samey-cli 0.0.0-stage → 0.1.0

package/dist/security/net-policy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Network policy for everything samey fetches, in the browser or from Node.
+ *
+ * Remote audits may only reach public addresses. Loopback and private ranges need an
+ * explicit development mode. Link-local, reserved, and cloud metadata addresses are never
+ * reachable. Every hostname is resolved before connecting, every resolved address must be
+ * allowed, and the connection is pinned to the address that was checked, so a DNS answer
+ * cannot change between validation and use (DNS rebinding).
+ */
+export type AddressKind = 'public' | 'loopback' | 'private' | 'link-local' | 'reserved' | 'metadata';
+export interface NetworkPolicy {
+    allowLoopback: boolean;
+    allowPrivate: boolean;
+    /** Test seam: replaces DNS resolution. */
+    resolver?: (hostname: string) => Promise<{
+        address: string;
+        family: 4 | 6;
+    }[]>;
+    /** Test seam: overrides address classification. */
+    classify?: (ip: string) => AddressKind;
+}
+export declare const REMOTE_POLICY: NetworkPolicy;
+export declare const DEV_POLICY: NetworkPolicy;
+export declare class BlockedError extends Error {
+    readonly url: string;
+    constructor(message: string, url: string);
+}
+/** Expands an IPv6 address to eight 16-bit groups, handling `::` and an embedded dotted IPv4 tail. */
+export declare function expandV6(ip: string): number[];
+export declare function classifyIp(ip: string): AddressKind;
+export declare function kindAllowed(kind: AddressKind, policy: NetworkPolicy): boolean;
+export interface ResolvedTarget {
+    url: URL;
+    address: string;
+    family: 4 | 6;
+}
+/** Syntax checks that need no network: scheme, credentials, literal addresses, localhost names. */
+export declare function checkUrlSyntax(raw: string | URL, policy: NetworkPolicy): URL;
+/**
+ * Resolves the URL's host and checks every address. All addresses must be allowed: a name
+ * that resolves to both a public and a private address is rejected, because the client
+ * cannot control which one a later lookup returns.
+ */
+export declare function resolveTarget(raw: string | URL, policy: NetworkPolicy): Promise<ResolvedTarget>;
+/** Removes credentials, query, and fragment so a URL is safe to show in reports and logs. */
+export declare function displayUrl(raw: string): string;

package/dist/security/net-policy.js

@@ -0,0 +1,178 @@
+import { lookup as dnsLookup } from 'node:dns/promises';
+import net from 'node:net';
+export const REMOTE_POLICY = { allowLoopback: false, allowPrivate: false };
+export const DEV_POLICY = { allowLoopback: true, allowPrivate: true };
+export class BlockedError extends Error {
+    url;
+    constructor(message, url) {
+        super(message);
+        this.url = url;
+    }
+}
+const METADATA = new Set(['169.254.169.254', '100.100.100.200', '168.63.129.16', 'fd00:ec2::254']);
+function v4ToInt(ip) {
+    return ip.split('.').reduce((acc, o) => (acc << 8) + Number(o), 0) >>> 0;
+}
+const V4_RANGES = [
+    ['0.0.0.0', 8, 'reserved'],
+    ['10.0.0.0', 8, 'private'],
+    ['100.64.0.0', 10, 'private'], // carrier-grade NAT
+    ['127.0.0.0', 8, 'loopback'],
+    ['169.254.0.0', 16, 'link-local'],
+    ['172.16.0.0', 12, 'private'],
+    ['192.0.0.0', 24, 'reserved'],
+    ['192.0.2.0', 24, 'reserved'],
+    ['192.88.99.0', 24, 'reserved'],
+    ['192.168.0.0', 16, 'private'],
+    ['198.18.0.0', 15, 'reserved'],
+    ['198.51.100.0', 24, 'reserved'],
+    ['203.0.113.0', 24, 'reserved'],
+    ['224.0.0.0', 4, 'reserved'], // multicast
+    ['240.0.0.0', 4, 'reserved'], // includes 255.255.255.255
+];
+function classifyV4(ip) {
+    if (METADATA.has(ip))
+        return 'metadata';
+    const n = v4ToInt(ip);
+    for (const [base, bits, kind] of V4_RANGES) {
+        const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+        if ((n & mask) === (v4ToInt(base) & mask))
+            return kind;
+    }
+    return 'public';
+}
+/** Expands an IPv6 address to eight 16-bit groups, handling `::` and an embedded dotted IPv4 tail. */
+export function expandV6(ip) {
+    let s = ip.toLowerCase().replace(/%.*$/, '');
+    const dotted = s.match(/(\d+\.\d+\.\d+\.\d+)$/);
+    if (dotted) {
+        const n = v4ToInt(dotted[1]);
+        s = s.slice(0, -dotted[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
+    }
+    const [head, tail] = s.includes('::') ? s.split('::') : [s, undefined];
+    const h = head ? head.split(':') : [];
+    const t = tail !== undefined && tail !== '' ? tail.split(':') : [];
+    const fill = tail !== undefined ? 8 - h.length - t.length : 0;
+    return [...h, ...Array(fill).fill('0'), ...t].map((g) => parseInt(g, 16) || 0);
+}
+function classifyV6(ip) {
+    const g = expandV6(ip);
+    const compact = g.map((x) => x.toString(16)).join(':');
+    if (METADATA.has(ip.toLowerCase()) || compact === 'fd00:ec2:0:0:0:0:0:254')
+        return 'metadata';
+    const embedded = (hi, lo) => `${hi >>> 8}.${hi & 0xff}.${lo >>> 8}.${lo & 0xff}`;
+    const zeroPrefix = (n) => g.slice(0, n).every((x) => x === 0);
+    if (g.every((x) => x === 0))
+        return 'reserved'; // ::
+    if (zeroPrefix(7) && g[7] === 1)
+        return 'loopback'; // ::1
+    if (zeroPrefix(5) && g[5] === 0xffff)
+        return classifyV4(embedded(g[6], g[7])); // ::ffff:a.b.c.d mapped
+    if (zeroPrefix(6))
+        return 'reserved'; // deprecated IPv4-compatible
+    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0))
+        return classifyV4(embedded(g[6], g[7])); // NAT64
+    if (g[0] === 0x2002)
+        return classifyV4(embedded(g[1], g[2])); // 6to4
+    if (g[0] === 0x2001 && g[1] === 0)
+        return 'reserved'; // Teredo
+    if (g[0] === 0x2001 && g[1] === 0xdb8)
+        return 'reserved'; // documentation
+    if (g[0] === 0x100 && g.slice(1, 4).every((x) => x === 0))
+        return 'reserved'; // discard
+    if ((g[0] & 0xfe00) === 0xfc00)
+        return 'private'; // unique local
+    if ((g[0] & 0xffc0) === 0xfe80)
+        return 'link-local';
+    if ((g[0] & 0xffc0) === 0xfec0)
+        return 'private'; // deprecated site-local
+    if ((g[0] & 0xff00) === 0xff00)
+        return 'reserved'; // multicast
+    return 'public';
+}
+export function classifyIp(ip) {
+    const bare = ip.replace(/^\[|\]$/g, '');
+    const v = net.isIP(bare);
+    if (v === 4)
+        return classifyV4(bare);
+    if (v === 6)
+        return classifyV6(bare);
+    return 'reserved';
+}
+export function kindAllowed(kind, policy) {
+    if (kind === 'public')
+        return true;
+    if (kind === 'loopback')
+        return policy.allowLoopback;
+    if (kind === 'private')
+        return policy.allowPrivate;
+    return false;
+}
+/** Syntax checks that need no network: scheme, credentials, literal addresses, localhost names. */
+export function checkUrlSyntax(raw, policy) {
+    let u;
+    try {
+        u = typeof raw === 'string' ? new URL(raw) : raw;
+    }
+    catch {
+        throw new BlockedError(`Not a valid URL: ${String(raw)}`, String(raw));
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:')
+        throw new BlockedError(`Only http and https URLs are allowed (got ${u.protocol})`, u.href);
+    if (u.username || u.password)
+        throw new BlockedError('URLs with embedded credentials are not allowed', u.origin);
+    const host = u.hostname.replace(/^\[|\]$/g, '');
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        if (!policy.allowLoopback)
+            throw new BlockedError(`${host} is a loopback address`, u.href);
+    }
+    if (net.isIP(host)) {
+        const kind = (policy.classify ?? classifyIp)(host);
+        if (!kindAllowed(kind, policy))
+            throw new BlockedError(`${host} is a ${kind} address`, u.href);
+    }
+    return u;
+}
+/**
+ * Resolves the URL's host and checks every address. All addresses must be allowed: a name
+ * that resolves to both a public and a private address is rejected, because the client
+ * cannot control which one a later lookup returns.
+ */
+export async function resolveTarget(raw, policy) {
+    const u = checkUrlSyntax(raw, policy);
+    const host = u.hostname.replace(/^\[|\]$/g, '');
+    const classify = policy.classify ?? classifyIp;
+    let addrs;
+    if (net.isIP(host))
+        addrs = [{ address: host, family: net.isIP(host) }];
+    else {
+        try {
+            addrs = policy.resolver ? await policy.resolver(host) : (await dnsLookup(host, { all: true, verbatim: true }));
+        }
+        catch (err) {
+            throw new BlockedError(`Could not resolve ${host}: ${err.code ?? err.message}`, u.href);
+        }
+    }
+    if (!addrs.length)
+        throw new BlockedError(`${host} did not resolve to any address`, u.href);
+    for (const a of addrs) {
+        const kind = classify(a.address);
+        if (!kindAllowed(kind, policy))
+            throw new BlockedError(`${host} resolves to ${a.address}, a ${kind} address`, u.href);
+    }
+    return { url: u, address: addrs[0].address, family: addrs[0].family };
+}
+/** Removes credentials, query, and fragment so a URL is safe to show in reports and logs. */
+export function displayUrl(raw) {
+    try {
+        const u = new URL(raw);
+        u.username = '';
+        u.password = '';
+        u.search = '';
+        u.hash = '';
+        return u.href;
+    }
+    catch {
+        return raw.replace(/\?.*$/, '');
+    }
+}

package/dist/static/scan.d.ts

@@ -0,0 +1,15 @@
+import type { RepoFacts, SourceFile } from '../types.js';
+/** Directory that can be served as a static site without running any project code. */
+export declare function findStaticRoot(root: string, pkg: Record<string, unknown> | null): string | undefined;
+export declare function routeHints(files: SourceFile[]): string[];
+export declare function scanRepo(root: string): RepoFacts;
+/** Finds the 1-based line of the first occurrence of `needle` in `content`. */
+export declare function lineOf(content: string, index: number): number;
+/**
+ * Locates rendered text in the source tree. Only exact, unique-enough matches are
+ * returned so that reported source locations are trustworthy.
+ */
+export declare function locateText(files: SourceFile[], text: string, max?: number, pagePath?: string): {
+    file: string;
+    line: number;
+}[];

package/dist/static/scan.js

@@ -0,0 +1,191 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+const IGNORED_DIRS = new Set([
+    'node_modules', '.git', '.hg', '.svn', 'dist', 'build', 'out', '.next', '.nuxt', '.svelte-kit', '.astro', '.output',
+    '.vercel', '.netlify', '.turbo', '.cache', '.parcel-cache', 'coverage', '.samey', 'vendor', '__pycache__', '.venv', 'venv', 'storybook-static',
+]);
+const SOURCE_EXT = new Set(['.html', '.htm', '.jsx', '.tsx', '.js', '.ts', '.mjs', '.vue', '.svelte', '.astro', '.css', '.scss', '.sass', '.less', '.mdx']);
+const MAX_FILES = 3000;
+const MAX_BYTES = 400_000;
+const FRAMEWORKS = [
+    ['next', 'Next.js'], ['nuxt', 'Nuxt'], ['@sveltejs/kit', 'SvelteKit'], ['svelte', 'Svelte'], ['astro', 'Astro'], ['@remix-run/react', 'Remix'],
+    ['react-router', 'React Router'], ['react', 'React'], ['vue', 'Vue'], ['solid-js', 'Solid'], ['@angular/core', 'Angular'], ['gatsby', 'Gatsby'],
+    ['vite', 'Vite'], ['tailwindcss', 'Tailwind CSS'], ['@shadcn/ui', 'shadcn/ui'], ['framer-motion', 'Framer Motion'], ['motion', 'Motion'],
+    ['lucide-react', 'Lucide'], ['@radix-ui/react-slot', 'Radix UI'], ['styled-components', 'styled-components'], ['@emotion/react', 'Emotion'],
+];
+function walk(root, rel, out, state) {
+    let entries;
+    try {
+        entries = readdirSync(path.join(root, rel));
+    }
+    catch {
+        return;
+    }
+    for (const name of entries.sort()) {
+        if (state.count >= MAX_FILES) {
+            state.truncated = true;
+            return;
+        }
+        const relPath = rel ? `${rel}/${name}` : name;
+        const abs = path.join(root, relPath);
+        let st;
+        try {
+            st = statSync(abs);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            if (IGNORED_DIRS.has(name) || (name.startsWith('.') && name !== '.storybook'))
+                continue;
+            walk(root, relPath, out, state);
+            continue;
+        }
+        const ext = path.extname(name).toLowerCase();
+        if (!SOURCE_EXT.has(ext) || st.size > MAX_BYTES)
+            continue;
+        if (/\.(?:min|bundle)\.(?:js|css)$/.test(name) || /\.d\.ts$/.test(name))
+            continue;
+        if (/(?:^|\/)(?:test|tests|__tests__|e2e|fixtures?)\//.test(relPath) || /\.(?:test|spec|stories)\.[jt]sx?$/.test(name))
+            continue;
+        state.count++;
+        out.push({ path: relPath, ext, content: readFileSync(abs, 'utf8') });
+    }
+}
+/** Directory that can be served as a static site without running any project code. */
+export function findStaticRoot(root, pkg) {
+    for (const dir of ['out', 'dist', 'build', '_site', 'public_html', 'site']) {
+        if (existsSync(path.join(root, dir, 'index.html')))
+            return path.join(root, dir);
+    }
+    if (existsSync(path.join(root, 'index.html'))) {
+        // A Vite-style index.html points at uncompiled modules and cannot be served as-is.
+        const html = readFileSync(path.join(root, 'index.html'), 'utf8');
+        const needsBundler = /<script[^>]+src=["'][^"']+\.(?:tsx?|jsx)["']/.test(html);
+        const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+        if (!needsBundler && !deps.next && !deps.astro && !deps['@sveltejs/kit'])
+            return root;
+    }
+    return undefined;
+}
+export function routeHints(files) {
+    const routes = new Set();
+    for (const f of files) {
+        const p = f.path;
+        let m;
+        if ((m = p.match(/^(?:src\/)?app\/(.*?)\/?page\.(?:tsx|jsx|ts|js|mdx)$/))) {
+            const segs = m[1].split('/').filter((s) => s && !/^\(.*\)$/.test(s) && !s.startsWith('@'));
+            if (!segs.some((s) => s.startsWith('[') || s.startsWith('_')))
+                routes.add('/' + segs.join('/'));
+        }
+        else if ((m = p.match(/^(?:src\/)?pages\/(.*)\.(?:tsx|jsx|ts|js|vue|astro|md|mdx|html)$/))) {
+            const r = m[1].replace(/(?:^|\/)index$/, '');
+            if (!/\[|^_|\/_|^api(?:\/|$)/.test(r))
+                routes.add('/' + r);
+        }
+        else if ((m = p.match(/^(?:src\/)?routes\/(.*?)\/?\+page\.svelte$/))) {
+            const r = m[1].split('/').filter((s) => s && !/^\(.*\)$/.test(s));
+            if (!r.some((s) => s.startsWith('[')))
+                routes.add('/' + r.join('/'));
+        }
+        else if (/\.html?$/.test(p) && !p.includes('/') && p !== '404.html') {
+            routes.add(p === 'index.html' ? '/' : '/' + p.replace(/\.html?$/, ''));
+        }
+        if (/\.(?:jsx|tsx|js|ts)$/.test(p)) {
+            for (const r of f.content.matchAll(/\bpath\s*[:=]\s*["'](\/[a-z0-9/_-]*)["']/gi)) {
+                if (!r[1].includes(':') && !r[1].includes('*'))
+                    routes.add(r[1]);
+            }
+        }
+    }
+    return [...routes].map((r) => r.replace(/\/+$/, '') || '/').filter((r, i, a) => a.indexOf(r) === i).slice(0, 50);
+}
+export function scanRepo(root) {
+    const abs = path.resolve(root);
+    if (!existsSync(abs) || !statSync(abs).isDirectory())
+        throw new Error(`Not a directory: ${root}`);
+    let pkg = null;
+    try {
+        pkg = JSON.parse(readFileSync(path.join(abs, 'package.json'), 'utf8'));
+    }
+    catch {
+        pkg = null;
+    }
+    const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+    const frameworks = FRAMEWORKS.filter(([dep]) => dep in deps).map(([, label]) => label);
+    const packageManager = existsSync(path.join(abs, 'pnpm-lock.yaml'))
+        ? 'pnpm'
+        : existsSync(path.join(abs, 'yarn.lock'))
+            ? 'yarn'
+            : existsSync(path.join(abs, 'bun.lockb')) || existsSync(path.join(abs, 'bun.lock'))
+                ? 'bun'
+                : existsSync(path.join(abs, 'package-lock.json'))
+                    ? 'npm'
+                    : undefined;
+    const files = [];
+    const state = { count: 0, truncated: false };
+    walk(abs, '', files, state);
+    if (frameworks.length === 0 && files.some((f) => f.ext === '.html'))
+        frameworks.push('Static HTML');
+    return {
+        root: abs,
+        name: pkg?.name ?? path.basename(abs),
+        frameworks,
+        packageManager,
+        scripts: pkg?.scripts ?? {},
+        files,
+        fileCount: files.length,
+        truncated: state.truncated,
+        routeHints: routeHints(files),
+        staticRoot: findStaticRoot(abs, pkg),
+    };
+}
+/** Finds the 1-based line of the first occurrence of `needle` in `content`. */
+export function lineOf(content, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < content.length; i++)
+        if (content.charCodeAt(i) === 10)
+            line++;
+    return line;
+}
+/**
+ * Locates rendered text in the source tree. Only exact, unique-enough matches are
+ * returned so that reported source locations are trustworthy.
+ */
+export function locateText(files, text, max = 3, pagePath) {
+    const needle = text.replace(/\s+/g, ' ').trim().slice(0, 48);
+    if (needle.length < 12)
+        return [];
+    const out = [];
+    // When the same text exists in several files, prefer the one named after the page it was seen on.
+    const page = (pagePath ?? '').replace(/^\/+|\/+$/g, '').split('/').pop() || 'index';
+    const rank = (f) => (path.basename(f.path).replace(/\.[^.]+$/, '') === page || f.path.includes(`/${page}/`) ? 0 : 1);
+    for (const f of [...files].sort((a, b) => rank(a) - rank(b))) {
+        if (f.ext === '.css' || f.ext === '.scss')
+            continue;
+        const { flat, map } = collapse(f.content);
+        const idx = flat.indexOf(needle);
+        if (idx < 0)
+            continue;
+        out.push({ file: f.path, line: lineOf(f.content, map[idx]) });
+        if (out.length >= max)
+            break;
+    }
+    return out;
+}
+/** Collapses whitespace runs to single spaces, keeping a map back to original offsets. */
+function collapse(content) {
+    const map = [];
+    let flat = '';
+    let prevSpace = false;
+    for (let i = 0; i < content.length; i++) {
+        const ch = content[i];
+        const space = ch === ' ' || ch === '\n' || ch === '\t' || ch === '\r';
+        if (space && prevSpace)
+            continue;
+        flat += space ? ' ' : ch;
+        map.push(i);
+        prevSpace = space;
+    }
+    return { flat, map };
+}