pulse-js-framework 1.11.3 → 1.11.4

package/cli/release.js

@@ -10,11 +10,11 @@
  * - Push to remote
  */
 
-import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
+import { readFileSync, writeFileSync, unlinkSync, openSync, closeSync, ftruncateSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { execSync } from 'child_process';
-import { tmpdir } from 'os';
+import { randomBytes } from 'crypto';
 import { createInterface } from 'readline';
 import https from 'https';
 import { log } from './logger.js';
@@ -23,6 +23,30 @@ import { runDocsTest } from './docs-test.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const root = join(__dirname, '..');
 
+/**
+ * Atomically read-modify-write a file using a file descriptor to prevent TOCTOU races.
+ * Opens the file with 'r+' flag, reads content, applies transform, truncates, and writes.
+ * Returns false if the file doesn't exist (ENOENT), true on success.
+ */
+function atomicReadModifyWrite(filePath, transformFn) {
+  let fd;
+  try {
+    fd = openSync(filePath, 'r+');
+  } catch (err) {
+    if (err.code === 'ENOENT') return false;
+    throw err;
+  }
+  try {
+    const content = readFileSync(fd, 'utf-8');
+    const newContent = transformFn(content);
+    ftruncateSync(fd, 0);
+    writeFileSync(fd, newContent, { encoding: 'utf-8' });
+  } finally {
+    closeSync(fd);
+  }
+  return true;
+}
+
 /**
  * Prompt user for input
  */
@@ -211,17 +235,15 @@ function updatePackageJson(newVersion) {
  */
 function updateDocsState(newVersion) {
   const statePath = join(root, 'docs/src/state.js');
-  if (!existsSync(statePath)) {
-    log.warn('  docs/src/state.js not found, skipping');
-    return;
-  }
 
-  let content = readFileSync(statePath, 'utf-8');
-  content = content.replace(
-    /export const version = '[^']+'/,
-    `export const version = '${newVersion}'`
-  );
-  writeFileSync(statePath, content);
+  const updated = atomicReadModifyWrite(statePath, (content) => {
+    return content.replace(
+      /export const version = '[^']+'/,
+      `export const version = '${newVersion}'`
+    );
+  });
+
+  if (!updated) { log.warn('  docs/src/state.js not found, skipping'); return; }
   log.info(`  Updated docs/src/state.js to v${newVersion}`);
 }
 
@@ -230,12 +252,6 @@ function updateDocsState(newVersion) {
  */
 function updateChangelog(newVersion, title, changes) {
   const changelogPath = join(root, 'CHANGELOG.md');
-  if (!existsSync(changelogPath)) {
-    log.warn('  CHANGELOG.md not found, skipping');
-    return;
-  }
-
-  let content = readFileSync(changelogPath, 'utf-8');
 
   // Build changelog entry
   const date = getCurrentDate();
@@ -277,18 +293,22 @@ function updateChangelog(newVersion, title, changes) {
     entry += '\n';
   }
 
-  // Insert after the header section (after line 6)
-  const lines = content.split('\n');
-  const insertIndex = lines.findIndex(line => line.startsWith('## ['));
+  // Atomically read-modify-write to prevent TOCTOU race (CWE-367)
+  const updated = atomicReadModifyWrite(changelogPath, (content) => {
+    const lines = content.split('\n');
+    const insertIndex = lines.findIndex(line => line.startsWith('## ['));
 
-  if (insertIndex !== -1) {
-    lines.splice(insertIndex, 0, entry);
-  } else {
-    // No existing version entries, add after header
-    lines.push(entry);
-  }
+    if (insertIndex !== -1) {
+      lines.splice(insertIndex, 0, entry);
+    } else {
+      // No existing version entries, add after header
+      lines.push(entry);
+    }
 
-  writeFileSync(changelogPath, lines.join('\n'));
+    return lines.join('\n');
+  });
+
+  if (!updated) { log.warn('  CHANGELOG.md not found, skipping'); return; }
   log.info(`  Updated CHANGELOG.md with v${newVersion}`);
 }
 
@@ -297,12 +317,7 @@ function updateChangelog(newVersion, title, changes) {
  */
 function updateDocsChangelog(newVersion, title, changes) {
   const changelogPagePath = join(root, 'docs/src/pages/ChangelogPage.js');
-  if (!existsSync(changelogPagePath)) {
-    log.warn('  docs/src/pages/ChangelogPage.js not found, skipping');
-    return;
-  }
 
-  let content = readFileSync(changelogPagePath, 'utf-8');
   const monthYear = getCurrentMonthYear();
 
   // Build HTML changelog section
@@ -337,15 +352,18 @@ function updateDocsChangelog(newVersion, title, changes) {
     </section>
 `;
 
-  // Find where to insert (after the intro paragraph, before first section)
-  const insertMarker = '<section class="doc-section changelog-section">';
-  const insertIndex = content.indexOf(insertMarker);
+  // Atomically read-modify-write to prevent TOCTOU race (CWE-367)
+  const updated = atomicReadModifyWrite(changelogPagePath, (content) => {
+    const insertMarker = '<section class="doc-section changelog-section">';
+    const insertIndex = content.indexOf(insertMarker);
 
-  if (insertIndex !== -1) {
-    content = content.slice(0, insertIndex) + section + content.slice(insertIndex);
-  }
+    if (insertIndex !== -1) {
+      return content.slice(0, insertIndex) + section + content.slice(insertIndex);
+    }
+    return content;
+  });
 
-  writeFileSync(changelogPagePath, content);
+  if (!updated) { log.warn('  docs/src/pages/ChangelogPage.js not found, skipping'); return; }
   log.info(`  Updated docs/src/pages/ChangelogPage.js with v${newVersion}`);
 }
 
@@ -593,8 +611,8 @@ function createGitHubRelease(version, title, changes) {
     notes += '\n';
   }
 
-  // Write notes to temp file
-  const tempFile = join(tmpdir(), `pulse-release-notes-${Date.now()}.md`);
+  // Write notes to a temp file in the project root (avoids os.tmpdir() for CWE-377)
+  const tempFile = join(root, `.release-notes-${randomBytes(16).toString('hex')}.tmp.md`);
   writeFileSync(tempFile, notes, 'utf-8');
 
   try {
@@ -656,8 +674,8 @@ function gitCommitTagPush(newVersion, title, changes, dryRun = false) {
     return { success: false, stage: 'add', error: result.error };
   }
 
-  // git commit using temp file for cross-platform compatibility
-  const tempFile = join(tmpdir(), `pulse-release-${Date.now()}.txt`);
+  // git commit using temp file for cross-platform compatibility (avoids os.tmpdir() for CWE-377)
+  const tempFile = join(root, `.commit-msg-${randomBytes(16).toString('hex')}.tmp`);
   writeFileSync(tempFile, commitMessage, 'utf-8');
   try {
     result = execGitCommand(`git commit -F "${tempFile}"`, 'git commit');
@@ -769,8 +787,8 @@ function gitCommitTagNoPush(newVersion, title, changes) {
     return { success: false, stage: 'add', error: result.error };
   }
 
-  // git commit using temp file for cross-platform compatibility
-  const tempFile = join(tmpdir(), `pulse-release-${Date.now()}.txt`);
+  // git commit using temp file for cross-platform compatibility (avoids os.tmpdir() for CWE-377)
+  const tempFile = join(root, `.commit-msg-${randomBytes(16).toString('hex')}.tmp`);
   writeFileSync(tempFile, commitMessage, 'utf-8');
   try {
     result = execGitCommand(`git commit -F "${tempFile}"`, 'git commit');

package/cli/scaffold.js

@@ -3,7 +3,7 @@
  * Generate components, pages, stores, and other project files
  */
 
-import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, relative, basename } from 'path';
 import { log } from './logger.js';
 import { parseArgs } from './utils/file-utils.js';
@@ -957,13 +957,6 @@ export async function runScaffold(args) {
   const fileName = toCase(name, type === 'component' || type === 'page' || type === 'layout' ? 'pascal' : 'camel');
   const fullPath = join(process.cwd(), dir, fileName + scaffoldType.extension);
 
-  // Check if file already exists
-  if (existsSync(fullPath) && !options.force && !options.f) {
-    log.error(`File already exists: ${relative(process.cwd(), fullPath)}`);
-    log.info('Use --force to overwrite.');
-    process.exit(1);
-  }
-
   // Generate content
   const content = scaffoldType.template(name, {
     withState: options.state !== false,
@@ -973,13 +966,21 @@ export async function runScaffold(args) {
 
   // Create directory if needed
   const outputDir = dirname(fullPath);
-  if (!existsSync(outputDir)) {
-    mkdirSync(outputDir, { recursive: true });
+  mkdirSync(outputDir, { recursive: true });
+
+  // Write file (atomic create unless --force)
+  const forceOverwrite = options.force || options.f;
+  try {
+    writeFileSync(fullPath, content, forceOverwrite ? undefined : { flag: 'wx' });
+  } catch (err) {
+    if (err.code === 'EEXIST') {
+      log.error(`File already exists: ${relative(process.cwd(), fullPath)}`);
+      log.info('Use --force to overwrite.');
+      process.exit(1);
+    }
+    throw err;
   }
 
-  // Write file
-  writeFileSync(fullPath, content);
-
   log.success(`Created ${type}: ${relative(process.cwd(), fullPath)}`);
 
   // Show next steps

package/compiler/lexer.js

@@ -197,11 +197,18 @@ export class Token {
  */
 export class Lexer {
   constructor(source) {
+    if (source == null) {
+      throw new Error('Lexer: source must be a string, got ' + typeof source);
+    }
     this.source = source;
     this.pos = 0;
     this.line = 1;
     this.column = 1;
     this.tokens = [];
+    // Block context tracking (avoids O(n) backward scans)
+    this._currentBlock = null; // 'view' | 'style' | 'state' | 'actions' | 'router' | 'store' | null
+    this._blockDepth = 0;      // brace depth within current block
+    this._parenDepth = 0;      // parentheses depth within current block (for expression context)
   }
 
   /**
@@ -264,6 +271,8 @@ export class Lexer {
         }
       } else if (char === '/' && this.peek() === '*') {
         // Multi-line comment
+        const commentLine = this.line;
+        const commentCol = this.column;
         this.advance(); // /
         this.advance(); // *
         while (!this.isEOF() && !(this.current() === '*' && this.peek() === '/')) {
@@ -272,6 +281,9 @@ export class Lexer {
         if (!this.isEOF()) {
           this.advance(); // *
           this.advance(); // /
+        } else {
+          // Unclosed block comment — emit error token so downstream gets a clear diagnostic
+          this.tokens.push(new Token(TokenType.ERROR, 'Unterminated block comment', commentLine, commentCol));
         }
       } else {
         break;
@@ -572,10 +584,19 @@ export class Lexer {
   /**
    * Tokenize the entire source
    */
+  /**
+   * Set of top-level block keywords that define context
+   */
+  static BLOCK_KEYWORDS = new Set([
+    TokenType.VIEW, TokenType.STYLE, TokenType.STATE,
+    TokenType.ACTIONS, TokenType.ROUTER, TokenType.STORE
+  ]);
+
   tokenize() {
     this.tokens = [];
-    let inViewBlock = false;
-    let braceDepth = 0;
+    this._currentBlock = null;
+    this._blockDepth = 0;
+    let _pendingBlock = null; // keyword waiting for its opening brace
 
     while (!this.isEOF()) {
       this.skipWhitespace();
@@ -645,20 +666,35 @@ export class Lexer {
       switch (char) {
         case '{':
           this.advance();
-          braceDepth++;
+          if (_pendingBlock) {
+            this._currentBlock = _pendingBlock;
+            this._blockDepth = 1;
+            this._parenDepth = 0;
+            _pendingBlock = null;
+          } else if (this._currentBlock) {
+            this._blockDepth++;
+          }
           this.tokens.push(new Token(TokenType.LBRACE, '{', startLine, startColumn));
           continue;
         case '}':
           this.advance();
-          braceDepth--;
+          if (this._currentBlock) {
+            this._blockDepth--;
+            if (this._blockDepth === 0) {
+              this._currentBlock = null;
+              this._parenDepth = 0;
+            }
+          }
           this.tokens.push(new Token(TokenType.RBRACE, '}', startLine, startColumn));
           continue;
         case '(':
           this.advance();
+          if (this._currentBlock) this._parenDepth++;
           this.tokens.push(new Token(TokenType.LPAREN, '(', startLine, startColumn));
           continue;
         case ')':
           this.advance();
+          if (this._currentBlock) this._parenDepth--;
           this.tokens.push(new Token(TokenType.RPAREN, ')', startLine, startColumn));
           continue;
         case '[':
@@ -875,9 +911,14 @@ export class Lexer {
         const forceIdent = inStyle && cssReservedWords.has(word);
 
         if (shouldBeKeyword) {
-          this.tokens.push(this.readIdentifier(false));
+          const token = this.readIdentifier(false);
+          this.tokens.push(token);
+          // Track top-level block keywords for context detection
+          if (Lexer.BLOCK_KEYWORDS.has(token.type) && !this._currentBlock) {
+            _pendingBlock = token.type.toLowerCase();
+          }
         } else if (this.isViewContext() && this.couldBeSelector()) {
-          // Only treat as selector if not a keyword
+          // Only treat as selector if in view context (checks paren depth)
           this.tokens.push(this.readSelector());
         } else {
           this.tokens.push(this.readIdentifier(forceIdent));
@@ -896,23 +937,10 @@ export class Lexer {
 
   /**
    * Check if we're in a style context (inside style block)
+   * Uses tracked block context for O(1) lookup
    */
   isStyleContext() {
-    // Look back through tokens for 'style' keyword
-    for (let i = this.tokens.length - 1; i >= 0; i--) {
-      const token = this.tokens[i];
-      if (token.type === TokenType.STYLE) {
-        return true;
-      }
-      if (token.type === TokenType.STATE ||
-          token.type === TokenType.VIEW ||
-          token.type === TokenType.ACTIONS ||
-          token.type === TokenType.ROUTER ||
-          token.type === TokenType.STORE) {
-        return false;
-      }
-    }
-    return false;
+    return this._currentBlock === 'style';
   }
 
   /**
@@ -933,11 +961,13 @@ export class Lexer {
 
   /**
    * Check if we're in a view context where selectors are expected
+   * Uses tracked block context and paren depth for O(1) lookup
    */
   isViewContext() {
-    // Look back through tokens for 'view' keyword
-    let inView = false;
-    let parenDepth = 0;
+    if (this._currentBlock !== 'view') return false;
+
+    // Inside parentheses = expression context, not selector context
+    if (this._parenDepth > 0) return false;
 
     // After @ token, next word is directive name (not selector)
     const lastToken = this.tokens[this.tokens.length - 1];
@@ -945,36 +975,7 @@ export class Lexer {
       return false;
     }
 
-    for (let i = this.tokens.length - 1; i >= 0; i--) {
-      const token = this.tokens[i];
-
-      // Track parentheses depth (backwards)
-      if (token.type === TokenType.RPAREN) {
-        parenDepth++;
-      } else if (token.type === TokenType.LPAREN) {
-        parenDepth--;
-        // If we go negative, we're inside parentheses (expression context)
-        if (parenDepth < 0) {
-          return false;  // Inside expression, not selector context
-        }
-      }
-
-      if (token.type === TokenType.VIEW) {
-        inView = true;
-        break;
-      }
-      if (token.type === TokenType.STATE ||
-          token.type === TokenType.ACTIONS ||
-          token.type === TokenType.STYLE ||
-          token.type === TokenType.ROUTER ||
-          token.type === TokenType.STORE ||
-          token.type === TokenType.ROUTES ||
-          token.type === TokenType.GETTERS) {
-        return false;
-      }
-    }
-
-    return inView;
+    return true;
   }
 
   /**

package/compiler/parser/core.js

@@ -39,6 +39,7 @@ export const NodeType = {
   A11yDirective: 'A11yDirective',
   LiveDirective: 'LiveDirective',
   FocusTrapDirective: 'FocusTrapDirective',
+  SrOnlyDirective: 'SrOnlyDirective',
 
   // SSR directives
   ClientDirective: 'ClientDirective',

package/compiler/parser/state.js

@@ -34,15 +34,19 @@ Parser.prototype.parsePropsBlock = function() {
 };
 
 /**
- * Parse a props property (name: defaultValue)
+ * Parse a property declaration (name: value) — shared by props and state blocks
  */
-Parser.prototype.parsePropsProperty = function() {
+Parser.prototype.parseProperty = function() {
   const name = this.expect(TokenType.IDENT);
   this.expect(TokenType.COLON);
   const value = this.parseValue();
   return new ASTNode(NodeType.Property, { name: name.value, value });
 };
 
+// Aliases for semantic clarity in callers
+Parser.prototype.parsePropsProperty = Parser.prototype.parseProperty;
+Parser.prototype.parseStateProperty = Parser.prototype.parseProperty;
+
 // ============================================================
 // State Block Parsing
 // ============================================================
@@ -63,16 +67,6 @@ Parser.prototype.parseStateBlock = function() {
   return new ASTNode(NodeType.StateBlock, { properties });
 };
 
-/**
- * Parse a state property
- */
-Parser.prototype.parseStateProperty = function() {
-  const name = this.expect(TokenType.IDENT);
-  this.expect(TokenType.COLON);
-  const value = this.parseValue();
-  return new ASTNode(NodeType.Property, { name: name.value, value });
-};
-
 // ============================================================
 // Value Parsing Utilities
 // ============================================================

package/compiler/parser/style.js

@@ -59,6 +59,8 @@ Parser.prototype.parseStyleBlock = function() {
     // Parsing failed - likely preprocessor syntax (LESS/SASS/Stylus)
     parseError = error;
     rules = []; // Clear any partial parse
+    // Warn so users know structured CSS parsing fell back to raw mode
+    console.warn(`[pulse] CSS parse warning: falling back to raw mode — ${error.message}`);
   }
 
   // Restore position to after the closing }
@@ -195,7 +197,10 @@ Parser.prototype.parseStyleRule = function() {
 };
 
 /**
- * Check if current position is a nested rule
+ * Check if current position is a nested rule.
+ * Scans forward for the first decisive token ({, :, or }) to determine
+ * if this is a nested rule (selector) or a property declaration.
+ * Bounded lookahead prevents O(n²) on deeply nested CSS.
  */
 Parser.prototype.isNestedRule = function() {
   const currentToken = this.peek(0);
@@ -207,35 +212,27 @@ Parser.prototype.isNestedRule = function() {
   }
 
   const startLine = currentToken.line;
-  let i = 0;
+  // Bounded lookahead — selectors/property names are never longer than ~50 tokens
+  const maxLookahead = 50;
 
-  while (this.peek(i) && this.peek(i).type !== TokenType.EOF) {
+  for (let i = 0; i < maxLookahead; i++) {
     const token = this.peek(i);
+    if (!token || token.type === TokenType.EOF) return false;
 
-    // Found { before : - this is a nested rule
+    // Found { before : → nested rule
     if (token.type === TokenType.LBRACE) return true;
 
-    // Found : - this is a property, not a nested rule
+    // Found : before { → property declaration
     if (token.type === TokenType.COLON) return false;
 
-    // Found } - end of current rule
+    // Found } → end of current rule block
     if (token.type === TokenType.RBRACE) return false;
 
-    if (token.line > startLine && i > 0) {
-      const nextLine = token.line;
-      let j = i;
-      while (this.peek(j) && this.peek(j).line === nextLine) {
-        const t = this.peek(j);
-        if (t.type === TokenType.LBRACE) return true;
-        if (t.type === TokenType.COLON) return false;
-        if (t.type === TokenType.RBRACE) return false;
-        j++;
-      }
-      return false;
-    }
-
-    i++;
+    // If we've moved past the starting line without finding a decisive token,
+    // default to property (most common case in CSS)
+    if (i > 0 && token.line > startLine) return false;
   }
+
   return false;
 };
 

package/compiler/parser/view.js

@@ -622,7 +622,5 @@ Parser.prototype.parseFocusTrapDirective = function() {
  * Parse @srOnly directive - visually hidden but accessible text
  */
 Parser.prototype.parseSrOnlyDirective = function() {
-  return new ASTNode(NodeType.A11yDirective, {
-    attrs: { srOnly: true }
-  });
+  return new ASTNode(NodeType.SrOnlyDirective, {});
 };