practicode 0.1.8 → 0.1.10

package/Cargo.lock

@@ -453,7 +453,7 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "practicode"
-version = "0.1.8"
+version = "0.1.10"
 dependencies = [
  "anyhow",
  "crossterm",

package/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "practicode"
-version = "0.1.8"
+version = "0.1.10"
 edition = "2024"
 description = "Local-first coding-test practice in a Rust terminal UI with optional AI help."
 readme = "README.md"

package/README.md

@@ -7,6 +7,7 @@
 ![crates.io](https://img.shields.io/crates/v/practicode?logo=rust)
 ![npm](https://img.shields.io/npm/v/practicode?logo=npm)
 ![CI](https://github.com/baba9811/practicode/actions/workflows/ci.yml/badge.svg)
+[Socket.dev package health](https://socket.dev/npm/package/practicode)
 
 ![practicode terminal UI](assets/practicode-terminal.svg)
 
@@ -36,6 +37,8 @@ npm install -g practicode
 practicode
 ```
 
+The npm package has a `postinstall` step that runs `cargo build --release --locked` from the package root so the Rust TUI binary is ready. Set `PRACTICODE_SKIP_BUILD=1` to skip that install-time build; the `practicode` launcher will try the same locked Cargo build on first run if the binary is missing.
+
 ### Cargo
 
 ```bash
@@ -176,6 +179,8 @@ cargo install --force practicode
 - `/run` executes your local submission as a normal process. practicode runs it from `.practicode/build/<problem-id>/run`, but this is not an OS sandbox. Only run code you trust.
 - `/hint` sends the current problem and submission to the selected AI provider CLI.
 - AI-backed `/next` and `/generate` can run a custom shell command from `settings.ai_next_command`; save only commands you trust.
+- npm installs run the package `postinstall` script described above. It only invokes Cargo with the checked-in lockfile from this package root; it does not read local `.env`/`.npmrc` files or contact the configured AI provider.
+- npm releases are published from GitHub Actions with registry signatures and provenance enabled in `package.json`. The release workflow is also prepared for npm Trusted Publishing/OIDC; maintainers should prefer that over long-lived publish tokens when the package setting is enabled on npm.
 - Local `.env`, `.npmrc`, `.practicode/`, `problems/`, and `submissions/` are ignored by git. Do not commit tokens, private prompts, or answer keys.
 
 ## Development Checks

package/SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting
+
+Report vulnerabilities through GitHub Security Advisories for this repository when available. If that is not available, open a minimal public issue asking for a private security contact and avoid posting exploit details.
+
+Do not include tokens, private prompts, `.env`, `.npmrc`, `.practicode/`, `problems/`, or `submissions/` contents in public reports.
+
+## Scope
+
+Security-sensitive areas include npm install scripts, release publishing, command execution, local judging, AI provider prompts, update checks, and local user data handling.

package/docs/ARCHITECTURE.md

@@ -4,9 +4,25 @@ Practicode is local-first: user data stays under `.practicode/`, `problems/`, an
 
 ## Source Layout
 
-- `src/core.rs` owns problem data, state loading/saving, judging, and file generation.
-- `src/core/profile.rs` owns user-profile defaults and normalization.
-- `src/tui.rs` owns the Ratatui app shell, event routing, and workflow orchestration.
+- `src/core.rs` is the public core facade. Keep new domain logic in nested `src/core/` modules.
+- `src/core/model.rs` owns persisted/user-facing data shapes and core constants.
+- `src/core/bank.rs` owns local problem-bank loading, saving, starter data, and bank validation.
+- `src/core/state.rs` owns state loading, saving, and settings normalization.
+- `src/core/language.rs` owns language/provider normalization, templates, and extension mapping.
+- `src/core/render.rs` owns plain/markdown problem rendering.
+- `src/core/judge.rs` owns submission file creation, runtime commands, compilation, and judging.
+- `src/core/progress.rs` owns give-up/next/previous/pass history transitions.
+- `src/core/problem_files.rs` owns generated problem README/index file writes.
+- `src/core/profile.rs` owns user-profile defaults and normalization helpers.
+- `src/tui.rs` owns the `PracticodeApp` state shell, construction, run loop, and test accessors. Keep new TUI behavior in nested `src/tui/` modules.
+- `src/tui/actions.rs` owns user actions such as run, next, generate, language/theme/profile changes.
+- `src/tui/command_handlers.rs` owns slash-command routing.
+- `src/tui/command_input.rs` owns command palette input, completion, and Hangul composition.
+- `src/tui/events.rs` owns keyboard/mouse event routing.
+- `src/tui/tasks.rs` owns background AI/update/model tasks and output writing helpers.
+- `src/tui/view.rs` owns Ratatui drawing, pane styling, mouse-capture toggles, and cursor placement.
+- `src/tui/problem_list.rs` owns problem-list rendering and navigation.
+- `src/tui/status.rs` owns status-line text, busy-game text, mode hints, and help text.
 - `src/tui/commands.rs` owns the command palette catalog.
 - `src/tui/editor.rs` owns the in-terminal code editor state.
 - `src/tui/problem_view.rs` owns problem-statement rendering.
@@ -17,7 +33,7 @@ Practicode is local-first: user data stays under `.practicode/`, `problems/`, an
 
 ## Extension Rules
 
-- Add domain logic under the owning module first; keep `tui.rs` as orchestration, not a catch-all.
+- Add domain logic under the owning nested module first; keep `core.rs` and `tui.rs` as facades/shells, not catch-alls.
 - Add user-visible commands in `src/tui/commands.rs`, then route behavior in `PracticodeApp::handle_command`.
 - Add persisted user profile settings to `Settings`, normalize them in `normalize_settings`, and cover old-state compatibility with tests.
 - Keep provider-specific behavior in `src/ai.rs`; TUI should ask for status or start tasks, not know provider internals.

package/docs/MAINTAINING.md

@@ -45,11 +45,16 @@ Verify publication:
 ```bash
 gh run list --limit 5
 npm view practicode version
+npm view practicode dist.signatures dist.attestations --json
 cargo search practicode --limit 1
 ```
 
 Do not print or commit tokens. Local `.env` and `.npmrc` are ignored; GitHub Actions uses `NPM_TOKEN` and `CRATES_TOKEN` repository secrets.
 
+For npm supply-chain posture, keep `publishConfig.provenance` enabled and keep the release job's `id-token: write` permission. When the npm package's Trusted Publisher setting is configured for this repository and `.github/workflows/release.yml`, remove the long-lived `NPM_TOKEN` dependency from the npm publish steps and disallow token publishing in the npm package settings.
+
+Socket.dev indexes the npm package page at <https://socket.dev/npm/package/practicode>. It may lag behind npm immediately after a release; verify npm first with `npm view practicode version`, then re-check Socket after indexing catches up. If Socket flags the npm `postinstall` script, confirm it still only runs the locked Cargo build documented in the README.
+
 ## Documentation Ownership
 
 | File | Audience |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "practicode",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Local-first coding-test practice in a Rust terminal UI with optional AI help.",
   "license": "MIT",
   "repository": {
@@ -8,6 +8,9 @@
     "url": "git+https://github.com/baba9811/practicode.git"
   },
   "homepage": "https://github.com/baba9811/practicode#readme",
+  "bugs": {
+    "url": "https://github.com/baba9811/practicode/issues"
+  },
   "bin": {
     "practicode": "bin/practicode.js"
   },
@@ -27,6 +30,7 @@
     "Cargo.toml",
     "LICENSE",
     "README.md",
+    "SECURITY.md",
     "THIRD_PARTY_LICENSES.md"
   ],
   "keywords": [
@@ -41,6 +45,7 @@
     "node": ">=18"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }

package/src/core/bank.rs

@@ -0,0 +1,148 @@
+use super::*;
+
+pub fn starter_problem() -> Problem {
+    Problem {
+        id: "001-hello-world".to_string(),
+        slug: "hello-world".to_string(),
+        difficulty: "easy".to_string(),
+        topics: vec!["io".to_string()],
+        title: localized_map(&[
+            ("en", "Hello World"),
+            ("ko", "Hello World"),
+            ("ja", "Hello World"),
+            ("zh", "Hello World"),
+            ("es", "Hello World"),
+        ]),
+        statement: localized_map(&[
+            ("en", "Print exactly `Hello, World!` to stdout."),
+            ("ko", "표준 출력으로 정확히 `Hello, World!`를 출력하세요."),
+            ("ja", "標準出力に正確に `Hello, World!` を出力してください。"),
+            ("zh", "向标准输出准确打印 `Hello, World!`。"),
+            ("es", "Imprime exactamente `Hello, World!` en stdout."),
+        ]),
+        input: localized_map(&[
+            ("en", "No input."),
+            ("ko", "입력은 없습니다."),
+            ("ja", "入力はありません。"),
+            ("zh", "没有输入。"),
+            ("es", "No hay entrada."),
+        ]),
+        output: localized_map(&[
+            ("en", "One line: `Hello, World!`"),
+            ("ko", "`Hello, World!` 한 줄"),
+            ("ja", "1行: `Hello, World!`"),
+            ("zh", "一行: `Hello, World!`"),
+            ("es", "Una linea: `Hello, World!`"),
+        ]),
+        examples: vec![IoCase {
+            input: String::new(),
+            output: "Hello, World!\n".to_string(),
+        }],
+        cases: vec![IoCase {
+            input: String::new(),
+            output: "Hello, World!\n".to_string(),
+        }],
+        answers: HashMap::from([
+            ("python".to_string(), "print('Hello, World!')\n".to_string()),
+            (
+                "ts".to_string(),
+                "console.log('Hello, World!');\n".to_string(),
+            ),
+            (
+                "java".to_string(),
+                "class Solution {\n    public static void main(String[] args) {\n        System.out.println(\"Hello, World!\");\n    }\n}\n".to_string(),
+            ),
+            (
+                "rust".to_string(),
+                "fn main() {\n    println!(\"Hello, World!\");\n}\n".to_string(),
+            ),
+        ]),
+    }
+}
+
+pub fn map2(k1: &str, v1: &str, k2: &str, v2: &str) -> HashMap<String, String> {
+    HashMap::from([
+        (k1.to_string(), v1.to_string()),
+        (k2.to_string(), v2.to_string()),
+    ])
+}
+
+pub fn localized_map(entries: &[(&str, &str)]) -> HashMap<String, String> {
+    entries
+        .iter()
+        .map(|(key, value)| ((*key).to_string(), (*value).to_string()))
+        .collect()
+}
+
+pub fn load_bank(root: &Path) -> Result<Vec<Problem>> {
+    let path = root.join(BANK_PATH);
+    if path.exists() {
+        let text = fs::read_to_string(&path).with_context(|| format!("read {}", path.display()))?;
+        let bank: Vec<Problem> =
+            serde_json::from_str(&text).with_context(|| format!("parse {}", path.display()))?;
+        validate_bank(&bank, &path)?;
+        Ok(bank)
+    } else {
+        Ok(vec![starter_problem()])
+    }
+}
+
+pub fn save_bank(root: &Path, bank: &[Problem]) -> Result<()> {
+    let path = root.join(BANK_PATH);
+    validate_bank(bank, &path)?;
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+    fs::write(&path, serde_json::to_string_pretty(bank)? + "\n")?;
+    Ok(())
+}
+
+fn validate_bank(bank: &[Problem], path: &Path) -> Result<()> {
+    if bank.is_empty() {
+        bail!("{} must contain at least one problem", path.display());
+    }
+    for problem in bank {
+        if !is_safe_name(&problem.id) {
+            bail!("{} has invalid problem id {:?}", path.display(), problem.id);
+        }
+        if !is_safe_name(&problem.slug) {
+            bail!(
+                "{} has invalid slug {:?} for {}",
+                path.display(),
+                problem.slug,
+                problem.id
+            );
+        }
+        if problem.cases.is_empty() {
+            bail!(
+                "{} problem {} has no judge cases",
+                path.display(),
+                problem.id
+            );
+        }
+        if problem.answers.is_empty() {
+            bail!(
+                "{} problem {} must contain at least one answer",
+                path.display(),
+                problem.id
+            );
+        }
+        for language in problem.answers.keys() {
+            if !LANGUAGES.contains(&language.as_str()) {
+                bail!(
+                    "{} problem {} has unsupported answer language {language}",
+                    path.display(),
+                    problem.id,
+                );
+            }
+        }
+    }
+    Ok(())
+}
+
+fn is_safe_name(value: &str) -> bool {
+    !value.is_empty()
+        && value
+            .chars()
+            .all(|char| char.is_ascii_alphanumeric() || matches!(char, '-' | '_'))
+}

package/src/core/judge.rs

@@ -0,0 +1,205 @@
+use super::*;
+
+pub fn ensure_submission(root: &Path, problem: &Problem, settings: &Settings) -> Result<PathBuf> {
+    let language = normalize_language(&settings.language);
+    let path = root
+        .join("submissions")
+        .join(&problem.id)
+        .join(format!("solution.{}", ext_for(&language)));
+    if !path.exists() {
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent)?;
+        }
+        fs::write(&path, template_for(&language))?;
+    }
+    Ok(path)
+}
+pub fn judge(root: &Path, problem: &Problem, settings: &Settings) -> JudgeResult {
+    if problem.cases.is_empty() {
+        return JudgeResult {
+            passed: false,
+            passed_cases: 0,
+            total_cases: 0,
+            output: "problem has no judge cases".to_string(),
+        };
+    }
+    let path = match ensure_submission(root, problem, settings) {
+        Ok(path) => path,
+        Err(error) => {
+            return JudgeResult {
+                passed: false,
+                passed_cases: 0,
+                total_cases: problem.cases.len(),
+                output: error.to_string(),
+            };
+        }
+    };
+    let language = normalize_language(&settings.language);
+    let command = match command_for(root, &path, &language) {
+        Ok(Some(command)) => command,
+        Ok(None) => {
+            return JudgeResult {
+                passed: false,
+                passed_cases: 0,
+                total_cases: problem.cases.len(),
+                output: format!("Missing runtime for {}", settings.language),
+            };
+        }
+        Err(error) => {
+            return JudgeResult {
+                passed: false,
+                passed_cases: 0,
+                total_cases: problem.cases.len(),
+                output: format!("compile failed\n{error}"),
+            };
+        }
+    };
+    let run_dir = root.join(".practicode/build").join(&problem.id).join("run");
+    if let Err(error) = fs::create_dir_all(&run_dir) {
+        return JudgeResult {
+            passed: false,
+            passed_cases: 0,
+            total_cases: problem.cases.len(),
+            output: error.to_string(),
+        };
+    }
+
+    let mut passed = 0;
+    let mut lines = Vec::new();
+    for (index, case) in problem.cases.iter().enumerate() {
+        let mut process = Command::new(&command.program);
+        process.args(&command.args).current_dir(&run_dir);
+        let run = match run_capture(&mut process, &case.input, Duration::from_secs(5)) {
+            Ok(run) => run,
+            Err(error) => {
+                lines.push(format!("Case {}: FAIL", index + 1));
+                push_labeled_block(&mut lines, "Error", &error.to_string());
+                break;
+            }
+        };
+        let got = run.stdout.trim();
+        let expected = case.output.trim();
+        if !run.timed_out && run.code == Some(0) && got == expected {
+            passed += 1;
+            lines.push(format!("Case {}: PASS", index + 1));
+            if !run.stderr.trim().is_empty() {
+                push_labeled_block(&mut lines, "Stderr", run.stderr.trim_end());
+            }
+        } else {
+            lines.push(format!("Case {}: FAIL", index + 1));
+            if run.timed_out {
+                push_labeled_block(&mut lines, "Error", "timeout: 5s");
+            }
+            push_labeled_block(&mut lines, "Input", case.input.trim_end());
+            push_labeled_block(&mut lines, "Expected", expected);
+            push_labeled_block(&mut lines, "Got", run.stdout.trim_end());
+            if !run.stderr.trim().is_empty() {
+                push_labeled_block(&mut lines, "Stderr", run.stderr.trim_end());
+            }
+            break;
+        }
+    }
+
+    JudgeResult {
+        passed: passed == problem.cases.len(),
+        passed_cases: passed,
+        total_cases: problem.cases.len(),
+        output: lines.join("\n"),
+    }
+}
+
+fn push_labeled_block(lines: &mut Vec<String>, label: &str, body: &str) {
+    lines.push(String::new());
+    lines.push(label.to_string());
+    if body.is_empty() {
+        lines.push("  <empty>".to_string());
+    } else {
+        lines.extend(body.lines().map(|line| format!("  {line}")));
+    }
+}
+
+pub fn command_for(root: &Path, path: &Path, language: &str) -> Result<Option<CommandSpec>> {
+    match language {
+        "python" => Ok(which("python3")
+            .or_else(|| which("python"))
+            .map(|program| CommandSpec {
+                program,
+                args: vec![path.display().to_string()],
+            })),
+        "ts" => Ok(which("node").map(|program| CommandSpec {
+            program,
+            args: vec![
+                "--experimental-strip-types".to_string(),
+                path.display().to_string(),
+            ],
+        })),
+        "java" => compile_java(root, path),
+        "rust" => compile_rust(root, path),
+        _ => Ok(None),
+    }
+}
+
+fn compile_java(root: &Path, path: &Path) -> Result<Option<CommandSpec>> {
+    let Some(javac) = which("javac") else {
+        return Ok(None);
+    };
+    let Some(java) = which("java") else {
+        return Ok(None);
+    };
+    let build = root
+        .join(".practicode/build")
+        .join(path.parent().and_then(Path::file_name).unwrap_or_default())
+        .join("java");
+    fs::create_dir_all(&build)?;
+    let mut compile = Command::new(javac);
+    compile
+        .args([
+            "-d",
+            &build.display().to_string(),
+            &path.display().to_string(),
+        ])
+        .current_dir(root);
+    let output = run_capture(&mut compile, "", Duration::from_secs(30))?;
+    if output.code != Some(0) {
+        return Err(anyhow!(output.stderr.trim().to_string()));
+    }
+    Ok(Some(CommandSpec {
+        program: java,
+        args: vec![
+            "-cp".to_string(),
+            build.display().to_string(),
+            "Solution".to_string(),
+        ],
+    }))
+}
+
+fn compile_rust(root: &Path, path: &Path) -> Result<Option<CommandSpec>> {
+    let Some(rustc) = which("rustc") else {
+        return Ok(None);
+    };
+    let build = root
+        .join(".practicode/build")
+        .join(path.parent().and_then(Path::file_name).unwrap_or_default());
+    fs::create_dir_all(&build)?;
+    let exe = build.join(if cfg!(windows) {
+        "solution.exe"
+    } else {
+        "solution"
+    });
+    let mut compile = Command::new(rustc);
+    compile
+        .args([
+            path.display().to_string(),
+            "-o".to_string(),
+            exe.display().to_string(),
+        ])
+        .current_dir(root);
+    let output = run_capture(&mut compile, "", Duration::from_secs(30))?;
+    if output.code != Some(0) {
+        return Err(anyhow!(output.stderr.trim().to_string()));
+    }
+    Ok(Some(CommandSpec {
+        program: exe,
+        args: Vec::new(),
+    }))
+}

package/src/core/language.rs

@@ -0,0 +1,92 @@
+use super::*;
+
+pub fn ext_for(language: &str) -> &'static str {
+    match normalize_language(language).as_str() {
+        "python" => "py",
+        "ts" => "ts",
+        "java" => "java",
+        "rust" => "rs",
+        _ => "py",
+    }
+}
+pub fn problem_by_id<'a>(bank: &'a [Problem], problem_id: &str) -> Option<&'a Problem> {
+    bank.iter().find(|problem| problem.id == problem_id)
+}
+
+pub fn normalize_language(language: &str) -> String {
+    let language = language.trim().to_lowercase();
+    if LANGUAGES.contains(&language.as_str()) {
+        language
+    } else {
+        "python".to_string()
+    }
+}
+
+pub fn parse_language_list(value: &str) -> Vec<String> {
+    let mut languages = Vec::new();
+    for language in value.split(',') {
+        let language = language.trim().to_lowercase();
+        if language == "all" {
+            return Vec::new();
+        }
+        if LANGUAGES.contains(&language.as_str()) && !languages.contains(&language) {
+            languages.push(language);
+        }
+    }
+    languages
+}
+
+pub fn normalize_language_list(languages: &[String]) -> Vec<String> {
+    parse_language_list(&languages.join(","))
+}
+
+pub fn parse_ui_language_list(value: &str) -> Vec<String> {
+    let mut languages = Vec::new();
+    for language in value.split(',') {
+        let lower = language.trim().to_lowercase();
+        if lower == "all" {
+            return Vec::new();
+        }
+        let language = lower
+            .split(['-', '_'])
+            .next()
+            .filter(|value| UI_LANGUAGES.contains(value))
+            .unwrap_or("");
+        if language == "all" {
+            return Vec::new();
+        }
+        if !language.is_empty() && !languages.iter().any(|value| value == language) {
+            languages.push(language.to_string());
+        }
+    }
+    languages
+}
+
+pub fn normalize_ui_language_list(languages: &[String]) -> Vec<String> {
+    parse_ui_language_list(&languages.join(","))
+}
+
+pub fn normalize_next_source(source: &str) -> String {
+    if source == "ai" {
+        "ai".to_string()
+    } else {
+        "bank".to_string()
+    }
+}
+
+pub fn normalize_ai_provider(provider: &str) -> String {
+    if provider == "claude" {
+        "claude".to_string()
+    } else {
+        "codex".to_string()
+    }
+}
+pub fn template_for(language: &str) -> String {
+    match normalize_language(language).as_str() {
+        "python" => "# Read from stdin and print to stdout.\nimport sys\n\n\n".to_string(),
+        "ts" => "const fs = require('fs');\nconst input = fs.readFileSync(0, 'utf8');\n\n".to_string(),
+        "java" => "import java.io.*;\n\nclass Solution {\n    public static void main(String[] args) throws Exception {\n    }\n}\n".to_string(),
+        "rust" => "fn main() {\n}\n".to_string(),
+        _ => String::new(),
+    }
+}