toolmoat 0.0.0-stage → 0.1.0

package/dist/util/jsonc.js

@@ -0,0 +1,113 @@
+/**
+ * Parses JSON that may contain // and /* *\/ comments and trailing commas, as
+ * VS Code style config files do. Returns undefined instead of throwing.
+ */
+export function parseJsonc(text) {
+    const source = text.startsWith('') ? text.slice(1) : text;
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        // fall through to the lenient path
+    }
+    try {
+        return JSON.parse(stripTrailingCommas(stripComments(source)));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Replaces comments with spaces so character offsets stay the same. */
+export function stripComments(text) {
+    let out = '';
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        const next = text[i + 1];
+        if (inString) {
+            out += ch;
+            if (ch === '\\') {
+                out += next ?? '';
+                i++;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+        }
+        else if (ch === '"') {
+            inString = true;
+            out += ch;
+        }
+        else if (ch === '/' && next === '/') {
+            while (i < text.length && text[i] !== '\n') {
+                out += ' ';
+                i++;
+            }
+            if (i < text.length)
+                out += '\n';
+        }
+        else if (ch === '/' && next === '*') {
+            out += '  ';
+            i += 2;
+            while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) {
+                out += text[i] === '\n' ? '\n' : ' ';
+                i++;
+            }
+            out += '  ';
+            i++;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return out;
+}
+function stripTrailingCommas(text) {
+    let out = '';
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            out += ch;
+            if (ch === '\\') {
+                out += text[i + 1] ?? '';
+                i++;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            continue;
+        }
+        if (ch === ',') {
+            let j = i + 1;
+            while (j < text.length && /\s/.test(text[j]))
+                j++;
+            if (text[j] === '}' || text[j] === ']') {
+                out += ' ';
+                continue;
+            }
+        }
+        out += ch;
+    }
+    return out;
+}
+/**
+ * Best-effort offset of a JSON string value (or key) in the raw text, used to
+ * point findings at the right line. Searches for the JSON-encoded form first,
+ * then the raw value. Returns -1 when not found.
+ */
+export function indexOfJsonString(text, value, from = 0) {
+    const encoded = JSON.stringify(value);
+    const exact = text.indexOf(encoded, from);
+    if (exact !== -1)
+        return exact;
+    return text.indexOf(value, from);
+}
+export function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}

package/dist/util/paths.d.ts

@@ -0,0 +1,9 @@
+export declare function homeDir(): string;
+/** Expands a leading ~ to the user's home directory. */
+export declare function expandHome(p: string): string;
+/** Where toolmoat keeps its lockfile and audit logs. Override with TOOLMOAT_HOME. */
+export declare function toolmoatHome(): string;
+/** Forward-slash path relative to root when the file is inside it, otherwise the absolute path. */
+export declare function toDisplayPath(absPath: string, root?: string): string;
+/** Platform-specific application-data directory (APPDATA on Windows, ~/Library/Application Support on macOS, XDG_CONFIG_HOME elsewhere). */
+export declare function appDataDir(): string;

package/dist/util/paths.js

@@ -0,0 +1,37 @@
+import os from 'node:os';
+import path from 'node:path';
+export function homeDir() {
+    return process.env.TOOLMOAT_TEST_USER_HOME ?? os.homedir();
+}
+/** Expands a leading ~ to the user's home directory. */
+export function expandHome(p) {
+    if (p === '~')
+        return homeDir();
+    if (p.startsWith('~/') || p.startsWith('~\\'))
+        return path.join(homeDir(), p.slice(2));
+    return p;
+}
+/** Where toolmoat keeps its lockfile and audit logs. Override with TOOLMOAT_HOME. */
+export function toolmoatHome() {
+    return process.env.TOOLMOAT_HOME ?? path.join(homeDir(), '.toolmoat');
+}
+/** Forward-slash path relative to root when the file is inside it, otherwise the absolute path. */
+export function toDisplayPath(absPath, root) {
+    if (absPath.includes('://'))
+        return absPath;
+    let shown = absPath;
+    if (root) {
+        const rel = path.relative(root, absPath);
+        if (rel && !rel.startsWith('..') && !path.isAbsolute(rel))
+            shown = rel;
+    }
+    return shown.split(path.sep).join('/');
+}
+/** Platform-specific application-data directory (APPDATA on Windows, ~/Library/Application Support on macOS, XDG_CONFIG_HOME elsewhere). */
+export function appDataDir() {
+    if (process.platform === 'win32')
+        return process.env.APPDATA ?? path.join(homeDir(), 'AppData', 'Roaming');
+    if (process.platform === 'darwin')
+        return path.join(homeDir(), 'Library', 'Application Support');
+    return process.env.XDG_CONFIG_HOME ?? path.join(homeDir(), '.config');
+}

package/dist/util/text.d.ts

@@ -0,0 +1,29 @@
+/** Converts a character offset into 1-based line and column numbers. */
+export declare function lineColAt(content: string, index: number): {
+    line: number;
+    column: number;
+};
+/** Returns the text of a 1-based line without its line terminator, or '' when out of range. */
+export declare function lineAt(content: string, line: number): string;
+/** Offset of the first character of a 1-based line, or -1 when out of range. */
+export declare function lineStartIndex(content: string, line: number): number;
+export declare function truncate(text: string, max?: number): string;
+/**
+ * Makes text safe to print on one terminal line: control and invisible
+ * characters become visible escapes such as ​, so hidden payloads show up
+ * in reports instead of being smuggled into them.
+ */
+export declare function printable(text: string): string;
+/** Zero-width, bidi-control, tag and other format characters that render as nothing. */
+export declare function isInvisible(code: number): boolean;
+export interface RegexHit {
+    index: number;
+    text: string;
+    groups: (string | undefined)[];
+}
+/**
+ * Runs a regex over content and returns every hit. The regex is copied with the
+ * global flag added, so callers can pass literals without worrying about lastIndex.
+ * Stops after `limit` hits so one noisy file cannot flood a report.
+ */
+export declare function findAll(regex: RegExp, content: string, limit?: number): RegexHit[];

package/dist/util/text.js

@@ -0,0 +1,96 @@
+/** Converts a character offset into 1-based line and column numbers. */
+export function lineColAt(content, index) {
+    const clamped = Math.max(0, Math.min(index, content.length));
+    let line = 1;
+    let lastNewline = -1;
+    for (let i = content.indexOf('\n'); i !== -1 && i < clamped; i = content.indexOf('\n', i + 1)) {
+        line++;
+        lastNewline = i;
+    }
+    return { line, column: clamped - lastNewline };
+}
+/** Returns the text of a 1-based line without its line terminator, or '' when out of range. */
+export function lineAt(content, line) {
+    if (line < 1)
+        return '';
+    let start = 0;
+    for (let current = 1; current < line; current++) {
+        const next = content.indexOf('\n', start);
+        if (next === -1)
+            return '';
+        start = next + 1;
+    }
+    const end = content.indexOf('\n', start);
+    return content.slice(start, end === -1 ? content.length : end).replace(/\r$/, '');
+}
+/** Offset of the first character of a 1-based line, or -1 when out of range. */
+export function lineStartIndex(content, line) {
+    if (line < 1)
+        return -1;
+    let start = 0;
+    for (let current = 1; current < line; current++) {
+        const next = content.indexOf('\n', start);
+        if (next === -1)
+            return -1;
+        start = next + 1;
+    }
+    return start;
+}
+export function truncate(text, max = 160) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+/**
+ * Makes text safe to print on one terminal line: control and invisible
+ * characters become visible escapes such as ​, so hidden payloads show up
+ * in reports instead of being smuggled into them.
+ */
+export function printable(text) {
+    let out = '';
+    for (const ch of text) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (ch === '\t')
+            out += ' ';
+        else if (isInvisible(code) || code < 0x20 || code === 0x7f) {
+            out += code > 0xffff ? `\\u{${code.toString(16)}}` : `\\u${code.toString(16).padStart(4, '0')}`;
+        }
+        else
+            out += ch;
+    }
+    return out;
+}
+/** Zero-width, bidi-control, tag and other format characters that render as nothing. */
+export function isInvisible(code) {
+    return ((code >= 0x200b && code <= 0x200f) ||
+        (code >= 0x202a && code <= 0x202e) ||
+        (code >= 0x2060 && code <= 0x2064) ||
+        (code >= 0x2066 && code <= 0x2069) ||
+        code === 0x00ad ||
+        code === 0x034f ||
+        code === 0x061c ||
+        code === 0x115f ||
+        code === 0x1160 ||
+        code === 0x180e ||
+        code === 0x3164 ||
+        code === 0xfeff ||
+        code === 0xffa0 ||
+        (code >= 0xfe00 && code <= 0xfe0f) ||
+        (code >= 0xe0000 && code <= 0xe007f) ||
+        (code >= 0xe0100 && code <= 0xe01ef));
+}
+/**
+ * Runs a regex over content and returns every hit. The regex is copied with the
+ * global flag added, so callers can pass literals without worrying about lastIndex.
+ * Stops after `limit` hits so one noisy file cannot flood a report.
+ */
+export function findAll(regex, content, limit = 50) {
+    const flags = regex.flags.includes('g') ? regex.flags : `${regex.flags}g`;
+    const re = new RegExp(regex.source, flags);
+    const hits = [];
+    let match;
+    while (hits.length < limit && (match = re.exec(content)) !== null) {
+        hits.push({ index: match.index, text: match[0], groups: match.slice(1) });
+        if (match[0].length === 0)
+            re.lastIndex++;
+    }
+    return hits;
+}

package/dist/util/toml-lite.d.ts

@@ -0,0 +1,40 @@
+/**
+ * toml-lite: a small, defensive TOML reader for the TOML files toolmoat
+ * inspects, mainly Codex's ~/.codex/config.toml and pyproject.toml.
+ *
+ * Supported: [tables], [[arrays of tables]], dotted and quoted keys, basic and
+ * literal strings (single and multi-line, with escapes), integers (decimal,
+ * hex, octal, binary), floats, booleans, dates and times (kept as their
+ * source text), arrays (multi-line, nested, trailing commas) and inline
+ * tables. A statement it cannot read is skipped and listed in `errors`, so a
+ * malformed or hostile file never throws. It runs in linear time with bounded
+ * nesting because scanned files are attacker-controlled.
+ *
+ * Not a validator: duplicate keys overwrite, and integers beyond 2^53 lose
+ * precision.
+ */
+export interface TomlError {
+    /** 1-based line where parsing failed. */
+    line: number;
+    message: string;
+}
+export interface TomlDocument {
+    /** Parsed tables and values. Keys such as "__proto__" are stored as ordinary own properties. */
+    data: Record<string, unknown>;
+    /**
+     * 1-based line of every key, table header and array element, keyed by its
+     * full path as built by joinKeyPath, for example 'mcp_servers.github.args.1'.
+     */
+    lines: Map<string, number>;
+    errors: TomlError[];
+}
+type Segment = string | number;
+/**
+ * Joins a key path the way `TomlDocument.lines` is keyed: bare segments as
+ * they are, other segments JSON-quoted, array indexes as numbers.
+ * joinKeyPath(['mcp_servers', 'my.server', 'args', 0]) === 'mcp_servers."my.server".args.0'
+ */
+export declare function joinKeyPath(segments: readonly Segment[]): string;
+/** Parses TOML text. Never throws; unreadable statements are skipped and reported in `errors`. */
+export declare function parseToml(text: string): TomlDocument;
+export {};