sourcemonkey 0.0.0-stage → 0.5.0

package/dist/extension/channel.js

@@ -0,0 +1,133 @@
+// The channel key: a random secret, one per install, baked into the code
+// we register, that keeps the page out of what our page-world (MAIN)
+// pieces share. See docs/injection.md#the-channel-key.
+//
+// Two things use it:
+//   - The registry. Our MAIN-world entries (each script's config, prelude
+//     and program, the GM runtime) are separate scripts, so they meet
+//     through the document. Each gets the one shared registry object from
+//     `document.__smGate(key)`, which hands it out only for the key. The
+//     page can see the gate but can't call it usefully, and can't
+//     replace it: it's defined at document_start, before any page script,
+//     non-writable and non-configurable.
+//   - The bridge's events. Their names end in the key, so the page can
+//     neither send nor hear them.
+//
+// The page never sees the key: it is only ever in code Chrome injects
+// (which the page can't read), and only in top-level statements and in
+// functions that run before any page script, never in one the page could
+// get hold of later (through `.caller`, or a stack trace's call sites)
+// and `toString`. See docs/injection.md#the-channel-key.
+import { CHANNEL_KEY_PLACEHOLDER } from '../channel-placeholder.js';
+import { assertWorkerContext } from '../run-context.js';
+const STORAGE_KEY = 'channelKey';
+let key = null;
+// Whether this is the extension itself, rather than unit tests building
+// code under Node (with whatever `chrome` stub a test installs).
+function inExtension() {
+    return globalThis.location?.protocol === 'chrome-extension:';
+}
+// The key, made and stored the first time, and again for each new
+// extension version: a key that leaked stops working at the next update,
+// which places every registration again anyway. Every spec build awaits
+// this before building. One load at a time, so two first callers can't
+// each make a key.
+let loading = null;
+export function loadChannelKey() {
+    if (key)
+        return Promise.resolve(key);
+    if (!inExtension())
+        return Promise.resolve(CHANNEL_KEY_PLACEHOLDER);
+    loading ??= readOrMakeKey().finally(() => { loading = null; });
+    return loading;
+}
+async function readOrMakeKey() {
+    const version = chrome.runtime.getManifest().version;
+    const got = (await chrome.storage.local.get(STORAGE_KEY))[STORAGE_KEY];
+    if (got && typeof got.key === 'string' && /^[0-9a-f]{32}$/.test(got.key) && got.version === version) {
+        key = got.key;
+        return key;
+    }
+    assertWorkerContext('write storage');
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    const made = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    await chrome.storage.local.set({ [STORAGE_KEY]: { key: made, version } });
+    key = made;
+    return key;
+}
+// The key, once `loadChannelKey` has run. Under Node (unit tests) the
+// placeholder.
+export function channelKey() {
+    if (key)
+        return key;
+    if (!inExtension())
+        return CHANNEL_KEY_PLACEHOLDER;
+    throw new Error('Internal error: The channel key was used before it was loaded');
+}
+// `code` (a static wrapper file) with the key in place of the stand-in.
+// Throws if the stand-in isn't there: every install would otherwise
+// share the stand-in as its key.
+export function withChannelKey(code) {
+    const stand = JSON.stringify(CHANNEL_KEY_PLACEHOLDER);
+    if (!code.includes(stand))
+        throw new Error('Internal error: A wrapper has no channel key stand-in');
+    return code.split(stand).join(JSON.stringify(channelKey()));
+}
+// A JavaScript expression for the shared registry, for generated code.
+// The first of our entries to run in a document defines the gate; the
+// rest call it. The static wrapper files carry the same code (`reg` in
+// each), and `tests/unit/channel.test.mjs` checks they stay in step.
+//
+// - On `document`, not `window`: a navigation from a frame's initial
+//   `about:blank` to a same-origin page keeps the Window, so a parent
+//   could plant a gate there before our code runs. Each navigation gets
+//   a new Document.
+// - One registry per key (a manual run's code has a key of its own; see
+//   `documentKey`), in an object with no prototype, read by bracket
+//   access: no `Map`, whose `get` the page could replace to see the
+//   key. A caller with any other string, the page included, gets an
+//   empty registry of its own.
+// - Registries have no prototype either, so reading a field one lacks
+//   can't hand it to a getter the page put on `Object.prototype`.
+// - Each carries built-ins as they were when the gate was made, for
+//   generated code that runs after the page's: `apply`
+//   (Reflect.apply), `resolve` / `reject` (a promise made with the
+//   `Promise` constructor of then), `info` (console.info). See
+//   `emitGmBindings`.
+export function registryExpr() {
+    return '(function(k){var g=document.__smGate;if(typeof g!=="function"){'
+        + 'var m=Object.create(null),c=Object.create,a=Reflect.apply,p=Promise;'
+        + 'var i=console.info.bind(console);'
+        + 'var rs=function(v){return new p(function(y){y(v)})};var rj=function(e){return new p(function(y,n){n(e)})};'
+        + 'g=function(x){if(typeof x!=="string")return void 0;var r=m[x];'
+        + 'if(!r){r=c(null);r.apply=a;r.resolve=rs;r.reject=rj;r.info=i;m[x]=r}return r};'
+        + 'var d=c(null);d.value=g;Object.defineProperty(document,"__smGate",d)}return g(k)})'
+        + `(${JSON.stringify(channelKey())})`;
+}
+// The key a manual run of script `scriptId` gets in document
+// `documentId`, in place of the install's. A manual run's page-world code is injected long after
+// the page's own, so the built-ins it captures may be the page's
+// replacements, and either could hand the page whatever key the code
+// carries. This one opens only that document's bridge (the run injects
+// its own, `onlyScript` limiting it to the run's script), so a page that
+// got it reaches only that script there. Per script, so each script's
+// runs have a bridge of their own (another script's would filter them
+// out). The same in every run of the script in a document, so a run
+// replaces the last one's state. See docs/manual-scripts.md.
+export async function documentKey(documentId, scriptId) {
+    const data = new TextEncoder().encode(`${await loadChannelKey()}:${documentId}:${scriptId}`);
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', data));
+    return Array.from(digest.slice(0, 16), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+// `code` built under the install's key, rekeyed to `to`.
+export function rekey(code, to) {
+    return code.split(channelKey()).join(to);
+}
+// The bridge's code (built under the install's key) as a manual run's
+// bridge: relaying only `scriptId`'s traffic.
+export function onlyScript(bridgeCode, scriptId) {
+    const stand = JSON.stringify('__SM_ONLY__');
+    if (!bridgeCode.includes(stand))
+        throw new Error('Internal error: The bridge has no script stand-in');
+    return bridgeCode.split(stand).join(JSON.stringify(scriptId));
+}

package/dist/extension/code-links.js

@@ -0,0 +1,187 @@
+// Linkification of a Prism-highlighted code block, plus the anchor
+// builder both it and the details panel use.
+//
+// Split out of `userscript.ts` so the same pass runs over installed
+// scripts and over a not-yet-installed preview — the two share one
+// tabbed code view (see `code-tabs.ts`).
+//
+// Pure DOM helpers: everything takes the elements it operates on. No
+// chrome.* calls, no module state.
+import { appendWithSlashBreaks } from '../script-display.js';
+import { resolveScriptResource } from '../file-loader.js';
+import { matchTargetInfo, sameDirLinkUrl } from '../match-targets.js';
+import { MATCH_HEADER_TAGS, RESOLVABLE_HEADER_TAGS, connectLinkUrl, splitResourceValue, splitTextByUrls, } from '../script-links.js';
+export function openInNewTabAnchor(href, text, 
+// When true, insert `<wbr>` markers after each `/` so a long URL
+// wraps at slash boundaries — desired in the details panel (Match
+// patterns, Location row). The code box passes false: with
+// `white-space: pre`, Chrome still honors `<wbr>` as a break
+// opportunity, so a URL inside a single source line could wrap
+// mid-line and misalign the line-numbers gutter.
+slashBreaks = true) {
+    const a = document.createElement('a');
+    a.className = 'code-link';
+    a.href = href;
+    a.target = '_blank';
+    a.rel = 'noopener noreferrer';
+    if (slashBreaks) {
+        appendWithSlashBreaks(a, text);
+    }
+    else {
+        a.textContent = text;
+    }
+    return a;
+}
+// Post-Prism walk over the highlighted code: replace eligible text
+// runs with anchors. Two passes:
+//
+//   1. Metadata blocks are recognised as `.token.userscript-header`
+//      spans by the Prism grammar extension in `userscript.ts`; inside
+//      each, the `@tag` is a `.header-tag-name` span and its value is a
+//      `.header-tag-value` span. For tags we know how to linkify
+//      (@match → wildcard-trimmed link, @icon/@require/@updateURL/…
+//      → resolved against the script's fileUrl) the value span's
+//      contents become an anchor; non-linkable tags fall through to
+//      URL mode on the value text.
+//   2. Every other text node has its absolute http(s) / file:// URLs
+//      turned into anchors — covers comment URLs outside the header,
+//      URLs inside strings, and `@require` source bodies (no header).
+//
+// Driving the header detection off the Prism token class (rather
+// than line-shape matching) means a single-line string literal like
+// `"// ==UserScript=="` can't trick the linkifier — Prism tokenises
+// it as a string, not as our header block. A multi-line template
+// literal that contains BOTH markers can still be picked up because
+// our pattern is inserted before `string`/template tokens; in
+// practice no userscript embeds a fake metadata block that way, but
+// it's worth knowing.
+export function linkifyCodeBlock(root, fileUrl) {
+    for (const headerEl of Array.from(root.querySelectorAll('.userscript-header'))) {
+        linkifyHeaderBlock(headerEl, fileUrl);
+    }
+    // Walk text nodes AFTER the header pass so the tree mutations from
+    // linkifyHeaderBlock are reflected. Skip nodes inside marker /
+    // tag-name / tag-value spans — they were either handled by
+    // linkifyHeaderBlock or are anchor labels we just inserted and
+    // don't want to re-process.
+    const walker = root.ownerDocument.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+    const nodes = [];
+    let n;
+    while ((n = walker.nextNode()) !== null) {
+        const tn = n;
+        const parent = tn.parentElement;
+        if (parent && parent.closest('.header-marker, .header-tag-name, .header-tag-value')) {
+            continue;
+        }
+        nodes.push(tn);
+    }
+    for (const tn of nodes)
+        linkifyTextNodeUrls(tn);
+}
+// Process one `.userscript-header` span: for each `.header-tag-value`
+// inside it, look back for the matching `.header-tag-name` and turn
+// the value into an anchor (or URL-linkified text for tags we don't
+// know how to resolve).
+function linkifyHeaderBlock(headerEl, fileUrl) {
+    const valueEls = headerEl.querySelectorAll('.header-tag-value');
+    for (const valueEl of Array.from(valueEls)) {
+        const tag = findPrecedingTagName(valueEl);
+        if (!tag)
+            continue;
+        const value = valueEl.textContent ?? '';
+        const link = linkForHeaderTag(tag, value, fileUrl);
+        if (link) {
+            const doc = headerEl.ownerDocument;
+            valueEl.replaceChildren(doc.createTextNode(link.prefix), openInNewTabAnchor(link.href, link.linkText, false), doc.createTextNode(link.suffix));
+        }
+        else {
+            // Fall back to URL-only linkification (e.g. an http URL inside
+            // a `@description` value). Only touch the leaf text node so we
+            // don't disturb any nested tokens (shouldn't exist today, but
+            // safe if Prism's grammar evolves).
+            const tn = valueEl.firstChild;
+            if (tn && tn.nodeType === Node.TEXT_NODE) {
+                linkifyTextNodeUrls(tn);
+            }
+        }
+    }
+}
+// Walk back from a tag-value span past whitespace text nodes to find
+// the immediately-preceding tag-name span; returns the lowercased
+// canonical tag (no `@`, no locale suffix), or null if the structure
+// doesn't match (defensive — Prism should always pair them).
+function findPrecedingTagName(valueEl) {
+    let prev = valueEl.previousSibling;
+    while (prev) {
+        if (prev.nodeType === Node.ELEMENT_NODE) {
+            const el = prev;
+            if (!el.classList.contains('header-tag-name'))
+                return null;
+            const text = el.textContent ?? '';
+            const m = /^@([A-Za-z][\w-]*)(?::[\w-]+)?$/.exec(text);
+            return m ? m[1].toLowerCase() : null;
+        }
+        prev = prev.previousSibling;
+    }
+    return null;
+}
+function linkifyTextNodeUrls(tn) {
+    const runs = splitTextByUrls(tn.data);
+    if (runs.length === 1 && runs[0].kind === 'text')
+        return;
+    const doc = tn.ownerDocument;
+    const replacement = runs.map((r) => r.kind === 'url'
+        ? openInNewTabAnchor(r.value, r.value, false)
+        : doc.createTextNode(r.value));
+    tn.replaceWith(...replacement);
+}
+function linkForHeaderTag(tag, value, fileUrl) {
+    if (MATCH_HEADER_TAGS.has(tag)) {
+        // Site-less patterns (`*://*/…`, `file:///*/…`) fall through to the
+        // same-directory guess against the script's own location.
+        const linkUrl = matchTargetInfo(value)?.linkUrl ?? sameDirLinkUrl(value, fileUrl);
+        if (!linkUrl)
+            return null;
+        return { prefix: '', linkText: value, href: linkUrl, suffix: '' };
+    }
+    if (RESOLVABLE_HEADER_TAGS.has(tag)) {
+        const resolved = resolveScriptResource(value, fileUrl);
+        if (!resolved)
+            return null;
+        // A `data:` URL is technically navigable but its href would be
+        // many KB long inside the anchor, drowning the code box. Inline
+        // data URLs are already rendered via the favicon path; in the
+        // body we just show the value as plain text.
+        if (resolved.kind === 'data')
+            return null;
+        return { prefix: '', linkText: value, href: resolved.url, suffix: '' };
+    }
+    if (tag === 'resource') {
+        // `@resource <name> <url>`: keep the name + gap as plain text;
+        // linkify only the URL portion. The pure splitter in
+        // script-links.ts owns the round-trip — see `splitResourceValue`.
+        const parts = splitResourceValue(value);
+        if (!parts)
+            return null;
+        const resolved = resolveScriptResource(parts.url, fileUrl);
+        if (!resolved || resolved.kind === 'data')
+            return null;
+        return {
+            prefix: parts.prefix,
+            linkText: parts.url,
+            href: resolved.url,
+            suffix: parts.suffix,
+        };
+    }
+    if (tag === 'connect') {
+        // `@connect` values are hosts (`example.com`, `*.example.com`)
+        // or full URLs, not match patterns. `connectLinkUrl` picks the
+        // click target; `*` and `self` return null and fall through to
+        // plain text since neither names a single site.
+        const href = connectLinkUrl(value);
+        if (!href)
+            return null;
+        return { prefix: '', linkText: value, href, suffix: '' };
+    }
+    return null;
+}