vaspera 2.13.0 → 2.15.0

package/dist/__tests__/http-server-transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server-transport.test.js","sourceRoot":"","sources":["../../src/__tests__/http-server-transport.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE9C,sEAAsE;AACtE,4DAA4D;AAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,IAAI,GAAG,IAAI,CAAC;AAClB,MAAM,IAAI,GAAG,oBAAoB,IAAI,MAAM,CAAC;AAC5C,MAAM,KAAK,GAAG,sBAAsB,CAAC;AACrC,IAAI,IAAkB,CAAC;AAEvB,KAAK,UAAU,GAAG,CAAC,IAAa,EAAE,KAAK,GAAG,KAAK;IAC7C,OAAO,KAAK,CAAC,IAAI,EAAE;QACjB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;YAC7C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE;QAC5C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/E,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAO,EAAE,MAAM,CAAC,CAAa,CAAC;QAC/D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO;IAC/D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC,EAAE,KAAK,CAAC,CAAC;AAEV,QAAQ,CAAC,GAAG,EAAE;IACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;YACD,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACxE,MAAM,MAAM,GAAG,oBAAoB,IAAI,SAAS,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,YAAY,CAAC,wCAAwC,EAAE,OAAO,CAAC,CAChE,CAAC;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,gCAAgC;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/integration/destructive-guards.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=destructive-guards.test.d.ts.map

package/dist/__tests__/integration/destructive-guards.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive-guards.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/integration/destructive-guards.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/integration/destructive-guards.test.js

@@ -0,0 +1,49 @@
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { server } from "../../index.js";
+/**
+ * Fail-closed guards on destructive tools: deploy_vercel_promote /
+ * deploy_vercel_rollback / consensus_clear must NOT act unless the caller
+ * passes confirm: true. Without it they return a no-op preview. Verified
+ * through the real MCP boundary (in-memory client → server tools/call).
+ */
+describe("destructive-tool confirm guards", () => {
+    let client;
+    beforeAll(async () => {
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        client = new Client({ name: "guard-test", version: "1.0.0" }, { capabilities: {} });
+        await Promise.all([client.connect(clientTransport), server.connect(serverTransport)]);
+    });
+    afterAll(async () => {
+        await client?.close().catch(() => undefined);
+        await server.close().catch(() => undefined);
+    });
+    async function call(name, args) {
+        const res = (await client.callTool({ name, arguments: args }));
+        const text = res.content.find((c) => c.type === "text")?.text ?? "{}";
+        return JSON.parse(text);
+    }
+    it("consensus_clear is a no-op preview without confirm", async () => {
+        const out = await call("consensus_clear", { certification_id: "cert-guard-test" });
+        expect(out.preview).toBe(true);
+        expect(out.cleared).toBeUndefined();
+    });
+    it("deploy_vercel_promote is a no-op preview without confirm", async () => {
+        const out = await call("deploy_vercel_promote", {
+            project_id: "proj",
+            deployment_id: "dpl_123",
+        });
+        expect(out.preview).toBe(true);
+        expect(out.success).toBeUndefined();
+    });
+    it("deploy_vercel_rollback is a no-op preview without confirm", async () => {
+        const out = await call("deploy_vercel_rollback", {
+            project_id: "proj",
+            deployment_id: "dpl_123",
+        });
+        expect(out.preview).toBe(true);
+        expect(out.success).toBeUndefined();
+    });
+});
+//# sourceMappingURL=destructive-guards.test.js.map

package/dist/__tests__/integration/destructive-guards.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive-guards.test.js","sourceRoot":"","sources":["../../../src/__tests__/integration/destructive-guards.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;GAKG;AACH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAI,MAAc,CAAC;IAEnB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAChF,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAA6B;QAC7D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAE5D,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QACtE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAED,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE;YAC9C,UAAU,EAAE,MAAM;YAClB,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE;YAC/C,UAAU,EAAE,MAAM;YAClB,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/logger-redaction.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=logger-redaction.test.d.ts.map

package/dist/__tests__/logger-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-redaction.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/logger-redaction.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/logger-redaction.test.js

@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { logger } from "../logger.js";
+function captureLog(fn) {
+    const spy = vi.spyOn(console, "error").mockImplementation(() => { });
+    try {
+        fn();
+        return String(spy.mock.calls[0]?.[0] ?? "");
+    }
+    finally {
+        spy.mockRestore();
+    }
+}
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe("logger secret redaction", () => {
+    it("redacts secret-shaped keys", () => {
+        const line = captureLog(() => logger.error("test", {
+            apiKey: "sk-abcdef1234567890abcdef",
+            authorization: "Bearer abc123",
+            password: "hunter2",
+            normal: "visible",
+        }));
+        expect(line).not.toContain("sk-abcdef");
+        expect(line).not.toContain("hunter2");
+        expect(line).not.toContain("Bearer abc123");
+        expect(line).toContain("visible");
+        expect(line).toContain("[REDACTED]");
+    });
+    it("redacts nested config objects", () => {
+        const line = captureLog(() => logger.error("test", {
+            config: {
+                endpoint: "https://example.com",
+                api_key: "vpm_live_supersecretvalue",
+                nested: { client_secret: "deep-secret" },
+            },
+        }));
+        expect(line).not.toContain("supersecretvalue");
+        expect(line).not.toContain("deep-secret");
+        expect(line).toContain("https://example.com");
+    });
+    it("redacts token-shaped values under innocent keys", () => {
+        const line = captureLog(() => logger.error("test", {
+            detail: "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            header: "Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig",
+        }));
+        expect(line).not.toContain("ghp_");
+        expect(line).not.toContain("eyJhbGciOiJIUzI1NiJ9");
+    });
+    it("redacts a secret EMBEDDED inside a larger string (not just whole values)", () => {
+        const line = captureLog(() => logger.error("test", {
+            msg: "request to https://api/x failed: Authorization: Bearer sk-abcdef1234567890abcdef returned 401",
+            url: "https://u:ghp_abcdefghijklmnopqrstuvwxyz0123456789@host/repo",
+        }));
+        expect(line).not.toContain("sk-abcdef");
+        expect(line).not.toContain("ghp_abcdef");
+        expect(line).toContain("[REDACTED]");
+        // surrounding context preserved
+        expect(line).toContain("returned 401");
+    });
+    it("does not crash on circular references", () => {
+        const a = { name: "node" };
+        a.self = a;
+        const line = captureLog(() => logger.error("test", { graph: a, ok: "visible" }));
+        expect(line).toContain("[Circular]");
+        expect(line).toContain("visible");
+    });
+    it("leaves ordinary context intact", () => {
+        const line = captureLog(() => logger.info("test", { certId: "cert-123", count: 5, flag: true }));
+        expect(line).toContain("cert-123");
+        expect(line).toContain("5");
+    });
+});
+//# sourceMappingURL=logger-redaction.test.js.map

package/dist/__tests__/logger-redaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-redaction.test.js","sourceRoot":"","sources":["../../src/__tests__/logger-redaction.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,SAAS,UAAU,CAAC,EAAc;IAChC,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAC3B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE,2BAA2B;YACnC,aAAa,EAAE,eAAe;YAC9B,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,SAAS;SAClB,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAC3B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE;gBACN,QAAQ,EAAE,qBAAqB;gBAC/B,OAAO,EAAE,2BAA2B;gBACpC,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;aACzC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAC3B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE,0CAA0C;YAClD,MAAM,EAAE,yCAAyC;SAClD,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAC3B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;YACnB,GAAG,EAAE,+FAA+F;YACpG,GAAG,EAAE,8DAA8D;SACpE,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrC,gCAAgC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAA4B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACX,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAClE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/manifest-schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=manifest-schema.test.d.ts.map

package/dist/__tests__/manifest-schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-schema.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/manifest-schema.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/manifest-schema.test.js

@@ -0,0 +1,43 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "fs";
+import { join } from "path";
+/**
+ * Contract test for the published manifest (mcp.json).
+ *
+ * Regression guard for the empty-schema bug: the generator used to emit a
+ * bare `{ type: "object" }` placeholder for every tool, so the published
+ * manifest exposed NO input properties (0/113). The generator now derives
+ * real JSON Schema from the live server's tools/list. These assertions fail
+ * if it ever regresses to placeholders.
+ */
+const manifest = JSON.parse(readFileSync(join(process.cwd(), "mcp.json"), "utf-8"));
+function hasProps(t) {
+    return !!t.inputSchema?.properties && Object.keys(t.inputSchema.properties).length > 0;
+}
+describe("mcp.json input schemas", () => {
+    it("every tool carries an object inputSchema", () => {
+        for (const t of manifest.tools) {
+            expect(t.inputSchema, t.name).toBeDefined();
+            expect(t.inputSchema.type, t.name).toBe("object");
+        }
+    });
+    it("the vast majority of tools expose real input properties (not placeholders)", () => {
+        const withProps = manifest.tools.filter(hasProps).length;
+        // Pre-fix this was 0. A handful of tools are genuinely arg-less, so we
+        // assert a high floor rather than 100%.
+        expect(withProps).toBeGreaterThanOrEqual(Math.floor(manifest.tools.length * 0.85));
+    });
+    it("a known tool exposes its declared parameter (hardening_list_projects → base_dir)", () => {
+        const tool = manifest.tools.find((t) => t.name === "hardening_list_projects");
+        expect(tool).toBeDefined();
+        expect(tool.inputSchema?.properties).toHaveProperty("base_dir");
+    });
+    it("no tool is left with a bare placeholder when it declares parameters", () => {
+        // A bare placeholder is `{ type: "object" }` with no properties key at
+        // all. That's only acceptable for genuinely arg-less tools; assert the
+        // count of bare placeholders stays small.
+        const bare = manifest.tools.filter((t) => t.inputSchema && !("properties" in t.inputSchema));
+        expect(bare.length).toBeLessThanOrEqual(Math.ceil(manifest.tools.length * 0.15));
+    });
+});
+//# sourceMappingURL=manifest-schema.test.js.map

package/dist/__tests__/manifest-schema.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-schema.test.js","sourceRoot":"","sources":["../../src/__tests__/manifest-schema.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CASvD,CAAC;AAEF,SAAS,QAAQ,CAAC,CAA6D;IAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,CAAC,CAAC,CAAC,WAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzD,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,uEAAuE;QACvE,uEAAuE;QACvE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CACzD,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/scanners/builtin-rules.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=builtin-rules.test.d.ts.map

package/dist/__tests__/scanners/builtin-rules.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-rules.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/scanners/builtin-rules.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/scanners/builtin-rules.test.js

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "vitest";
+import { readFile } from "fs/promises";
+import { BUILTIN_SEMGREP_RULES, getBuiltinRulesPath, } from "../../scanners/builtin-rules.js";
+describe("built-in semgrep taint rules", () => {
+    it("declares the three taint classes the free community rules miss", () => {
+        for (const id of [
+            "vaspera-sql-injection",
+            "vaspera-command-injection",
+            "vaspera-ssrf",
+        ]) {
+            expect(BUILTIN_SEMGREP_RULES).toContain(`id: ${id}`);
+        }
+        // taint mode + request sources
+        expect(BUILTIN_SEMGREP_RULES).toContain("mode: taint");
+        expect(BUILTIN_SEMGREP_RULES).toContain("req.query");
+        expect(BUILTIN_SEMGREP_RULES).toContain("req.body");
+    });
+    it("declares the insecure-deserialization and XXE pattern rules", () => {
+        expect(BUILTIN_SEMGREP_RULES).toContain("id: vaspera-insecure-deserialization");
+        expect(BUILTIN_SEMGREP_RULES).toContain("id: vaspera-xxe");
+        // deser sinks: eval / Function constructor / unsafe yaml.load
+        expect(BUILTIN_SEMGREP_RULES).toContain("pattern: eval(...)");
+        expect(BUILTIN_SEMGREP_RULES).toContain("pattern: new Function(...)");
+        expect(BUILTIN_SEMGREP_RULES).toContain("CWE-502");
+        // xxe sink: xmldom DOMParser (XMLParser is safe-by-default, not flagged)
+        expect(BUILTIN_SEMGREP_RULES).toContain("pattern: new DOMParser()");
+        expect(BUILTIN_SEMGREP_RULES).toContain("CWE-611");
+    });
+    it("scopes the yaml.load sink to yaml receivers and single-arg calls (precision)", () => {
+        // a yaml.load with a safe schema (2-arg) must not be reachable by the
+        // single-arg pattern, and the receiver is constrained to yaml-ish names
+        expect(BUILTIN_SEMGREP_RULES).toContain("pattern: $YAML.load($X)");
+        expect(BUILTIN_SEMGREP_RULES).toContain("regex: (?i)(yaml|jsyaml)");
+        expect(BUILTIN_SEMGREP_RULES).not.toContain("$YAML.load($X, ...)");
+    });
+    it("writes the rules to a temp file (cached across calls)", async () => {
+        const p1 = await getBuiltinRulesPath();
+        const p2 = await getBuiltinRulesPath();
+        expect(p1).toBe(p2); // memoized
+        expect(p1).toMatch(/vaspera-builtin\.yaml$/);
+        const content = await readFile(p1, "utf-8");
+        expect(content).toBe(BUILTIN_SEMGREP_RULES);
+    });
+    it("does not treat array-form spawn or a request body as a sink (precision)", () => {
+        // command-injection: plain spawn(...) is intentionally not a bare sink
+        expect(BUILTIN_SEMGREP_RULES).not.toContain("- pattern: spawn(...)");
+        // ssrf: sinks focus on the URL arg, not the whole call
+        expect(BUILTIN_SEMGREP_RULES).toContain("focus-metavariable: $URL");
+    });
+});
+//# sourceMappingURL=builtin-rules.test.js.map

package/dist/__tests__/scanners/builtin-rules.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-rules.test.js","sourceRoot":"","sources":["../../../src/__tests__/scanners/builtin-rules.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,KAAK,MAAM,EAAE,IAAI;YACf,uBAAuB;YACvB,2BAA2B;YAC3B,cAAc;SACf,EAAE,CAAC;YACF,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,+BAA+B;QAC/B,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAChF,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3D,8DAA8D;QAC9D,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC9D,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACtE,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,yEAAyE;QACzE,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACnE,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW;QAChC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,uEAAuE;QACvE,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACrE,uDAAuD;QACvD,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/scanners/runtime/golden-path-runner.test.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { join } from "path";
 import { mkdir, writeFile, rm, readFile } from "fs/promises";
 import { tmpdir } from "os";
@@ -103,6 +103,18 @@ steps: []
         });
     });
     describe("runFlow", () => {
+        // Constitution: tests must pass offline — never hit the real network.
+        beforeEach(() => {
+            vi.stubGlobal("fetch", vi.fn(async (url) => {
+                if (String(url).includes("localhost:99999")) {
+                    throw new Error("connect ECONNREFUSED");
+                }
+                return new Response("ok", { status: 200 });
+            }));
+        });
+        afterEach(() => {
+            vi.unstubAllGlobals();
+        });
         it("executes navigate step successfully", async () => {
             const flow = {
                 name: "navigate-test",

package/dist/__tests__/scanners/runtime/golden-path-runner.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"golden-path-runner.test.js","sourceRoot":"","sources":["../../../../src/__tests__/scanners/runtime/golden-path-runner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAM,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,OAAO,GACR,MAAM,iDAAiD,CAAC;AAGzD,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QACxB,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACvC,MAAM,WAAW,GAAG;;;;;;;;;CASzB,CAAC;YACI,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC/C,MAAM,SAAS,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YAErD,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,WAAW,GAAG;;;;CAIzB,CAAC;YACI,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACtD,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEvC,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,KAAK,GAAG,2DAA2D,CAAC;YAC1E,MAAM,KAAK,GAAG,gEAAgE,CAAC;YAE/E,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;YAEpD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,SAAS,GAAG,2DAA2D,CAAC;YAC9E,MAAM,WAAW,GAAG,kCAAkC,CAAC;YAEvD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;YAE7D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,0DAA0D,CAAC,CAAC;YACzG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;YACzD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC;YAErE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE1C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAEnD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;iBACjC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;iBACjC;aACF,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAEvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE;oBACxC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;oBACrD,EAAE,MAAM,EAAE,YAAY,EAAE;iBACzB;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;oBAChC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,oCAAoC,EAAE;oBACjE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;iBACjC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;iBAChC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;oBAChC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE;iBACzC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"golden-path-runner.test.js","sourceRoot":"","sources":["../../../../src/__tests__/scanners/runtime/golden-path-runner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,OAAO,GACR,MAAM,iDAAiD,CAAC;AAGzD,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QACxB,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACvC,MAAM,WAAW,GAAG;;;;;;;;;CASzB,CAAC;YACI,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC/C,MAAM,SAAS,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YAErD,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,WAAW,GAAG;;;;CAIzB,CAAC;YACI,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACtD,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAEvC,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,KAAK,GAAG,2DAA2D,CAAC;YAC1E,MAAM,KAAK,GAAG,gEAAgE,CAAC;YAE/E,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;YAEpD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,SAAS,GAAG,2DAA2D,CAAC;YAC9E,MAAM,WAAW,GAAG,kCAAkC,CAAC;YAEvD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;YAE7D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,0DAA0D,CAAC,CAAC;YACzG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;YACzD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC;YAErE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE1C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAEnD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,sEAAsE;QACtE,UAAU,CAAC,GAAG,EAAE;YACd,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAiB,EAAE,EAAE;gBAChC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;iBACjC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;iBACjC;aACF,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAEvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE;oBACxC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;oBACrD,EAAE,MAAM,EAAE,YAAY,EAAE;iBACzB;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;oBAChC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,oCAAoC,EAAE;oBACjE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;iBACjC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;iBAChC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE;oBAChC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE;iBACzC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tool-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tool-guard.test.d.ts.map

package/dist/__tests__/tool-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-guard.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tool-guard.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tool-guard.test.js

@@ -0,0 +1,97 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, rm, symlink, mkdir } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { realpathSync } from "fs";
+import { applyProjectPathGuard } from "../tool-guard.js";
+function fakeServer() {
+    const tools = {};
+    return {
+        tools,
+        registerTool(name, _config, handler) {
+            tools[name] = handler;
+            return { name };
+        },
+    };
+}
+describe("applyProjectPathGuard", () => {
+    let dir;
+    beforeEach(async () => {
+        // realpath: on macOS, tmpdir is a /var -> /private/var symlink
+        dir = realpathSync(await mkdtemp(join(tmpdir(), "guard-test-")));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    it("passes a validated, resolved project_path to the handler", async () => {
+        const server = fakeServer();
+        applyProjectPathGuard(server);
+        let received;
+        server.registerTool("t", {}, (args) => {
+            received = args;
+            return "ok";
+        });
+        const result = await server.tools.t({ project_path: dir + "/." });
+        expect(result).toBe("ok");
+        expect(received.project_path).toBe(dir);
+    });
+    it("rejects a nonexistent project_path with an isError result, without invoking the handler", async () => {
+        const server = fakeServer();
+        applyProjectPathGuard(server);
+        let invoked = false;
+        server.registerTool("t", {}, () => {
+            invoked = true;
+        });
+        const result = (await server.tools.t({
+            project_path: join(dir, "does-not-exist"),
+        }));
+        expect(invoked).toBe(false);
+        expect(result.isError).toBe(true);
+        expect(result.content[0].text).toMatch(/does not exist/);
+    });
+    it("leaves tools without project_path untouched", async () => {
+        const server = fakeServer();
+        applyProjectPathGuard(server);
+        server.registerTool("t", {}, (args) => args);
+        const args = { other: 1 };
+        expect(await server.tools.t(args)).toBe(args);
+    });
+    it("enforces basePath containment, including prefix-sibling escapes", async () => {
+        const inside = join(dir, "workspace", "proj");
+        const sibling = dir + "-evil";
+        await mkdir(inside, { recursive: true });
+        await mkdir(join(dir, "workspace"), { recursive: true }).catch(() => { });
+        const server = fakeServer();
+        applyProjectPathGuard(server, { basePath: join(dir, "workspace") });
+        server.registerTool("t", {}, (args) => args);
+        const ok = (await server.tools.t({ project_path: inside }));
+        expect(ok.project_path).toBe(inside);
+        await mkdir(sibling, { recursive: true });
+        try {
+            const guarded = fakeServer();
+            // basePath = dir; sibling "<dir>-evil" must NOT pass the prefix check
+            applyProjectPathGuard(guarded, { basePath: dir });
+            guarded.registerTool("t", {}, (args) => args);
+            const result = (await guarded.tools.t({ project_path: sibling }));
+            expect(result.isError).toBe(true);
+        }
+        finally {
+            await rm(sibling, { recursive: true, force: true });
+        }
+    });
+    it("rejects symlinks that escape the basePath", async () => {
+        const outside = join(dir, "outside-target");
+        const base = join(dir, "base");
+        await mkdir(outside, { recursive: true });
+        await mkdir(base, { recursive: true });
+        const link = join(base, "sneaky");
+        await symlink(outside, link);
+        const server = fakeServer();
+        applyProjectPathGuard(server, { basePath: base });
+        server.registerTool("t", {}, (args) => args);
+        const result = (await server.tools.t({ project_path: link }));
+        expect(result.isError).toBe(true);
+        expect(result.content[0].text).toMatch(/Symlink escapes/);
+    });
+});
+//# sourceMappingURL=tool-guard.test.js.map

package/dist/__tests__/tool-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-guard.test.js","sourceRoot":"","sources":["../../src/__tests__/tool-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAIzD,SAAS,UAAU;IACjB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,OAAO;QACL,KAAK;QACL,YAAY,CAAC,IAAY,EAAE,OAAgB,EAAE,OAAgB;YAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,+DAA+D;QAC/D,GAAG,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,QAAiB,CAAC;QACtB,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAa,EAAE,EAAE;YAC7C,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,CAAE,QAAqC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE;YAChC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;SAC1C,CAAC,CAA2D,CAAC;QAE9D,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;QAC9B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,qBAAqB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAEzD,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,sEAAsE;YACtE,qBAAqB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAE/D,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClC,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,qBAAqB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAG3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/util/contained-file.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=contained-file.test.d.ts.map

package/dist/__tests__/util/contained-file.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contained-file.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/util/contained-file.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/util/contained-file.test.js

@@ -0,0 +1,78 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, rm, mkdir, writeFile, symlink } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { realpathSync } from "fs";
+import { resolveContainedFile, resolveContainedWritePath, PathValidationError, } from "../../util/paths.js";
+describe("resolveContainedFile", () => {
+    let root;
+    beforeEach(async () => {
+        root = realpathSync(await mkdtemp(join(tmpdir(), "contained-")));
+        await writeFile(join(root, "inside.txt"), "ok");
+    });
+    afterEach(async () => {
+        await rm(root, { recursive: true, force: true });
+    });
+    it("resolves a normal relative file inside the tree", async () => {
+        expect(await resolveContainedFile(root, "inside.txt")).toBe(join(root, "inside.txt"));
+    });
+    it("rejects ../ traversal", async () => {
+        await expect(resolveContainedFile(root, "../../../etc/passwd")).rejects.toThrow(PathValidationError);
+    });
+    it("rejects absolute paths outside the tree", async () => {
+        await expect(resolveContainedFile(root, "/etc/passwd")).rejects.toThrow(/escapes project tree/);
+    });
+    it("rejects in-tree symlinks pointing outside the tree", async () => {
+        const outside = join(root, "..", `outside-${Date.now()}`);
+        await mkdir(outside, { recursive: true });
+        try {
+            await writeFile(join(outside, "secret.txt"), "secret");
+            await symlink(join(outside, "secret.txt"), join(root, "sneaky.txt"));
+            await expect(resolveContainedFile(root, "sneaky.txt")).rejects.toThrow(/Symlinked file escapes/);
+        }
+        finally {
+            await rm(outside, { recursive: true, force: true });
+        }
+    });
+    it("rejects prefix-sibling escapes", async () => {
+        const sibling = `${root}-evil`;
+        await mkdir(sibling, { recursive: true });
+        try {
+            await writeFile(join(sibling, "f.txt"), "x");
+            await expect(resolveContainedFile(root, join(sibling, "f.txt"))).rejects.toThrow(PathValidationError);
+        }
+        finally {
+            await rm(sibling, { recursive: true, force: true });
+        }
+    });
+});
+describe("resolveContainedWritePath", () => {
+    let root;
+    beforeEach(async () => {
+        root = realpathSync(await mkdtemp(join(tmpdir(), "cwrite-")));
+    });
+    afterEach(async () => {
+        await rm(root, { recursive: true, force: true });
+    });
+    it("allows a not-yet-existing file inside the tree", async () => {
+        expect(await resolveContainedWritePath(root, "out/report.json")).toBe(join(root, "out", "report.json"));
+    });
+    it("rejects ../ traversal on a write target", async () => {
+        await expect(resolveContainedWritePath(root, "../escape.json")).rejects.toThrow(PathValidationError);
+    });
+    it("rejects an absolute write target outside the tree", async () => {
+        await expect(resolveContainedWritePath(root, "/tmp/evil.json")).rejects.toThrow(/escapes project tree/);
+    });
+    it("rejects writes through a symlinked directory escaping the tree", async () => {
+        const outside = join(root, "..", `wout-${Date.now()}`);
+        await mkdir(outside, { recursive: true });
+        try {
+            await symlink(outside, join(root, "link"));
+            await expect(resolveContainedWritePath(root, "link/evil.json")).rejects.toThrow(/Symlinked directory escapes/);
+        }
+        finally {
+            await rm(outside, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=contained-file.test.js.map

package/dist/__tests__/util/contained-file.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contained-file.test.js","sourceRoot":"","sources":["../../../src/__tests__/util/contained-file.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,IAAY,CAAC;IAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACzD,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAClD,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,CAAC,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,wBAAwB,CACzB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,CAAC;QAC/B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7C,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CACnD,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,IAAY,CAAC;IAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CACnE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,CACV,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAClD,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,MAAM,CACV,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAClD,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3C,MAAM,MAAM,CACV,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAClD,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/util/subprocess.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=subprocess.test.d.ts.map

package/dist/__tests__/util/subprocess.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/util/subprocess.test.ts"],"names":[],"mappings":""}