superpowers-manager 0.5.1 → 0.5.2

package/dist/harnesses/codex/stored-state.js

@@ -0,0 +1,249 @@
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import { parse, TomlDate } from "smol-toml";
+import { SafetyError } from "../../safety-error.js";
+import { codexHome } from "./paths.js";
+const CONFIG_LIMIT = 1024 * 1024;
+const CONFIG_DEPTH_LIMIT = 64;
+const MANAGER_MARKETPLACE = "superpowers-manager";
+const LEGACY_MARKETPLACE = "superpowers-wrapper";
+const MANAGER_PLUGIN = `superpowers@${MANAGER_MARKETPLACE}`;
+const LEGACY_PLUGIN = `superpowers@${LEGACY_MARKETPLACE}`;
+const VERSION_SEGMENT = /^[A-Za-z0-9._+-]+$/u;
+const MARKETPLACE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+function storedError(message, cause) {
+    return new SafetyError("codex-stored-state", message, { cause });
+}
+function isErrno(cause, code) {
+    return (cause !== null &&
+        typeof cause === "object" &&
+        "code" in cause &&
+        cause.code === code);
+}
+function table(value, name) {
+    if (value === undefined)
+        return {};
+    if (value === null ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        value instanceof TomlDate ||
+        Object.getPrototypeOf(value) !== Object.prototype) {
+        throw storedError(`Codex configuration ${name} must be a table`);
+    }
+    return value;
+}
+async function readConfig(path) {
+    let handle;
+    try {
+        const initial = await lstat(path);
+        if (!initial.isFile() || initial.isSymbolicLink()) {
+            throw storedError(`Codex configuration must be a regular file: ${path}`);
+        }
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const before = await handle.stat();
+        if (!before.isFile() || before.size > CONFIG_LIMIT) {
+            throw storedError(`Codex configuration must be a bounded regular file: ${path}`);
+        }
+        const buffer = Buffer.alloc(CONFIG_LIMIT + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        const bytes = buffer.subarray(0, length);
+        const after = await handle.stat();
+        const pathAfter = await lstat(path);
+        if (bytes.length > CONFIG_LIMIT ||
+            bytes.length !== before.size ||
+            before.dev !== after.dev ||
+            before.ino !== after.ino ||
+            before.size !== after.size ||
+            before.mtimeMs !== after.mtimeMs ||
+            before.ctimeMs !== after.ctimeMs ||
+            before.dev !== pathAfter.dev ||
+            before.ino !== pathAfter.ino ||
+            !pathAfter.isFile() ||
+            pathAfter.isSymbolicLink()) {
+            throw storedError(`Codex configuration changed while being read: ${path}`);
+        }
+        let text;
+        try {
+            text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+        }
+        catch (cause) {
+            throw storedError(`Codex configuration is not valid UTF-8: ${path}`, cause);
+        }
+        try {
+            return parse(text, {
+                maxDepth: CONFIG_DEPTH_LIMIT,
+                integersAsBigInt: true,
+            });
+        }
+        catch (cause) {
+            throw storedError(`Codex configuration TOML is invalid: ${path}`, cause);
+        }
+    }
+    catch (cause) {
+        if (cause instanceof SafetyError && cause.module === "codex-stored-state") {
+            throw cause;
+        }
+        throw storedError(`cannot safely read Codex configuration: ${path}`, cause);
+    }
+    finally {
+        await handle?.close().catch(() => { });
+    }
+}
+function marketplaceRoot(marketplaces, name) {
+    const value = marketplaces[name];
+    if (value === undefined)
+        return null;
+    const entry = table(value, `marketplaces.${name}`);
+    if (entry.source_type !== "local" ||
+        typeof entry.source !== "string" ||
+        !isAbsolute(entry.source)) {
+        throw storedError(`Codex marketplace ${name} must name an absolute local source`);
+    }
+    return entry.source;
+}
+async function requireMissingManagerSource(path) {
+    try {
+        await lstat(path);
+    }
+    catch (cause) {
+        if (isErrno(cause, "ENOENT"))
+            return;
+        throw storedError(`cannot inspect Codex marketplace source: ${path}`, cause);
+    }
+    throw storedError(`Codex marketplace source is not missing: ${path}`);
+}
+function validVersionSegment(value) {
+    return value !== "." && value !== ".." && VERSION_SEGMENT.test(value);
+}
+async function cachedVersionPresent(searchRoot, marketplace) {
+    if (!MARKETPLACE_SEGMENT.test(marketplace))
+        return null;
+    let base = searchRoot;
+    for (const segment of ["plugins", "cache", marketplace, "superpowers"]) {
+        let details;
+        try {
+            details = await lstat(base);
+        }
+        catch (cause) {
+            if (isErrno(cause, "ENOENT"))
+                return false;
+            throw storedError(`cannot inspect Codex plugin cache: ${base}`, cause);
+        }
+        if (!details.isDirectory() || details.isSymbolicLink()) {
+            throw storedError(`Codex plugin cache must be a directory: ${base}`);
+        }
+        base = join(base, segment);
+    }
+    let before;
+    try {
+        before = await lstat(base);
+    }
+    catch (cause) {
+        if (isErrno(cause, "ENOENT"))
+            return false;
+        throw storedError(`cannot inspect Codex plugin cache: ${base}`, cause);
+    }
+    if (!before.isDirectory() || before.isSymbolicLink()) {
+        throw storedError(`Codex plugin cache must be a directory: ${base}`);
+    }
+    let names;
+    try {
+        names = await readdir(base);
+    }
+    catch (cause) {
+        throw storedError(`cannot inspect Codex plugin cache: ${base}`, cause);
+    }
+    let present = false;
+    for (const name of names) {
+        if (!validVersionSegment(name))
+            continue;
+        const candidate = join(base, name);
+        try {
+            const details = await lstat(candidate);
+            if (details.isSymbolicLink()) {
+                throw storedError(`Codex plugin cache entry must not be a symlink: ${candidate}`);
+            }
+            if (details.isDirectory() && !details.isSymbolicLink())
+                present = true;
+        }
+        catch (cause) {
+            if (!isErrno(cause, "ENOENT")) {
+                throw storedError(`cannot inspect Codex plugin cache entry: ${candidate}`, cause);
+            }
+        }
+    }
+    let after;
+    try {
+        after = await lstat(base);
+    }
+    catch (cause) {
+        throw storedError(`cannot verify Codex plugin cache: ${base}`, cause);
+    }
+    if (!after.isDirectory() ||
+        after.isSymbolicLink() ||
+        before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.mtimeMs !== after.mtimeMs) {
+        throw storedError(`Codex plugin cache changed while being inspected: ${base}`);
+    }
+    return present;
+}
+export async function readCodexStoredState(env, cwd) {
+    const root = codexHome(env, cwd);
+    try {
+        const details = await lstat(root);
+        if (!details.isDirectory() || details.isSymbolicLink()) {
+            throw storedError(`Codex home must be a directory: ${root}`);
+        }
+    }
+    catch (cause) {
+        if (cause instanceof SafetyError && cause.module === "codex-stored-state") {
+            throw cause;
+        }
+        throw storedError(`cannot inspect Codex home: ${root}`, cause);
+    }
+    const config = await readConfig(join(root, "config.toml"));
+    const marketplaces = table(config.marketplaces, "marketplaces");
+    const managerMarketplaceRoot = marketplaceRoot(marketplaces, MANAGER_MARKETPLACE);
+    if (managerMarketplaceRoot === null) {
+        throw storedError("Codex manager marketplace is not configured");
+    }
+    await requireMissingManagerSource(managerMarketplaceRoot);
+    const legacyMarketplaceRoot = marketplaceRoot(marketplaces, LEGACY_MARKETPLACE);
+    const plugins = table(config.plugins, "plugins");
+    const searchRoot = env.SUPERPOWERS_INSTALLED_SEARCH_ROOT || root;
+    const installed = [];
+    for (const [pluginId, rawEntry] of Object.entries(plugins)) {
+        const entry = table(rawEntry, `plugins.${pluginId}`);
+        if (typeof entry.enabled !== "boolean") {
+            throw storedError(`Codex plugin ${pluginId} has invalid enabled state`);
+        }
+        if (!pluginId.startsWith("superpowers@"))
+            continue;
+        const marketplace = pluginId.slice("superpowers@".length);
+        installed.push({
+            pluginId,
+            installed: await cachedVersionPresent(searchRoot, marketplace),
+            enabled: entry.enabled === true,
+        });
+    }
+    const byId = (id) => installed.find((plugin) => plugin.pluginId === id);
+    const manager = byId(MANAGER_PLUGIN);
+    const legacy = byId(LEGACY_PLUGIN);
+    return {
+        managerMarketplaceRoot,
+        legacyMarketplaceRoot,
+        managerPluginPresent: manager?.installed === true,
+        managerPluginEnabled: manager?.enabled === true,
+        legacyPluginPresent: legacy?.installed === true,
+        legacyPluginEnabled: legacy?.enabled === true,
+        installedListingJson: JSON.stringify({ installed }),
+    };
+}

package/dist/provenance.js

@@ -4,16 +4,16 @@ import { COMMIT_INPUT_RE } from "./domain/refs.js";
 import { escapePythonJsonString } from "./python-json.js";
 import { SafetyError } from "./safety-error.js";
 import { parseStrictJson, } from "./strict-json.js";
-export const PROVENANCE_STRICT_PROFILE = {
+const PROVENANCE_STRICT_PROFILE = {
     duplicateKeys: "last-wins",
     nonStandardConstants: "reject",
     maxDepth: 256,
 };
-export const PROVENANCE_LENIENT_PROFILE = {
+const PROVENANCE_LENIENT_PROFILE = {
     duplicateKeys: "last-wins",
     nonStandardConstants: "reject",
 };
-export const PROVENANCE_CODEX_SOURCE_PROFILE = {
+const PROVENANCE_CODEX_SOURCE_PROFILE = {
     duplicateKeys: "last-wins",
     nonStandardConstants: "accept",
 };

package/node_modules/smol-toml/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) Squirrel Chat et al., All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.