poe-code 3.0.306 → 3.0.308

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.306",
+  "version": "3.0.308",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/process-launcher/dist/health/health-check.js

@@ -2,8 +2,10 @@ import net from "node:net";
 export async function waitForReady(check, options) {
     assertValidTimeout(options.timeoutMs, "readiness timeout");
     if (check.kind === "log-pattern") {
+        assertValidLogPattern(check.pattern);
         return waitForLogPattern(check.pattern, options);
     }
+    assertValidTcpPort(check.port);
     return waitForTcp(check, options);
 }
 function waitForLogPattern(pattern, options) {
@@ -124,3 +126,13 @@ function assertValidTimeout(value, description) {
         throw new Error(`Invalid ${description}: ${value}`);
     }
 }
+function assertValidLogPattern(value) {
+    if (value.trim().length === 0) {
+        throw new Error("Invalid log pattern readiness check: pattern must not be blank.");
+    }
+}
+function assertValidTcpPort(value) {
+    if (!Number.isSafeInteger(value) || value <= 0 || value > 65_535) {
+        throw new Error(`Invalid TCP readiness port: ${value}`);
+    }
+}

package/packages/process-launcher/dist/launcher.js

@@ -6,7 +6,7 @@ import { hasOwnErrorCode } from "./errors.js";
 import { createLogWriter } from "./logs/log-writer.js";
 import { assertPathHasNoSymbolicLinks } from "./path-safety.js";
 import { assertValidManagedProcessId } from "./process-id.js";
-import { createStateStore } from "./state/state-store.js";
+import { assertValidProcessStateDocument, createStateStore } from "./state/state-store.js";
 import { createSupervisor } from "./supervisor/supervisor.js";
 const DEFAULT_POLL_INTERVAL_MS = 100;
 const DEFAULT_STARTUP_TIMEOUT_MS = 30_000;
@@ -14,6 +14,7 @@ const DEFAULT_STOP_TIMEOUT_MS = 5_000;
 const TEMP_WRITE_MAX_ATTEMPTS = 3;
 export async function startManagedProcess(options) {
     assertOptionalFiniteDuration(options.startupTimeoutMs, "startup timeout");
+    assertOptionalFiniteDuration(options.pollIntervalMs, "poll interval");
     const fs = options.fs ?? defaultFs();
     const spec = normalizeSpec(options.spec);
     const existing = await readManagedProcess({
@@ -56,6 +57,8 @@ export async function startManagedProcess(options) {
     }
 }
 export async function stopManagedProcess(options) {
+    assertOptionalFiniteDuration(options.stopTimeoutMs, "stop timeout");
+    assertOptionalFiniteDuration(options.pollIntervalMs, "poll interval");
     const fs = options.fs ?? defaultFs();
     const record = await readManagedProcess({
         baseDir: options.baseDir,
@@ -310,6 +313,7 @@ export async function runManagedProcess(options) {
     if (options.signal?.aborted) {
         return;
     }
+    assertOptionalFiniteDuration(options.pollIntervalMs, "poll interval");
     const fs = options.fs ?? defaultFs();
     await assertProcessDirectorySafe(fs, options.baseDir, options.id);
     await assertPathNotSymbolicLink(fs, resolveLogDir(options.baseDir, options.id));
@@ -523,13 +527,94 @@ async function readSpec(fs, baseDir, id) {
     if (!isRecord(spec) || typeof spec.id !== "string" || spec.id !== id) {
         throw new Error(`Invalid managed process specification for "${id}".`);
     }
-    return spec;
+    return assertValidProcessSpec(spec, id);
+}
+function assertValidProcessSpec(value, id) {
+    if (value.id !== id ||
+        !isNonEmptyString(value.command) ||
+        !isOptionalStringArray(value.args) ||
+        !isOptionalString(value.cwd) ||
+        !isOptionalStringRecord(value.env) ||
+        !isRestartPolicy(value.restart) ||
+        !isOptionalNonNegativeSafeInteger(value.maxRestarts) ||
+        !isOptionalFiniteDurationValue(value.backoffMs) ||
+        !isOptionalFiniteDurationValue(value.maxBackoffMs) ||
+        !isOptionalPositiveSafeInteger(value.logRetainCount) ||
+        !isOptionalReadyCheck(value.readyCheck) ||
+        !isOptionalRecord(value.docker)) {
+        throw new Error(`Invalid managed process specification for "${id}".`);
+    }
+    return value;
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function isOptionalString(value) {
+    return value === undefined || typeof value === "string";
+}
+function isOptionalStringArray(value) {
+    return value === undefined || (Array.isArray(value) &&
+        value.every((entry) => typeof entry === "string"));
+}
+function isOptionalStringRecord(value) {
+    if (value === undefined) {
+        return true;
+    }
+    if (!isPlainRecord(value)) {
+        return false;
+    }
+    return Object.values(value).every((entry) => typeof entry === "string");
+}
+function isRestartPolicy(value) {
+    return value === "never" || value === "on-failure" || value === "always";
+}
+function isOptionalNonNegativeSafeInteger(value) {
+    return value === undefined || (typeof value === "number" &&
+        Number.isSafeInteger(value) &&
+        value >= 0);
+}
+function isOptionalPositiveSafeInteger(value) {
+    return value === undefined || (typeof value === "number" &&
+        Number.isSafeInteger(value) &&
+        value > 0);
+}
+function isOptionalFiniteDurationValue(value) {
+    return value === undefined || (typeof value === "number" &&
+        Number.isFinite(value) &&
+        value >= 0);
+}
+function isOptionalReadyCheck(value) {
+    if (value === undefined) {
+        return true;
+    }
+    if (!isPlainRecord(value)) {
+        return false;
+    }
+    if (value.kind === "log-pattern") {
+        return isNonEmptyString(value.pattern);
+    }
+    if (value.kind === "tcp") {
+        return (typeof value.port === "number" &&
+            Number.isSafeInteger(value.port) &&
+            value.port > 0 &&
+            value.port <= 65_535 &&
+            isOptionalString(value.host) &&
+            isOptionalFiniteDurationValue(value.timeoutMs));
+    }
+    return false;
+}
+function isOptionalRecord(value) {
+    return value === undefined || isPlainRecord(value);
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function writeSpec(fs, baseDir, spec) {
     await writeJsonFile(fs, resolveSpecPath(baseDir, spec.id), spec);
 }
 async function readState(fs, baseDir, id) {
-    return await readJsonFile(fs, resolveStatePath(baseDir, id));
+    const state = await readJsonFile(fs, resolveStatePath(baseDir, id));
+    return state === null ? null : assertValidProcessStateDocument(state, id);
 }
 async function writeState(fs, baseDir, state) {
     await writeJsonFile(fs, resolveStatePath(baseDir, state.id), state);

package/packages/process-launcher/dist/process-id.js

@@ -1,6 +1,20 @@
 import path from "node:path";
 export function assertValidManagedProcessId(id) {
-    if (id.length === 0 || id === "." || id === ".." || path.basename(id) !== id) {
+    if (id.length === 0 ||
+        id !== id.trim() ||
+        id === "." ||
+        id === ".." ||
+        path.basename(id) !== id ||
+        hasControlCharacter(id)) {
         throw new Error(`Invalid managed process id: ${id}`);
     }
 }
+function hasControlCharacter(value) {
+    for (const char of value) {
+        const code = char.charCodeAt(0);
+        if (code <= 31 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}

package/packages/process-launcher/dist/state/state-store.d.ts

@@ -1,2 +1,3 @@
-import type { LauncherFileSystem, StateStore } from "../types.js";
+import type { LauncherFileSystem, ProcessState, StateStore } from "../types.js";
 export declare function createStateStore(stateDir: string, fs?: LauncherFileSystem): StateStore;
+export declare function assertValidProcessStateDocument(value: unknown, id: string): ProcessState;

package/packages/process-launcher/dist/state/state-store.js

@@ -78,10 +78,7 @@ export function createStateStore(stateDir, fs = nodeFs) {
             await assertPathHasNoSymbolicLinks(fs, statePath);
             const content = await fs.readFile(statePath, "utf8");
             const parsed = JSON.parse(content);
-            if (!isProcessState(parsed, id)) {
-                throw new Error(`Invalid process state document: ${id}`);
-            }
-            return parsed;
+            return assertValidProcessStateDocument(parsed, id);
         }
         catch (error) {
             if (isNotFoundError(error)) {
@@ -169,6 +166,12 @@ export function createStateStore(stateDir, fs = nodeFs) {
     }
     return { read, write, list, remove };
 }
+export function assertValidProcessStateDocument(value, id) {
+    if (!isProcessState(value, id)) {
+        throw new Error(`Invalid process state document: ${id}`);
+    }
+    return value;
+}
 function isProcessState(value, id) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return false;
@@ -181,11 +184,20 @@ function isProcessState(value, id) {
             state.status === "crashed" ||
             state.status === "restarting") &&
         (state.runtime === "host" || state.runtime === "docker") &&
-        typeof state.restartCount === "number" &&
-        (state.lastExitCode === null || typeof state.lastExitCode === "number") &&
+        isPositiveSafeIntegerOrNull(state.pid) &&
+        isNonNegativeSafeInteger(state.restartCount) &&
+        (state.lastExitCode === null || isNonNegativeSafeInteger(state.lastExitCode)) &&
         (state.lastStartedAt === null || typeof state.lastStartedAt === "string") &&
         (state.lastStoppedAt === null || typeof state.lastStoppedAt === "string") &&
         typeof state.command === "string" &&
         Array.isArray(state.args) &&
         state.args.every((argument) => typeof argument === "string"));
 }
+function isPositiveSafeIntegerOrNull(value) {
+    return value === null || (typeof value === "number" &&
+        Number.isSafeInteger(value) &&
+        value > 0);
+}
+function isNonNegativeSafeInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}

package/packages/toolcraft-landing-page/dist/render.js

@@ -3,10 +3,108 @@ import { highlight } from "./highlight.js";
 import { SCRIPT } from "./script.js";
 import { CSS } from "./styles.js";
 import { TEMPLATE } from "./template.js";
+const DEFAULT_ACCENT = "#2563eb";
+function isAsciiHexDigit(value) {
+    const code = value.charCodeAt(0);
+    return ((code >= 48 && code <= 57) ||
+        (code >= 65 && code <= 70) ||
+        (code >= 97 && code <= 102));
+}
+function isHexColor(value) {
+    if (!value.startsWith("#")) {
+        return false;
+    }
+    if (![4, 5, 7, 9].includes(value.length)) {
+        return false;
+    }
+    for (const char of value.slice(1)) {
+        if (!isAsciiHexDigit(char)) {
+            return false;
+        }
+    }
+    return true;
+}
+function isNamedColor(value) {
+    if (value.length === 0) {
+        return false;
+    }
+    for (const char of value) {
+        const code = char.charCodeAt(0);
+        if (!((code >= 65 && code <= 90) || (code >= 97 && code <= 122))) {
+            return false;
+        }
+    }
+    return true;
+}
+function sanitizeAccent(value) {
+    const trimmed = value.trim();
+    if (isHexColor(trimmed) || isNamedColor(trimmed)) {
+        return trimmed;
+    }
+    return DEFAULT_ACCENT;
+}
+function hasUnsafeHrefCharacter(value) {
+    for (const char of value) {
+        const code = char.charCodeAt(0);
+        if (code <= 32 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}
+function schemeDelimiterIndex(value) {
+    const colon = value.indexOf(":");
+    if (colon === -1) {
+        return -1;
+    }
+    const slash = value.indexOf("/");
+    const question = value.indexOf("?");
+    const hash = value.indexOf("#");
+    const precedingDelimiters = [slash, question, hash].filter((index) => index !== -1);
+    if (precedingDelimiters.some((index) => index < colon)) {
+        return -1;
+    }
+    return colon;
+}
+function safeHref(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || hasUnsafeHrefCharacter(trimmed)) {
+        return undefined;
+    }
+    const delimiter = schemeDelimiterIndex(trimmed);
+    if (delimiter === -1) {
+        return trimmed;
+    }
+    const scheme = trimmed.slice(0, delimiter).toLowerCase();
+    return scheme === "http" || scheme === "https" ? trimmed : undefined;
+}
+function stripFragment(value) {
+    const hash = value.indexOf("#");
+    return hash === -1 ? value : value.slice(0, hash);
+}
+function docsHref(value) {
+    return stripFragment(safeHref(value) ?? "#docs");
+}
+function docsAnchorHref(baseHref, anchor) {
+    return baseHref === "#docs" ? baseHref : `${baseHref}#${anchor}`;
+}
 export function renderLandingPage(page) {
-    const styles = renderTemplate(CSS, { accent: page.accent });
+    const accent = sanitizeAccent(page.accent);
+    const docsUrl = docsHref(page.docsUrl);
+    const styles = renderTemplate(CSS, { accent });
     const view = {
         ...page,
+        accent,
+        repoUrl: safeHref(page.repoUrl),
+        docsUrl,
+        docsHelloWorldUrl: docsAnchorHref(docsUrl, "hello-world"),
+        docsRuntimeUrl: docsAnchorHref(docsUrl, "one-binary-three-runtimes"),
+        docsSecretsUrl: docsAnchorHref(docsUrl, "secrets"),
+        docsMigrationUrl: docsAnchorHref(docsUrl, "migrating-from-a-folder-of-scripts"),
+        copyInstall: page.includeJs && page.install !== undefined,
         installHtml: page.install === undefined ? undefined : highlight(page.install),
         useCases: page.useCases.map((useCase) => ({
             ...useCase,

package/packages/toolcraft-landing-page/dist/template.js

@@ -33,7 +33,9 @@ export const TEMPLATE = String.raw `<!doctype html>
           {{#install}}
           <div class="install">
             <code><span aria-hidden="true">$ </span>{{{installHtml}}}</code>
+            {{#copyInstall}}
             <button class="copy" type="button" data-copy="{{install}}" aria-label="Copy {{install}}">Copy</button>
+            {{/copyInstall}}
           </div>
           {{/install}}
         </div>
@@ -112,10 +114,10 @@ export const TEMPLATE = String.raw `<!doctype html>
             <a class="text-link" href="{{docsUrl}}">Read the Toolcraft README <span aria-hidden="true">→</span></a>
           </div>
           <div class="docs-grid">
-            <a class="doc-card" href="{{docsUrl}}#hello-world"><span>01</span><strong>Start with one command</strong><small>Install, define, and run a typed CLI in five minutes.</small></a>
-            <a class="doc-card" href="{{docsUrl}}#one-binary-three-runtimes"><span>02</span><strong>Choose a runtime</strong><small>CLI, MCP, and SDK from the same command tree.</small></a>
-            <a class="doc-card" href="{{docsUrl}}#secrets"><span>03</span><strong>Add safety controls</strong><small>Secrets, preconditions, services, and human approval.</small></a>
-            <a class="doc-card" href="{{docsUrl}}#migrating-from-a-folder-of-scripts"><span>04</span><strong>Migrate existing scripts</strong><small>Adopt Toolcraft incrementally without rewriting useful logic.</small></a>
+            <a class="doc-card" href="{{docsHelloWorldUrl}}"><span>01</span><strong>Start with one command</strong><small>Install, define, and run a typed CLI in five minutes.</small></a>
+            <a class="doc-card" href="{{docsRuntimeUrl}}"><span>02</span><strong>Choose a runtime</strong><small>CLI, MCP, and SDK from the same command tree.</small></a>
+            <a class="doc-card" href="{{docsSecretsUrl}}"><span>03</span><strong>Add safety controls</strong><small>Secrets, preconditions, services, and human approval.</small></a>
+            <a class="doc-card" href="{{docsMigrationUrl}}"><span>04</span><strong>Migrate existing scripts</strong><small>Adopt Toolcraft incrementally without rewriting useful logic.</small></a>
           </div>
         </div>
       </section>