mdinject 0.2.3__tar.gz

mdinject-0.2.3/.betterleaks.toml

@@ -0,0 +1,52 @@
+# betterleaks (gitleaks-schema) allowlist for mdinject.
+#
+# betterleaks reads this file from the git toplevel when invoked by
+# crackerjack — the `[tool.crackerjack.betterleaks]` pyproject block has
+# NO effect (crackerjack __main__.py:291 documents this). Schema lives
+# at https://github.com/betterleaks/betterleaks/blob/main/config.toml
+# (mirrors gitleaks v8).
+#
+# Allowlist rationale:
+#
+# * `mdinject/assets/vendor/` and `app/MdInjectApp/Resources/vendor/` —
+#   vendored JS/CSS bundles (xterm.js, milkdown, FontAwesome). Minified
+#   code regularly matches the generic-api-key regex on constant
+#   strings that aren't actually secrets. Real secret handling happens
+#   in our own code, not vendored runtime dependencies.
+#
+# * `dist/` — sdist + wheel output (`python -m build` artifacts).
+#   betterleaks recurses into tarballs and finds the same vendor
+#   content twice. Excluding `dist/` skips the duplicate scan.
+#
+# * `htmlcov/` — pytest-cov HTML output. Contains verbatim copies of
+#   every Python source file in `mdinject/`; any secret in real code
+#   would still be caught by betterleaks walking `mdinject/` itself.
+#
+# * `node_modules/` — third-party npm packages, gitignored.
+#
+# * `*worktrees*` — sibling project checkouts (`.worktrees/<name>/`,
+#   `.claude/worktrees/<name>/`). Gitignored as of 2026-09-21; the
+#   allowlist stays for defense-in-depth in case stale tarballs
+#   reference the old gitlink paths.
+#
+# * `.venv/`, `.cache/`, `.crackerjack/`, `.oneiric_cache/`,
+#   `mdinject.egg-info/` — generated local artifacts.
+
+title = "mdinject betterleaks allowlist"
+
+[allowlist]
+description = "Skip vendored JS/CSS, build artifacts, and runtime caches"
+paths = [
+  '''mdinject/assets/vendor/''',
+  '''app/MdInjectApp/Resources/vendor/''',
+  '''dist/''',
+  '''htmlcov/''',
+  '''node_modules/''',
+  '''\.worktrees/''',
+  '''\.claude/worktrees/''',
+  '''\.venv/''',
+  '''\.cache/''',
+  '''\.crackerjack/''',
+  '''\.oneiric_cache/''',
+  '''mdinject\.egg-info/''',
+]

mdinject-0.2.3/.cache/betterleaks-report.json

@@ -0,0 +1 @@
+null

mdinject-0.2.3/.claude/settings.local.json

@@ -0,0 +1,25 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(/Users/les/Projects/mdinject/.venv/bin/python -m pytest:*)",
+      "Bash(PYTHONPATH=/Users/les/Projects/mdinject uv run pytest:*)",
+      "Bash(PYTHONPATH=/Users/les/Projects/mdinject uv run python:*)",
+      "mcp__excalidraw__get_resource",
+      "Bash(osascript:*)",
+      "Bash(screencapture:*)",
+      "mcp__macos_automator__execute_script",
+      "Bash(glab auth:*)",
+      "Bash(xcodebuild test:*)",
+      "Bash(xcodebuild build-for-testing:*)",
+      "Bash(git -C /Users/les/Projects/mdinject diff --stat HEAD~10..HEAD)",
+      "Bash(git -C /Users/les/Projects/mdinject log:*)",
+      "Bash(git -C /Users/les/Projects/mdinject status --porcelain)",
+      "Bash(git -C /Users/les/Projects/mdinject diff:*)",
+      "Bash(timeout 5 uv run:*)",
+      "Bash(uv run:*)",
+      "Bash(git commit:*)",
+      "Bash(git push:*)",
+      "Bash(echo:*)"
+    ]
+  }
+}

mdinject-0.2.3/.codespellrc

@@ -0,0 +1,43 @@
+[codespell]
+# Skip vendored assets — minified JS/CSS uses short identifiers (te, ot, openEnd)
+# that codespell misidentifies as misspellings but are correct as-is.
+#
+# IMPORTANT — codespell parses ``.codespellrc`` via Python's
+# ``configparser`` then re-emits each key as ``--<key> <value>`` on the
+# command line, where ``--skip`` has ``action="append"``. Two consequences:
+#
+#   * Multi-line INI continuation (``skip = a\n       b``) is read as ONE
+#     value with embedded newlines. codespell's
+#     ``flatten_clean_comma_separated_arguments`` then has only ONE
+#     element to split on commas — the embedded-newlines pattern never
+#     matches anything because paths contain no ``\n``. Verified failure
+#     mode on mdinject 2026-09-21: ~4000 vendor hits came back after
+#     converting the single-line ``*vendor/*`` into a multi-line entry.
+#
+#   * Duplicate ``skip =`` keys raise ``configparser.DuplicateOptionError``
+#     at read time, so we can't list each pattern on its own line.
+#
+# The supported format is comma-separated values on a single line. Order
+# doesn't matter; ``fnmatch.fnmatch`` does whole-string matching so the
+# trailing ``*`` after each comma-separated value is the "match anything
+# after" anchor.
+#
+# Vendor — covers both ``mdinject/assets/vendor/...`` and
+# ``app/MdInjectApp/Resources/vendor/...`` (and any future vendor path
+# at any depth) via ``*vendor/*``. ``fnmatch``'s ``*`` matches across
+# ``/``, so the leading ``*`` lets the prefix be anything.
+#
+# Worktrees — ``.worktrees/`` and ``.claude/worktrees/`` host sibling-
+# project checkouts (e.g. ``ghostty-spike``, ``w4-claude-md-breadcrumb``).
+# codespell's vendored JS in their nested ``node_modules/`` produces
+# false-positive misspellings (xterm.js's ``shiftIn`` → ``shifting`` etc.).
+# We exclude the WORKTREE directory roots so ``os.walk()`` calls
+# ``dirs.clear()`` on match and never descends. One pattern per walk
+# depth — first-level dirs (.worktrees, .claude/worktrees) plus their
+# first subdir (*/<name>) — is enough; deeper levels are skipped by
+# ``dirs.clear()`` on the parent match.
+skip = *vendor/*, .worktrees, .worktrees/*, .claude/worktrees, .claude/worktrees/*, package-lock.json, *htmlcov/*
+# Bodai-wide ignore list — kept in sync with mahavishnu/.codespellrc
+# ND = Neighbor Discovery (IPv6 protocol, used in scapy/MCP packet tooling).
+# iTerm = Apple terminal app proper noun.
+ignore-words-list = iTerm, ND, inout

mdinject-0.2.3/.envrc

@@ -0,0 +1 @@
+layout uv

mdinject-0.2.3/.gitignore

@@ -0,0 +1,157 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+venv/
+ENV/
+env/
+
+# Testing and coverage
+.coverage
+.coverage.*
+htmlcov/
+.pytest_cache/
+.tox/
+.hypothesis/
+
+# IDE and editors
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Ruff cache
+.ruff_cache/
+
+# MyPy/Pyright cache
+.mypy_cache/
+.pyright/
+.dmypy.json
+
+# Environment variables
+.env
+.env.*
+!.env.example
+
+# Logs
+*.log
+
+# Node.js
+node_modules/
+
+# Build artifacts
+.build/
+# Compiled helper binary — 97 MB, regenerated by scripts/build_macos_app.sh.
+# Tracked historically but should not be in git; rebuilt on demand.
+app/MdInjectApp/Resources/helper/mdinject-helper
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+
+# Backup Files (added by gitignore audit)
+# ============================================================================
+*.backup
+*.bak
+/.backups/
+/.backup/
+.backups/
+.backup/
+
+# Bodai canonical runtime artifacts (added 2026-08-17 cleanup wave)
+.crackerjack/
+.crackerjack/outputs/
+.crackerjack-state/
+.crackerjack-hooks-updated/
+.crackerjack-mcp/
+.oneiric_cache/
+*.bak2
+*.backup.*
+*.backup.json
+.coverage*
+coverage.json
+*.pyc
+*.pyo
+*.pyd
+example.mcp.json
+
+# ============================================================================
+# Bodai-wide gitignore patterns (added 2026-09-07; cross-repo cleanup sweep)
+# ============================================================================
+# Editor / pre-edit backups (foo.py.backup, foo.py.backup.json)
+*.backup
+*.backup.*
+*.bak
+*.tmpl
+# XDG mistake dirs (env var expansion failed; literal names)
+~
+[{]HOME[}]
+[{]XDG_DATA_HOME:-$HOME
+# pytest-benchmark autosave cache (sibling of the tracked `benchmarks/` test suite)
+.benchmarks/
+# Vitest config timestamp cache
+vitest.config.js.timestamp-*.mjs
+# Playwright output cruft
+playwright-junit.xml
+playwright-report/
+playwright-results.json
+test-results/
+
+
+# >>> bodai-shared-gitignore >>>
+# Source of truth: crackerjack/templates/GITIGNORE_BODAI.md
+# Enforced by: crackerjack check `gitignore-conformance`
+# Fleet list: /Users/les/Projects/mahavishnu/BODAI_REPO_REGISTRY.md
+# Do NOT remove the marker line above — `crackerjack gitignore sync` uses it
+# to detect already-applied state.
+
+# Editor / pre-edit backups (foo.py.backup, foo.py.backup.json)
+*.backup
+*.backup.*
+*.bak
+*.tmpl
+# XDG mistake dirs (env var expansion failed; literal names)
+# Note: both `{` and `}` are escaped (`{` -> `[{]`, `}` -> `[}]`)
+# because gitignore parsers interpret `${...}` as a brace-expansion
+# alternate group; escaping only the open brace leaves a stray `}`.
+~
+[{]HOME[}]
+[{]XDG_DATA_HOME:-$HOME[}]
+# pytest-benchmark autosave cache (sibling of the tracked `benchmarks/` test suite)
+.benchmarks/
+# Vitest config timestamp cache
+vitest.config.js.timestamp-*.mjs
+# Playwright output cruft
+playwright-junit.xml
+playwright-report/
+playwright-results.json
+test-results/
+
+# ============================================================================
+# Documentation — image assets
+# ============================================================================
+# Tracked images live under docs/assets/images/. Session scratch outputs
+# (named like "*-v4.png", "*-window.png", or anything dropped in
+# .scratch/) are local-only and must not be committed. The dot-prefix on
+# `.scratch` is load-bearing — the gitignore rule only matches with it.
+docs/assets/images/.scratch/
+docs/assets/images/.scratch/**
+# <<< bodai-shared-gitignore <<<
+# Worktree directories — local checkouts of sibling repos used for
+# cross-project work, sandboxed investigations, or session scratch.
+# As of 2026-09-21 these were dangling ``160000 commit <sha>`` gitlinks
+# in mdinject's index (no ``.gitmodules`` backing). They were removed via
+# ``git rm --cached`` and now exist on disk as untracked working
+# directories — gitignore keeps them out of ``git status`` so they
+# don't shadow mdinject's own change-detection. ``*worktrees/*`` matches
+# both ``.worktrees/<name>/...`` and ``.claude/worktrees/<name>/...``.
+*worktrees/*

mdinject-0.2.3/.lycheecache

@@ -0,0 +1,19 @@
+https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json,200,1789995776
+https://semver.org/spec/v2.0.0.html,200,1789995776
+https://img.shields.io/badge/runtime-oneiric-6e5494,200,1789995776
+https://github.com/lesleslie/crackerjack,200,1789995778
+https://github.com/migueldeicaza/SwiftTerm,200,1789995776
+https://github.com/jlowin/fastmcp,200,1789995776
+https://www.python.org/downloads/,200,1789995776
+https://mitchellh.com/writing/libghostty-is-coming,200,1789995776
+https://ghostty.org/docs/about,200,1789995776
+https://github.com/astral-sh/uv,200,1789995776
+https://github.com/manaflow-ai/cmux,200,1789995776
+https://semver.org/,200,1789995776
+https://raw.githubusercontent.com/manaflow-ai/cmux/main/Packages/macOS/CmuxTerminalCore/Package.swift,200,1789995776
+https://keepachangelog.com/en/1.0.0/,200,1789995776
+https://xtermjs.org/,200,1789995776
+https://github.com/lesleslie/oneiric,200,1789995776
+https://img.shields.io/badge/python-3.14%2B-green,200,1789995776
+https://github.com/Lakr233/libghostty-spm,200,1789995776
+https://img.shields.io/badge/code%20style-crackerjack-000042,200,1789995776

mdinject-0.2.3/.lycheeignore

@@ -0,0 +1,46 @@
+# lychee ignore patterns for mdinject (gitignore-like syntax).
+#
+# crackerjack reads this from the repo root (cwd); a
+# `[tool.crackerjack.lychee]` pyproject block has NO effect.
+# See crackerjack __main__.py:291.
+
+# CHANGELOG self-references — Keep-a-Changelog footer uses
+# `file://./CHANGELOG.md#<anchor>` which is GitHub-renderable but not
+# a real URL. lychee tries to fetch it as a remote and reports 404.
+file://./CHANGELOG.md#*
+
+# Font Awesome CSS — vendored `all.min.css` references eight font
+# files at `../webfonts/fa-*.{ttf,woff2}` but the setup_assets.sh
+# script only ships fa-regular-400.woff2 + fa-solid-900.woff2. The
+# four referenced font faces (fa-brands-*, fa-v4compatibility*) are
+# not used by mdinject; the unused ttf companions exist for legacy
+# browser fallbacks that we don't need. Lychee flags all 8; we
+# ignore all 8 rather than patching the vendored CSS.
+file:///Users/les/Projects/mdinject/mdinject/assets/webfonts/*
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/webfonts/*
+
+# editor.html:117 links `milkdown.bundle.css` from
+# `app/MdInjectApp/Resources/`. The file actually lives at
+# `app/MdInjectApp/Resources/vendor/milkdown.bundle.css`. The macOS
+# Xcode build flattens `vendor/` into `Resources/`, so the runtime
+# path resolves correctly, but lychee resolves relative to the
+# HTML file's directory and sees a missing file. Ignore rather than
+# duplicate the bundle or patch the HTML.
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/milkdown.bundle.css
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/milkdown.bundle.js
+
+# Same flattening issue for the other vendor JS bundles referenced
+# from editor.html. The paths resolve at runtime in the Xcode bundle
+# but not under lychee's static resolution.
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/codemirror.bundle.js
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/codemirror_adapter.js
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/codemirror.css
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/easymde.min.js
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/easymde.min.css
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/all.min.js
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/all.min.css
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/xterm.js
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/xterm.css
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/xterm-addon-fit.js
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/milkdown.bundle.css
+file:///Users/les/Projects/mdinject/app/MdInjectApp/Resources/milkdown.bundle.js

mdinject-0.2.3/.pre-commit-config.yaml

@@ -0,0 +1,37 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.4
+    hooks:
+      - id: ruff
+        args: [--fix, --exit-non-zero-on-fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-yaml
+      - id: check-toml
+      - id: check-json
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-added-large-files
+        args: [--maxkb=1000]
+      - id: check-merge-conflict
+      - id: detect-private-key
+
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.8.0
+    hooks:
+      - id: bandit
+        args: [-r, mdinject/, -ll]
+        pass_filenames: false
+
+  - repo: local
+    hooks:
+      - id: pytest-check
+        name: pytest-check
+        entry: uv run pytest
+        language: system
+        pass_filenames: false
+        always_run: true
+        args: [-m, "not integration and not slow", --tb=short]