returned when `bootAndLaunchForLeakInvestigation`
+ * is invoked without `MEMORYDETECTIVE_ALLOW_LAUNCH=1`. Exposed as a
+ * named export so the same wording is used everywhere (and so the
+ * unit tests can assert on it).
+ */
+export declare const ALLOW_LAUNCH_REQUIRED_MESSAGE = "bootAndLaunchForLeakInvestigation requires MEMORYDETECTIVE_ALLOW_LAUNCH=1 in the environment, because this tool executes xcodebuild + xcrun simctl launch against the host. Set the env var only when you trust the inputs (workspace/project paths and bundle ids) the agent will pass.";
+/**
+ * Build the error message returned when `recordTimeProfile` is asked
+ * for a duration above the cap.
+ */
+export declare function maxRecordingExceededMessage(requested: number, cap: number): string;

package/dist/runtime/securityFlags.js

@@ -0,0 +1,90 @@
+/**
+ * Security and resource-limit flags read from the environment.
+ *
+ * These flags exist to make memorydetective safer to install in shared
+ * setups (CI runners, teammate's machine, automation pipelines) by
+ * gating operations that can execute arbitrary local programs, bound
+ * recording durations so an unattended agent does not pile up
+ * multi-GB traces, and centralize where `.trace` bundles get written
+ * by default so cleanup is predictable.
+ *
+ * The flags are read from `process.env` lazily (each tool call calls
+ * `getSecurityFlags()` fresh). Defaults preserve the v1.8 behavior
+ * for every existing caller; the new behavior is opt-in via the env
+ * var.
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH=1`: gates
+ *   `bootAndLaunchForLeakInvestigation`. Without it, the tool returns
+ *   `ok: false` with an explanation. With it, the tool runs normally.
+ *   Default is OFF because that tool executes `xcodebuild` and
+ *   `xcrun simctl launch`, which are "run arbitrary local program"
+ *   in a trusted-input sense.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS=300` (default 300): caps
+ *   `durationSec` for `recordTimeProfile`. A caller asking for a
+ *   recording longer than this gets a clear error rather than the
+ *   tool silently agreeing to a 10-minute trace.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT=<path>` (default
+ *   `~/Library/Application Support/memorydetective/traces`):
+ *   directory where `.trace` bundles are written when the caller
+ *   provides a relative `output` path. Absolute `output` paths
+ *   bypass this default, preserving existing behavior. Also used by
+ *   the upcoming `cleanup_traces` tool as the default scan path.
+ */
+import os from "node:os";
+import { join as joinPath } from "node:path";
+export const DEFAULT_MAX_RECORDING_SECONDS = 300;
+export function defaultTraceRoot(homeDir = os.homedir()) {
+    return joinPath(homeDir, "Library", "Application Support", "memorydetective", "traces");
+}
+/**
+ * Pure: read the security flags from an env-like object. Threaded as
+ * a parameter for testability; production callers omit it and get
+ * `process.env`.
+ *
+ * Parse rules:
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH` is truthy only when the value is
+ *   literally `"1"`. Any other value (including `"true"` and `"yes"`)
+ *   leaves it off, to keep the gate explicit.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS` accepts a positive
+ *   integer string; anything else (missing, zero, negative, NaN)
+ *   falls back to the default 300. The cap is bounded at 3600s (1h)
+ *   to prevent obviously-bad configs from disabling the gate via
+ *   absurd values.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT` accepts any non-empty string; empty
+ *   or missing values fall back to the default location.
+ */
+export function getSecurityFlags(env = process.env, homeDir = os.homedir()) {
+    const allowLaunch = env.MEMORYDETECTIVE_ALLOW_LAUNCH === "1";
+    const rawMax = env.MEMORYDETECTIVE_MAX_RECORDING_SECONDS;
+    let maxRecordingSeconds = DEFAULT_MAX_RECORDING_SECONDS;
+    if (rawMax != null && rawMax !== "") {
+        const parsed = Number.parseInt(rawMax, 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            maxRecordingSeconds = Math.min(parsed, 3600);
+        }
+    }
+    const rawRoot = env.MEMORYDETECTIVE_TRACE_ROOT;
+    const traceRoot = rawRoot != null && rawRoot.length > 0 ? rawRoot : defaultTraceRoot(homeDir);
+    return { allowLaunch, maxRecordingSeconds, traceRoot };
+}
+/**
+ * Build the error message returned when `bootAndLaunchForLeakInvestigation`
+ * is invoked without `MEMORYDETECTIVE_ALLOW_LAUNCH=1`. Exposed as a
+ * named export so the same wording is used everywhere (and so the
+ * unit tests can assert on it).
+ */
+export const ALLOW_LAUNCH_REQUIRED_MESSAGE = "bootAndLaunchForLeakInvestigation requires MEMORYDETECTIVE_ALLOW_LAUNCH=1 in the environment, because this tool executes xcodebuild + xcrun simctl launch against the host. Set the env var only when you trust the inputs (workspace/project paths and bundle ids) the agent will pass.";
+/**
+ * Build the error message returned when `recordTimeProfile` is asked
+ * for a duration above the cap.
+ */
+export function maxRecordingExceededMessage(requested, cap) {
+    return (`recordTimeProfile durationSec=${requested} exceeds the configured cap of ${cap}s ` +
+        `(MEMORYDETECTIVE_MAX_RECORDING_SECONDS). Lower durationSec, or raise the cap with the env var.`);
+}
+//# sourceMappingURL=securityFlags.js.map

package/dist/runtime/securityFlags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityFlags.js","sourceRoot":"","sources":["../../src/runtime/securityFlags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAQ7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,CAAC,OAAO,EAAE;IAC7D,OAAO,QAAQ,CACb,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoD,OAAO,CAAC,GAAG,EAC/D,UAAkB,EAAE,CAAC,OAAO,EAAE;IAE9B,MAAM,WAAW,GAAG,GAAG,CAAC,4BAA4B,KAAK,GAAG,CAAC;IAE7D,MAAM,MAAM,GAAG,GAAG,CAAC,qCAAqC,CAAC;IACzD,IAAI,mBAAmB,GAAG,6BAA6B,CAAC;IACxD,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/C,MAAM,SAAS,GACb,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE9E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,0RAA0R,CAAC;AAE7R;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,GAAW;IAEX,OAAO,CACL,iCAAiC,SAAS,kCAAkC,GAAG,IAAI;QACnF,gGAAgG,CACjG,CAAC;AACJ,CAAC"}

package/dist/runtime/staticAnalysisHints.js

@@ -203,7 +203,20 @@ const HINTS = {
     "swiftdata.modelcontext-actor-cycle": {
         rule: null,
         url: "https://developer.apple.com/forums/thread/748042",
-        explanation: "No static rule. The cycle is between Apple-provided types (`Actor` / `DefaultSerialModelExecutor` / `ModelContext`) — SwiftLint can't reason about Apple-framework retain semantics. Apple fixed the framework-level shape in iOS 18 beta 1 (FB13844786). Until your minimum target is iOS 18+, the user-code shape persists.",
+        explanation: "No static rule. The cycle is between Apple-provided types (`Actor` / `DefaultSerialModelExecutor` / `ModelContext`); SwiftLint can't reason about Apple-framework retain semantics. Apple fixed the framework-level shape in iOS 18 beta 1 (FB13844786). Until your minimum target is iOS 18+, the user-code shape persists.",
+    },
+    // ─────────────────────────────────────────────────────────────────────────
+    // v1.9 catalog (DebugSwift borrow)
+    // ─────────────────────────────────────────────────────────────────────────
+    "uikit.viewcontroller-retained-after-pop": {
+        rule: "weak_delegate",
+        url: "https://realm.github.io/SwiftLint/weak_delegate.html",
+        explanation: "`weak_delegate` catches the most common shape (delegate property without `weak`), and the project-wide `weak_self` rule covers closure-captured self in `viewDidLoad`/`viewWillAppear`. Neither catches Combine sinks stored on the VC nor KVO observations that never `invalidate()`; for those you need the offline catalog match.",
+    },
+    "swiftui.observable-write-on-every-render": {
+        rule: null,
+        url: "https://developer.apple.com/documentation/swiftui/managing-model-data-in-your-app",
+        explanation: "No static rule. SwiftLint cannot prove that an `@Observable` mutation happens inside a `View.body` chain (it would need to reason about View body resolution, which is compiler-internal). The cycle catalog catches the heap shape it leaves behind; the trace-side perf signal (excessive body re-evaluations on the same view) is a parallel detector.",
     },
 };
 /** Returns the static-analysis hint for a given pattern, or null if unknown. */

package/dist/runtime/staticAnalysisHints.js.map

@@ -1 +1 @@
-{"version":3,"file":"staticAnalysisHints.js","sourceRoot":"","sources":["../../src/runtime/staticAnalysisHints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH;;;GAGG;AACH,MAAM,KAAK,GAAuC;IAChD,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,8BAA8B,EAAE;QAC9B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8KAA8K;KACjL;IACD,mCAAmC,EAAE;QACnC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2JAA2J;KAC9J;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,+CAA+C;QACpD,WAAW,EACT,uLAAuL;KAC1L;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2NAA2N;KAC9N;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,yQAAyQ;KAC5Q;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wKAAwK;KAC3K;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,+BAA+B,EAAE;QAC/B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,gKAAgK;KACnK;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yGAAyG;KAC5G;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,oKAAoK;KACvK;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iKAAiK;KACpK;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,6HAA6H;KAChI;IACD,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,sDAAsD;QAC3D,WAAW,EACT,8HAA8H;KACjI;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mJAAmJ;KACtJ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kHAAkH;KACrH;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,qLAAqL;KACxL;IACD,2CAA2C,EAAE;QAC3C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kIAAkI;KACrI;IACD,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,wJAAwJ;KAC3J;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,+OAA+O;KAClP;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,sMAAsM;KACzM;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wGAAwG;KAC3G;IAED,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kPAAkP;KACrP;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kNAAkN;KACrN;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8HAA8H;KACjI;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iLAAiL;KACpL;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,uGAAuG;QAC5G,WAAW,EACT,8OAA8O;KACjP;IACD,oDAAoD,EAAE;QACpD,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iGAAiG;QACtG,WAAW,EACT,yLAAyL;KAC5L;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IACD,sCAAsC,EAAE;QACtC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,0MAA0M;KAC7M;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,+TAA+T;KAClU;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,SAAiB;IAEjB,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"staticAnalysisHints.js","sourceRoot":"","sources":["../../src/runtime/staticAnalysisHints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH;;;GAGG;AACH,MAAM,KAAK,GAAuC;IAChD,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,8BAA8B,EAAE;QAC9B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8KAA8K;KACjL;IACD,mCAAmC,EAAE;QACnC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2JAA2J;KAC9J;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,+CAA+C;QACpD,WAAW,EACT,uLAAuL;KAC1L;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2NAA2N;KAC9N;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,yQAAyQ;KAC5Q;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wKAAwK;KAC3K;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,+BAA+B,EAAE;QAC/B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,gKAAgK;KACnK;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yGAAyG;KAC5G;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,oKAAoK;KACvK;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iKAAiK;KACpK;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,6HAA6H;KAChI;IACD,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,sDAAsD;QAC3D,WAAW,EACT,8HAA8H;KACjI;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mJAAmJ;KACtJ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kHAAkH;KACrH;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,qLAAqL;KACxL;IACD,2CAA2C,EAAE;QAC3C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kIAAkI;KACrI;IACD,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,wJAAwJ;KAC3J;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,+OAA+O;KAClP;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,sMAAsM;KACzM;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wGAAwG;KAC3G;IAED,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kPAAkP;KACrP;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kNAAkN;KACrN;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8HAA8H;KACjI;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iLAAiL;KACpL;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,uGAAuG;QAC5G,WAAW,EACT,8OAA8O;KACjP;IACD,oDAAoD,EAAE;QACpD,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iGAAiG;QACtG,WAAW,EACT,yLAAyL;KAC5L;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IACD,sCAAsC,EAAE;QACtC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,0MAA0M;KAC7M;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,8TAA8T;KACjU;IAED,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAE5E,yCAAyC,EAAE;QACzC,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,sDAAsD;QAC3D,WAAW,EACT,sUAAsU;KACzU;IAED,0CAA0C,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,mFAAmF;QACxF,WAAW,EACT,2VAA2V;KAC9V;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,SAAiB;IAEjB,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}