vkusvill 0.0.0-dev.0

package/src/main.js

@@ -0,0 +1,113 @@
+// Entry point: parses arguments and starts either the full-screen interface or a plain-output command.
+
+import { readFileSync } from "node:fs";
+import { App } from "./app.js";
+import { catalogView, dealsView } from "./views/catalog.js";
+import { recipesView } from "./views/recipes.js";
+import { shopsView } from "./views/shops.js";
+import { cartView } from "./views/cart.js";
+import { profileView } from "./views/profile.js";
+import { Splash, Help, Palette, Barcode, CompareView, analogsView } from "./views/overlays.js";
+import * as cli from "./cli.js";
+
+export const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+
+export const VIEWS = {
+  catalog: catalogView,
+  deals: dealsView,
+  recipes: recipesView,
+  shops: shopsView,
+  cart: cartView,
+  profile: profileView,
+  palette: (app) => app.overlay(new Palette(app)),
+  help: (app) => app.overlay(new Help()),
+  barcode: (app) => app.overlay(new Barcode(app)),
+  analogs: analogsView,
+  compare: (app) => app.push(new CompareView(app)),
+  searchCatalog: (app, q) => {
+    app.stacks.catalog.length = 1;
+    app.switchTab("catalog");
+    app.stacks.catalog[0].search(q);
+  },
+  searchRecipes: (app, q) => {
+    app.stacks.recipes.length = 1;
+    app.switchTab("recipes");
+    const v = app.stacks.recipes[0];
+    v.input.set(q);
+    v.setQuery(q);
+    v.focus = "list";
+  },
+};
+
+const HELP = `
+  ВкусВилл в терминале · vkusvill-cli ${"$VERSION"}
+
+  npx vkusvill-cli            полноэкранный интерфейс
+  npx vkusvill-cli <запрос>   открыть интерфейс сразу с поиском
+
+  Команды с обычным выводом (для скриптов, --json — сырые данные):
+    vv search <запрос>        поиск товаров   [--sort price_asc|price_desc|rating|new] [--page N]
+    vv deals                  скидки по карте [--quantity — «от N штук»]
+    vv product <id>           карточка товара
+    vv barcode <EAN-13>       товар по штрихкоду
+    vv recipes <запрос>       рецепты
+    vv shops [метро|город]    магазины
+    vv cart                   корзина из интерфейса
+    vv cart add <id> [кол-во] положить товар в корзину
+    vv cart link              ссылка на корзину ВкусВилла и QR-код
+    vv cart clear             очистить корзину
+
+  Флаги: --json  --no-splash  --version  --help
+  Окружение: VV_TOKEN (заказы и персональные скидки), VV_COLOR=256|truecolor, NO_COLOR
+`;
+
+const VALUE_FLAGS = new Set(["--sort", "--page"]);
+const BOOL_FLAGS = new Set(["--json", "--quantity", "--no-splash", "--version", "--help"]);
+const SORTS = ["popularity", "rating", "price_asc", "price_desc", "new"];
+
+// Splits argv into positional words, boolean flags and flag values (`--page 2` or `--page=2`)
+function parseArgs(argv) {
+  const args = [], flags = new Set(), values = {};
+  for (let i = 0; i < argv.length; i++) {
+    let a = argv[i];
+    if (a === "-h") a = "--help";
+    if (a === "-v") a = "--version";
+    if (!a.startsWith("--")) { args.push(a); continue; }
+    const [name, inline] = a.split(/=(.*)/s, 2);
+    if (VALUE_FLAGS.has(name)) {
+      const v = inline ?? argv[++i];
+      if (v === undefined) throw new Error(`Флагу ${name} нужно значение`);
+      values[name.slice(2)] = v;
+    } else if (BOOL_FLAGS.has(name)) flags.add(name);
+    else throw new Error(`Неизвестный флаг ${name} — vv --help`);
+  }
+  return { args, flags, values };
+}
+
+export async function main(argv) {
+  const { args, flags, values } = parseArgs(argv);
+  if (flags.has("--version") || args[0] === "version") return console.log(VERSION);
+  if (flags.has("--help") || args[0] === "help") return console.log(HELP.replace("$VERSION", VERSION));
+  if (values.sort !== undefined && !SORTS.includes(values.sort)) throw new Error(`--sort: одно из ${SORTS.join(", ")}`);
+  if (values.page !== undefined && !/^[1-9]\d{0,4}$/.test(values.page)) throw new Error("--page: номер страницы, 1 и больше");
+  const json = flags.has("--json");
+  const cmd = args[0];
+  const commands = {
+    search: () => cli.search(args.slice(1).join(" "), { json, sort: values.sort, page: +(values.page ?? 1) }),
+    deals: () => cli.deals({ json, type: flags.has("--quantity") ? "quantity" : "card" }),
+    product: () => cli.product(args[1], { json }),
+    barcode: () => cli.barcode(args[1], { json }),
+    recipes: () => cli.recipes(args.slice(1).join(" "), { json }),
+    shops: () => cli.shops(args.slice(1).join(" "), { json }),
+    cart: () => cli.cart(args.slice(1), { json }),
+  };
+  if (commands[cmd]) return commands[cmd]();
+  if (!process.stdout.isTTY || !process.stdin.isTTY) {
+    if (args.length) return cli.search(args.join(" "), { json });
+    return console.log(HELP.replace("$VERSION", VERSION));
+  }
+  const app = new App({ views: VIEWS });
+  app.start();
+  if (args.length) VIEWS.searchCatalog(app, args.join(" "));
+  if (!flags.has("--no-splash") && !args.length && !process.env.VV_NO_SPLASH) app.overlay(new Splash(app));
+}

package/src/product.js

@@ -0,0 +1,135 @@
+// MCP response item → a convenient model: price per 100 g, kcal and macros, composition flags, photos, properties.
+// Flags are heuristics over the first manufacturer's ingredients; in JS \b doesn't see Cyrillic, hence the (?<![а-яё]) boundaries.
+
+import { cleanDeep } from "./safe.js";
+
+const W = "(?<![а-яё])";
+export const RX = {
+  sugar: /сахар(?!озаменит)|сироп|(?<![а-яё])мед(?![а-яё])|(?<![а-яё])мёд|фруктоз|глюкоз|декстроз|патока|сгущ|инверт/iu,
+  noSugar: /без (доб\.?|добавленного )?сахара/iu,
+  gluten: new RegExp(`пшени|глютен|ячмен|ржан|${W}рож|овсян|овёс|овес|солод|манн|булгур|кускус|полб|спельт|сухар|панир`, "iu"),
+  glutenFree: /без глютена/iu,
+  lactose: /молок|молоч|сливк|сливоч|творог|сыр(?!ь)|кефир|йогурт|сыворот|лактоз|казеин/iu,
+  lactoseFree: /безлактоз|без лактозы|безмолочн|растительн/iu,
+  additives: /(?<![a-zа-яё])[EЕ] ?-?\d{3}[a-z]?|загустител[ьи]|стабилизатор[ы]?|эмульгатор[ы]?|консервант[ы]?|ароматизатор[ы]?|краситель|регулятор[ы]? кислотности|модифицированн[а-я]+ крахмал|усилител[ья] вкуса/giu,
+  palm: /пальмов/iu,
+};
+
+export const decode = (s = "") =>
+  String(s).replace(/&nbsp;/g, " ").replace(/&quot;/g, '"').replace(/&laquo;/g, "«").replace(/&raquo;/g, "»")
+    .replace(/&mdash;/g, "—").replace(/&ndash;/g, "–").replace(/&#0?39;/g, "'").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">")
+    .replace(/\u00a0/g, " ");
+
+const stripTags = (s) => decode(String(s).replace(/<br\s*\/?>/gi, "\n").replace(/<[^>]+>/g, " ")).replace(/[ \t]+/g, " ").trim();
+
+// «ООО "А": текст;<br>ООО "Б": текст» → the first manufacturer's text, without its name
+export function firstMaker(value = "") {
+  let part = String(value).split(/<br\s*\/?>/i)[0];
+  part = part.replace(/^\s*(ООО|АО|ЗАО|ИП|ОАО|ПАО)?[^:]{0,80}?"[^"]*"+\s*:/u, "");
+  part = part.replace(/^\s*[^:]{0,60}(ИП|ООО|АО)[^:]{0,40}:/u, "");
+  part = part.replace(/\s*Поставщики:.*$/su, "");
+  return stripTags(part).replace(/^[;.\s]+|[;.\s]+$/g, "");
+}
+
+function nutrition(v) {
+  const num = (re) => { const m = v.match(re); return m ? parseFloat(m[1].replace(",", ".")) : null; };
+  return {
+    p: num(/белк[а-я]*\s*([\d.,]+)/iu), f: num(/жир[а-я]*\s*([\d.,]+)/iu), c: num(/углевод[а-я]*\s*([\d.,]+)/iu),
+    kcal: num(/([\d.,]+)\s*ккал/iu), sugars: num(/сахар[а-я() ]*[-–—]?\s*([\d.,]+)/iu),
+  };
+}
+
+// Name: a trailing weight («Творог 5%, 180 г») is split off for compact rows
+function splitName(name) {
+  const m = /^(.*?),?\s+(\d[\d.,]*\s*(?:г|кг|мл|л|шт)\.?(?:\s*[×x]\s*\d+)?)\s*$/iu.exec(name);
+  return m && m[1].length > 2 ? { title: m[1], pack: m[2] } : { title: name, pack: "", whole: true };
+}
+
+export function normalize(item) {
+  if (!item || item.__vv) return item;
+  const name = decode(item.name ?? "").trim();
+  const props = (item.properties ?? []).map((p) => ({ name: decode(p.name), raw: p.value, value: firstMaker(p.value) }));
+  const prop = (needle) => props.find((p) => p.name.includes(needle));
+  const comp = prop("Состав")?.value ?? "";
+  const nutr = nutrition(prop("ценность")?.value ?? "");
+  const w = item.weight ?? {};
+  const grams = item.unit === "кг" ? 1000 : Math.round((w.value || 0) * (w.unit === "кг" ? 1000 : 1));
+  const price = item.price?.current ?? 0;
+  const old = item.price?.old ?? null;
+  const compL = comp.toLowerCase().replace(/ё/g, "е");
+  const text = `${name.toLowerCase()} ${compL}`;
+  const adds = [...new Set((comp.match(RX.additives) || []).map((s) => s.toLowerCase().replace(/\s+/g, " ")))];
+  const { title, pack, whole } = splitName(name);
+  return {
+    __vv: true,
+    id: item.id,
+    name,
+    title,
+    pack: pack || (grams && whole && !/\d\s*(г|кг|мл|л)(?![а-яё])/iu.test(name) ? (grams >= 1000 ? `${+(grams / 1000).toFixed(2)} кг` : `${grams} г`) : ""),
+    slug: item.slug,
+    url: item.url ?? `https://vkusvill.ru/goods/${item.id}/`,
+    description: decode(item.description ?? "").trim(),
+    brand: item.brand ?? null,
+    price,
+    old: old && old > price ? old : null,
+    off: item.price?.discount_percent ? Math.round(item.price.discount_percent) : old && old > price ? Math.round((1 - price / old) * 100) : 0,
+    offInfo: item.price?.discount_info ?? null,
+    unit: item.unit ?? "шт",
+    grams,
+    per100: grams ? Math.round((price / grams) * 1000) / 10 : null,
+    rating: item.rating?.average ? Math.round(item.rating.average * 10) / 10 : 0,
+    votes: item.rating?.count ?? 0,
+    images: (item.images ?? []).map((i) => i.medium ?? i.small ?? i.large).filter(Boolean),
+    thumb: item.images?.[0]?.small ?? item.images?.[0]?.medium ?? null,
+    category: (item.category ?? []).map((c) => c.name).reverse(),
+    props,
+    comp,
+    ...nutr,
+    flags: {
+      sugar: RX.sugar.test(compL) && !RX.noSugar.test(name),
+      gluten: RX.gluten.test(compL) && !RX.glutenFree.test(name),
+      lactose: RX.lactose.test(text) && !RX.lactoseFree.test(name),
+      additives: adds.length,
+      palm: RX.palm.test(compL),
+    },
+    additiveList: adds,
+    available: item.available_quantity ?? null,
+  };
+}
+
+// Compact snapshot for the cart and history, without long texts
+export function snapshot(p) {
+  return {
+    id: p.id, name: p.name, title: p.title, pack: p.pack, price: p.price, old: p.old, off: p.off, unit: p.unit, grams: p.grams,
+    url: p.url, thumb: p.thumb, images: (p.images ?? []).slice(0, 1), rating: p.rating, votes: p.votes, category: p.category,
+    p: p.p, f: p.f, c: p.c, kcal: p.kcal, flags: p.flags, per100: p.per100,
+  };
+}
+
+// Snapshots come from the state file, which may be hand-edited: strings are cleaned, shapes enforced
+export function fromSnapshot(raw) {
+  const s = cleanDeep(raw);
+  const strings = (a) => (Array.isArray(a) ? a.filter((x) => typeof x === "string") : []);
+  return {
+    __vv: true, description: "", props: [], comp: "", additiveList: [], offInfo: null,
+    ...s,
+    title: typeof s.title === "string" ? s.title : s.name,
+    images: strings(s.images),
+    category: strings(s.category),
+    flags: s.flags && typeof s.flags === "object" ? s.flags : {},
+  };
+}
+
+export const rub = (n) => (n == null ? "—" : `${Math.round(n).toLocaleString("ru-RU").replace(/\u00a0|\u202f/g, " ")} ₽`);
+export const plural = (n, one, few, many) => {
+  const m10 = n % 10, m100 = n % 100;
+  return m10 === 1 && m100 !== 11 ? one : m10 >= 2 && m10 <= 4 && (m100 < 12 || m100 > 14) ? few : many;
+};
+export const compactNum = (n) => (n >= 1e6 ? `${(n / 1e6).toFixed(1).replace(".", ",")} млн` : n >= 1e4 ? `${Math.round(n / 1000)} тыс` : n >= 1000 ? `${(n / 1000).toFixed(1).replace(".", ",")} тыс` : String(n));
+
+export const qtyStep = (p) => (p.unit === "кг" ? 0.1 : 1);
+export const qtyText = (p, q) => (p.unit === "кг" ? `${+q.toFixed(2)} кг` : `${q} шт`);
+// Line cost: for items sold by weight, price per kg × kg
+export const lineTotal = (p, q) => p.price * q;
+// Line weight in grams, for the kcal and macro totals
+export const lineGrams = (p, q) => (p.unit === "кг" ? q * 1000 : (p.grams || 0) * q);

package/src/safe.js

@@ -0,0 +1,37 @@
+// Defense against untrusted data: anything from the network may contain terminal control characters
+// (ESC, C1 codes such as \x9b, which is CSI) and bidi override characters that spoof
+// the visible text. We clean on input and open outbound links only to known domains.
+
+const UNSAFE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2066-\u2069\ufeff]/g;
+
+export const clean = (s) => String(s ?? "").replace(UNSAFE, "").replace(/\t/g, " ");
+
+// Recursively cleans every string in a response
+export function cleanDeep(v, depth = 0) {
+  if (depth > 40) return null;
+  if (typeof v === "string") return clean(v);
+  if (Array.isArray(v)) return v.map((x) => cleanDeep(x, depth + 1));
+  if (v && typeof v === "object") {
+    const out = {};
+    for (const [k, x] of Object.entries(v)) if (k !== "__proto__" && k !== "constructor" && k !== "prototype") out[clean(k)] = cleanDeep(x, depth + 1);
+    return out;
+  }
+  return v;
+}
+
+const HOSTS = {
+  open: ["vkusvill.ru", "yandex.ru"],
+  image: ["vkusvill.ru"],
+};
+
+// https only, and only known domains (subdomains included)
+export function safeUrl(url, kind = "open") {
+  try {
+    const u = new URL(url);
+    if (u.protocol !== "https:" || u.username || u.password) return null;
+    const host = u.hostname.toLowerCase();
+    return HOSTS[kind].some((h) => host === h || host.endsWith("." + h)) ? u.href : null;
+  } catch {
+    return null;
+  }
+}

package/src/store.js

@@ -0,0 +1,190 @@
+// Persistent state: cart, favourites, history, recent searches and UI preferences.
+// One JSON file in ~/.config/vv-cli/state.json, readable by the owner only.
+//
+// - Writes are atomic (temp file + rename) and debounced; exit and crash paths flush synchronously.
+// - Everything read from disk is validated: a hand-edited or truncated file never crashes the app.
+// - A file that cannot be parsed is kept as state.json.broken-<time> instead of being overwritten.
+// - Another process (a second TUI, `vv cart add`) may change the file: the TUI watches it and reloads.
+
+import { mkdirSync, readFileSync, writeFileSync, renameSync, statSync, chmodSync, watchFile, unwatchFile } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { snapshot, fromSnapshot, lineTotal, qtyStep } from "./product.js";
+
+const VERSION = 2;
+const DIR = process.env.VV_CONFIG_DIR ?? path.join(process.env.XDG_CONFIG_HOME ?? (process.platform === "win32" && process.env.APPDATA ? process.env.APPDATA : path.join(homedir(), ".config")), "vv-cli");
+const FILE = path.join(DIR, "state.json");
+
+export const CART_MAX = 100;
+export const QTY_MAX = 40;
+const HISTORY_MAX = 60;
+const QUERIES_MAX = 20;
+const FAVS_MAX = 500;
+
+const isId = (v) => Number.isInteger(v) && v > 0 && v < 1e9;
+const clampQty = (q) => Math.min(QTY_MAX, Math.max(0.01, Math.round(q * 100) / 100));
+
+function validProduct(p) {
+  return p && typeof p === "object" && isId(p.id) && typeof p.name === "string" && Number.isFinite(p.price);
+}
+
+class Store {
+  constructor() {
+    this.cart = [];      // [{ p, q, at }] — `at` is when the price snapshot was taken
+    this.favs = [];
+    this.history = [];
+    this.queries = [];
+    this.prefs = {};     // UI state: last tab, filters, sorts
+    this.warning = null;   // shown once by the TUI
+    this.saveError = null; // last failed write, shown by the TUI
+    this.listeners = new Set();
+    this.mtime = 0;
+    this.load();
+  }
+
+  load() {
+    let raw;
+    try { raw = readFileSync(FILE, "utf8"); } catch { return; }
+    let s;
+    try {
+      s = JSON.parse(raw);
+      if (!s || typeof s !== "object") throw new Error("not an object");
+    } catch {
+      const backup = `${FILE}.broken-${Date.now()}`;
+      try { renameSync(FILE, backup); } catch {}
+      this.warning = `Файл состояния был повреждён — копия в ${backup}`;
+      return;
+    }
+    const now = Date.now();
+    this.cart = (Array.isArray(s.cart) ? s.cart : [])
+      .filter((l) => validProduct(l?.p) && Number.isFinite(l.q) && l.q > 0)
+      .slice(0, CART_MAX)
+      .map((l) => ({ p: fromSnapshot(l.p), q: clampQty(l.q), at: Number.isFinite(l.at) ? l.at : now }));
+    this.favs = (Array.isArray(s.favs) ? s.favs : []).filter(validProduct).slice(0, FAVS_MAX).map(fromSnapshot);
+    this.history = (Array.isArray(s.history) ? s.history : []).filter(validProduct).slice(0, HISTORY_MAX).map(fromSnapshot);
+    this.queries = (Array.isArray(s.queries) ? s.queries : []).filter((q) => typeof q === "string" && q.length <= 100).slice(0, QUERIES_MAX);
+    this.prefs = s.prefs && typeof s.prefs === "object" && !Array.isArray(s.prefs) ? s.prefs : {};
+    try { this.mtime = statSync(FILE).mtimeMs; } catch {}
+  }
+
+  save() {
+    clearTimeout(this.timer);
+    this.pending = true;
+    this.timer = setTimeout(() => this.saveNow(), 200);
+  }
+
+  saveNow() {
+    clearTimeout(this.timer);
+    this.pending = false;
+    try {
+      mkdirSync(DIR, { recursive: true, mode: 0o700 });
+      const data = {
+        v: VERSION,
+        cart: this.cart.map((l) => ({ p: snapshot(l.p), q: l.q, at: l.at })),
+        favs: this.favs.map(snapshot),
+        history: this.history.map(snapshot),
+        queries: this.queries,
+        prefs: this.prefs,
+      };
+      const tmp = `${FILE}.${process.pid}.tmp`;
+      writeFileSync(tmp, JSON.stringify(data), { mode: 0o600 });
+      renameSync(tmp, FILE);
+      // Older versions created these with default permissions: tighten on every write
+      try { chmodSync(FILE, 0o600); chmodSync(DIR, 0o700); } catch {}
+      this.mtime = statSync(FILE).mtimeMs;
+      this.saveError = null;
+    } catch (e) {
+      // Surfaced by the TUI; a lost write must never be silent
+      this.saveError = e.message;
+      this.notify();
+    }
+  }
+
+  // Reload when another process rewrites the file (polling: fs.watch is unreliable across platforms)
+  watch() {
+    watchFile(FILE, { interval: 1000 }, (cur) => {
+      // A pending local write wins: it is the newer intent and is about to land
+      if (!cur.mtimeMs || cur.mtimeMs === this.mtime || this.pending) return;
+      this.load();
+      this.notify();
+    });
+  }
+
+  unwatch() { unwatchFile(FILE); }
+
+  notify() { for (const fn of this.listeners) fn(); }
+
+  changed() {
+    this.save();
+    this.notify();
+  }
+
+  // ——— Preferences ———
+
+  pref(key, fallback) { return this.prefs[key] ?? fallback; }
+  setPref(key, value) { this.prefs[key] = value; this.save(); }
+
+  // ——— Cart ———
+
+  qty(id) { return this.cart.find((l) => l.p.id === id)?.q ?? 0; }
+
+  add(p, delta = qtyStep(p)) {
+    if (!validProduct(p) || !Number.isFinite(delta) || delta === 0) return false;
+    const line = this.cart.find((l) => l.p.id === p.id);
+    if (line) {
+      const q = Math.round((line.q + delta) * 100) / 100;
+      if (q < 0.01) this.cart = this.cart.filter((l) => l !== line);
+      else line.q = clampQty(q);
+      if (p.comp) { line.p = p; line.at = Date.now(); } // a fuller product refreshes the snapshot
+    } else if (delta > 0) {
+      if (this.cart.length >= CART_MAX) return false;
+      this.cart.push({ p, q: clampQty(delta), at: Date.now() });
+    }
+    this.changed();
+    return true;
+  }
+
+  // Fresh price data for a cart line
+  refresh(id, p) {
+    const line = this.cart.find((l) => l.p.id === id);
+    if (!line || !validProduct(p)) return false;
+    const changed = line.p.price !== p.price;
+    line.p = { ...line.p, ...p };
+    line.at = Date.now();
+    return changed;
+  }
+
+  stale(maxAge) { return this.cart.filter((l) => Date.now() - l.at > maxAge); }
+
+  remove(id) { this.cart = this.cart.filter((l) => l.p.id !== id); this.changed(); }
+  clearCart() { this.cart = []; this.changed(); }
+
+  get total() { return this.cart.reduce((s, l) => s + lineTotal(l.p, l.q), 0); }
+  get savings() { return this.cart.reduce((s, l) => s + (l.p.old ? (l.p.old - l.p.price) * l.q : 0), 0); }
+  get count() { return this.cart.length; }
+
+  // ——— Favourites and history ———
+
+  isFav(id) { return this.favs.some((p) => p.id === id); }
+
+  toggleFav(p) {
+    if (this.isFav(p.id)) this.favs = this.favs.filter((x) => x.id !== p.id);
+    else this.favs = [p, ...this.favs].slice(0, FAVS_MAX);
+    this.changed();
+    return this.isFav(p.id);
+  }
+
+  viewed(p) {
+    this.history = [p, ...this.history.filter((x) => x.id !== p.id)].slice(0, HISTORY_MAX);
+    this.save();
+  }
+
+  rememberQuery(q) {
+    q = q.trim().slice(0, 100);
+    if (!q) return;
+    this.queries = [q, ...this.queries.filter((x) => x !== q)].slice(0, QUERIES_MAX);
+    this.save();
+  }
+}
+
+export const store = new Store();

package/src/sys.js

@@ -0,0 +1,36 @@
+// System integration: open a link in the browser, copy to the clipboard.
+
+import { spawn } from "node:child_process";
+import { safeUrl } from "./safe.js";
+
+let onBlocked = () => {};
+export function onUrlBlocked(fn) { onBlocked = fn; }
+
+// Opens only https links to known hosts. No shell is involved: on Windows `cmd /c start` would
+// interpret `&` and `|` inside the URL, so rundll32 gets the URL as a plain argument instead.
+export function openUrl(url) {
+  const safe = safeUrl(url, "open");
+  if (!safe) { onBlocked(url); return false; }
+  const [cmd, args] =
+    process.platform === "darwin" ? ["open", [safe]]
+    : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", safe]]
+    : ["xdg-open", [safe]];
+  try { spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {}).unref(); } catch {}
+  return true;
+}
+
+// System clipboard first; OSC 52 as a fallback (works over SSH in most terminals).
+export function copy(text) {
+  const tryCmd = (cmd, args) => new Promise((resolve) => {
+    try {
+      const p = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
+      p.on("error", () => resolve(false));
+      p.on("close", (code) => resolve(code === 0));
+      p.stdin.end(text);
+    } catch { resolve(false); }
+  });
+  const osc = () => { if (process.stdout.isTTY) process.stdout.write(`\x1b]52;c;${Buffer.from(text).toString("base64")}\x07`); return true; };
+  if (process.platform === "darwin") return tryCmd("pbcopy", []).then((ok) => ok || osc());
+  if (process.platform === "win32") return tryCmd("clip", []).then((ok) => ok || osc());
+  return tryCmd("wl-copy", []).then((ok) => ok || tryCmd("xclip", ["-selection", "clipboard"])).then((ok) => ok || osc());
+}

package/src/term/input.js

@@ -0,0 +1,131 @@
+// Terminal input parsing: keys, mouse (SGR), paste. Hotkeys also work with the Russian keyboard layout.
+
+const RU = "йцукенгшщзхъфывапролджэячсмитьбюЙЦУКЕНГШЩЗХЪФЫВАПРОЛДЖЭЯЧСМИТЬБЮё";
+const EN = "qwertyuiop[]asdfghjkl;'zxcvbnm,.QWERTYUIOP{}ASDFGHJKL:\"ZXCVBNM<>`";
+const RU2EN = new Map([...RU].map((c, i) => [c, EN[i]]));
+
+const PASTE_MAX = 64 * 1024;
+
+const SEQ = {
+  "[A": "up", "[B": "down", "[C": "right", "[D": "left", "[H": "home", "[F": "end",
+  "OA": "up", "OB": "down", "OC": "right", "OD": "left", "OH": "home", "OF": "end",
+  "[1~": "home", "[4~": "end", "[7~": "home", "[8~": "end", "[2~": "insert", "[3~": "delete",
+  "[5~": "pageup", "[6~": "pagedown", "[Z": "backtab",
+  "OP": "f1", "OQ": "f2", "OR": "f3", "OS": "f4", "[11~": "f1", "[15~": "f5",
+};
+
+function key(name, extra = {}) {
+  return { type: "key", name, ch: null, ctrl: false, alt: false, shift: false, ...extra };
+}
+
+export class Input {
+  constructor(stdin, onEvent) {
+    this.stdin = stdin;
+    this.onEvent = onEvent;
+    this.buf = "";
+    this.pasting = null;
+    this.timer = null;
+    this.handler = (data) => this.feed(data.toString("utf8"));
+  }
+
+  start() {
+    if (this.stdin.isTTY) this.stdin.setRawMode(true);
+    this.stdin.resume();
+    this.stdin.on("data", this.handler);
+  }
+
+  stop() {
+    this.stdin.off("data", this.handler);
+    if (this.stdin.isTTY) this.stdin.setRawMode(false);
+    this.stdin.pause();
+  }
+
+  feed(s) {
+    clearTimeout(this.timer);
+    this.buf += s;
+    this.parse();
+    // A lone ESC is the Esc key if nothing arrives after it
+    if (this.buf === "\x1b") this.timer = setTimeout(() => { this.buf = ""; this.emit(key("escape")); }, 30);
+  }
+
+  emit(ev) {
+    this.onEvent(ev);
+  }
+
+  parse() {
+    while (this.buf.length) {
+      const b = this.buf;
+      if (this.pasting !== null) {
+        // Pasted text is capped: a runaway paste must not grow memory without bound
+        const end = b.indexOf("\x1b[201~");
+        if (end < 0) { this.pasting = (this.pasting + b).slice(0, PASTE_MAX); this.buf = ""; return; }
+        this.pasting = (this.pasting + b.slice(0, end)).slice(0, PASTE_MAX);
+        this.emit({ type: "paste", text: this.pasting });
+        this.pasting = null;
+        this.buf = b.slice(end + 6);
+        continue;
+      }
+      if (b[0] === "\x1b") {
+        if (b.length === 1) return;
+        if (b.startsWith("\x1b[200~")) { this.pasting = ""; this.buf = b.slice(6); continue; }
+        // SGR mouse: ESC [ < b ; x ; y M|m
+        const m = /^\x1b\[<(\d+);(\d+);(\d+)([Mm])/.exec(b);
+        if (m) {
+          this.buf = b.slice(m[0].length);
+          this.emit(mouse(+m[1], +m[2] - 1, +m[3] - 1, m[4] === "m"));
+          continue;
+        }
+        if (b.startsWith("\x1b[<")) { if (/^\x1b\[<[\d;]*$/.test(b)) return; this.buf = b.slice(3); continue; }
+        // CSI with modifiers: ESC [ 1 ; 5 A
+        const csi = /^\x1b\[(\d*)(?:;(\d+))?([A-Za-z~])/.exec(b);
+        if (csi) {
+          this.buf = b.slice(csi[0].length);
+          const mod = csi[2] ? +csi[2] - 1 : 0;
+          const code = csi[3] === "~" ? `[${csi[1]}~` : `[${csi[3]}`;
+          const name = SEQ[code];
+          if (name) this.emit(key(name, { shift: !!(mod & 1), alt: !!(mod & 2), ctrl: !!(mod & 4) }));
+          continue;
+        }
+        if (b[1] === "O" && b.length >= 3) {
+          this.buf = b.slice(3);
+          const name = SEQ["O" + b[2]];
+          if (name) this.emit(key(name));
+          continue;
+        }
+        if (b[1] === "[" ) { if (/^\x1b\[[\d;]*$/.test(b)) return; this.buf = b.slice(2); continue; }
+        // Alt+character
+        const [ch] = [...b.slice(1)];
+        this.buf = b.slice(1 + ch.length);
+        if (ch === "\x1b") { this.emit(key("escape")); this.buf = "\x1b" + this.buf; continue; }
+        this.emit(printable(ch, { alt: true }));
+        continue;
+      }
+      const [ch] = [...b];
+      this.buf = b.slice(ch.length);
+      const c = ch.charCodeAt(0);
+      if (ch === "\r" || ch === "\n") this.emit(key("enter"));
+      else if (ch === "\t") this.emit(key("tab"));
+      else if (ch === "\x7f" || ch === "\b") this.emit(key("backspace"));
+      else if (c === 0) this.emit(key("space", { ctrl: true }));
+      else if (c < 27) this.emit(key(String.fromCharCode(c + 96), { ctrl: true }));
+      else if (c < 32) continue;
+      else this.emit(printable(ch));
+    }
+  }
+}
+
+function printable(ch, extra = {}) {
+  const hot = RU2EN.get(ch) ?? ch;
+  return { type: "key", name: ch === " " ? "space" : ch, ch, hot, ctrl: false, alt: false, shift: ch !== ch.toLowerCase(), ...extra };
+}
+
+function mouse(code, x, y, release) {
+  const base = code & ~(4 | 8 | 16 | 32);
+  const drag = !!(code & 32);
+  let action;
+  if (code & 64) action = (code & 1) ? "wheeldown" : "wheelup";
+  else if (release) action = "up";
+  else if (drag) action = "drag";
+  else action = "down";
+  return { type: "mouse", action, button: base & 3, x, y, shift: !!(code & 4), ctrl: !!(code & 16) };
+}