open-multi-agent-kit 0.95.0 → 0.95.2

package/dist/core/package-manager.js

@@ -29,6 +29,8 @@ import { spawnProcess, spawnProcessSync } from "../utils/child-process.js";
 import { parseGitUrl } from "../utils/git.js";
 import { canonicalizePath, isLocalPath, markPathIgnoredByCloudSync, resolvePath } from "../utils/paths.js";
 import { isStdoutTakenOver } from "./output-guard.js";
+import { extractNpmPackageTarball } from "./package-archive.js";
+import { readPackageManifest as readPackageManifestFile, } from "./package-manifest.js";
 const NETWORK_TIMEOUT_MS = 10000;
 const UPDATE_CHECK_CONCURRENCY = 4;
 const GIT_UPDATE_CONCURRENCY = 4;
@@ -370,20 +372,10 @@ function collectAutoThemeEntries(dir) {
     }
     return entries;
 }
-function readOmkManifestFile(packageJsonPath) {
-    try {
-        const content = readFileSync(packageJsonPath, "utf-8");
-        const pkg = JSON.parse(content);
-        return pkg.omk ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 function resolveExtensionEntries(dir) {
     const packageJsonPath = join(dir, "package.json");
     if (existsSync(packageJsonPath)) {
-        const manifest = readOmkManifestFile(packageJsonPath);
+        const manifest = readPackageManifestFile(packageJsonPath)?.manifest;
         if (manifest?.extensions?.length) {
             const entries = [];
             for (const extPath of manifest.extensions) {
@@ -729,6 +721,42 @@ export class DefaultPackageManager {
         await this.resolvePackageSources(packageSources, accumulator);
         return this.toResolvedPaths(accumulator);
     }
+    async preparePackageInspection(source) {
+        const parsed = this.parseSource(source);
+        const accumulator = this.createAccumulator();
+        const metadata = { source, scope: "temporary", origin: "package" };
+        let packageRoot;
+        let cleanupRoot;
+        if (parsed.type === "local") {
+            const resolved = this.resolvePathFromBase(parsed.path, this.cwd);
+            if (!existsSync(resolved))
+                throw new Error(`Path does not exist: ${resolved}`);
+            packageRoot = statSync(resolved).isDirectory() ? resolved : dirname(resolved);
+            this.resolveLocalExtensionSource(parsed, accumulator, undefined, metadata, this.cwd);
+        }
+        else {
+            if (isOfflineModeEnabled())
+                throw new Error(`Package is unavailable in offline mode: ${source}`);
+            packageRoot =
+                parsed.type === "npm"
+                    ? await this.downloadNpmForInspection(parsed)
+                    : await this.cloneGitForInspection(parsed);
+            cleanupRoot = dirname(packageRoot);
+            metadata.baseDir = packageRoot;
+            try {
+                this.collectPackageResources(packageRoot, accumulator, undefined, metadata);
+            }
+            catch (error) {
+                rmSync(cleanupRoot, { recursive: true, force: true });
+                throw error;
+            }
+        }
+        return {
+            packageRoot,
+            resources: this.toResolvedPaths(accumulator),
+            ...(cleanupRoot ? { cleanup: () => rmSync(cleanupRoot, { recursive: true, force: true }) } : {}),
+        };
+    }
     listConfiguredPackages() {
         const globalSettings = this.settingsManager.getGlobalSettings();
         const projectSettings = this.settingsManager.getProjectSettings();
@@ -1218,7 +1246,15 @@ export class DefaultPackageManager {
         const raw = stdout.trim();
         if (!raw)
             throw new Error("Empty response from npm view");
-        return JSON.parse(raw);
+        try {
+            const parsed = JSON.parse(raw);
+            if (typeof parsed === "string" && parsed.length > 0)
+                return parsed;
+        }
+        catch {
+            // Fall through to the stable validation error below.
+        }
+        throw new Error("Invalid version response from npm view");
     }
     async gitHasAvailableUpdate(installedPath) {
         if (isOfflineModeEnabled()) {
@@ -1444,14 +1480,15 @@ export class DefaultPackageManager {
         const npmCommand = this.getNpmCommand();
         return this.runCommandSync(npmCommand.command, [...npmCommand.args, ...args]);
     }
-    getNpmInstallArgs(specs, installRoot) {
+    getNpmInstallArgs(specs, installRoot, ignoreScripts = false) {
         const packageManagerName = this.getPackageManagerName();
+        const scriptArgs = ignoreScripts ? ["--ignore-scripts"] : [];
         // Extension packages run inside OMK and resolve OMK APIs through loader aliases/virtual modules.
         // Disable peer dependency resolution for managed installs (npm's --legacy-peer-deps, and
         // equivalent bun/pnpm settings) so package managers do not install or solve host-provided
         // omk-agent-core, omk-ai, and omk-tui peers. Stale auto-installed host peers can otherwise block updates.
         if (packageManagerName === "bun") {
-            return ["install", ...specs, "--cwd", installRoot, "--omit=peer"];
+            return ["install", ...specs, "--cwd", installRoot, "--omit=peer", ...scriptArgs];
         }
         if (packageManagerName === "pnpm") {
             return [
@@ -1462,14 +1499,74 @@ export class DefaultPackageManager {
                 "--config.auto-install-peers=false",
                 "--config.strict-peer-dependencies=false",
                 "--config.strict-dep-builds=false",
+                ...scriptArgs,
             ];
         }
-        return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps"];
+        return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps", ...scriptArgs];
+    }
+    async cloneGitForInspection(source) {
+        if (source.repo.startsWith("-") || /[\u0000-\u001f\u007f]/u.test(source.repo)) {
+            throw new Error("Git inspection URL contains unsupported option or control characters");
+        }
+        if (source.ref && (source.ref.startsWith("-") || /[\u0000-\u001f\u007f]/u.test(source.ref))) {
+            throw new Error("Git inspection ref contains unsupported option or control characters");
+        }
+        const sourceHash = createHash("sha256")
+            .update(source.repo)
+            .update("\0")
+            .update(source.ref ?? "")
+            .digest("hex")
+            .slice(0, 12);
+        const inspectionRoot = this.getTemporaryDir("doctor-git", `${process.pid}-${sourceHash}`);
+        const packageRoot = join(inspectionRoot, "package");
+        rmSync(inspectionRoot, { recursive: true, force: true });
+        mkdirSync(inspectionRoot, { recursive: true });
+        try {
+            await this.runCommand("git", ["clone", "--", source.repo, packageRoot]);
+            if (source.ref)
+                await this.runCommand("git", ["checkout", source.ref], { cwd: packageRoot });
+            return packageRoot;
+        }
+        catch (error) {
+            rmSync(inspectionRoot, { recursive: true, force: true });
+            throw error;
+        }
     }
-    async installNpm(source, scope, temporary) {
+    async downloadNpmForInspection(source) {
+        const sourceHash = createHash("sha256").update(source.spec).digest("hex").slice(0, 12);
+        const inspectionRoot = this.getTemporaryDir("doctor-npm", `${process.pid}-${sourceHash}`);
+        const archiveRoot = join(inspectionRoot, "archive");
+        const packageRoot = join(inspectionRoot, "package");
+        rmSync(inspectionRoot, { recursive: true, force: true });
+        mkdirSync(archiveRoot, { recursive: true });
+        try {
+            const npmCommand = this.getNpmCommand();
+            await this.runCommandCapture(npmCommand.command, [
+                ...npmCommand.args,
+                "pack",
+                "--ignore-scripts",
+                "--json",
+                "--pack-destination",
+                archiveRoot,
+                "--",
+                source.spec,
+            ], { cwd: inspectionRoot, timeoutMs: NETWORK_TIMEOUT_MS });
+            const archives = readdirSync(archiveRoot).filter((entry) => entry.endsWith(".tgz"));
+            if (archives.length !== 1)
+                throw new Error("npm pack did not produce exactly one package archive");
+            extractNpmPackageTarball(join(archiveRoot, archives[0]), packageRoot);
+            rmSync(archiveRoot, { recursive: true, force: true });
+            return packageRoot;
+        }
+        catch (error) {
+            rmSync(inspectionRoot, { recursive: true, force: true });
+            throw error;
+        }
+    }
+    async installNpm(source, scope, temporary, ignoreScripts = false) {
         const installRoot = this.getNpmInstallRoot(scope, temporary);
         this.ensureNpmProject(installRoot);
-        await this.runNpmCommand(this.getNpmInstallArgs([source.spec], installRoot));
+        await this.runNpmCommand(this.getNpmInstallArgs([source.spec], installRoot, ignoreScripts));
     }
     async uninstallNpm(source, scope) {
         const installRoot = this.getNpmInstallRoot(scope, false);
@@ -1482,7 +1579,7 @@ export class DefaultPackageManager {
         }
         await this.runNpmCommand(["uninstall", source.name, "--prefix", installRoot]);
     }
-    async installGit(source, scope) {
+    async installGit(source, scope, installDependencies = true) {
         const targetDir = this.getGitInstallPath(source, scope);
         if (existsSync(targetDir)) {
             if (source.ref) {
@@ -1503,7 +1600,7 @@ export class DefaultPackageManager {
             await this.runCommand("git", ["checkout", source.ref], { cwd: targetDir });
         }
         const packageJsonPath = join(targetDir, "package.json");
-        if (existsSync(packageJsonPath)) {
+        if (installDependencies && existsSync(packageJsonPath)) {
             await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
         }
     }
@@ -1637,11 +1734,26 @@ export class DefaultPackageManager {
             return undefined;
         }
         const output = this.runNpmCommandSync(["list", "-g", "--depth", "0", "--json"]);
-        const entries = JSON.parse(output);
-        for (const entry of entries) {
-            const path = entry.dependencies?.[packageName]?.path;
-            if (path)
-                return path;
+        try {
+            const parsed = JSON.parse(output);
+            if (!Array.isArray(parsed))
+                return undefined;
+            for (const entry of parsed) {
+                if (typeof entry !== "object" || entry === null)
+                    continue;
+                const dependencies = entry.dependencies;
+                if (typeof dependencies !== "object" || dependencies === null)
+                    continue;
+                const dependency = dependencies[packageName];
+                if (typeof dependency !== "object" || dependency === null)
+                    continue;
+                const path = dependency.path;
+                if (typeof path === "string" && path.length > 0)
+                    return path;
+            }
+        }
+        catch {
+            return undefined;
         }
         return undefined;
     }
@@ -1734,8 +1846,9 @@ export class DefaultPackageManager {
             }
             return true;
         }
-        const manifest = this.readOmkManifest(packageRoot);
-        if (manifest) {
+        const manifestResolution = this.readPackageManifest(packageRoot);
+        if (manifestResolution?.key !== null && manifestResolution?.key !== undefined) {
+            const manifest = manifestResolution.manifest ?? {};
             for (const resourceType of RESOURCE_TYPES) {
                 const entries = manifest[resourceType];
                 this.addManifestEntries(entries, packageRoot, resourceType, this.getTargetMap(accumulator, resourceType), metadata);
@@ -1757,10 +1870,11 @@ export class DefaultPackageManager {
         return hasAnyDir;
     }
     collectDefaultResources(packageRoot, resourceType, target, metadata) {
-        const manifest = this.readOmkManifest(packageRoot);
-        const entries = manifest?.[resourceType];
-        if (entries) {
-            this.addManifestEntries(entries, packageRoot, resourceType, target, metadata);
+        const manifestResolution = this.readPackageManifest(packageRoot);
+        if (manifestResolution?.key !== null && manifestResolution?.key !== undefined) {
+            const entries = manifestResolution.manifest?.[resourceType];
+            if (entries)
+                this.addManifestEntries(entries, packageRoot, resourceType, target, metadata);
             return;
         }
         const dir = join(packageRoot, resourceType);
@@ -1794,14 +1908,17 @@ export class DefaultPackageManager {
      * that pass the manifest's own patterns.
      */
     collectManifestFiles(packageRoot, resourceType) {
-        const manifest = this.readOmkManifest(packageRoot);
-        const entries = manifest?.[resourceType];
+        const manifestResolution = this.readPackageManifest(packageRoot);
+        const entries = manifestResolution?.manifest?.[resourceType];
         if (entries && entries.length > 0) {
             const allFiles = this.collectFilesFromManifestEntries(entries, packageRoot, resourceType);
             const manifestPatterns = entries.filter(isOverridePattern);
             const enabledByManifest = manifestPatterns.length > 0 ? applyPatterns(allFiles, manifestPatterns, packageRoot) : new Set(allFiles);
             return { allFiles: Array.from(enabledByManifest), enabledByManifest };
         }
+        if (manifestResolution?.key !== null && manifestResolution?.key !== undefined) {
+            return { allFiles: [], enabledByManifest: new Set() };
+        }
         const conventionDir = join(packageRoot, resourceType);
         if (!existsSync(conventionDir)) {
             return { allFiles: [], enabledByManifest: new Set() };
@@ -1809,19 +1926,35 @@ export class DefaultPackageManager {
         const allFiles = collectResourceFiles(conventionDir, resourceType);
         return { allFiles, enabledByManifest: new Set(allFiles) };
     }
-    readOmkManifest(packageRoot) {
+    readPackageManifest(packageRoot) {
         const packageJsonPath = join(packageRoot, "package.json");
-        if (!existsSync(packageJsonPath)) {
+        if (!existsSync(packageJsonPath))
             return null;
-        }
-        try {
-            const content = readFileSync(packageJsonPath, "utf-8");
-            const pkg = JSON.parse(content);
-            return pkg.omk ?? null;
-        }
-        catch {
+        const resolvedManifest = readPackageManifestFile(packageJsonPath);
+        if (!resolvedManifest)
             return null;
-        }
+        if (resolvedManifest.diagnostics.length > 0) {
+            throw new Error(`Invalid package manifest: ${resolvedManifest.diagnostics.map((diagnostic) => `${diagnostic.path}: ${diagnostic.message}`).join("; ")}`);
+        }
+        if (!resolvedManifest.manifest || resolvedManifest.key !== "pi")
+            return resolvedManifest;
+        const extensions = resolvedManifest.manifest.extensions?.map((entry) => {
+            if (hasGlobPattern(entry) || isOverridePattern(entry))
+                return entry;
+            const candidate = resolve(packageRoot, entry);
+            if (!existsSync(candidate) || !statSync(candidate).isDirectory())
+                return entry;
+            for (const indexName of ["index.ts", "index.js", "index.mjs", "index.cjs"]) {
+                const indexPath = join(candidate, indexName);
+                if (existsSync(indexPath))
+                    return indexPath;
+            }
+            return entry;
+        });
+        return {
+            ...resolvedManifest,
+            manifest: { ...resolvedManifest.manifest, ...(extensions ? { extensions } : {}) },
+        };
     }
     addManifestEntries(entries, root, resourceType, target, metadata) {
         if (!entries)