toolcraft 0.0.50 → 0.0.52

package/node_modules/@poe-code/task-list/dist/backends/utils.js

@@ -36,8 +36,20 @@ export function sortStrings(values) {
 export function sortTasks(tasks) {
     return [...tasks].sort((left, right) => left.qualifiedId.localeCompare(right.qualifiedId));
 }
+export function isTrimmedPrintableIdentifier(value) {
+    if (value.length === 0 || value !== value.trim()) {
+        return false;
+    }
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < 32 || code === 127) {
+            return false;
+        }
+    }
+    return true;
+}
 export function validateTaskId(id) {
-    if (id.length === 0 ||
+    if (!isTrimmedPrintableIdentifier(id) ||
         id.startsWith(".") ||
         id.includes("/") ||
         id.includes("\\") ||
@@ -46,6 +58,12 @@ export function validateTaskId(id) {
     }
     return id;
 }
+export function validateTaskName(name) {
+    if (name.trim().length === 0) {
+        throw new Error("Task name must not be empty.");
+    }
+    return name;
+}
 export async function statIfExists(fs, filePath) {
     try {
         return await fs.stat(filePath);
@@ -66,6 +84,9 @@ export async function rejectSymbolicLinkComponents(fs, filePath) {
         currentPath = path.join(currentPath, component);
         try {
             if ((await fs.lstat(currentPath)).isSymbolicLink()) {
+                if (currentPath === "/tmp") {
+                    continue;
+                }
                 throw new Error(`Path "${filePath}" contains a symbolic link.`);
             }
         }
@@ -138,7 +159,7 @@ async function removeAbandonedLock(fs, lockPath) {
         throw error;
     }
     const owner = Number(content);
-    if (!Number.isInteger(owner) || owner <= 0 || isProcessRunning(owner)) {
+    if (Number.isInteger(owner) && owner > 0 && isProcessRunning(owner)) {
         return false;
     }
     try {

package/node_modules/@poe-code/task-list/dist/backends/yaml-file.js

@@ -5,7 +5,7 @@ import taskSchema from "../schema/task.schema.json" with { type: "json" };
 import { eventsFromState, findEvent } from "../state-machine.js";
 import { resolveStateMachine } from "../state.js";
 import { AnchorNotFoundError, InvalidTransitionError, MalformedTaskError, OrderMismatchError, TaskAlreadyExistsError, TaskNotFoundError } from "../types.js";
-import { applyOrder, isRecord, rejectSymbolicLinkComponents, sortStrings, statIfExists, validateTaskId, withFileLock, writeAtomically } from "./utils.js";
+import { applyOrder, isTrimmedPrintableIdentifier, isRecord, rejectSymbolicLinkComponents, sortStrings, statIfExists, validateTaskId, validateTaskName, withFileLock, writeAtomically } from "./utils.js";
 const STORE_KIND = "task-store";
 const STORE_SCHEMA_ID = storeSchema.$id;
 const STORE_VERSION = 1;
@@ -28,7 +28,7 @@ function malformedTask(list, id, field) {
     return new MalformedTaskError(`Malformed task "${list}/${id}": invalid "${field}".`);
 }
 function validateListName(name) {
-    if (name.length === 0 ||
+    if (!isTrimmedPrintableIdentifier(name) ||
         name.startsWith(".") ||
         name.includes("/") ||
         name.includes("\\") ||
@@ -171,9 +171,7 @@ function assertValidStoreRecord(store, filePath) {
         throw malformedStore(filePath, "kind");
     }
     const version = getOwnEntry(store, "version");
-    if (typeof version !== "number" ||
-        !Number.isInteger(version) ||
-        version !== STORE_VERSION) {
+    if (typeof version !== "number" || !Number.isInteger(version) || version !== STORE_VERSION) {
         throw malformedStore(filePath, "version");
     }
     if (!isRecord(getOwnEntry(store, "lists"))) {
@@ -184,7 +182,8 @@ function assertValidTaskRecord(taskRecord, list, id, validStates) {
     if (!isRecord(taskRecord)) {
         throw malformedTask(list, id, "task");
     }
-    if (hasOwnTaskField(taskRecord, "$schema") && getOwnEntry(taskRecord, "$schema") !== TASK_SCHEMA_ID) {
+    if (hasOwnTaskField(taskRecord, "$schema") &&
+        getOwnEntry(taskRecord, "$schema") !== TASK_SCHEMA_ID) {
         throw malformedTask(list, id, "$schema");
     }
     if (hasOwnTaskField(taskRecord, "kind") && getOwnEntry(taskRecord, "kind") !== TASK_KIND) {
@@ -192,16 +191,12 @@ function assertValidTaskRecord(taskRecord, list, id, validStates) {
     }
     if (hasOwnTaskField(taskRecord, "version")) {
         const version = getOwnEntry(taskRecord, "version");
-        if (typeof version !== "number" ||
-            !Number.isInteger(version) ||
-            version !== TASK_VERSION) {
+        if (typeof version !== "number" || !Number.isInteger(version) || version !== TASK_VERSION) {
             throw malformedTask(list, id, "version");
         }
     }
     const name = getOwnEntry(taskRecord, "name");
-    if (!hasOwnTaskField(taskRecord, "name") ||
-        typeof name !== "string" ||
-        name.length === 0) {
+    if (!hasOwnTaskField(taskRecord, "name") || typeof name !== "string" || name.length === 0) {
         throw malformedTask(list, id, "name");
     }
     const state = getOwnEntry(taskRecord, "state");
@@ -396,6 +391,7 @@ function createTasksView(deps, list) {
             assertCreateDoesNotSetState(input);
             assertCreateHasId(input);
             validateTaskId(input.id);
+            validateTaskName(input.name);
             const { document, store } = await readStore(deps.fs, deps.path, validStates);
             if (getTaskRecord(store, list, input.id)) {
                 throw new TaskAlreadyExistsError(`Task "${list}/${input.id}" already exists.`);
@@ -408,6 +404,9 @@ function createTasksView(deps, list) {
         async update(id, patch) {
             assertUpdateDoesNotSetState(patch);
             validateTaskId(id);
+            if (patch.name !== undefined) {
+                validateTaskName(patch.name);
+            }
             const { document, store } = await readStore(deps.fs, deps.path, validStates);
             const existing = getTaskOrThrow(store, list, id);
             const nextTaskRecord = buildUpdatedTaskRecord(existing, patch);
@@ -500,6 +499,11 @@ function createTasksView(deps, list) {
             }
             else {
                 const anchorId = "before" in anchor ? anchor.before : anchor.after;
+                const activeIds = new Set(activeItemIds(listNode, validStates));
+                if (!activeIds.has(anchorId)) {
+                    listNode.items.splice(fromIndex, 0, movedPair);
+                    throw new AnchorNotFoundError(anchorId);
+                }
                 const anchorIndex = findItemIndex(listNode, anchorId);
                 if (anchorIndex < 0) {
                     listNode.items.splice(fromIndex, 0, movedPair);

package/node_modules/@poe-code/task-list/dist/state-machine.js

@@ -4,6 +4,9 @@ function isRecord(value) {
 function isStateList(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function hasVisibleName(value) {
+    return value.trim().length > 0;
+}
 function canFireFromState(event, fromState) {
     if (event.from === "*") {
         return event.to !== fromState;
@@ -18,6 +21,9 @@ export function validateMachine(machine) {
         throw new TypeError("State machine states must be a string array.");
     }
     const states = new Set(machine.states);
+    if (machine.states.some((state) => !hasVisibleName(state))) {
+        throw new Error("State names must not be empty.");
+    }
     if (!hasOwnRecordField(machine, "initial") || typeof machine.initial !== "string") {
         throw new TypeError("State machine initial must be a string.");
     }
@@ -28,6 +34,9 @@ export function validateMachine(machine) {
         throw new TypeError("State machine events must be an object.");
     }
     for (const [eventName, event] of Object.entries(machine.events)) {
+        if (!hasVisibleName(eventName)) {
+            throw new Error("Event names must not be empty.");
+        }
         if (!isRecord(event)) {
             throw new TypeError(`Event "${eventName}" must be an object.`);
         }

package/node_modules/@poe-code/task-list/package.json

@@ -20,7 +20,6 @@
     "dist"
   ],
   "dependencies": {
-    "@poe-code/process-runner": "*",
     "yaml": "*"
   }
 }

package/node_modules/auth-store/dist/create-secret-store.js

@@ -28,13 +28,14 @@ export function createSecretStore(input) {
 function resolveBackend(input) {
     const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
     const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
-    if (configuredBackend === "keychain") {
+    const backend = configuredBackend?.trim();
+    if (backend === "keychain") {
         return "keychain";
     }
-    if (configuredBackend === undefined || configuredBackend === "file") {
+    if (backend === undefined || backend === "file") {
         return "file";
     }
-    throw new Error(`Unsupported auth store backend: ${configuredBackend}`);
+    throw new Error(`Unsupported auth store backend: ${backend}`);
 }
 function getOwnEnvValue(env, key) {
     return env !== undefined && Object.prototype.hasOwnProperty.call(env, key)

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -24,7 +24,10 @@ export class EncryptedFileStore {
         if (input.filePath === undefined) {
             const homeDirectory = (input.getHomeDirectory ?? homedir)();
             const defaultDirectory = input.defaultDirectory ?? ".auth-store";
-            this.filePath = path.join(homeDirectory, defaultDirectory, input.defaultFileName ?? "credentials.enc");
+            const defaultFileName = input.defaultFileName ?? "credentials.enc";
+            assertSafeDefaultDirectory(defaultDirectory);
+            assertSafeDefaultFileName(defaultFileName);
+            this.filePath = path.join(homeDirectory, defaultDirectory, defaultFileName);
             this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
         }
         else {
@@ -154,7 +157,7 @@ function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
 }
 function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
     if (symbolicLinkCheckStartPath === null) {
-        return [path.dirname(resolvedPath), resolvedPath];
+        return getExplicitProtectedCredentialPaths(resolvedPath);
     }
     const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
     if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
@@ -168,6 +171,50 @@ function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
     }
     return protectedPaths;
 }
+function assertSafeDefaultDirectory(defaultDirectory) {
+    if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
+        throw new Error("defaultDirectory must be a relative path inside the home directory");
+    }
+    for (const segment of splitPathSegments(defaultDirectory)) {
+        if (segment === "..") {
+            throw new Error("defaultDirectory must be a relative path inside the home directory");
+        }
+    }
+}
+function assertSafeDefaultFileName(defaultFileName) {
+    if (defaultFileName.trim().length === 0 ||
+        defaultFileName === "." ||
+        defaultFileName === ".." ||
+        splitPathSegments(defaultFileName).length !== 1) {
+        throw new Error("defaultFileName must be a file name without path separators");
+    }
+}
+function splitPathSegments(value) {
+    return value
+        .split("/")
+        .flatMap((segment) => segment.split("\\"))
+        .filter((segment) => segment.length > 0);
+}
+function getExplicitProtectedCredentialPaths(resolvedPath) {
+    const parsed = path.parse(resolvedPath);
+    const segments = resolvedPath
+        .slice(parsed.root.length)
+        .split(path.sep)
+        .filter((segment) => segment.length > 0);
+    if (segments.length <= 1) {
+        return [resolvedPath];
+    }
+    const protectedPaths = [];
+    let currentPath = parsed.root;
+    for (const [index, segment] of segments.entries()) {
+        currentPath = path.join(currentPath, segment);
+        if (index === 0) {
+            continue;
+        }
+        protectedPaths.push(currentPath);
+    }
+    return protectedPaths;
+}
 function isPathInsideOrEqual(childPath, parentPath) {
     const relativePath = path.relative(parentPath, childPath);
     return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));

package/node_modules/auth-store/dist/keychain-store.js

@@ -7,8 +7,14 @@ export class KeychainStore {
     account;
     constructor(input) {
         this.runCommand = input.runCommand ?? runSecurityCommand;
-        this.service = input.service;
-        this.account = input.account;
+        this.service = input.service.trim();
+        this.account = input.account.trim();
+        if (this.service.length === 0) {
+            throw new Error("Keychain service must not be empty");
+        }
+        if (this.account.length === 0) {
+            throw new Error("Keychain account must not be empty");
+        }
     }
     async get() {
         const result = await this.executeSecurityCommand(["find-generic-password", "-s", this.service, "-a", this.account, "-w"], "read secret from macOS Keychain");
@@ -31,8 +37,9 @@ export class KeychainStore {
             "-a",
             this.account,
             "-U",
-            "-w"
-        ], "store secret in macOS Keychain", { stdin: value });
+            "-w",
+            value
+        ], "store secret in macOS Keychain");
         if (getCommandExitCode(result) !== 0) {
             throw createSecurityCliFailure("store secret in macOS Keychain", result);
         }

package/node_modules/auth-store/package.json

@@ -14,7 +14,6 @@
   "scripts": {
     "build": "node ../../scripts/guard-package-dist.mjs && tsc"
   },
-  "dependencies": {},
   "files": [
     "dist"
   ],

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 import path from "node:path";
-import { createSecretStore, } from "auth-store";
+import { createSecretStore } from "auth-store";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 const DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
 const DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
@@ -8,6 +8,7 @@ const DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
 const DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
 const DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
 const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
+const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createAuthStoreSessionStore(options = {}) {
     return {
         async load(resource) {
@@ -17,10 +18,10 @@ export function createAuthStoreSessionStore(options = {}) {
                 return null;
             }
             const parsed = JSON.parse(value);
-            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            if (isStoredOAuthSession(parsed)) {
                 return parsed;
             }
-            throw new Error("Stored OAuth session must be a JSON object");
+            throw new Error("Stored OAuth session must match the expected shape");
         },
         async save(resource, session) {
             const store = createResourceSecretStore(resource, options);
@@ -29,7 +30,7 @@ export function createAuthStoreSessionStore(options = {}) {
         async clear(resource) {
             const store = createResourceSecretStore(resource, options);
             await store.delete();
-        },
+        }
     };
 }
 export function createAuthStoreClientStore(options) {
@@ -44,7 +45,8 @@ export function createAuthStoreClientStore(options) {
             const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
             if (clientId !== undefined) {
                 const client = { clientId };
-                if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+                if (isObjectRecord(parsed) &&
+                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
                     client.clientSecret = getOwnEntry(parsed, "clientSecret");
                 }
                 return client;
@@ -58,7 +60,7 @@ export function createAuthStoreClientStore(options) {
         async clear(issuer) {
             const store = createIssuerSecretStore(issuer, options);
             await store.delete();
-        },
+        }
     };
 }
 function createNamedSecretStore(key, options, defaults) {
@@ -71,16 +73,15 @@ function createNamedSecretStore(key, options, defaults) {
             ? undefined
             : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
         salt: options.fileStore?.salt ?? defaults.salt,
-        defaultDirectory: options.fileStore?.defaultDirectory ||
-            defaults.directory,
+        defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
         defaultFileName: parsedFilePath === null
             ? `${hash}.enc`
-            : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`,
+            : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
     };
     const keychainStore = {
         ...options.keychainStore,
         service: options.keychainStore?.service ?? defaults.service,
-        account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`,
+        account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
     };
     return createSecretStore({ ...options, fileStore, keychainStore }).store;
 }
@@ -89,7 +90,7 @@ function createResourceSecretStore(resource, options) {
         salt: DEFAULT_FILE_SALT,
         directory: DEFAULT_FILE_DIRECTORY,
         service: DEFAULT_KEYCHAIN_SERVICE,
-        accountPrefix: "provider",
+        accountPrefix: "provider"
     });
 }
 function createIssuerSecretStore(issuer, options) {
@@ -97,7 +98,7 @@ function createIssuerSecretStore(issuer, options) {
         salt: DEFAULT_CLIENT_FILE_SALT,
         directory: DEFAULT_CLIENT_FILE_DIRECTORY,
         service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
-        accountPrefix: "issuer",
+        accountPrefix: "issuer"
     });
 }
 function isObjectRecord(value) {
@@ -110,3 +111,59 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
+function isStoredOAuthSession(value) {
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    return (isNonBlankOwnString(value, "resource") &&
+        isNonBlankOwnString(value, "authorizationServer") &&
+        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
+}
+function isStoredOAuthClient(value) {
+    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
+        return false;
+    }
+    const clientSecret = getOwnEntry(value, "clientSecret");
+    return (clientSecret === undefined ||
+        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
+}
+function isStoredOAuthDiscovery(value) {
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    return (isNonBlankOwnString(value, "resourceMetadataUrl") &&
+        isObjectRecord(getOwnEntry(value, "resourceMetadata")) &&
+        isObjectRecord(getOwnEntry(value, "authorizationServerMetadata")));
+}
+function isStoredOAuthTokensOrMissing(value) {
+    if (value === undefined) {
+        return true;
+    }
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
+        return false;
+    }
+    const expiresAt = getOwnEntry(value, "expiresAt");
+    if (expiresAt !== null &&
+        (typeof expiresAt !== "number" ||
+            !Number.isSafeInteger(expiresAt) ||
+            expiresAt > MAX_JS_DATE_MS ||
+            !Number.isFinite(new Date(expiresAt).getTime()))) {
+        return false;
+    }
+    const refreshToken = getOwnEntry(value, "refreshToken");
+    if (refreshToken !== undefined &&
+        (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+        return false;
+    }
+    const scope = getOwnEntry(value, "scope");
+    return scope === undefined || (typeof scope === "string" && scope.trim().length > 0);
+}
+function isNonBlankOwnString(record, key) {
+    const value = getOwnString(record, key);
+    return value !== undefined && value.trim().length > 0;
+}