chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,28 @@
|
||||
/**
|
||||
* bin-context — tiny shared helpers for non-interactive gstack bins that need the
|
||||
* project slug, current branch, and argv flags. Extracted from the decision bins
|
||||
* (gstack-decision-log / gstack-decision-search) so the slug/branch/flag plumbing
|
||||
* lives in one audited place instead of being copy-pasted per bin.
|
||||
*/
|
||||
|
||||
import { spawnSync } from "child_process";
|
||||
|
||||
/** Resolve the project slug via the `gstack-slug` helper (parses `SLUG=...`). */
|
||||
export function resolveSlug(slugBinPath: string): string {
|
||||
const r = spawnSync(slugBinPath, { encoding: "utf-8" });
|
||||
const m = (r.stdout || "").match(/^SLUG=(.+)$/m);
|
||||
return m ? m[1].trim() : "unknown";
|
||||
}
|
||||
|
||||
/** Current git branch, or undefined on detached HEAD / outside a repo. */
|
||||
export function gitBranch(): string | undefined {
|
||||
const r = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf-8" });
|
||||
const b = (r.stdout || "").trim();
|
||||
return b && b !== "HEAD" ? b : undefined;
|
||||
}
|
||||
|
||||
/** The value following `--flag` in argv, or undefined if absent. */
|
||||
export function flagValue(args: string[], name: string): string | undefined {
|
||||
const i = args.indexOf(name);
|
||||
return i >= 0 ? args[i + 1] : undefined;
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
/**
|
||||
* Conductor workspaces don't inherit the user's interactive shell env, so the
|
||||
* canonical ANTHROPIC_API_KEY / OPENAI_API_KEY may be missing while
|
||||
* Conductor's GSTACK_-prefixed forms are present. Promote the GSTACK_ form to
|
||||
* canonical when canonical is empty, so subprocesses (gbrain embed,
|
||||
* @anthropic-ai/claude-agent-sdk, etc) pick it up.
|
||||
*
|
||||
* Import this for its side effect: `import "../lib/conductor-env-shim";`
|
||||
*/
|
||||
const PROMOTED_KEYS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"] as const;
|
||||
|
||||
/**
|
||||
* Pure form: returns a copy of `base` with each GSTACK_-prefixed key promoted
|
||||
* to its canonical name when the canonical is empty. Single source of truth
|
||||
* for promotion semantics — used by the ambient mutator below and by the
|
||||
* hermetic env builder (test/helpers/hermetic-env.ts), which must not mutate
|
||||
* process.env.
|
||||
*/
|
||||
export function promotedEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
|
||||
const out: NodeJS.ProcessEnv = { ...base };
|
||||
for (const key of PROMOTED_KEYS) {
|
||||
if (!out[key] && out[`GSTACK_${key}`]) {
|
||||
out[key] = out[`GSTACK_${key}`];
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
export function promoteConductorEnv(): void {
|
||||
const promoted = promotedEnv(process.env);
|
||||
for (const key of PROMOTED_KEYS) {
|
||||
if (promoted[key]) process.env[key] = promoted[key];
|
||||
}
|
||||
}
|
||||
|
||||
promoteConductorEnv();
|
||||
@@ -0,0 +1,42 @@
|
||||
# diagram-render
|
||||
|
||||
Offline diagram rendering for make-pdf and /diagram. One self-contained HTML
|
||||
page (`dist/diagram-render.html`, ~9MB) bundles mermaid, the excalidraw export
|
||||
utilities, and the official mermaid→excalidraw converter. The browse daemon
|
||||
loads it with `load-html`; callers drive it through `browse js` and pull bytes
|
||||
back with `js --out`.
|
||||
|
||||
The built page is **committed** (eng-review D2): rendering works with zero
|
||||
network at install time and render time, and there is no npm supply-chain
|
||||
surface in `./setup`. The drift test (`test/diagram-render-drift.test.ts`)
|
||||
fails CI if `dist/` is edited by hand or falls out of sync with `BUILD_INFO.json`.
|
||||
|
||||
## Page API (window functions)
|
||||
|
||||
| Function | In → Out |
|
||||
|---|---|
|
||||
| `__renderMermaid(id, text)` | mermaid text → SVG string. `id` must be unique per fence (`mermaid-fence-<n>`) — it namespaces every internal SVG id. |
|
||||
| `__mermaidToExcalidraw(text)` | mermaid text → `.excalidraw` scene JSON (flowcharts fully; other types degrade upstream). |
|
||||
| `__excalidrawToSvg(sceneJson)` | scene JSON → SVG string (Excalifont embedded, offline). |
|
||||
| `__rasterize(svg, targetWidthPx)` | SVG → PNG data URL. Callers own DPI math: `targetWidthPx = placed width (in) × 300`. Throws on tainted canvas. |
|
||||
| `__downscaleRaster(dataUri, targetWidthPx, mime)` | raster data URI → smaller data URI at `targetWidthPx` (same mime). make-pdf uses it to normalize oversized photos to print resolution. |
|
||||
| `__mountForScreenshot(svg, px)` | taint-proof fallback: mounts SVG at `#raster-stage` for `browse screenshot --selector`. |
|
||||
| `__probeImage(src)` | data URI/URL → `{width, height}` JSON. |
|
||||
| `__bundleInfo` | `{ name, deps }` — pinned dependency versions baked at build. |
|
||||
|
||||
Readiness: poll until `#status` text is `ready` (or `browse wait '#done'`).
|
||||
Page errors accumulate in `window.__errors`.
|
||||
|
||||
## Updating
|
||||
|
||||
```bash
|
||||
# 1. edit the exact pin in package.json
|
||||
cd lib/diagram-render && bun install
|
||||
# 2. rebuild (deterministic; build twice → same sha)
|
||||
bun run build
|
||||
# 3. commit package.json + bun.lock + dist/ together
|
||||
```
|
||||
|
||||
Render contract details (securityLevel strict, htmlLabels false, print-css font
|
||||
lock, `<base href>` + `</scri` escaping) are documented in `src/entry.ts` and
|
||||
`scripts/build.ts` — read both before touching either.
|
||||
@@ -0,0 +1,19 @@
|
||||
# Third-party licenses — diagram-render bundle
|
||||
|
||||
`dist/diagram-render.html` bundles the following packages (exact pins in
|
||||
`package.json`; transitive dependencies resolved via `bun.lock`):
|
||||
|
||||
| Package | Version | License | Source |
|
||||
|---|---|---|---|
|
||||
| mermaid | 11.12.2 | MIT | https://github.com/mermaid-js/mermaid |
|
||||
| @excalidraw/excalidraw | 0.18.0 | MIT | https://github.com/excalidraw/excalidraw |
|
||||
| @excalidraw/mermaid-to-excalidraw | 1.1.2 | MIT | https://github.com/excalidraw/mermaid-to-excalidraw |
|
||||
| react | 18.3.1 | MIT | https://github.com/facebook/react |
|
||||
| react-dom | 18.3.1 | MIT | https://github.com/facebook/react |
|
||||
|
||||
The bundle also embeds fonts shipped inside @excalidraw/excalidraw
|
||||
(Excalifont and related faces), licensed under the SIL Open Font License 1.1
|
||||
per the excalidraw repository.
|
||||
|
||||
When bumping a pin, re-verify its license field (`bun pm ls` or the package's
|
||||
LICENSE file) and update this table in the same commit.
|
||||
@@ -0,0 +1,625 @@
|
||||
{
|
||||
"lockfileVersion": 1,
|
||||
"configVersion": 1,
|
||||
"workspaces": {
|
||||
"": {
|
||||
"name": "@gstack/diagram-render",
|
||||
"dependencies": {
|
||||
"@excalidraw/excalidraw": "0.18.0",
|
||||
"@excalidraw/mermaid-to-excalidraw": "1.1.2",
|
||||
"mermaid": "11.12.2",
|
||||
"react": "18.3.1",
|
||||
"react-dom": "18.3.1",
|
||||
},
|
||||
},
|
||||
},
|
||||
"packages": {
|
||||
"@antfu/install-pkg": ["@antfu/install-pkg@1.1.0", "", { "dependencies": { "package-manager-detector": "^1.3.0", "tinyexec": "^1.0.1" } }, "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ=="],
|
||||
|
||||
"@babel/runtime": ["@babel/runtime@7.29.7", "", {}, "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw=="],
|
||||
|
||||
"@braintree/sanitize-url": ["@braintree/sanitize-url@6.0.2", "", {}, "sha512-Tbsj02wXCbqGmzdnXNk0SOF19ChhRU70BsroIi4Pm6Ehp56in6vch94mfbdQ17DozxkL3BAVjbZ4Qc1a0HFRAg=="],
|
||||
|
||||
"@chevrotain/cst-dts-gen": ["@chevrotain/cst-dts-gen@11.0.3", "", { "dependencies": { "@chevrotain/gast": "11.0.3", "@chevrotain/types": "11.0.3", "lodash-es": "4.17.21" } }, "sha512-BvIKpRLeS/8UbfxXxgC33xOumsacaeCKAjAeLyOn7Pcp95HiRbrpl14S+9vaZLolnbssPIUuiUd8IvgkRyt6NQ=="],
|
||||
|
||||
"@chevrotain/gast": ["@chevrotain/gast@11.0.3", "", { "dependencies": { "@chevrotain/types": "11.0.3", "lodash-es": "4.17.21" } }, "sha512-+qNfcoNk70PyS/uxmj3li5NiECO+2YKZZQMbmjTqRI3Qchu8Hig/Q9vgkHpI3alNjr7M+a2St5pw5w5F6NL5/Q=="],
|
||||
|
||||
"@chevrotain/regexp-to-ast": ["@chevrotain/regexp-to-ast@11.0.3", "", {}, "sha512-1fMHaBZxLFvWI067AVbGJav1eRY7N8DDvYCTwGBiE/ytKBgP8azTdgyrKyWZ9Mfh09eHWb5PgTSO8wi7U824RA=="],
|
||||
|
||||
"@chevrotain/types": ["@chevrotain/types@11.0.3", "", {}, "sha512-gsiM3G8b58kZC2HaWR50gu6Y1440cHiJ+i3JUvcp/35JchYejb2+5MVeJK0iKThYpAa/P2PYFV4hoi44HD+aHQ=="],
|
||||
|
||||
"@chevrotain/utils": ["@chevrotain/utils@11.0.3", "", {}, "sha512-YslZMgtJUyuMbZ+aKvfF3x1f5liK4mWNxghFRv7jqRR9C3R3fAOGTTKvxXDa2Y1s9zSbcpuO0cAxDYsc9SrXoQ=="],
|
||||
|
||||
"@excalidraw/excalidraw": ["@excalidraw/excalidraw@0.18.0", "", { "dependencies": { "@braintree/sanitize-url": "6.0.2", "@excalidraw/laser-pointer": "1.3.1", "@excalidraw/mermaid-to-excalidraw": "1.1.2", "@excalidraw/random-username": "1.1.0", "@radix-ui/react-popover": "1.1.6", "@radix-ui/react-tabs": "1.0.2", "browser-fs-access": "0.29.1", "canvas-roundrect-polyfill": "0.0.1", "clsx": "1.1.1", "cross-env": "7.0.3", "es6-promise-pool": "2.5.0", "fractional-indexing": "3.2.0", "fuzzy": "0.1.3", "image-blob-reduce": "3.0.1", "jotai": "2.11.0", "jotai-scope": "0.7.2", "lodash.debounce": "4.0.8", "lodash.throttle": "4.1.1", "nanoid": "3.3.3", "open-color": "1.9.1", "pako": "2.0.3", "perfect-freehand": "1.2.0", "pica": "7.1.1", "png-chunk-text": "1.0.0", "png-chunks-encode": "1.0.0", "png-chunks-extract": "1.0.0", "points-on-curve": "1.0.1", "pwacompat": "2.0.17", "roughjs": "4.6.4", "sass": "1.51.0", "tunnel-rat": "0.1.2" }, "peerDependencies": { "react": "^17.0.2 || ^18.2.0 || ^19.0.0", "react-dom": "^17.0.2 || ^18.2.0 || ^19.0.0" } }, "sha512-QkIiS+5qdy8lmDWTKsuy0sK/fen/LRDtbhm2lc2xcFcqhv2/zdg95bYnl+wnwwXGHo7kEmP65BSiMHE7PJ3Zpw=="],
|
||||
|
||||
"@excalidraw/laser-pointer": ["@excalidraw/laser-pointer@1.3.1", "", {}, "sha512-psA1z1N2qeAfsORdXc9JmD2y4CmDwmuMRxnNdJHZexIcPwaNEyIpNcelw+QkL9rz9tosaN9krXuKaRqYpRAR6g=="],
|
||||
|
||||
"@excalidraw/markdown-to-text": ["@excalidraw/markdown-to-text@0.1.2", "", {}, "sha512-1nDXBNAojfi3oSFwJswKREkFm5wrSjqay81QlyRv2pkITG/XYB5v+oChENVBQLcxQwX4IUATWvXM5BcaNhPiIg=="],
|
||||
|
||||
"@excalidraw/mermaid-to-excalidraw": ["@excalidraw/mermaid-to-excalidraw@1.1.2", "", { "dependencies": { "@excalidraw/markdown-to-text": "0.1.2", "mermaid": "10.9.3", "nanoid": "4.0.2" } }, "sha512-hAFv/TTIsOdoy0dL5v+oBd297SQ+Z88gZ5u99fCIFuEMHfQuPgLhU/ztKhFSTs7fISwVo6fizny/5oQRR3d4tQ=="],
|
||||
|
||||
"@excalidraw/random-username": ["@excalidraw/random-username@1.1.0", "", {}, "sha512-nULYsQxkWHnbmHvcs+efMkJ4/9TtvNyFeLyHdeGxW0zHs6P+jYVqcRff9A6Vq9w9JXeDRnRh2VKvTtS19GW2qA=="],
|
||||
|
||||
"@floating-ui/core": ["@floating-ui/core@1.7.5", "", { "dependencies": { "@floating-ui/utils": "^0.2.11" } }, "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ=="],
|
||||
|
||||
"@floating-ui/dom": ["@floating-ui/dom@1.7.6", "", { "dependencies": { "@floating-ui/core": "^1.7.5", "@floating-ui/utils": "^0.2.11" } }, "sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ=="],
|
||||
|
||||
"@floating-ui/react-dom": ["@floating-ui/react-dom@2.1.8", "", { "dependencies": { "@floating-ui/dom": "^1.7.6" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A=="],
|
||||
|
||||
"@floating-ui/utils": ["@floating-ui/utils@0.2.11", "", {}, "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg=="],
|
||||
|
||||
"@iconify/types": ["@iconify/types@2.0.0", "", {}, "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg=="],
|
||||
|
||||
"@iconify/utils": ["@iconify/utils@3.1.3", "", { "dependencies": { "@antfu/install-pkg": "^1.1.0", "@iconify/types": "^2.0.0", "import-meta-resolve": "^4.2.0" } }, "sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw=="],
|
||||
|
||||
"@mermaid-js/parser": ["@mermaid-js/parser@0.6.3", "", { "dependencies": { "langium": "3.3.1" } }, "sha512-lnjOhe7zyHjc+If7yT4zoedx2vo4sHaTmtkl1+or8BRTnCtDmcTpAjpzDSfCZrshM5bCoz0GyidzadJAH1xobA=="],
|
||||
|
||||
"@radix-ui/primitive": ["@radix-ui/primitive@1.1.1", "", {}, "sha512-SJ31y+Q/zAyShtXJc8x83i9TYdbAfHZ++tUZnvjJJqFjzsdUnKsxPL6IEtBlxKkU7yzer//GQtZSV4GbldL3YA=="],
|
||||
|
||||
"@radix-ui/react-arrow": ["@radix-ui/react-arrow@1.1.2", "", { "dependencies": { "@radix-ui/react-primitive": "2.0.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-G+KcpzXHq24iH0uGG/pF8LyzpFJYGD4RfLjCIBfGdSLXvjLHST31RUiRVrupIBMvIppMgSzQ6l66iAxl03tdlg=="],
|
||||
|
||||
"@radix-ui/react-collection": ["@radix-ui/react-collection@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-compose-refs": "1.0.0", "@radix-ui/react-context": "1.0.0", "@radix-ui/react-primitive": "1.0.1", "@radix-ui/react-slot": "1.0.1" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-uuiFbs+YCKjn3X1DTSx9G7BHApu4GHbi3kgiwsnFUbOKCrwejAJv4eE4Vc8C0Oaxt9T0aV4ox0WCOdx+39Xo+g=="],
|
||||
|
||||
"@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Y9VzoRDSJtgFMUCoiZBDVo084VQ5hfpXxVE+NgkdNsjiDBByiImMZKKhxMwCbdHvhlENG6a833CbFkOQvTricw=="],
|
||||
|
||||
"@radix-ui/react-context": ["@radix-ui/react-context@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-UASk9zi+crv9WteK/NU4PLvOoL3OuE6BWVKNF6hPRBtYBDXQ2u5iu3O59zUlJiTVvkyuycnqrztsHVJwcK9K+Q=="],
|
||||
|
||||
"@radix-ui/react-direction": ["@radix-ui/react-direction@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-2HV05lGUgYcA6xgLQ4BKPDmtL+QbIZYH5fCOTAOOcJ5O0QbWS3i9lKaurLzliYUDhORI2Qr3pyjhJh44lKA3rQ=="],
|
||||
|
||||
"@radix-ui/react-dismissable-layer": ["@radix-ui/react-dismissable-layer@1.1.5", "", { "dependencies": { "@radix-ui/primitive": "1.1.1", "@radix-ui/react-compose-refs": "1.1.1", "@radix-ui/react-primitive": "2.0.2", "@radix-ui/react-use-callback-ref": "1.1.0", "@radix-ui/react-use-escape-keydown": "1.1.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-E4TywXY6UsXNRhFrECa5HAvE5/4BFcGyfTyK36gP+pAW1ed7UTK4vKwdr53gAJYwqbfCWC6ATvJa3J3R/9+Qrg=="],
|
||||
|
||||
"@radix-ui/react-focus-guards": ["@radix-ui/react-focus-guards@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-pSIwfrT1a6sIoDASCSpFwOasEwKTZWDw/iBdtnqKO7v6FeOzYJ7U53cPzYFVR3geGGXgVHaH+CdngrrAzqUGxg=="],
|
||||
|
||||
"@radix-ui/react-focus-scope": ["@radix-ui/react-focus-scope@1.1.2", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.1", "@radix-ui/react-primitive": "2.0.2", "@radix-ui/react-use-callback-ref": "1.1.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-zxwE80FCU7lcXUGWkdt6XpTTCKPitG1XKOwViTxHVKIJhZl9MvIl2dVHeZENCWD9+EdWv05wlaEkRXUykU27RA=="],
|
||||
|
||||
"@radix-ui/react-id": ["@radix-ui/react-id@1.1.0", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-EJUrI8yYh7WOjNOqpoJaf1jlFIH2LvtgAl+YcFqNCa+4hj64ZXmPkAKOFs/ukjz3byN6bdb/AVUqHkI8/uWWMA=="],
|
||||
|
||||
"@radix-ui/react-popover": ["@radix-ui/react-popover@1.1.6", "", { "dependencies": { "@radix-ui/primitive": "1.1.1", "@radix-ui/react-compose-refs": "1.1.1", "@radix-ui/react-context": "1.1.1", "@radix-ui/react-dismissable-layer": "1.1.5", "@radix-ui/react-focus-guards": "1.1.1", "@radix-ui/react-focus-scope": "1.1.2", "@radix-ui/react-id": "1.1.0", "@radix-ui/react-popper": "1.2.2", "@radix-ui/react-portal": "1.1.4", "@radix-ui/react-presence": "1.1.2", "@radix-ui/react-primitive": "2.0.2", "@radix-ui/react-slot": "1.1.2", "@radix-ui/react-use-controllable-state": "1.1.0", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-NQouW0x4/GnkFJ/pRqsIS3rM/k97VzKnVb2jB7Gq7VEGPy5g7uNV1ykySFt7eWSp3i2uSGFwaJcvIRJBAHmmFg=="],
|
||||
|
||||
"@radix-ui/react-popper": ["@radix-ui/react-popper@1.2.2", "", { "dependencies": { "@floating-ui/react-dom": "^2.0.0", "@radix-ui/react-arrow": "1.1.2", "@radix-ui/react-compose-refs": "1.1.1", "@radix-ui/react-context": "1.1.1", "@radix-ui/react-primitive": "2.0.2", "@radix-ui/react-use-callback-ref": "1.1.0", "@radix-ui/react-use-layout-effect": "1.1.0", "@radix-ui/react-use-rect": "1.1.0", "@radix-ui/react-use-size": "1.1.0", "@radix-ui/rect": "1.1.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Rvqc3nOpwseCyj/rgjlJDYAgyfw7OC1tTkKn2ivhaMGcYt8FSBlahHOZak2i3QwkRXUXgGgzeEe2RuqeEHuHgA=="],
|
||||
|
||||
"@radix-ui/react-portal": ["@radix-ui/react-portal@1.1.4", "", { "dependencies": { "@radix-ui/react-primitive": "2.0.2", "@radix-ui/react-use-layout-effect": "1.1.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-sn2O9k1rPFYVyKd5LAJfo96JlSGVFpa1fS6UuBJfrZadudiw5tAmru+n1x7aMRQ84qDM71Zh1+SzK5QwU0tJfA=="],
|
||||
|
||||
"@radix-ui/react-presence": ["@radix-ui/react-presence@1.1.2", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.1", "@radix-ui/react-use-layout-effect": "1.1.0" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-18TFr80t5EVgL9x1SwF/YGtfG+l0BS0PRAlCWBDoBEiDQjeKgnNZRVJp/oVBl24sr3Gbfwc/Qpj4OcWTQMsAEg=="],
|
||||
|
||||
"@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.0.2", "", { "dependencies": { "@radix-ui/react-slot": "1.1.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Ec/0d38EIuvDF+GZjcMU/Ze6MxntVJYO/fRlCPhCaVUyPY9WTalHJw54tp9sXeJo3tlShWpy41vQRgLRGOuz+w=="],
|
||||
|
||||
"@radix-ui/react-roving-focus": ["@radix-ui/react-roving-focus@1.0.2", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/primitive": "1.0.0", "@radix-ui/react-collection": "1.0.1", "@radix-ui/react-compose-refs": "1.0.0", "@radix-ui/react-context": "1.0.0", "@radix-ui/react-direction": "1.0.0", "@radix-ui/react-id": "1.0.0", "@radix-ui/react-primitive": "1.0.1", "@radix-ui/react-use-callback-ref": "1.0.0", "@radix-ui/react-use-controllable-state": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-HLK+CqD/8pN6GfJm3U+cqpqhSKYAWiOJDe+A+8MfxBnOue39QEeMa43csUn2CXCHQT0/mewh1LrrG4tfkM9DMA=="],
|
||||
|
||||
"@radix-ui/react-slot": ["@radix-ui/react-slot@1.1.2", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-YAKxaiGsSQJ38VzKH86/BPRC4rh+b1Jpa+JneA5LRE7skmLPNAyeG8kPJj/oo4STLvlrs8vkf/iYyc3A5stYCQ=="],
|
||||
|
||||
"@radix-ui/react-tabs": ["@radix-ui/react-tabs@1.0.2", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/primitive": "1.0.0", "@radix-ui/react-context": "1.0.0", "@radix-ui/react-direction": "1.0.0", "@radix-ui/react-id": "1.0.0", "@radix-ui/react-presence": "1.0.0", "@radix-ui/react-primitive": "1.0.1", "@radix-ui/react-roving-focus": "1.0.2", "@radix-ui/react-use-controllable-state": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-gOUwh+HbjCuL0UCo8kZ+kdUEG8QtpdO4sMQduJ34ZEz0r4922g9REOBM+vIsfwtGxSug4Yb1msJMJYN2Bk8TpQ=="],
|
||||
|
||||
"@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.1.0", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-CasTfvsy+frcFkbXtSJ2Zu9JHpN8TYKxkgJGWbjiZhFivxaeW7rMeZt7QELGVLaYVfFMsKHjb7Ak0nMEe+2Vfw=="],
|
||||
|
||||
"@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.1.0", "", { "dependencies": { "@radix-ui/react-use-callback-ref": "1.1.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-MtfMVJiSr2NjzS0Aa90NPTnvTSg6C/JLCV7ma0W6+OMV78vd8OyRpID+Ng9LxzsPbLeuBnWBA1Nq30AtBIDChw=="],
|
||||
|
||||
"@radix-ui/react-use-escape-keydown": ["@radix-ui/react-use-escape-keydown@1.1.0", "", { "dependencies": { "@radix-ui/react-use-callback-ref": "1.1.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-L7vwWlR1kTTQ3oh7g1O0CBF3YCyyTj8NmhLR+phShpyA50HCfBFKVJTpshm9PzLiKmehsrQzTYTpX9HvmC9rhw=="],
|
||||
|
||||
"@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.0", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+FPE0rOdziWSrH9athwI1R0HDVbWlEhd+FR+aSDk4uWGmSJ9Z54sdZVDQPZAinJhJXwfT+qnj969mCsT2gfm5w=="],
|
||||
|
||||
"@radix-ui/react-use-rect": ["@radix-ui/react-use-rect@1.1.0", "", { "dependencies": { "@radix-ui/rect": "1.1.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-0Fmkebhr6PiseyZlYAOtLS+nb7jLmpqTrJyv61Pe68MKYW6OWdRE2kI70TaYY27u7H0lajqM3hSMMLFq18Z7nQ=="],
|
||||
|
||||
"@radix-ui/react-use-size": ["@radix-ui/react-use-size@1.1.0", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-XW3/vWuIXHa+2Uwcc2ABSfcCledmXhhQPlGbfcRXbiUQI5Icjcg19BGCZVKKInYbvUCut/ufbbLLPFC5cbb1hw=="],
|
||||
|
||||
"@radix-ui/rect": ["@radix-ui/rect@1.1.0", "", {}, "sha512-A9+lCBZoaMJlVKcRBz2YByCG+Cp2t6nAnMnNba+XiWxnj6r4JUFqfsgwocMBZU9LPtdxC6wB56ySYpc7LQIoJg=="],
|
||||
|
||||
"@types/d3": ["@types/d3@7.4.3", "", { "dependencies": { "@types/d3-array": "*", "@types/d3-axis": "*", "@types/d3-brush": "*", "@types/d3-chord": "*", "@types/d3-color": "*", "@types/d3-contour": "*", "@types/d3-delaunay": "*", "@types/d3-dispatch": "*", "@types/d3-drag": "*", "@types/d3-dsv": "*", "@types/d3-ease": "*", "@types/d3-fetch": "*", "@types/d3-force": "*", "@types/d3-format": "*", "@types/d3-geo": "*", "@types/d3-hierarchy": "*", "@types/d3-interpolate": "*", "@types/d3-path": "*", "@types/d3-polygon": "*", "@types/d3-quadtree": "*", "@types/d3-random": "*", "@types/d3-scale": "*", "@types/d3-scale-chromatic": "*", "@types/d3-selection": "*", "@types/d3-shape": "*", "@types/d3-time": "*", "@types/d3-time-format": "*", "@types/d3-timer": "*", "@types/d3-transition": "*", "@types/d3-zoom": "*" } }, "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww=="],
|
||||
|
||||
"@types/d3-array": ["@types/d3-array@3.2.2", "", {}, "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw=="],
|
||||
|
||||
"@types/d3-axis": ["@types/d3-axis@3.0.6", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw=="],
|
||||
|
||||
"@types/d3-brush": ["@types/d3-brush@3.0.6", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A=="],
|
||||
|
||||
"@types/d3-chord": ["@types/d3-chord@3.0.6", "", {}, "sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg=="],
|
||||
|
||||
"@types/d3-color": ["@types/d3-color@3.1.3", "", {}, "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A=="],
|
||||
|
||||
"@types/d3-contour": ["@types/d3-contour@3.0.6", "", { "dependencies": { "@types/d3-array": "*", "@types/geojson": "*" } }, "sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg=="],
|
||||
|
||||
"@types/d3-delaunay": ["@types/d3-delaunay@6.0.4", "", {}, "sha512-ZMaSKu4THYCU6sV64Lhg6qjf1orxBthaC161plr5KuPHo3CNm8DTHiLw/5Eq2b6TsNP0W0iJrUOFscY6Q450Hw=="],
|
||||
|
||||
"@types/d3-dispatch": ["@types/d3-dispatch@3.0.7", "", {}, "sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA=="],
|
||||
|
||||
"@types/d3-drag": ["@types/d3-drag@3.0.7", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ=="],
|
||||
|
||||
"@types/d3-dsv": ["@types/d3-dsv@3.0.7", "", {}, "sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g=="],
|
||||
|
||||
"@types/d3-ease": ["@types/d3-ease@3.0.2", "", {}, "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA=="],
|
||||
|
||||
"@types/d3-fetch": ["@types/d3-fetch@3.0.7", "", { "dependencies": { "@types/d3-dsv": "*" } }, "sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA=="],
|
||||
|
||||
"@types/d3-force": ["@types/d3-force@3.0.10", "", {}, "sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw=="],
|
||||
|
||||
"@types/d3-format": ["@types/d3-format@3.0.4", "", {}, "sha512-fALi2aI6shfg7vM5KiR1wNJnZ7r6UuggVqtDA+xiEdPZQwy/trcQaHnwShLuLdta2rTymCNpxYTiMZX/e09F4g=="],
|
||||
|
||||
"@types/d3-geo": ["@types/d3-geo@3.1.0", "", { "dependencies": { "@types/geojson": "*" } }, "sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ=="],
|
||||
|
||||
"@types/d3-hierarchy": ["@types/d3-hierarchy@3.1.7", "", {}, "sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg=="],
|
||||
|
||||
"@types/d3-interpolate": ["@types/d3-interpolate@3.0.4", "", { "dependencies": { "@types/d3-color": "*" } }, "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA=="],
|
||||
|
||||
"@types/d3-path": ["@types/d3-path@3.1.1", "", {}, "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg=="],
|
||||
|
||||
"@types/d3-polygon": ["@types/d3-polygon@3.0.2", "", {}, "sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA=="],
|
||||
|
||||
"@types/d3-quadtree": ["@types/d3-quadtree@3.0.6", "", {}, "sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg=="],
|
||||
|
||||
"@types/d3-random": ["@types/d3-random@3.0.3", "", {}, "sha512-Imagg1vJ3y76Y2ea0871wpabqp613+8/r0mCLEBfdtqC7xMSfj9idOnmBYyMoULfHePJyxMAw3nWhJxzc+LFwQ=="],
|
||||
|
||||
"@types/d3-scale": ["@types/d3-scale@4.0.9", "", { "dependencies": { "@types/d3-time": "*" } }, "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw=="],
|
||||
|
||||
"@types/d3-scale-chromatic": ["@types/d3-scale-chromatic@3.1.0", "", {}, "sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ=="],
|
||||
|
||||
"@types/d3-selection": ["@types/d3-selection@3.0.11", "", {}, "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w=="],
|
||||
|
||||
"@types/d3-shape": ["@types/d3-shape@3.1.8", "", { "dependencies": { "@types/d3-path": "*" } }, "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w=="],
|
||||
|
||||
"@types/d3-time": ["@types/d3-time@3.0.4", "", {}, "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g=="],
|
||||
|
||||
"@types/d3-time-format": ["@types/d3-time-format@4.0.3", "", {}, "sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg=="],
|
||||
|
||||
"@types/d3-timer": ["@types/d3-timer@3.0.2", "", {}, "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw=="],
|
||||
|
||||
"@types/d3-transition": ["@types/d3-transition@3.0.9", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg=="],
|
||||
|
||||
"@types/d3-zoom": ["@types/d3-zoom@3.0.8", "", { "dependencies": { "@types/d3-interpolate": "*", "@types/d3-selection": "*" } }, "sha512-iqMC4/YlFCSlO8+2Ii1GGGliCAY4XdeG748w5vQUbevlbDu0zSjH/+jojorQVBK/se0j6DUFNPBGSqD3YWYnDw=="],
|
||||
|
||||
"@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="],
|
||||
|
||||
"@types/geojson": ["@types/geojson@7946.0.16", "", {}, "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg=="],
|
||||
|
||||
"@types/mdast": ["@types/mdast@3.0.15", "", { "dependencies": { "@types/unist": "^2" } }, "sha512-LnwD+mUEfxWMa1QpDraczIn6k0Ee3SMicuYSSzS6ZYl2gKS09EClnJYGd8Du6rfc5r/GZEk5o1mRb8TaTj03sQ=="],
|
||||
|
||||
"@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
|
||||
|
||||
"@types/trusted-types": ["@types/trusted-types@2.0.7", "", {}, "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw=="],
|
||||
|
||||
"@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
|
||||
|
||||
"anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
|
||||
|
||||
"aria-hidden": ["aria-hidden@1.2.6", "", { "dependencies": { "tslib": "^2.0.0" } }, "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA=="],
|
||||
|
||||
"binary-extensions": ["binary-extensions@2.3.0", "", {}, "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw=="],
|
||||
|
||||
"braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
|
||||
|
||||
"browser-fs-access": ["browser-fs-access@0.29.1", "", {}, "sha512-LSvVX5e21LRrXqVMhqtAwj5xPgDb+fXAIH80NsnCQ9xuZPs2xWsOREi24RKgZa1XOiQRbcmVrv87+ulOKsgjxw=="],
|
||||
|
||||
"canvas-roundrect-polyfill": ["canvas-roundrect-polyfill@0.0.1", "", {}, "sha512-yWq+R3U3jE+coOeEb3a3GgE2j/0MMiDKM/QpLb6h9ihf5fGY9UXtvK9o4vNqjWXoZz7/3EaSVU3IX53TvFFUOw=="],
|
||||
|
||||
"character-entities": ["character-entities@2.0.2", "", {}, "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ=="],
|
||||
|
||||
"chevrotain": ["chevrotain@11.0.3", "", { "dependencies": { "@chevrotain/cst-dts-gen": "11.0.3", "@chevrotain/gast": "11.0.3", "@chevrotain/regexp-to-ast": "11.0.3", "@chevrotain/types": "11.0.3", "@chevrotain/utils": "11.0.3", "lodash-es": "4.17.21" } }, "sha512-ci2iJH6LeIkvP9eJW6gpueU8cnZhv85ELY8w8WiFtNjMHA5ad6pQLaJo9mEly/9qUyCpvqX8/POVUTf18/HFdw=="],
|
||||
|
||||
"chevrotain-allstar": ["chevrotain-allstar@0.3.1", "", { "dependencies": { "lodash-es": "^4.17.21" }, "peerDependencies": { "chevrotain": "^11.0.0" } }, "sha512-b7g+y9A0v4mxCW1qUhf3BSVPg+/NvGErk/dOkrDaHA0nQIQGAtrOjlX//9OQtRlSCy+x9rfB5N8yC71lH1nvMw=="],
|
||||
|
||||
"chokidar": ["chokidar@3.6.0", "", { "dependencies": { "anymatch": "~3.1.2", "braces": "~3.0.2", "glob-parent": "~5.1.2", "is-binary-path": "~2.1.0", "is-glob": "~4.0.1", "normalize-path": "~3.0.0", "readdirp": "~3.6.0" }, "optionalDependencies": { "fsevents": "~2.3.2" } }, "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw=="],
|
||||
|
||||
"clsx": ["clsx@1.1.1", "", {}, "sha512-6/bPho624p3S2pMyvP5kKBPXnI3ufHLObBFCfgx+LkeR5lg2XYy2hqZqUf45ypD8COn2bhgGJSUE+l5dhNBieA=="],
|
||||
|
||||
"commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="],
|
||||
|
||||
"cose-base": ["cose-base@1.0.3", "", { "dependencies": { "layout-base": "^1.0.0" } }, "sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg=="],
|
||||
|
||||
"crc-32": ["crc-32@0.3.0", "", {}, "sha512-kucVIjOmMc1f0tv53BJ/5WIX+MGLcKuoBhnGqQrgKJNqLByb/sVMWfW/Aw6hw0jgcqjJ2pi9E5y32zOIpaUlsA=="],
|
||||
|
||||
"cross-env": ["cross-env@7.0.3", "", { "dependencies": { "cross-spawn": "^7.0.1" }, "bin": { "cross-env": "src/bin/cross-env.js", "cross-env-shell": "src/bin/cross-env-shell.js" } }, "sha512-+/HKd6EgcQCJGh2PSjZuUitQBQynKor4wrFbRg4DtAgS1aWO+gU52xpH7M9ScGgXSYmAVS9bIJ8EzuaGw0oNAw=="],
|
||||
|
||||
"cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
|
||||
|
||||
"cytoscape": ["cytoscape@3.34.0", "", {}, "sha512-62rNSrioXw93uliKFBwjukeQyeWwH2PqDrTac31r2P6464u3AUvTk0xS4LVvT251g7IgkFunrI48ZEZGjywSOg=="],
|
||||
|
||||
"cytoscape-cose-bilkent": ["cytoscape-cose-bilkent@4.1.0", "", { "dependencies": { "cose-base": "^1.0.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-wgQlVIUJF13Quxiv5e1gstZ08rnZj2XaLHGoFMYXz7SkNfCDOOteKBE6SYRfA9WxxI/iBc3ajfDoc6hb/MRAHQ=="],
|
||||
|
||||
"cytoscape-fcose": ["cytoscape-fcose@2.2.0", "", { "dependencies": { "cose-base": "^2.2.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-ki1/VuRIHFCzxWNrsshHYPs6L7TvLu3DL+TyIGEsRcvVERmxokbf5Gdk7mFxZnTdiGtnA4cfSmjZJMviqSuZrQ=="],
|
||||
|
||||
"d3": ["d3@7.9.0", "", { "dependencies": { "d3-array": "3", "d3-axis": "3", "d3-brush": "3", "d3-chord": "3", "d3-color": "3", "d3-contour": "4", "d3-delaunay": "6", "d3-dispatch": "3", "d3-drag": "3", "d3-dsv": "3", "d3-ease": "3", "d3-fetch": "3", "d3-force": "3", "d3-format": "3", "d3-geo": "3", "d3-hierarchy": "3", "d3-interpolate": "3", "d3-path": "3", "d3-polygon": "3", "d3-quadtree": "3", "d3-random": "3", "d3-scale": "4", "d3-scale-chromatic": "3", "d3-selection": "3", "d3-shape": "3", "d3-time": "3", "d3-time-format": "4", "d3-timer": "3", "d3-transition": "3", "d3-zoom": "3" } }, "sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA=="],
|
||||
|
||||
"d3-array": ["d3-array@3.2.4", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg=="],
|
||||
|
||||
"d3-axis": ["d3-axis@3.0.0", "", {}, "sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw=="],
|
||||
|
||||
"d3-brush": ["d3-brush@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-drag": "2 - 3", "d3-interpolate": "1 - 3", "d3-selection": "3", "d3-transition": "3" } }, "sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ=="],
|
||||
|
||||
"d3-chord": ["d3-chord@3.0.1", "", { "dependencies": { "d3-path": "1 - 3" } }, "sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g=="],
|
||||
|
||||
"d3-color": ["d3-color@3.1.0", "", {}, "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA=="],
|
||||
|
||||
"d3-contour": ["d3-contour@4.0.2", "", { "dependencies": { "d3-array": "^3.2.0" } }, "sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA=="],
|
||||
|
||||
"d3-delaunay": ["d3-delaunay@6.0.4", "", { "dependencies": { "delaunator": "5" } }, "sha512-mdjtIZ1XLAM8bm/hx3WwjfHt6Sggek7qH043O8KEjDXN40xi3vx/6pYSVTwLjEgiXQTbvaouWKynLBiUZ6SK6A=="],
|
||||
|
||||
"d3-dispatch": ["d3-dispatch@3.0.1", "", {}, "sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg=="],
|
||||
|
||||
"d3-drag": ["d3-drag@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-selection": "3" } }, "sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg=="],
|
||||
|
||||
"d3-dsv": ["d3-dsv@3.0.1", "", { "dependencies": { "commander": "7", "iconv-lite": "0.6", "rw": "1" }, "bin": { "csv2json": "bin/dsv2json.js", "csv2tsv": "bin/dsv2dsv.js", "dsv2dsv": "bin/dsv2dsv.js", "dsv2json": "bin/dsv2json.js", "json2csv": "bin/json2dsv.js", "json2dsv": "bin/json2dsv.js", "json2tsv": "bin/json2dsv.js", "tsv2csv": "bin/dsv2dsv.js", "tsv2json": "bin/dsv2json.js" } }, "sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q=="],
|
||||
|
||||
"d3-ease": ["d3-ease@3.0.1", "", {}, "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w=="],
|
||||
|
||||
"d3-fetch": ["d3-fetch@3.0.1", "", { "dependencies": { "d3-dsv": "1 - 3" } }, "sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw=="],
|
||||
|
||||
"d3-force": ["d3-force@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-quadtree": "1 - 3", "d3-timer": "1 - 3" } }, "sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg=="],
|
||||
|
||||
"d3-format": ["d3-format@3.1.2", "", {}, "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg=="],
|
||||
|
||||
"d3-geo": ["d3-geo@3.1.1", "", { "dependencies": { "d3-array": "2.5.0 - 3" } }, "sha512-637ln3gXKXOwhalDzinUgY83KzNWZRKbYubaG+fGVuc/dxO64RRljtCTnf5ecMyE1RIdtqpkVcq0IbtU2S8j2Q=="],
|
||||
|
||||
"d3-hierarchy": ["d3-hierarchy@3.1.2", "", {}, "sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA=="],
|
||||
|
||||
"d3-interpolate": ["d3-interpolate@3.0.1", "", { "dependencies": { "d3-color": "1 - 3" } }, "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g=="],
|
||||
|
||||
"d3-path": ["d3-path@3.1.0", "", {}, "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ=="],
|
||||
|
||||
"d3-polygon": ["d3-polygon@3.0.1", "", {}, "sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg=="],
|
||||
|
||||
"d3-quadtree": ["d3-quadtree@3.0.1", "", {}, "sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw=="],
|
||||
|
||||
"d3-random": ["d3-random@3.0.1", "", {}, "sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ=="],
|
||||
|
||||
"d3-sankey": ["d3-sankey@0.12.3", "", { "dependencies": { "d3-array": "1 - 2", "d3-shape": "^1.2.0" } }, "sha512-nQhsBRmM19Ax5xEIPLMY9ZmJ/cDvd1BG3UVvt5h3WRxKg5zGRbvnteTyWAbzeSvlh3tW7ZEmq4VwR5mB3tutmQ=="],
|
||||
|
||||
"d3-scale": ["d3-scale@4.0.2", "", { "dependencies": { "d3-array": "2.10.0 - 3", "d3-format": "1 - 3", "d3-interpolate": "1.2.0 - 3", "d3-time": "2.1.1 - 3", "d3-time-format": "2 - 4" } }, "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ=="],
|
||||
|
||||
"d3-scale-chromatic": ["d3-scale-chromatic@3.1.0", "", { "dependencies": { "d3-color": "1 - 3", "d3-interpolate": "1 - 3" } }, "sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ=="],
|
||||
|
||||
"d3-selection": ["d3-selection@3.0.0", "", {}, "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ=="],
|
||||
|
||||
"d3-shape": ["d3-shape@3.2.0", "", { "dependencies": { "d3-path": "^3.1.0" } }, "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA=="],
|
||||
|
||||
"d3-time": ["d3-time@3.1.0", "", { "dependencies": { "d3-array": "2 - 3" } }, "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q=="],
|
||||
|
||||
"d3-time-format": ["d3-time-format@4.1.0", "", { "dependencies": { "d3-time": "1 - 3" } }, "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg=="],
|
||||
|
||||
"d3-timer": ["d3-timer@3.0.1", "", {}, "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA=="],
|
||||
|
||||
"d3-transition": ["d3-transition@3.0.1", "", { "dependencies": { "d3-color": "1 - 3", "d3-dispatch": "1 - 3", "d3-ease": "1 - 3", "d3-interpolate": "1 - 3", "d3-timer": "1 - 3" }, "peerDependencies": { "d3-selection": "2 - 3" } }, "sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w=="],
|
||||
|
||||
"d3-zoom": ["d3-zoom@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-drag": "2 - 3", "d3-interpolate": "1 - 3", "d3-selection": "2 - 3", "d3-transition": "2 - 3" } }, "sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw=="],
|
||||
|
||||
"dagre-d3-es": ["dagre-d3-es@7.0.13", "", { "dependencies": { "d3": "^7.9.0", "lodash-es": "^4.17.21" } }, "sha512-efEhnxpSuwpYOKRm/L5KbqoZmNNukHa/Flty4Wp62JRvgH2ojwVgPgdYyr4twpieZnyRDdIH7PY2mopX26+j2Q=="],
|
||||
|
||||
"dayjs": ["dayjs@1.11.21", "", {}, "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA=="],
|
||||
|
||||
"debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
|
||||
|
||||
"decode-named-character-reference": ["decode-named-character-reference@1.3.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q=="],
|
||||
|
||||
"delaunator": ["delaunator@5.1.0", "", { "dependencies": { "robust-predicates": "^3.0.2" } }, "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ=="],
|
||||
|
||||
"dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
|
||||
|
||||
"detect-node-es": ["detect-node-es@1.1.0", "", {}, "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ=="],
|
||||
|
||||
"diff": ["diff@5.2.2", "", {}, "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A=="],
|
||||
|
||||
"dompurify": ["dompurify@3.4.9", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-4dPSRMRDqHvs0V4YDFCsaIZo4if5u0xM+llyxiM2fwuZFdKArUBAF3VtI2+n8NKg9P870WMdYk0UhqQNoWXbfQ=="],
|
||||
|
||||
"elkjs": ["elkjs@0.9.3", "", {}, "sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ=="],
|
||||
|
||||
"es6-promise-pool": ["es6-promise-pool@2.5.0", "", {}, "sha512-VHErXfzR/6r/+yyzPKeBvO0lgjfC5cbDCQWjWwMZWSb6YU39TGIl51OUmCfWCq4ylMdJSB8zkz2vIuIeIxXApA=="],
|
||||
|
||||
"fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
|
||||
|
||||
"fractional-indexing": ["fractional-indexing@3.2.0", "", {}, "sha512-PcOxmqwYCW7O2ovKRU8OoQQj2yqTfEB/yeTYk4gPid6dN5ODRfU1hXd9tTVZzax/0NkO7AxpHykvZnT1aYp/BQ=="],
|
||||
|
||||
"fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
|
||||
|
||||
"fuzzy": ["fuzzy@0.1.3", "", {}, "sha512-/gZffu4ykarLrCiP3Ygsa86UAo1E5vEVlvTrpkKywXSbP9Xhln3oSp9QSV57gEq3JFFpGJ4GZ+5zdEp3FcUh4w=="],
|
||||
|
||||
"get-nonce": ["get-nonce@1.0.1", "", {}, "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q=="],
|
||||
|
||||
"glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
|
||||
|
||||
"glur": ["glur@1.1.2", "", {}, "sha512-l+8esYHTKOx2G/Aao4lEQ0bnHWg4fWtJbVoZZT9Knxi01pB8C80BR85nONLFwkkQoFRCmXY+BUcGZN3yZ2QsRA=="],
|
||||
|
||||
"hachure-fill": ["hachure-fill@0.5.2", "", {}, "sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg=="],
|
||||
|
||||
"iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
|
||||
|
||||
"image-blob-reduce": ["image-blob-reduce@3.0.1", "", { "dependencies": { "pica": "^7.1.0" } }, "sha512-/VmmWgIryG/wcn4TVrV7cC4mlfUC/oyiKIfSg5eVM3Ten/c1c34RJhMYKCWTnoSMHSqXLt3tsrBR4Q2HInvN+Q=="],
|
||||
|
||||
"immutable": ["immutable@4.3.8", "", {}, "sha512-d/Ld9aLbKpNwyl0KiM2CT1WYvkitQ1TSvmRtkcV8FKStiDoA7Slzgjmb/1G2yhKM1p0XeNOieaTbFZmU1d3Xuw=="],
|
||||
|
||||
"import-meta-resolve": ["import-meta-resolve@4.2.0", "", {}, "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg=="],
|
||||
|
||||
"inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
|
||||
|
||||
"internmap": ["internmap@1.0.1", "", {}, "sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw=="],
|
||||
|
||||
"is-binary-path": ["is-binary-path@2.1.0", "", { "dependencies": { "binary-extensions": "^2.0.0" } }, "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw=="],
|
||||
|
||||
"is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
|
||||
|
||||
"is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
|
||||
|
||||
"is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
|
||||
|
||||
"isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
|
||||
|
||||
"jotai": ["jotai@2.11.0", "", { "peerDependencies": { "@types/react": ">=17.0.0", "react": ">=17.0.0" }, "optionalPeers": ["@types/react", "react"] }, "sha512-zKfoBBD1uDw3rljwHkt0fWuja1B76R7CjznuBO+mSX6jpsO1EBeWNRKpeaQho9yPI/pvCv4recGfgOXGxwPZvQ=="],
|
||||
|
||||
"jotai-scope": ["jotai-scope@0.7.2", "", { "peerDependencies": { "jotai": ">=2.9.2", "react": ">=17.0.0" } }, "sha512-Gwed97f3dDObrO43++2lRcgOqw4O2sdr4JCjP/7eHK1oPACDJ7xKHGScpJX9XaflU+KBHXF+VhwECnzcaQiShg=="],
|
||||
|
||||
"js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
|
||||
|
||||
"katex": ["katex@0.16.47", "", { "dependencies": { "commander": "^8.3.0" }, "bin": { "katex": "cli.js" } }, "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg=="],
|
||||
|
||||
"khroma": ["khroma@2.1.0", "", {}, "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="],
|
||||
|
||||
"kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
|
||||
|
||||
"langium": ["langium@3.3.1", "", { "dependencies": { "chevrotain": "~11.0.3", "chevrotain-allstar": "~0.3.0", "vscode-languageserver": "~9.0.1", "vscode-languageserver-textdocument": "~1.0.11", "vscode-uri": "~3.0.8" } }, "sha512-QJv/h939gDpvT+9SiLVlY7tZC3xB2qK57v0J04Sh9wpMb6MP1q8gB21L3WIo8T5P1MSMg3Ep14L7KkDCFG3y4w=="],
|
||||
|
||||
"layout-base": ["layout-base@1.0.2", "", {}, "sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg=="],
|
||||
|
||||
"lodash-es": ["lodash-es@4.18.1", "", {}, "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A=="],
|
||||
|
||||
"lodash.debounce": ["lodash.debounce@4.0.8", "", {}, "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow=="],
|
||||
|
||||
"lodash.throttle": ["lodash.throttle@4.1.1", "", {}, "sha512-wIkUCfVKpVsWo3JSZlc+8MB5it+2AN5W8J7YVMST30UrvcQNZ1Okbj+rbVniijTWE6FGYy4XJq/rHkas8qJMLQ=="],
|
||||
|
||||
"loose-envify": ["loose-envify@1.4.0", "", { "dependencies": { "js-tokens": "^3.0.0 || ^4.0.0" }, "bin": { "loose-envify": "cli.js" } }, "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q=="],
|
||||
|
||||
"marked": ["marked@16.4.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-TI3V8YYWvkVf3KJe1dRkpnjs68JUPyEa5vjKrp1XEEJUAOaQc+Qj+L1qWbPd0SJuAdQkFU0h73sXXqwDYxsiDA=="],
|
||||
|
||||
"mdast-util-from-markdown": ["mdast-util-from-markdown@1.3.1", "", { "dependencies": { "@types/mdast": "^3.0.0", "@types/unist": "^2.0.0", "decode-named-character-reference": "^1.0.0", "mdast-util-to-string": "^3.1.0", "micromark": "^3.0.0", "micromark-util-decode-numeric-character-reference": "^1.0.0", "micromark-util-decode-string": "^1.0.0", "micromark-util-normalize-identifier": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0", "unist-util-stringify-position": "^3.0.0", "uvu": "^0.5.0" } }, "sha512-4xTO/M8c82qBcnQc1tgpNtubGUW/Y1tBQ1B0i5CtSoelOLKFYlElIr3bvgREYYO5iRqbMY1YuqZng0GVOI8Qww=="],
|
||||
|
||||
"mdast-util-to-string": ["mdast-util-to-string@3.2.0", "", { "dependencies": { "@types/mdast": "^3.0.0" } }, "sha512-V4Zn/ncyN1QNSqSBxTrMOLpjr+IKdHl2v3KVLoWmDPscP4r9GcCi71gjgvUV1SFSKh92AjAG4peFuBl2/YgCJg=="],
|
||||
|
||||
"mermaid": ["mermaid@11.12.2", "", { "dependencies": { "@braintree/sanitize-url": "^7.1.1", "@iconify/utils": "^3.0.1", "@mermaid-js/parser": "^0.6.3", "@types/d3": "^7.4.3", "cytoscape": "^3.29.3", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.13", "dayjs": "^1.11.18", "dompurify": "^3.2.5", "katex": "^0.16.22", "khroma": "^2.1.0", "lodash-es": "^4.17.21", "marked": "^16.2.1", "roughjs": "^4.6.6", "stylis": "^4.3.6", "ts-dedent": "^2.2.0", "uuid": "^11.1.0" } }, "sha512-n34QPDPEKmaeCG4WDMGy0OT6PSyxKCfy2pJgShP+Qow2KLrvWjclwbc3yXfSIf4BanqWEhQEpngWwNp/XhZt6w=="],
|
||||
|
||||
"micromark": ["micromark@3.2.0", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "micromark-core-commonmark": "^1.0.1", "micromark-factory-space": "^1.0.0", "micromark-util-character": "^1.0.0", "micromark-util-chunked": "^1.0.0", "micromark-util-combine-extensions": "^1.0.0", "micromark-util-decode-numeric-character-reference": "^1.0.0", "micromark-util-encode": "^1.0.0", "micromark-util-normalize-identifier": "^1.0.0", "micromark-util-resolve-all": "^1.0.0", "micromark-util-sanitize-uri": "^1.0.0", "micromark-util-subtokenize": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.1", "uvu": "^0.5.0" } }, "sha512-uD66tJj54JLYq0De10AhWycZWGQNUvDI55xPgk2sQM5kn1JYlhbCMTtEeT27+vAhW2FBQxLlOmS3pmA7/2z4aA=="],
|
||||
|
||||
"micromark-core-commonmark": ["micromark-core-commonmark@1.1.0", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "micromark-factory-destination": "^1.0.0", "micromark-factory-label": "^1.0.0", "micromark-factory-space": "^1.0.0", "micromark-factory-title": "^1.0.0", "micromark-factory-whitespace": "^1.0.0", "micromark-util-character": "^1.0.0", "micromark-util-chunked": "^1.0.0", "micromark-util-classify-character": "^1.0.0", "micromark-util-html-tag-name": "^1.0.0", "micromark-util-normalize-identifier": "^1.0.0", "micromark-util-resolve-all": "^1.0.0", "micromark-util-subtokenize": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.1", "uvu": "^0.5.0" } }, "sha512-BgHO1aRbolh2hcrzL2d1La37V0Aoz73ymF8rAcKnohLy93titmv62E0gP8Hrx9PKcKrqCZ1BbLGbP3bEhoXYlw=="],
|
||||
|
||||
"micromark-factory-destination": ["micromark-factory-destination@1.1.0", "", { "dependencies": { "micromark-util-character": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-XaNDROBgx9SgSChd69pjiGKbV+nfHGDPVYFs5dOoDd7ZnMAE+Cuu91BCpsY8RT2NP9vo/B8pds2VQNCLiu0zhg=="],
|
||||
|
||||
"micromark-factory-label": ["micromark-factory-label@1.1.0", "", { "dependencies": { "micromark-util-character": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0", "uvu": "^0.5.0" } }, "sha512-OLtyez4vZo/1NjxGhcpDSbHQ+m0IIGnT8BoPamh+7jVlzLJBH98zzuCoUeMxvM6WsNeh8wx8cKvqLiPHEACn0w=="],
|
||||
|
||||
"micromark-factory-space": ["micromark-factory-space@1.1.0", "", { "dependencies": { "micromark-util-character": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-cRzEj7c0OL4Mw2v6nwzttyOZe8XY/Z8G0rzmWQZTBi/jjwyw/U4uqKtUORXQrR5bAZZnbTI/feRV/R7hc4jQYQ=="],
|
||||
|
||||
"micromark-factory-title": ["micromark-factory-title@1.1.0", "", { "dependencies": { "micromark-factory-space": "^1.0.0", "micromark-util-character": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-J7n9R3vMmgjDOCY8NPw55jiyaQnH5kBdV2/UXCtZIpnHH3P6nHUKaH7XXEYuWwx/xUJcawa8plLBEjMPU24HzQ=="],
|
||||
|
||||
"micromark-factory-whitespace": ["micromark-factory-whitespace@1.1.0", "", { "dependencies": { "micromark-factory-space": "^1.0.0", "micromark-util-character": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-v2WlmiymVSp5oMg+1Q0N1Lxmt6pMhIHD457whWM7/GUlEks1hI9xj5w3zbc4uuMKXGisksZk8DzP2UyGbGqNsQ=="],
|
||||
|
||||
"micromark-util-character": ["micromark-util-character@1.2.0", "", { "dependencies": { "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-lXraTwcX3yH/vMDaFWCQJP1uIszLVebzUa3ZHdrgxr7KEU/9mL4mVgCpGbyhvNLNlauROiNUq7WN5u7ndbY6xg=="],
|
||||
|
||||
"micromark-util-chunked": ["micromark-util-chunked@1.1.0", "", { "dependencies": { "micromark-util-symbol": "^1.0.0" } }, "sha512-Ye01HXpkZPNcV6FiyoW2fGZDUw4Yc7vT0E9Sad83+bEDiCJ1uXu0S3mr8WLpsz3HaG3x2q0HM6CTuPdcZcluFQ=="],
|
||||
|
||||
"micromark-util-classify-character": ["micromark-util-classify-character@1.1.0", "", { "dependencies": { "micromark-util-character": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-SL0wLxtKSnklKSUplok1WQFoGhUdWYKggKUiqhX+Swala+BtptGCu5iPRc+xvzJ4PXE/hwM3FNXsfEVgoZsWbw=="],
|
||||
|
||||
"micromark-util-combine-extensions": ["micromark-util-combine-extensions@1.1.0", "", { "dependencies": { "micromark-util-chunked": "^1.0.0", "micromark-util-types": "^1.0.0" } }, "sha512-Q20sp4mfNf9yEqDL50WwuWZHUrCO4fEyeDCnMGmG5Pr0Cz15Uo7KBs6jq+dq0EgX4DPwwrh9m0X+zPV1ypFvUA=="],
|
||||
|
||||
"micromark-util-decode-numeric-character-reference": ["micromark-util-decode-numeric-character-reference@1.1.0", "", { "dependencies": { "micromark-util-symbol": "^1.0.0" } }, "sha512-m9V0ExGv0jB1OT21mrWcuf4QhP46pH1KkfWy9ZEezqHKAxkj4mPCy3nIH1rkbdMlChLHX531eOrymlwyZIf2iw=="],
|
||||
|
||||
"micromark-util-decode-string": ["micromark-util-decode-string@1.1.0", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "micromark-util-character": "^1.0.0", "micromark-util-decode-numeric-character-reference": "^1.0.0", "micromark-util-symbol": "^1.0.0" } }, "sha512-YphLGCK8gM1tG1bd54azwyrQRjCFcmgj2S2GoJDNnh4vYtnL38JS8M4gpxzOPNyHdNEpheyWXCTnnTDY3N+NVQ=="],
|
||||
|
||||
"micromark-util-encode": ["micromark-util-encode@1.1.0", "", {}, "sha512-EuEzTWSTAj9PA5GOAs992GzNh2dGQO52UvAbtSOMvXTxv3Criqb6IOzJUBCmEqrrXSblJIJBbFFv6zPxpreiJw=="],
|
||||
|
||||
"micromark-util-html-tag-name": ["micromark-util-html-tag-name@1.2.0", "", {}, "sha512-VTQzcuQgFUD7yYztuQFKXT49KghjtETQ+Wv/zUjGSGBioZnkA4P1XXZPT1FHeJA6RwRXSF47yvJ1tsJdoxwO+Q=="],
|
||||
|
||||
"micromark-util-normalize-identifier": ["micromark-util-normalize-identifier@1.1.0", "", { "dependencies": { "micromark-util-symbol": "^1.0.0" } }, "sha512-N+w5vhqrBihhjdpM8+5Xsxy71QWqGn7HYNUvch71iV2PM7+E3uWGox1Qp90loa1ephtCxG2ftRV/Conitc6P2Q=="],
|
||||
|
||||
"micromark-util-resolve-all": ["micromark-util-resolve-all@1.1.0", "", { "dependencies": { "micromark-util-types": "^1.0.0" } }, "sha512-b/G6BTMSg+bX+xVCshPTPyAu2tmA0E4X98NSR7eIbeC6ycCqCeE7wjfDIgzEbkzdEVJXRtOG4FbEm/uGbCRouA=="],
|
||||
|
||||
"micromark-util-sanitize-uri": ["micromark-util-sanitize-uri@1.2.0", "", { "dependencies": { "micromark-util-character": "^1.0.0", "micromark-util-encode": "^1.0.0", "micromark-util-symbol": "^1.0.0" } }, "sha512-QO4GXv0XZfWey4pYFndLUKEAktKkG5kZTdUNaTAkzbuJxn2tNBOr+QtxR2XpWaMhbImT2dPzyLrPXLlPhph34A=="],
|
||||
|
||||
"micromark-util-subtokenize": ["micromark-util-subtokenize@1.1.0", "", { "dependencies": { "micromark-util-chunked": "^1.0.0", "micromark-util-symbol": "^1.0.0", "micromark-util-types": "^1.0.0", "uvu": "^0.5.0" } }, "sha512-kUQHyzRoxvZO2PuLzMt2P/dwVsTiivCK8icYTeR+3WgbuPqfHgPPy7nFKbeqRivBvn/3N3GBiNC+JRTMSxEC7A=="],
|
||||
|
||||
"micromark-util-symbol": ["micromark-util-symbol@1.1.0", "", {}, "sha512-uEjpEYY6KMs1g7QfJ2eX1SQEV+ZT4rUD3UcF6l57acZvLNK7PBZL+ty82Z1qhK1/yXIY4bdx04FKMgR0g4IAag=="],
|
||||
|
||||
"micromark-util-types": ["micromark-util-types@1.1.0", "", {}, "sha512-ukRBgie8TIAcacscVHSiddHjO4k/q3pnedmzMQ4iwDcK0FtFCohKOlFbaOL/mPgfnPsL3C1ZyxJa4sbWrBl3jg=="],
|
||||
|
||||
"mri": ["mri@1.2.0", "", {}, "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA=="],
|
||||
|
||||
"ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
|
||||
|
||||
"multimath": ["multimath@2.0.0", "", { "dependencies": { "glur": "^1.1.2", "object-assign": "^4.1.1" } }, "sha512-toRx66cAMJ+Ccz7pMIg38xSIrtnbozk0dchXezwQDMgQmbGpfxjtv68H+L00iFL8hxDaVjrmwAFSb3I6bg8Q2g=="],
|
||||
|
||||
"nanoid": ["nanoid@3.3.3", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-p1sjXuopFs0xg+fPASzQ28agW1oHD7xDsd9Xkf3T15H3c/cifrFHVwrh74PdoklAPi+i7MdRsE47vm2r6JoB+w=="],
|
||||
|
||||
"non-layered-tidy-tree-layout": ["non-layered-tidy-tree-layout@2.0.2", "", {}, "sha512-gkXMxRzUH+PB0ax9dUN0yYF0S25BqeAYqhgMaLUFmpXLEk7Fcu8f4emJuOAY0V8kjDICxROIKsTAKsV/v355xw=="],
|
||||
|
||||
"normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
|
||||
|
||||
"object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
|
||||
|
||||
"open-color": ["open-color@1.9.1", "", {}, "sha512-vCseG/EQ6/RcvxhUcGJiHViOgrtz4x0XbZepXvKik66TMGkvbmjeJrKFyBEx6daG5rNyyd14zYXhz0hZVwQFOw=="],
|
||||
|
||||
"package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],
|
||||
|
||||
"pako": ["pako@2.0.3", "", {}, "sha512-WjR1hOeg+kki3ZIOjaf4b5WVcay1jaliKSYiEaB1XzwhMQZJxRdQRv0V31EKBYlxb4T7SK3hjfc/jxyU64BoSw=="],
|
||||
|
||||
"path-data-parser": ["path-data-parser@0.1.0", "", {}, "sha512-NOnmBpt5Y2RWbuv0LMzsayp3lVylAHLPUTut412ZA3l+C4uw4ZVkQbjShYCQ8TCpUMdPapr4YjUqLYD6v68j+w=="],
|
||||
|
||||
"path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
|
||||
|
||||
"perfect-freehand": ["perfect-freehand@1.2.0", "", {}, "sha512-h/0ikF1M3phW7CwpZ5MMvKnfpHficWoOEyr//KVNTxV4F6deRK1eYMtHyBKEAKFK0aXIEUK9oBvlF6PNXMDsAw=="],
|
||||
|
||||
"pica": ["pica@7.1.1", "", { "dependencies": { "glur": "^1.1.2", "inherits": "^2.0.3", "multimath": "^2.0.0", "object-assign": "^4.1.1", "webworkify": "^1.5.0" } }, "sha512-WY73tMvNzXWEld2LicT9Y260L43isrZ85tPuqRyvtkljSDLmnNFQmZICt4xUJMVulmcc6L9O7jbBrtx3DOz/YQ=="],
|
||||
|
||||
"picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
|
||||
|
||||
"png-chunk-text": ["png-chunk-text@1.0.0", "", {}, "sha512-DEROKU3SkkLGWNMzru3xPVgxyd48UGuMSZvioErCure6yhOc/pRH2ZV+SEn7nmaf7WNf3NdIpH+UTrRdKyq9Lw=="],
|
||||
|
||||
"png-chunks-encode": ["png-chunks-encode@1.0.0", "", { "dependencies": { "crc-32": "^0.3.0", "sliced": "^1.0.1" } }, "sha512-J1jcHgbQRsIIgx5wxW9UmCymV3wwn4qCCJl6KYgEU/yHCh/L2Mwq/nMOkRPtmV79TLxRZj5w3tH69pvygFkDqA=="],
|
||||
|
||||
"png-chunks-extract": ["png-chunks-extract@1.0.0", "", { "dependencies": { "crc-32": "^0.3.0" } }, "sha512-ZiVwF5EJ0DNZyzAqld8BP1qyJBaGOFaq9zl579qfbkcmOwWLLO4I9L8i2O4j3HkI6/35i0nKG2n+dZplxiT89Q=="],
|
||||
|
||||
"points-on-curve": ["points-on-curve@1.0.1", "", {}, "sha512-3nmX4/LIiyuwGLwuUrfhTlDeQFlAhi7lyK/zcRNGhalwapDWgAGR82bUpmn2mA03vII3fvNCG8jAONzKXwpxAg=="],
|
||||
|
||||
"points-on-path": ["points-on-path@0.2.1", "", { "dependencies": { "path-data-parser": "0.1.0", "points-on-curve": "0.2.0" } }, "sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g=="],
|
||||
|
||||
"pwacompat": ["pwacompat@2.0.17", "", {}, "sha512-6Du7IZdIy7cHiv7AhtDy4X2QRM8IAD5DII69mt5qWibC2d15ZU8DmBG1WdZKekG11cChSu4zkSUGPF9sweOl6w=="],
|
||||
|
||||
"react": ["react@18.3.1", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ=="],
|
||||
|
||||
"react-dom": ["react-dom@18.3.1", "", { "dependencies": { "loose-envify": "^1.1.0", "scheduler": "^0.23.2" }, "peerDependencies": { "react": "^18.3.1" } }, "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw=="],
|
||||
|
||||
"react-remove-scroll": ["react-remove-scroll@2.7.2", "", { "dependencies": { "react-remove-scroll-bar": "^2.3.7", "react-style-singleton": "^2.2.3", "tslib": "^2.1.0", "use-callback-ref": "^1.3.3", "use-sidecar": "^1.1.3" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q=="],
|
||||
|
||||
"react-remove-scroll-bar": ["react-remove-scroll-bar@2.3.8", "", { "dependencies": { "react-style-singleton": "^2.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react"] }, "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q=="],
|
||||
|
||||
"react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="],
|
||||
|
||||
"readdirp": ["readdirp@3.6.0", "", { "dependencies": { "picomatch": "^2.2.1" } }, "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA=="],
|
||||
|
||||
"robust-predicates": ["robust-predicates@3.0.3", "", {}, "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA=="],
|
||||
|
||||
"roughjs": ["roughjs@4.6.4", "", { "dependencies": { "hachure-fill": "^0.5.2", "path-data-parser": "^0.1.0", "points-on-curve": "^0.2.0", "points-on-path": "^0.2.1" } }, "sha512-s6EZ0BntezkFYMf/9mGn7M8XGIoaav9QQBCnJROWB3brUWQ683Q2LbRD/hq0Z3bAJ/9NVpU/5LpiTWvQMyLDhw=="],
|
||||
|
||||
"rw": ["rw@1.3.3", "", {}, "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ=="],
|
||||
|
||||
"sade": ["sade@1.8.1", "", { "dependencies": { "mri": "^1.1.0" } }, "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A=="],
|
||||
|
||||
"safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
|
||||
|
||||
"sass": ["sass@1.51.0", "", { "dependencies": { "chokidar": ">=3.0.0 <4.0.0", "immutable": "^4.0.0", "source-map-js": ">=0.6.2 <2.0.0" }, "bin": { "sass": "sass.js" } }, "sha512-haGdpTgywJTvHC2b91GSq+clTKGbtkkZmVAb82jZQN/wTy6qs8DdFm2lhEQbEwrY0QDRgSQ3xDurqM977C3noA=="],
|
||||
|
||||
"scheduler": ["scheduler@0.23.2", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ=="],
|
||||
|
||||
"shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
|
||||
|
||||
"shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
|
||||
|
||||
"sliced": ["sliced@1.0.1", "", {}, "sha512-VZBmZP8WU3sMOZm1bdgTadsQbcscK0UM8oKxKVBs4XAhUo2Xxzm/OFMGBkPusxw9xL3Uy8LrzEqGqJhclsr0yA=="],
|
||||
|
||||
"source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
|
||||
|
||||
"stylis": ["stylis@4.4.0", "", {}, "sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA=="],
|
||||
|
||||
"tinyexec": ["tinyexec@1.2.4", "", {}, "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg=="],
|
||||
|
||||
"to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
|
||||
|
||||
"ts-dedent": ["ts-dedent@2.3.0", "", {}, "sha512-JfJeIHke7y2egdGGgRAvpCwYFUsHlM2gPcrVOxFkznt/4uzQ7HFmvE63iFHVLBJNDuyDOQgijDK/tXH/f6Msjg=="],
|
||||
|
||||
"tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
|
||||
|
||||
"tunnel-rat": ["tunnel-rat@0.1.2", "", { "dependencies": { "zustand": "^4.3.2" } }, "sha512-lR5VHmkPhzdhrM092lI2nACsLO4QubF0/yoOhzX7c+wIpbN1GjHNzCc91QlpxBi+cnx8vVJ+Ur6vL5cEoQPFpQ=="],
|
||||
|
||||
"unist-util-stringify-position": ["unist-util-stringify-position@3.0.3", "", { "dependencies": { "@types/unist": "^2.0.0" } }, "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg=="],
|
||||
|
||||
"use-callback-ref": ["use-callback-ref@1.3.3", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg=="],
|
||||
|
||||
"use-sidecar": ["use-sidecar@1.1.3", "", { "dependencies": { "detect-node-es": "^1.1.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ=="],
|
||||
|
||||
"use-sync-external-store": ["use-sync-external-store@1.6.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w=="],
|
||||
|
||||
"uuid": ["uuid@11.1.1", "", { "bin": { "uuid": "dist/esm/bin/uuid" } }, "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ=="],
|
||||
|
||||
"uvu": ["uvu@0.5.6", "", { "dependencies": { "dequal": "^2.0.0", "diff": "^5.0.0", "kleur": "^4.0.3", "sade": "^1.7.3" }, "bin": { "uvu": "bin.js" } }, "sha512-+g8ENReyr8YsOc6fv/NVJs2vFdHBnBNdfE49rshrTzDWOlUx4Gq7KOS2GD8eqhy2j+Ejq29+SbKH8yjkAqXqoA=="],
|
||||
|
||||
"vscode-jsonrpc": ["vscode-jsonrpc@8.2.0", "", {}, "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA=="],
|
||||
|
||||
"vscode-languageserver": ["vscode-languageserver@9.0.1", "", { "dependencies": { "vscode-languageserver-protocol": "3.17.5" }, "bin": { "installServerIntoExtension": "bin/installServerIntoExtension" } }, "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g=="],
|
||||
|
||||
"vscode-languageserver-protocol": ["vscode-languageserver-protocol@3.17.5", "", { "dependencies": { "vscode-jsonrpc": "8.2.0", "vscode-languageserver-types": "3.17.5" } }, "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg=="],
|
||||
|
||||
"vscode-languageserver-textdocument": ["vscode-languageserver-textdocument@1.0.12", "", {}, "sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA=="],
|
||||
|
||||
"vscode-languageserver-types": ["vscode-languageserver-types@3.17.5", "", {}, "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg=="],
|
||||
|
||||
"vscode-uri": ["vscode-uri@3.0.8", "", {}, "sha512-AyFQ0EVmsOZOlAnxoFOGOq1SQDWAB7C6aqMGS23svWAllfOaxbuFvcT8D1i8z3Gyn8fraVeZNNmN6e9bxxXkKw=="],
|
||||
|
||||
"web-worker": ["web-worker@1.5.0", "", {}, "sha512-RiMReJrTAiA+mBjGONMnjVDP2u3p9R1vkcGz6gDIrOMT3oGuYwX2WRMYI9ipkphSuE5XKEhydbhNEJh4NY9mlw=="],
|
||||
|
||||
"webworkify": ["webworkify@1.5.0", "", {}, "sha512-AMcUeyXAhbACL8S2hqqdqOLqvJ8ylmIbNwUIqQujRSouf4+eUFaXbG6F1Rbu+srlJMmxQWsiU7mOJi0nMBfM1g=="],
|
||||
|
||||
"which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
|
||||
|
||||
"zustand": ["zustand@4.5.7", "", { "dependencies": { "use-sync-external-store": "^1.2.2" }, "peerDependencies": { "@types/react": ">=16.8", "immer": ">=9.0.6", "react": ">=16.8" }, "optionalPeers": ["@types/react", "immer", "react"] }, "sha512-CHOUy7mu3lbD6o6LJLfllpjkzhHXSBlX8B9+qPddUsIfeF5S/UZ5q0kmCsnRqT1UHFQZchNFDDzMbQsuesHWlw=="],
|
||||
|
||||
"@chevrotain/cst-dts-gen/lodash-es": ["lodash-es@4.17.21", "", {}, "sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw=="],
|
||||
|
||||
"@chevrotain/gast/lodash-es": ["lodash-es@4.17.21", "", {}, "sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw=="],
|
||||
|
||||
"@excalidraw/mermaid-to-excalidraw/mermaid": ["mermaid@10.9.3", "", { "dependencies": { "@braintree/sanitize-url": "^6.0.1", "@types/d3-scale": "^4.0.3", "@types/d3-scale-chromatic": "^3.0.0", "cytoscape": "^3.28.1", "cytoscape-cose-bilkent": "^4.1.0", "d3": "^7.4.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.10", "dayjs": "^1.11.7", "dompurify": "^3.0.5 <3.1.7", "elkjs": "^0.9.0", "katex": "^0.16.9", "khroma": "^2.0.0", "lodash-es": "^4.17.21", "mdast-util-from-markdown": "^1.3.0", "non-layered-tidy-tree-layout": "^2.0.2", "stylis": "^4.1.3", "ts-dedent": "^2.2.0", "uuid": "^9.0.0", "web-worker": "^1.2.0" } }, "sha512-V80X1isSEvAewIL3xhmz/rVmc27CVljcsbWxkxlWJWY/1kQa4XOABqpDl2qQLGKzpKm6WbTfUEKImBlUfFYArw=="],
|
||||
|
||||
"@excalidraw/mermaid-to-excalidraw/nanoid": ["nanoid@4.0.2", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-7ZtY5KTCNheRGfEFxnedV5zFiORN1+Y1N6zvPTnHQd8ENUvfaDBeuJDZb2bN/oXwXxu3qkTXDzy57W5vAmDTBw=="],
|
||||
|
||||
"@radix-ui/react-collection/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-0KaSv6sx787/hK3eF53iOkiSLwAGlFMx5lotrqD2pTjB18KbybKoEIgkNZTKC60YECDQTKGTRcDBILwZVqVKvA=="],
|
||||
|
||||
"@radix-ui/react-collection/@radix-ui/react-context": ["@radix-ui/react-context@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-1pVM9RfOQ+n/N5PJK33kRSKsr1glNxomxONs5c49MliinBY6Yw2Q995qfBUUo0/Mbg05B/sGA0gkgPI7kmSHBg=="],
|
||||
|
||||
"@radix-ui/react-collection/@radix-ui/react-primitive": ["@radix-ui/react-primitive@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-slot": "1.0.1" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-fHbmislWVkZaIdeF6GZxF0A/NH/3BjrGIYj+Ae6eTmTCr7EB0RQAAVEiqsXK6p3/JcRqVSBQoceZroj30Jj3XA=="],
|
||||
|
||||
"@radix-ui/react-collection/@radix-ui/react-slot": ["@radix-ui/react-slot@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-compose-refs": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-avutXAFL1ehGvAXtPquu0YK5oz6ctS474iM3vNGQIkswrVhdrS52e3uoMQBzZhNRAIE0jBnUyXWNmSjGHhCFcw=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/primitive": ["@radix-ui/primitive@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" } }, "sha512-3e7rn8FDMin4CgeL7Z/49smCA3rFYY3Ha2rUQ7HRWFadS5iCRw08ZgVT1LaNTCNqgvrUiyczLflrVrF0SRQtNA=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-0KaSv6sx787/hK3eF53iOkiSLwAGlFMx5lotrqD2pTjB18KbybKoEIgkNZTKC60YECDQTKGTRcDBILwZVqVKvA=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-context": ["@radix-ui/react-context@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-1pVM9RfOQ+n/N5PJK33kRSKsr1glNxomxONs5c49MliinBY6Yw2Q995qfBUUo0/Mbg05B/sGA0gkgPI7kmSHBg=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-id": ["@radix-ui/react-id@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-use-layout-effect": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-Q6iAB/U7Tq3NTolBBQbHTgclPmGWE3OlktGGqrClPozSw4vkQ1DfQAOtzgRPecKsMdJINE05iaoDUG8tRzCBjw=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-primitive": ["@radix-ui/react-primitive@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-slot": "1.0.1" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-fHbmislWVkZaIdeF6GZxF0A/NH/3BjrGIYj+Ae6eTmTCr7EB0RQAAVEiqsXK6p3/JcRqVSBQoceZroj30Jj3XA=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-GZtyzoHz95Rhs6S63D2t/eqvdFCm7I+yHMLVQheKM7nBD8mbZIt+ct1jz4536MDnaOGKIxynJ8eHTkVGVVkoTg=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-use-callback-ref": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-FohDoZvk3mEXh9AWAVyRTYR4Sq7/gavuofglmiXB2g1aKyboUD4YtgWxKj8O5n+Uak52gXQ4wKz5IFST4vtJHg=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/primitive": ["@radix-ui/primitive@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" } }, "sha512-3e7rn8FDMin4CgeL7Z/49smCA3rFYY3Ha2rUQ7HRWFadS5iCRw08ZgVT1LaNTCNqgvrUiyczLflrVrF0SRQtNA=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-context": ["@radix-ui/react-context@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-1pVM9RfOQ+n/N5PJK33kRSKsr1glNxomxONs5c49MliinBY6Yw2Q995qfBUUo0/Mbg05B/sGA0gkgPI7kmSHBg=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-id": ["@radix-ui/react-id@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-use-layout-effect": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-Q6iAB/U7Tq3NTolBBQbHTgclPmGWE3OlktGGqrClPozSw4vkQ1DfQAOtzgRPecKsMdJINE05iaoDUG8tRzCBjw=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-presence": ["@radix-ui/react-presence@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-compose-refs": "1.0.0", "@radix-ui/react-use-layout-effect": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-A+6XEvN01NfVWiKu38ybawfHsBjWum42MRPnEuqPsBZ4eV7e/7K321B5VgYMPv3Xx5An6o1/l9ZuDBgmcmWK3w=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-primitive": ["@radix-ui/react-primitive@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-slot": "1.0.1" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-fHbmislWVkZaIdeF6GZxF0A/NH/3BjrGIYj+Ae6eTmTCr7EB0RQAAVEiqsXK6p3/JcRqVSBQoceZroj30Jj3XA=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-use-callback-ref": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-FohDoZvk3mEXh9AWAVyRTYR4Sq7/gavuofglmiXB2g1aKyboUD4YtgWxKj8O5n+Uak52gXQ4wKz5IFST4vtJHg=="],
|
||||
|
||||
"chevrotain/lodash-es": ["lodash-es@4.17.21", "", {}, "sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw=="],
|
||||
|
||||
"cytoscape-fcose/cose-base": ["cose-base@2.2.0", "", { "dependencies": { "layout-base": "^2.0.0" } }, "sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g=="],
|
||||
|
||||
"d3-dsv/commander": ["commander@7.2.0", "", {}, "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw=="],
|
||||
|
||||
"d3-sankey/d3-array": ["d3-array@2.12.1", "", { "dependencies": { "internmap": "^1.0.0" } }, "sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ=="],
|
||||
|
||||
"d3-sankey/d3-shape": ["d3-shape@1.3.7", "", { "dependencies": { "d3-path": "1" } }, "sha512-EUkvKjqPFUAZyOlhY5gzCxCeI0Aep04LwIRpsZ/mLFelJiUfnK56jo5JMDSE7yyP2kLSb6LtF+S5chMk7uqPqw=="],
|
||||
|
||||
"mermaid/@braintree/sanitize-url": ["@braintree/sanitize-url@7.1.2", "", {}, "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA=="],
|
||||
|
||||
"mermaid/roughjs": ["roughjs@4.6.6", "", { "dependencies": { "hachure-fill": "^0.5.2", "path-data-parser": "^0.1.0", "points-on-curve": "^0.2.0", "points-on-path": "^0.2.1" } }, "sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ=="],
|
||||
|
||||
"points-on-path/points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="],
|
||||
|
||||
"roughjs/points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="],
|
||||
|
||||
"@excalidraw/mermaid-to-excalidraw/mermaid/dagre-d3-es": ["dagre-d3-es@7.0.10", "", { "dependencies": { "d3": "^7.8.2", "lodash-es": "^4.17.21" } }, "sha512-qTCQmEhcynucuaZgY5/+ti3X/rnszKZhEQH/ZdWdtP1tA/y3VoHJzcVrO9pjjJCNpigfscAtoUB5ONcd2wNn0A=="],
|
||||
|
||||
"@excalidraw/mermaid-to-excalidraw/mermaid/dompurify": ["dompurify@3.1.6", "", {}, "sha512-cTOAhc36AalkjtBpfG6O8JimdTMWNXjiePT2xQH/ppBGi/4uIpmj8eKyIkMJErXWARyINV/sB38yf8JCLF5pbQ=="],
|
||||
|
||||
"@excalidraw/mermaid-to-excalidraw/mermaid/uuid": ["uuid@9.0.1", "", { "bin": { "uuid": "dist/bin/uuid" } }, "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-id/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-6Tpkq+R6LOlmQb1R5NNETLG0B4YP0wc+klfXafpUCj6JGyaUc8il7/kUZ7m59rGbXGczE9Bs+iz2qloqsZBduQ=="],
|
||||
|
||||
"@radix-ui/react-roving-focus/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-compose-refs": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-avutXAFL1ehGvAXtPquu0YK5oz6ctS474iM3vNGQIkswrVhdrS52e3uoMQBzZhNRAIE0jBnUyXWNmSjGHhCFcw=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-id/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-6Tpkq+R6LOlmQb1R5NNETLG0B4YP0wc+klfXafpUCj6JGyaUc8il7/kUZ7m59rGbXGczE9Bs+iz2qloqsZBduQ=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-presence/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-0KaSv6sx787/hK3eF53iOkiSLwAGlFMx5lotrqD2pTjB18KbybKoEIgkNZTKC60YECDQTKGTRcDBILwZVqVKvA=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-presence/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-6Tpkq+R6LOlmQb1R5NNETLG0B4YP0wc+klfXafpUCj6JGyaUc8il7/kUZ7m59rGbXGczE9Bs+iz2qloqsZBduQ=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.0.1", "", { "dependencies": { "@babel/runtime": "^7.13.10", "@radix-ui/react-compose-refs": "1.0.0" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-avutXAFL1ehGvAXtPquu0YK5oz6ctS474iM3vNGQIkswrVhdrS52e3uoMQBzZhNRAIE0jBnUyXWNmSjGHhCFcw=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-use-controllable-state/@radix-ui/react-use-callback-ref": ["@radix-ui/react-use-callback-ref@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-GZtyzoHz95Rhs6S63D2t/eqvdFCm7I+yHMLVQheKM7nBD8mbZIt+ct1jz4536MDnaOGKIxynJ8eHTkVGVVkoTg=="],
|
||||
|
||||
"cytoscape-fcose/cose-base/layout-base": ["layout-base@2.0.1", "", {}, "sha512-dp3s92+uNI1hWIpPGH3jK2kxE2lMjdXdr+DH8ynZHpd6PUlH6x6cbuXnoMmiNumznqaNO31xu9e79F0uuZ0JFg=="],
|
||||
|
||||
"d3-sankey/d3-shape/d3-path": ["d3-path@1.0.9", "", {}, "sha512-VLaYcn81dtHVTjEHd8B+pbe9yHWpXKZUC87PzoFmsFrJqgFwDe/qxfp5MlfsfM1V5E/iVt0MmEbWQ7FVIXh/bg=="],
|
||||
|
||||
"mermaid/roughjs/points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="],
|
||||
|
||||
"@radix-ui/react-tabs/@radix-ui/react-primitive/@radix-ui/react-slot/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.0.0", "", { "dependencies": { "@babel/runtime": "^7.13.10" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0" } }, "sha512-0KaSv6sx787/hK3eF53iOkiSLwAGlFMx5lotrqD2pTjB18KbybKoEIgkNZTKC60YECDQTKGTRcDBILwZVqVKvA=="],
|
||||
}
|
||||
}
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"name": "gstack-diagram-render",
|
||||
"sha256": "da9c363071afbe79e06807bd1e67dbacc1123187db7b99e2608dd4a1a9567e94",
|
||||
"srcSha256": "07238fae312bc0444f62b0a0a3404a8a38c45cef505aa1528c60a0ded17cbe06",
|
||||
"bytes": 9645479,
|
||||
"bunVersion": "1.3.13",
|
||||
"deps": {
|
||||
"@excalidraw/excalidraw": "0.18.0",
|
||||
"@excalidraw/mermaid-to-excalidraw": "1.1.2",
|
||||
"mermaid": "11.12.2",
|
||||
"react": "18.3.1",
|
||||
"react-dom": "18.3.1"
|
||||
}
|
||||
}
|
||||
+5135
File diff suppressed because one or more lines are too long
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"name": "@gstack/diagram-render",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"description": "Offline diagram-render bundle: mermaid + excalidraw export + mermaid-to-excalidraw, built into a single self-contained HTML page loaded by the browse daemon. Versions are exact-pinned; bump them only via scripts/build.ts (see README.md).",
|
||||
"scripts": {
|
||||
"build": "bun run scripts/build.ts"
|
||||
},
|
||||
"dependencies": {
|
||||
"@excalidraw/excalidraw": "0.18.0",
|
||||
"@excalidraw/mermaid-to-excalidraw": "1.1.2",
|
||||
"mermaid": "11.12.2",
|
||||
"react": "18.3.1",
|
||||
"react-dom": "18.3.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
/**
|
||||
* Build dist/diagram-render.html — the single-file offline render page.
|
||||
*
|
||||
* One command updates everything: `bun run build` (in this directory) or
|
||||
* `bun run build:diagram-render` (repo root). To bump a dependency: edit the
|
||||
* exact pin in package.json, `bun install`, rebuild, commit src + dist +
|
||||
* BUILD_INFO.json together. The drift test (test/diagram-render-drift.test.ts)
|
||||
* fails CI when dist and BUILD_INFO disagree.
|
||||
*
|
||||
* Page assembly notes (learned in the spike, do not "simplify" away):
|
||||
* - The script MUST be `type="module"` — mermaid's bundle contains
|
||||
* import.meta, which throws in a classic script.
|
||||
* - `</scri` sequences inside the minified JS MUST be escaped to `<\/scri`,
|
||||
* or the inline <script> terminates early ("Unexpected end of input").
|
||||
* - A <base href> with an absolute URL is required: the page lives at
|
||||
* about:blank (page.setContent), where relative URL construction throws.
|
||||
*/
|
||||
import { createHash } from "node:crypto";
|
||||
import path from "node:path";
|
||||
|
||||
const ROOT = path.resolve(import.meta.dir, "..");
|
||||
const ENTRY = path.join(ROOT, "src", "entry.ts");
|
||||
const DIST_DIR = path.join(ROOT, "dist");
|
||||
const DIST_HTML = path.join(DIST_DIR, "diagram-render.html");
|
||||
const BUILD_INFO = path.join(DIST_DIR, "BUILD_INFO.json");
|
||||
|
||||
const pkg = await Bun.file(path.join(ROOT, "package.json")).json();
|
||||
const deps: Record<string, string> = pkg.dependencies;
|
||||
|
||||
const result = await Bun.build({
|
||||
entrypoints: [ENTRY],
|
||||
target: "browser",
|
||||
minify: true,
|
||||
define: {
|
||||
__BUNDLE_INFO_DEPS__: JSON.stringify(deps),
|
||||
"process.env.NODE_ENV": '"production"',
|
||||
},
|
||||
});
|
||||
if (!result.success) {
|
||||
for (const log of result.logs) console.error(log);
|
||||
process.exit(1);
|
||||
}
|
||||
const js = await result.outputs[0].text();
|
||||
|
||||
// Escape inline-script terminators (see header note).
|
||||
const inlineJs = js.replaceAll("</scri", "<\\/scri");
|
||||
|
||||
const head = `<!doctype html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<base href="https://gstack-render.localhost/">
|
||||
<title>gstack diagram-render</title>
|
||||
<style>
|
||||
body { font-family: Helvetica, "Liberation Sans", Arial, sans-serif; margin: 0; }
|
||||
</style>
|
||||
<script>
|
||||
window.__errors = [];
|
||||
window.onerror = function (msg, src, line, col, err) {
|
||||
window.__errors.push(String(msg) + " @" + line + ":" + col);
|
||||
};
|
||||
window.addEventListener("unhandledrejection", function (e) {
|
||||
window.__errors.push("unhandledrejection: " + String(e.reason).slice(0, 500));
|
||||
});
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<div id="status">loading</div>
|
||||
<script type="module">
|
||||
`;
|
||||
const tail = `
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
`;
|
||||
|
||||
const html = head + inlineJs + tail;
|
||||
await Bun.write(DIST_HTML, html);
|
||||
|
||||
const sha256 = createHash("sha256").update(html).digest("hex");
|
||||
// Source fingerprint: lets the drift test catch "edited src, forgot to
|
||||
// rebuild dist" WITHOUT needing node_modules for a full rebuild (the deep
|
||||
// rebuild check only runs where deps are installed).
|
||||
const srcSha256 = createHash("sha256")
|
||||
.update(await Bun.file(ENTRY).text())
|
||||
.update(await Bun.file(import.meta.path).text())
|
||||
.digest("hex");
|
||||
const info = {
|
||||
name: "gstack-diagram-render",
|
||||
sha256,
|
||||
srcSha256,
|
||||
bytes: Buffer.byteLength(html),
|
||||
bunVersion: Bun.version,
|
||||
deps,
|
||||
};
|
||||
await Bun.write(BUILD_INFO, JSON.stringify(info, null, 2) + "\n");
|
||||
|
||||
console.log(`built ${path.relative(process.cwd(), DIST_HTML)} (${(info.bytes / 1024 / 1024).toFixed(2)} MB)`);
|
||||
console.log(`sha256 ${sha256}`);
|
||||
@@ -0,0 +1,215 @@
|
||||
/**
|
||||
* diagram-render bundle entry.
|
||||
*
|
||||
* Built into a single self-contained HTML page (dist/diagram-render.html) that
|
||||
* make-pdf and /diagram load into a browse daemon tab via `load-html`. Every
|
||||
* capability is exposed as a window.__* function and driven through `browse js`;
|
||||
* binary results return as data URLs that `js --out` decodes to bytes on disk.
|
||||
*
|
||||
* page lifecycle (one tab per make-pdf run, reused across fences):
|
||||
* load-html dist copy ─▶ poll #status == "ready" ─▶ N × __renderMermaid/
|
||||
* __excalidrawToSvg/__rasterize ─▶ close tab (orchestrator finally)
|
||||
* render error ─▶ caller reloads the page before the next fence
|
||||
* (reset contract: no poisoned mermaid global survives, eng-review D6.2)
|
||||
*
|
||||
* Render contract (eng-review D3):
|
||||
* - securityLevel "strict": no click callbacks, no HTML label injection in
|
||||
* this tab. The make-pdf sanitizer is the second defense layer downstream.
|
||||
* - Callers pass a unique id per fence (mermaid-fence-<n>); mermaid bakes it
|
||||
* into every internal SVG id, so two diagrams inlined into one document
|
||||
* can't collide on gradients/markers.
|
||||
* - Font stacks mirror make-pdf/src/print-css.ts so text measured here lays
|
||||
* out identically in the printed document.
|
||||
* - htmlLabels false: foreignObject labels taint canvases (blocks toDataURL
|
||||
* rasterization) and break when the SVG is inlined into another document.
|
||||
*/
|
||||
import mermaid from "mermaid";
|
||||
import { parseMermaidToExcalidraw } from "@excalidraw/mermaid-to-excalidraw";
|
||||
import { convertToExcalidrawElements, exportToSvg } from "@excalidraw/excalidraw";
|
||||
|
||||
declare global {
|
||||
interface Window {
|
||||
__bundleInfo: { name: string; deps: Record<string, string> };
|
||||
__renderMermaid: (id: string, text: string) => Promise<string>;
|
||||
__mermaidToExcalidraw: (text: string) => Promise<string>;
|
||||
__excalidrawToSvg: (sceneJson: string) => Promise<string>;
|
||||
__rasterize: (svgText: string, targetWidthPx: number) => Promise<string>;
|
||||
__downscaleRaster: (dataUri: string, targetWidthPx: number, mime: string) => Promise<string>;
|
||||
__mountForScreenshot: (svgText: string, targetWidthPx: number) => string;
|
||||
__probeImage: (src: string) => Promise<string>;
|
||||
EXCALIDRAW_ASSET_PATH?: string;
|
||||
__errors: string[];
|
||||
}
|
||||
}
|
||||
|
||||
// Excalidraw's font registry builds URLs from this against the document base.
|
||||
// The host must be absolute and never resolves — the page is offline by design;
|
||||
// exportToSvg embeds the bundled Excalifont glyphs without fetching.
|
||||
window.EXCALIDRAW_ASSET_PATH = "https://gstack-render.localhost/excalidraw-assets/";
|
||||
|
||||
// Font stacks must match make-pdf/src/print-css.ts (sans + CJK + emoji) so
|
||||
// mermaid's text measurement in this tab matches the print document's layout.
|
||||
const PRINT_SANS =
|
||||
'Helvetica, "Liberation Sans", Arial, "Hiragino Kaku Gothic ProN", ' +
|
||||
'"Noto Sans CJK JP", "Microsoft YaHei", "Apple Color Emoji", ' +
|
||||
'"Segoe UI Emoji", "Noto Color Emoji", sans-serif';
|
||||
|
||||
mermaid.initialize({
|
||||
startOnLoad: false,
|
||||
securityLevel: "strict",
|
||||
theme: "neutral",
|
||||
fontFamily: PRINT_SANS,
|
||||
htmlLabels: false,
|
||||
flowchart: { htmlLabels: false },
|
||||
});
|
||||
|
||||
window.__renderMermaid = async (id: string, text: string): Promise<string> => {
|
||||
if (!/^[A-Za-z][\w-]*$/.test(id)) throw new Error(`invalid mermaid render id: ${id}`);
|
||||
const { svg } = await mermaid.render(id, text);
|
||||
return svg;
|
||||
};
|
||||
|
||||
window.__mermaidToExcalidraw = async (text: string): Promise<string> => {
|
||||
const { elements, files } = await parseMermaidToExcalidraw(text);
|
||||
const converted = convertToExcalidrawElements(elements);
|
||||
const scene = {
|
||||
type: "excalidraw",
|
||||
version: 2,
|
||||
source: "gstack-diagram-render",
|
||||
elements: converted,
|
||||
appState: { viewBackgroundColor: "#ffffff" },
|
||||
files: files ?? {},
|
||||
};
|
||||
return JSON.stringify(scene);
|
||||
};
|
||||
|
||||
window.__excalidrawToSvg = async (sceneJson: string): Promise<string> => {
|
||||
const scene = JSON.parse(sceneJson);
|
||||
if (!Array.isArray(scene.elements)) throw new Error("excalidraw scene has no elements array");
|
||||
const svg = await exportToSvg({
|
||||
elements: scene.elements,
|
||||
appState: { ...(scene.appState ?? {}), exportBackground: true },
|
||||
files: scene.files ?? null,
|
||||
exportPadding: 16,
|
||||
});
|
||||
return new XMLSerializer().serializeToString(svg);
|
||||
};
|
||||
|
||||
/**
|
||||
* SVG → PNG data URL at an explicit pixel width. Callers own the DPI math:
|
||||
* targetWidthPx = placed physical width (in) × 300dpi (eng-review D6.5) —
|
||||
* the bundle never guesses a viewport.
|
||||
*/
|
||||
/** Shared ceiling for rasterization targets (both window functions). */
|
||||
const MAX_TARGET_PX = 10_000;
|
||||
function assertTargetWidth(px: number): void {
|
||||
if (!(px > 0 && px <= MAX_TARGET_PX)) {
|
||||
throw new Error(`targetWidthPx out of range: ${px}`);
|
||||
}
|
||||
}
|
||||
|
||||
window.__rasterize = async (svgText: string, targetWidthPx: number): Promise<string> => {
|
||||
assertTargetWidth(targetWidthPx);
|
||||
const blob = new Blob([svgText], { type: "image/svg+xml;charset=utf-8" });
|
||||
const url = URL.createObjectURL(blob);
|
||||
try {
|
||||
const img = new Image();
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
img.onload = () => resolve();
|
||||
img.onerror = () => reject(new Error("SVG image decode failed (malformed SVG or foreignObject content)"));
|
||||
img.src = url;
|
||||
});
|
||||
const naturalW = img.naturalWidth || 800;
|
||||
const naturalH = img.naturalHeight || 600;
|
||||
const scale = targetWidthPx / naturalW;
|
||||
const canvas = document.createElement("canvas");
|
||||
canvas.width = Math.round(naturalW * scale);
|
||||
canvas.height = Math.round(naturalH * scale);
|
||||
const ctx = canvas.getContext("2d");
|
||||
if (!ctx) throw new Error("2d canvas context unavailable");
|
||||
ctx.fillStyle = "#ffffff";
|
||||
ctx.fillRect(0, 0, canvas.width, canvas.height);
|
||||
ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
|
||||
// Throws on tainted canvas — callers fall back to __mountForScreenshot +
|
||||
// `browse screenshot --selector "#raster-stage"`.
|
||||
return canvas.toDataURL("image/png");
|
||||
} finally {
|
||||
URL.revokeObjectURL(url);
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Fallback rasterization stage: mount the SVG in the DOM so the caller can
|
||||
* take an element screenshot (no canvas, no taint rules). Returns a marker
|
||||
* string; the artifact is the screenshot, not the return value.
|
||||
*/
|
||||
window.__mountForScreenshot = (svgText: string, targetWidthPx: number): string => {
|
||||
document.getElementById("raster-stage")?.remove();
|
||||
const stage = document.createElement("div");
|
||||
stage.id = "raster-stage";
|
||||
stage.style.cssText = `display:inline-block;background:#fff;width:${targetWidthPx}px`;
|
||||
stage.innerHTML = svgText;
|
||||
const svg = stage.querySelector("svg");
|
||||
if (svg) {
|
||||
svg.setAttribute("width", String(targetWidthPx));
|
||||
svg.removeAttribute("height");
|
||||
svg.style.height = "auto";
|
||||
}
|
||||
document.body.appendChild(stage);
|
||||
return `mounted:${targetWidthPx}`;
|
||||
};
|
||||
|
||||
/**
|
||||
* Downscale a raster image (data URI) to targetWidthPx, preserving aspect.
|
||||
* Re-encodes in the requested mime — JPEG photos stay JPEG (q0.9); PNG-encoding
|
||||
* a photo would bloat it past the original. Data URIs are same-origin, so the
|
||||
* canvas never taints.
|
||||
*/
|
||||
window.__downscaleRaster = async (
|
||||
dataUri: string,
|
||||
targetWidthPx: number,
|
||||
mime: string,
|
||||
): Promise<string> => {
|
||||
assertTargetWidth(targetWidthPx);
|
||||
const img = new Image();
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
img.onload = () => resolve();
|
||||
img.onerror = () => reject(new Error("image decode failed"));
|
||||
img.src = dataUri;
|
||||
});
|
||||
const scale = targetWidthPx / (img.naturalWidth || targetWidthPx);
|
||||
const canvas = document.createElement("canvas");
|
||||
canvas.width = Math.round(img.naturalWidth * scale);
|
||||
canvas.height = Math.round(img.naturalHeight * scale);
|
||||
const ctx = canvas.getContext("2d");
|
||||
if (!ctx) throw new Error("2d canvas context unavailable");
|
||||
ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
|
||||
const outMime = mime === "image/jpeg" ? "image/jpeg" : "image/png";
|
||||
return outMime === "image/jpeg" ? canvas.toDataURL(outMime, 0.9) : canvas.toDataURL(outMime);
|
||||
};
|
||||
|
||||
/** Probe intrinsic dimensions of an image (data URI or URL). Returns JSON. */
|
||||
window.__probeImage = async (src: string): Promise<string> => {
|
||||
const img = new Image();
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
img.onload = () => resolve();
|
||||
img.onerror = () => reject(new Error("image decode failed"));
|
||||
img.src = src;
|
||||
});
|
||||
return JSON.stringify({ width: img.naturalWidth, height: img.naturalHeight });
|
||||
};
|
||||
|
||||
// __BUNDLE_INFO__ is replaced at build time with the pinned dependency map.
|
||||
window.__bundleInfo = { name: "gstack-diagram-render", deps: __BUNDLE_INFO_DEPS__ };
|
||||
|
||||
// Readiness signal: pollable text beats a bare invisible div (Playwright's
|
||||
// visibility-based `wait` never fires on an empty element).
|
||||
const status = document.getElementById("status");
|
||||
if (status) status.textContent = "ready";
|
||||
const done = document.createElement("div");
|
||||
done.id = "done";
|
||||
done.textContent = "ready";
|
||||
done.style.cssText = "position:absolute;left:-9999px";
|
||||
document.body.appendChild(done);
|
||||
|
||||
declare const __BUNDLE_INFO_DEPS__: Record<string, string>;
|
||||
@@ -0,0 +1,218 @@
|
||||
/**
|
||||
* Centralized gbrain CLI invocation.
|
||||
*
|
||||
* Every `gbrain ...` spawn from `bin/gstack-gbrain-sync.ts` and
|
||||
* `bin/gstack-memory-ingest.ts` MUST go through `spawnGbrain` (or
|
||||
* `execGbrainJson`), and the invariant test
|
||||
* `test/gbrain-exec-invariant.test.ts` enforces this with a static-source
|
||||
* grep. The helper layer guarantees three properties:
|
||||
*
|
||||
* 1. **DATABASE_URL is seeded from gbrain's own config**, not from the
|
||||
* caller's `.env.local`. gbrain auto-loads `.env.local` via dotenv on
|
||||
* startup. When `/sync-gbrain` runs inside a Next.js / Prisma / Rails
|
||||
* project with its own `DATABASE_URL`, gbrain reads that one and not
|
||||
* its own `${GBRAIN_HOME:-$HOME/.gbrain}/config.json`. Auth fails;
|
||||
* code + memory stages crash; only brain-sync's git push survives.
|
||||
*
|
||||
* 2. **Bun-aware env passing.** Mutating `process.env.DATABASE_URL` does
|
||||
* NOT propagate to children of `child_process.spawnSync`/`spawn` in
|
||||
* Bun — the child gets the original startup env. So we cannot just
|
||||
* set process.env; we must thread an explicit `env:` dict to every
|
||||
* spawn. This is the central bug the helper exists to prevent
|
||||
* regressing on.
|
||||
*
|
||||
* 3. **`GBRAIN_HOME` honored consistently.** Other gstack helpers
|
||||
* (`detectEngineTier`) already honor `GBRAIN_HOME`. `buildGbrainEnv`
|
||||
* reads from `${GBRAIN_HOME:-$HOME/.gbrain}/config.json` so all
|
||||
* gstack-side gbrain calls agree on which config file matters.
|
||||
*
|
||||
* **Escape hatch:** `GSTACK_RESPECT_ENV_DATABASE_URL=1` returns the
|
||||
* caller's env unchanged. Use only when the brain intentionally lives in
|
||||
* the project's local DB (rare).
|
||||
*/
|
||||
|
||||
import { existsSync, readFileSync } from "fs";
|
||||
import { join } from "path";
|
||||
import { homedir } from "os";
|
||||
import { spawnSync, spawn, execFileSync, type SpawnSyncReturns, type ChildProcess, type SpawnOptions } from "child_process";
|
||||
|
||||
interface GbrainConfig {
|
||||
database_url?: string;
|
||||
}
|
||||
|
||||
export interface BuildGbrainEnvOptions {
|
||||
/**
|
||||
* Caller env to extend. Defaults to `process.env`. Tests inject a
|
||||
* synthetic env so the helper can be exercised without polluting the
|
||||
* real process env.
|
||||
*/
|
||||
baseEnv?: NodeJS.ProcessEnv;
|
||||
/**
|
||||
* When true, announce on stderr that we overrode the caller's
|
||||
* DATABASE_URL. Suppressed for the `--quiet` sync flow.
|
||||
*/
|
||||
announce?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect whether a DATABASE_URL targets a PgBouncer transaction-mode pooler.
|
||||
*
|
||||
* Supabase transaction-mode poolers conventionally run on port 6543 at
|
||||
* `*.pooler.supabase.com`. gbrain auto-disables prepared statements on these
|
||||
* (prepared statements break under transaction pooling — #1965); its banner
|
||||
* documents `GBRAIN_PREPARE=true` as the override for poolers that actually
|
||||
* run in session mode on 6543.
|
||||
*/
|
||||
export function isTransactionModePooler(url: string): boolean {
|
||||
try {
|
||||
// DATABASE_URLs use postgresql:// scheme which URL() doesn't natively
|
||||
// parse host/port from, so swap to http:// for reliable parsing.
|
||||
const parsed = new URL(url.replace(/^postgres(ql)?:\/\//, "http://"));
|
||||
return parsed.port === "6543";
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Build an env dict with DATABASE_URL seeded from
|
||||
* `${GBRAIN_HOME:-$HOME/.gbrain}/config.json`. Returns the base env
|
||||
* unchanged when:
|
||||
* - `GSTACK_RESPECT_ENV_DATABASE_URL=1` (intentional opt-out),
|
||||
* - the config file is missing or unparseable,
|
||||
* - the config has no `database_url`,
|
||||
* - the caller already set DATABASE_URL to the same value.
|
||||
*
|
||||
* GBRAIN_PREPARE is never set here (#1965): gbrain auto-disables prepared
|
||||
* statements on transaction-mode poolers itself, and forcing them on breaks
|
||||
* every write with "prepared statement does not exist". A caller-set
|
||||
* GBRAIN_PREPARE (either value) passes through untouched — that remains the
|
||||
* documented override for session-mode poolers on port 6543.
|
||||
*
|
||||
* Always returns a fresh object — mutating the returned env never
|
||||
* affects the caller's env. Tests assert on effective values, not
|
||||
* object identity.
|
||||
*/
|
||||
export function buildGbrainEnv(opts: BuildGbrainEnvOptions = {}): NodeJS.ProcessEnv {
|
||||
const baseEnv = opts.baseEnv || process.env;
|
||||
const out: NodeJS.ProcessEnv = { ...baseEnv };
|
||||
if (baseEnv.GSTACK_RESPECT_ENV_DATABASE_URL === "1") return out;
|
||||
|
||||
const homeBase = baseEnv.HOME || homedir();
|
||||
const gbrainHome = baseEnv.GBRAIN_HOME || join(homeBase, ".gbrain");
|
||||
const configPath = join(gbrainHome, "config.json");
|
||||
if (!existsSync(configPath)) return out;
|
||||
|
||||
let cfg: GbrainConfig = {};
|
||||
try {
|
||||
cfg = JSON.parse(readFileSync(configPath, "utf-8")) as GbrainConfig;
|
||||
} catch {
|
||||
return out;
|
||||
}
|
||||
if (!cfg.database_url) return out;
|
||||
|
||||
const hadCaller = baseEnv.DATABASE_URL !== undefined;
|
||||
const alreadyMatch = baseEnv.DATABASE_URL === cfg.database_url;
|
||||
if (!alreadyMatch) {
|
||||
out.DATABASE_URL = cfg.database_url;
|
||||
if (opts.announce) {
|
||||
const note = hadCaller ? " (overrode value from caller env / .env.local)" : "";
|
||||
process.stderr.write(`[gbrain-exec] seeded DATABASE_URL from ${configPath}${note}\n`);
|
||||
}
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Windows can't directly spawn the `gbrain` launcher (bun/npm install it as a
|
||||
* `gbrain.cmd`/`.ps1` shim) or a shebang script like the bash `gstack-brain-sync`
|
||||
* — `spawnSync`/`spawn` resolve those only through a shell's PATHEXT + interpreter
|
||||
* lookup. Without `shell: true` the child spawn fails ENOENT, which on the sync
|
||||
* orchestrator surfaced as "brain-sync exited undefined" (#1731). Gate on platform
|
||||
* so POSIX keeps the cheaper no-shell path. Exported so the static-grep tripwire
|
||||
* (test/gbrain-spawn-windows-shell.test.ts) can assert every gbrain/brain-sync
|
||||
* spawn carries it.
|
||||
*/
|
||||
export const NEEDS_SHELL_ON_WINDOWS = process.platform === "win32";
|
||||
|
||||
export interface SpawnGbrainOptions {
|
||||
/** Timeout in milliseconds. Defaults to 30s. */
|
||||
timeout?: number;
|
||||
/** Working directory for the child process. */
|
||||
cwd?: string;
|
||||
/** Stdio configuration. Defaults to capturing both stdout and stderr. */
|
||||
stdio?: "inherit" | "pipe" | "ignore" | Array<"inherit" | "pipe" | "ignore">;
|
||||
/**
|
||||
* Base env to extend before seeding DATABASE_URL. Defaults to
|
||||
* `process.env`. Tests inject a synthetic env so the spawn picks up a
|
||||
* gbrain shim on PATH and a fake `~/.gbrain/config.json`.
|
||||
*/
|
||||
baseEnv?: NodeJS.ProcessEnv;
|
||||
/** Whether to announce DATABASE_URL seeding on stderr. */
|
||||
announce?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Spawn `gbrain <args>` with the seeded env. Returns the raw
|
||||
* `SpawnSyncReturns<string>` so callers can inspect `status`, `stdout`,
|
||||
* `stderr` exactly as they would with `spawnSync` directly.
|
||||
*/
|
||||
export function spawnGbrain(args: string[], opts: SpawnGbrainOptions = {}): SpawnSyncReturns<string> {
|
||||
return spawnSync("gbrain", args, {
|
||||
encoding: "utf-8",
|
||||
timeout: opts.timeout ?? 30_000,
|
||||
cwd: opts.cwd,
|
||||
stdio: opts.stdio || ["ignore", "pipe", "pipe"],
|
||||
env: buildGbrainEnv({ baseEnv: opts.baseEnv, announce: opts.announce }),
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Run `gbrain <args>` and parse stdout as JSON. Returns `null` on
|
||||
* non-zero exit, parse failure, or timeout. Useful for `gbrain sources
|
||||
* list --json` and similar.
|
||||
*/
|
||||
export function execGbrainJson<T = unknown>(args: string[], opts: SpawnGbrainOptions = {}): T | null {
|
||||
const r = spawnGbrain(args, opts);
|
||||
if (r.status !== 0) return null;
|
||||
try {
|
||||
return JSON.parse(r.stdout || "null") as T;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Async streaming variant for callers that need to attach stdout/stderr
|
||||
* listeners (e.g., `gbrain import` in `gstack-memory-ingest.ts`). Always
|
||||
* injects the seeded env. Returns the raw `ChildProcess` so the caller
|
||||
* can wire up its own promise around exit/timeout/signal handling.
|
||||
*/
|
||||
export function spawnGbrainAsync(
|
||||
args: string[],
|
||||
opts: { stdio?: SpawnOptions["stdio"]; cwd?: string; baseEnv?: NodeJS.ProcessEnv } = {},
|
||||
): ChildProcess {
|
||||
return spawn("gbrain", args, {
|
||||
stdio: opts.stdio || ["ignore", "pipe", "pipe"],
|
||||
cwd: opts.cwd,
|
||||
env: buildGbrainEnv({ baseEnv: opts.baseEnv, announce: false }),
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Run `gbrain <args>` via execFileSync. Throws on non-zero exit. Useful
|
||||
* for callers that want to surface gbrain's stderr as the error message.
|
||||
*/
|
||||
export function execGbrainText(args: string[], opts: SpawnGbrainOptions = {}): string {
|
||||
return execFileSync("gbrain", args, {
|
||||
encoding: "utf-8",
|
||||
timeout: opts.timeout ?? 30_000,
|
||||
cwd: opts.cwd,
|
||||
stdio: opts.stdio || ["ignore", "pipe", "pipe"],
|
||||
env: buildGbrainEnv({ baseEnv: opts.baseEnv, announce: opts.announce }),
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,307 @@
|
||||
/**
|
||||
* gbrain-guards — defense-in-depth against gbrain's destructive code paths (#1734).
|
||||
*
|
||||
* gbrain (the separate CLI gstack shells out to) can rm-rf a user's working tree
|
||||
* during an autopilot race (its own bug, upstream gbrain #1526). gstack can't fix
|
||||
* that, but it MUST stop treating gbrain's destructive subcommands as safe. These
|
||||
* guards gate the two ways the orchestrator can reach destruction:
|
||||
*
|
||||
* 1. `sources remove --confirm-destructive` → decideSourceRemove()
|
||||
* 2. `sync --strategy code` (can auto-reclone) → decideCodeSync()
|
||||
*
|
||||
* plus an autopilot-active check (detectAutopilot) that refuses to run destructive
|
||||
* ops concurrently with the daemon.
|
||||
*
|
||||
* Design notes grounded in the real gbrain 0.41.x surface:
|
||||
* - There is NO `--keep-storage` flag and NO structured capability command, and
|
||||
* subcommand `--help` is generic — so capability detection is best-effort and
|
||||
* defaults to "unsupported". When we can't protect a user-managed source's
|
||||
* files, we FAIL CLOSED (refuse the remove) rather than delete unprotected.
|
||||
* - The autopilot lock filename isn't documented and (gbrain #1226) ignores
|
||||
* GBRAIN_HOME, so the live `gbrain autopilot` process is the PRIMARY signal;
|
||||
* known lock paths under both the configured home and ~/.gbrain are secondary.
|
||||
* - We refuse only on an AFFIRMATIVE autopilot signal — inability to introspect
|
||||
* never blocks a normal sync (that would brick the tool).
|
||||
* - Path containment uses realpath so a symlink inside ~/.gbrain/clones can't
|
||||
* smuggle a delete out to a user repo.
|
||||
*
|
||||
* Pure decision functions; the orchestrator logs the reasons (observability).
|
||||
*/
|
||||
|
||||
import { spawnSync } from "child_process";
|
||||
import { existsSync, realpathSync, readFileSync } from "fs";
|
||||
import { homedir } from "os";
|
||||
import { join, resolve, sep } from "path";
|
||||
import { execGbrainJson, execGbrainText, NEEDS_SHELL_ON_WINDOWS } from "./gbrain-exec";
|
||||
import { parseSourcesList, type GbrainSourceRow } from "./gbrain-sources";
|
||||
|
||||
export function gbrainHome(env: NodeJS.ProcessEnv = process.env): string {
|
||||
return env.GBRAIN_HOME || join(homedir(), ".gbrain");
|
||||
}
|
||||
|
||||
/**
|
||||
* Directories gbrain owns and may delete safely. A source whose local_path
|
||||
* resolves inside one of these is gbrain-managed; outside = user-managed and
|
||||
* must be protected. Both the configured home and the default ~/.gbrain are
|
||||
* checked because gbrain #1226 shows home-resolution is inconsistent.
|
||||
*/
|
||||
function clonesDirs(env: NodeJS.ProcessEnv = process.env): string[] {
|
||||
return [...new Set([join(gbrainHome(env), "clones"), join(homedir(), ".gbrain", "clones")])];
|
||||
}
|
||||
|
||||
/** True if `p` resolves (symlinks + `..` collapsed) to a location inside `dir`. */
|
||||
export function isInside(p: string, dir: string): boolean {
|
||||
let rp: string;
|
||||
let rd: string;
|
||||
try { rp = realpathSync(p); } catch { rp = resolve(p); }
|
||||
try { rd = realpathSync(dir); } catch { rd = resolve(dir); }
|
||||
const base = rd.endsWith(sep) ? rd : rd + sep;
|
||||
return rp === rd || rp.startsWith(base);
|
||||
}
|
||||
|
||||
// ── Autopilot detection (E1: multi-signal, affirmative-only) ────────────────
|
||||
|
||||
export interface AutopilotStatus {
|
||||
active: boolean;
|
||||
/** Which signal fired (lock path or "process"), or null when inactive. */
|
||||
signal: string | null;
|
||||
}
|
||||
|
||||
export interface AutopilotProbe {
|
||||
/** Override the lock-path list (tests). */
|
||||
lockPaths?: string[];
|
||||
/** Override the live-process check (tests). */
|
||||
processRunning?: () => boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect a running gbrain autopilot. Refuse the caller's destructive op only on
|
||||
* an affirmative signal; absence of a confirmable mechanism returns inactive so
|
||||
* normal syncs are never bricked.
|
||||
*/
|
||||
export function detectAutopilot(
|
||||
env: NodeJS.ProcessEnv = process.env,
|
||||
probe: AutopilotProbe = {},
|
||||
): AutopilotStatus {
|
||||
// Secondary signal: known lock files. gbrain #1226 — the lock ignores
|
||||
// GBRAIN_HOME, so check both the configured home and the default ~/.gbrain.
|
||||
const lockPaths = probe.lockPaths ?? [
|
||||
join(gbrainHome(env), "autopilot.lock"),
|
||||
join(homedir(), ".gbrain", "autopilot.lock"),
|
||||
join(gbrainHome(env), "autopilot.pid"),
|
||||
join(homedir(), ".gbrain", "autopilot.pid"),
|
||||
];
|
||||
for (const lp of lockPaths) {
|
||||
if (!existsSync(lp)) continue;
|
||||
// A lock FILE alone is not proof of life — a crashed daemon leaves a stale
|
||||
// lock that would otherwise wedge every sync forever (observed: a dead pid
|
||||
// refused --full indefinitely). Read the holder pid and check liveness.
|
||||
const pid = readLockPid(lp);
|
||||
if (pid === null) {
|
||||
// Can't introspect (no parseable pid) → stay conservative: treat as active.
|
||||
return { active: true, signal: `lock:${lp}` };
|
||||
}
|
||||
if (isPidAlive(pid)) {
|
||||
return { active: true, signal: `lock:${lp} (pid ${pid})` };
|
||||
}
|
||||
// Stale lock (holder pid is dead): ignore this signal, keep checking. Pure
|
||||
// decision function — we do NOT delete the file here; the caller may clean it.
|
||||
}
|
||||
// Primary signal: a live `gbrain autopilot` process.
|
||||
const running = (probe.processRunning ?? defaultProcessRunning)();
|
||||
if (running) return { active: true, signal: "process:gbrain autopilot" };
|
||||
return { active: false, signal: null };
|
||||
}
|
||||
|
||||
/** Read the holder pid from a lock/pid file. Returns null if no integer pid is present. */
|
||||
function readLockPid(lockPath: string): number | null {
|
||||
try {
|
||||
const raw = readFileSync(lockPath, "utf-8").trim();
|
||||
// Files seen: a bare pid ("65495"), or JSON like {"pid":65495,...}.
|
||||
const m = raw.match(/"pid"\s*:\s*(\d+)/) ?? raw.match(/^(\d+)$/);
|
||||
if (!m) return null;
|
||||
const pid = Number.parseInt(m[1], 10);
|
||||
return Number.isFinite(pid) && pid > 0 ? pid : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Liveness via signal 0: no signal sent, just an existence/permission check.
|
||||
* ESRCH → dead; EPERM → alive but owned by another user. Cross-host pids are
|
||||
* meaningless, but the autopilot lock is same-host by construction.
|
||||
*/
|
||||
function isPidAlive(pid: number): boolean {
|
||||
try {
|
||||
process.kill(pid, 0);
|
||||
return true;
|
||||
} catch (err) {
|
||||
return (err as NodeJS.ErrnoException).code === "EPERM";
|
||||
}
|
||||
}
|
||||
|
||||
function defaultProcessRunning(): boolean {
|
||||
// No reliable pgrep on Windows; rely on the lock-file signal there.
|
||||
if (process.platform === "win32") return false;
|
||||
const r = spawnSync("pgrep", ["-f", "gbrain autopilot"], { encoding: "utf-8", timeout: 3_000 });
|
||||
return r.status === 0 && (r.stdout || "").trim().length > 0;
|
||||
}
|
||||
|
||||
// ── Capability detection (E4 + Codex: per-process memo, no persistent cache) ─
|
||||
//
|
||||
// No structured capability command exists and subcommand --help is generic, so
|
||||
// --keep-storage support can't be probed reliably; default unsupported. Memoize
|
||||
// per process (keyed to the resolved gbrain identity) rather than persisting a
|
||||
// cross-run cache — Codex flagged stale persistent caches, and the probe is cheap.
|
||||
|
||||
let _keepStorageMemo: { key: string; value: boolean } | undefined;
|
||||
|
||||
function gbrainIdentity(env: NodeJS.ProcessEnv): string {
|
||||
const r = spawnSync("gbrain", ["--version"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 3_000,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS,
|
||||
env,
|
||||
});
|
||||
return (r.stdout || "").trim() || "unknown";
|
||||
}
|
||||
|
||||
export function gbrainSupportsKeepStorage(env: NodeJS.ProcessEnv = process.env): boolean {
|
||||
const key = gbrainIdentity(env);
|
||||
if (_keepStorageMemo && _keepStorageMemo.key === key) return _keepStorageMemo.value;
|
||||
let value = false;
|
||||
for (const args of [["sources", "remove", "--help"], ["--help"]]) {
|
||||
try {
|
||||
if (/--keep-storage/.test(execGbrainText(args, { baseEnv: env, timeout: 5_000 }))) {
|
||||
value = true;
|
||||
break;
|
||||
}
|
||||
} catch {
|
||||
// generic/empty help or non-zero exit → treat as unsupported
|
||||
}
|
||||
}
|
||||
_keepStorageMemo = { key, value };
|
||||
return value;
|
||||
}
|
||||
|
||||
/** Test-only: reset the per-process capability memo. */
|
||||
export function _resetCapabilityMemo(): void {
|
||||
_keepStorageMemo = undefined;
|
||||
}
|
||||
|
||||
// ── Destructive-op decisions ────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Fetch + normalize the source list. Throws on read/parse failure so callers can
|
||||
* distinguish "couldn't read" (fail closed) from "empty list" (source absent).
|
||||
* Injectable for hermetic tests.
|
||||
*/
|
||||
export function fetchSources(env: NodeJS.ProcessEnv = process.env): GbrainSourceRow[] {
|
||||
const raw = execGbrainJson(["sources", "list", "--json"], { baseEnv: env });
|
||||
if (raw === null) throw new Error("gbrain sources list returned no JSON");
|
||||
return parseSourcesList(raw);
|
||||
}
|
||||
|
||||
export interface RemoveDecision {
|
||||
allow: boolean;
|
||||
/** Extra args to append to `sources remove` (e.g. --keep-storage). */
|
||||
extraArgs: string[];
|
||||
reason: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Decide whether `sources remove <id>` is safe, and with what flags.
|
||||
*
|
||||
* Fail-closed cases (allow=false):
|
||||
* - sources list unreadable/unparseable (can't prove the row is safe).
|
||||
* - the row is user-managed (remote_url set AND local_path outside gbrain's
|
||||
* clones) and gbrain has no --keep-storage to protect the files.
|
||||
*
|
||||
* Allowed: absent row (no-op), gbrain-managed (inside clones), or path-managed
|
||||
* without a remote_url (gbrain's remove won't touch an outside-clones path that
|
||||
* it didn't clone). --keep-storage is appended whenever supported, as extra armor.
|
||||
*/
|
||||
export interface DecideRemoveOpts {
|
||||
/** Override capability detection (tests / cached caps). */
|
||||
keepStorage?: boolean;
|
||||
/** Override the source-list fetch (tests). Throwing simulates a read failure. */
|
||||
fetchRows?: (env: NodeJS.ProcessEnv) => GbrainSourceRow[];
|
||||
}
|
||||
|
||||
export function decideSourceRemove(
|
||||
sourceId: string,
|
||||
env: NodeJS.ProcessEnv = process.env,
|
||||
opts: DecideRemoveOpts = {},
|
||||
): RemoveDecision {
|
||||
const keepStorage = opts.keepStorage ?? gbrainSupportsKeepStorage(env);
|
||||
const extra = keepStorage ? ["--keep-storage"] : [];
|
||||
|
||||
let rows: GbrainSourceRow[];
|
||||
try {
|
||||
rows = (opts.fetchRows ?? fetchSources)(env);
|
||||
} catch {
|
||||
return { allow: false, extraArgs: [], reason: "could not read sources list; refusing remove (fail closed)" };
|
||||
}
|
||||
|
||||
const row = rows.find((r) => r.id === sourceId);
|
||||
if (!row) return { allow: true, extraArgs: extra, reason: "source absent (no-op)" };
|
||||
|
||||
const remoteUrl = row.config?.remote_url;
|
||||
const userManaged =
|
||||
!!remoteUrl && !!row.local_path && !clonesDirs(env).some((d) => isInside(row.local_path!, d));
|
||||
|
||||
if (userManaged) {
|
||||
if (keepStorage) {
|
||||
return { allow: true, extraArgs: ["--keep-storage"], reason: "user-managed; --keep-storage protects files" };
|
||||
}
|
||||
return {
|
||||
allow: false,
|
||||
extraArgs: [],
|
||||
reason:
|
||||
`refusing remove of user-managed source "${sourceId}" (remote_url set, local_path ` +
|
||||
`${row.local_path} outside gbrain clones) — this gbrain has no --keep-storage to ` +
|
||||
`protect the working tree. Upgrade gbrain or remove the source manually.`,
|
||||
};
|
||||
}
|
||||
|
||||
return { allow: true, extraArgs: extra, reason: "gbrain-managed or path-managed without remote_url" };
|
||||
}
|
||||
|
||||
export interface SyncDecision {
|
||||
allow: boolean;
|
||||
reason: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Decide whether `sync --strategy code --source <id>` is safe to run.
|
||||
*
|
||||
* A source with a remote_url can trigger gbrain's auto-reclone, the ungated
|
||||
* rm-rf path behind the data loss (gbrain #1526). Require an explicit
|
||||
* --allow-reclone opt-in for URL-managed sources. Read failure here is NOT
|
||||
* itself destructive, so it fails open (proceed) — the autopilot guard, checked
|
||||
* first, is the primary protection against the race that caused the loss.
|
||||
*/
|
||||
export function decideCodeSync(
|
||||
sourceId: string,
|
||||
env: NodeJS.ProcessEnv = process.env,
|
||||
allowReclone = false,
|
||||
fetchRows: (env: NodeJS.ProcessEnv) => GbrainSourceRow[] = fetchSources,
|
||||
): SyncDecision {
|
||||
let rows: GbrainSourceRow[];
|
||||
try {
|
||||
rows = fetchRows(env);
|
||||
} catch {
|
||||
return { allow: true, reason: "sources unreadable; proceeding (sync read is non-destructive)" };
|
||||
}
|
||||
const row = rows.find((r) => r.id === sourceId);
|
||||
if (row?.config?.remote_url && !allowReclone) {
|
||||
return {
|
||||
allow: false,
|
||||
reason:
|
||||
`source "${sourceId}" is URL-managed (remote_url set); sync may auto-reclone and ` +
|
||||
`delete the working tree. Re-run /sync-gbrain with --allow-reclone to proceed.`,
|
||||
};
|
||||
}
|
||||
return { allow: true, reason: "no remote_url, or reclone explicitly allowed" };
|
||||
}
|
||||
@@ -0,0 +1,327 @@
|
||||
/**
|
||||
* gbrain-local-status — classify the local gbrain engine into 6 states.
|
||||
*
|
||||
* Shared between bin/gstack-gbrain-detect (preamble probe on every skill start)
|
||||
* and bin/gstack-gbrain-sync.ts (orchestrator SKIP-when-not-ok semantics).
|
||||
* Single source of truth: same probe, same classification, same cache.
|
||||
*
|
||||
* Per the split-engine plan (D2 + D8):
|
||||
* - Probe: `gbrain sources list --json`. Cheap (~80ms), actually hits the DB.
|
||||
* Uses the same stderr patterns as lib/gbrain-sources.ts:66-67.
|
||||
* - Cache: 60s TTL at ~/.gstack/.gbrain-local-status-cache.json, keyed on
|
||||
* {home, gbrain_home, path_hash, gbrain_bin_path, gbrain_version,
|
||||
* config_mtime, probe_timeout_ms}.
|
||||
* - --no-cache bypass: /setup-gbrain and /sync-gbrain pass it after any
|
||||
* state-mutating operation so the next read sees fresh status.
|
||||
*
|
||||
* No-cli → gbrain not on PATH.
|
||||
* Missing → CLI present, config.json absent (honors GBRAIN_HOME).
|
||||
* Broken-config → config exists but `gbrain sources list` fails with config parse error
|
||||
* (or any non-recognized error — defensive default per codex #8).
|
||||
* Broken-db → config exists, DB unreachable per stderr classification.
|
||||
* Timeout → probe exceeded GSTACK_GBRAIN_PROBE_TIMEOUT_MS (default 15s) with no
|
||||
* recognized error — engine is likely healthy but slow (e.g. a cold
|
||||
* pooler connection, #1964). Consumers treat this as usable.
|
||||
* Ok → DB reachable, sources list returned valid JSON.
|
||||
*/
|
||||
|
||||
import { execFileSync } from "child_process";
|
||||
import {
|
||||
createHash,
|
||||
} from "crypto";
|
||||
import {
|
||||
existsSync,
|
||||
mkdirSync,
|
||||
readFileSync,
|
||||
renameSync,
|
||||
statSync,
|
||||
writeFileSync,
|
||||
} from "fs";
|
||||
import { homedir } from "os";
|
||||
import { dirname, join } from "path";
|
||||
import { buildGbrainEnv, NEEDS_SHELL_ON_WINDOWS } from "./gbrain-exec";
|
||||
|
||||
export type LocalEngineStatus =
|
||||
| "ok"
|
||||
| "no-cli"
|
||||
| "missing-config"
|
||||
| "broken-config"
|
||||
| "broken-db"
|
||||
| "timeout";
|
||||
|
||||
export interface ClassifyOptions {
|
||||
/** Bypass the 60s cache. Used after any state-mutating operation. */
|
||||
noCache?: boolean;
|
||||
/** Env override for the spawned `gbrain` (used by tests to point at a fake binary). */
|
||||
env?: NodeJS.ProcessEnv;
|
||||
}
|
||||
|
||||
interface CacheEntry {
|
||||
// Local-cache schema version, controlled by gstack. Not to be confused
|
||||
// with `gbrain doctor --json` output schema_version (gbrain v0.25+ emits
|
||||
// schema_version: 2). Doctor-output parsing lives in
|
||||
// lib/gstack-memory-helpers.ts:freshDetectEngineTier and accepts both
|
||||
// doctor-output versions. This cache stays strictly at version 1 — a
|
||||
// future shape change here requires an explicit migration.
|
||||
schema_version: 1;
|
||||
status: LocalEngineStatus;
|
||||
cached_at: number;
|
||||
/** Cache invariants — entry is invalidated if any of these change between writes. */
|
||||
key: {
|
||||
home: string;
|
||||
gbrain_home: string; // honors GBRAIN_HOME (#1964 / codex D11)
|
||||
path_hash: string;
|
||||
gbrain_bin_path: string;
|
||||
gbrain_version: string;
|
||||
config_mtime: number; // 0 when config absent
|
||||
config_size: number; // 0 when config absent
|
||||
probe_timeout_ms: number; // raising the timeout invalidates a cached "timeout"
|
||||
};
|
||||
}
|
||||
|
||||
export const CACHE_TTL_MS = 60_000;
|
||||
export const DEFAULT_PROBE_TIMEOUT_MS = 15_000;
|
||||
|
||||
/**
|
||||
* Effective probe timeout. `GSTACK_GBRAIN_PROBE_TIMEOUT_MS` overrides the
|
||||
* 15s default (tests set it low; users with slow poolers raise it).
|
||||
* Non-numeric or non-positive values fall back to the default.
|
||||
*/
|
||||
export function probeTimeoutMs(env?: NodeJS.ProcessEnv): number {
|
||||
const raw = (env ?? process.env).GSTACK_GBRAIN_PROBE_TIMEOUT_MS;
|
||||
if (!raw) return DEFAULT_PROBE_TIMEOUT_MS;
|
||||
const parsed = Number(raw);
|
||||
if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_PROBE_TIMEOUT_MS;
|
||||
// Floor of 1ms: Math.floor(0.5) would yield 0, and execFileSync treats
|
||||
// timeout: 0 as NO timeout — the probe that exists to bound hangs would
|
||||
// itself hang forever (adversarial review finding 2).
|
||||
return Math.max(1, Math.floor(parsed));
|
||||
}
|
||||
|
||||
/** Effective user home — respects HOME env override (used by tests). */
|
||||
function userHome(env?: NodeJS.ProcessEnv): string {
|
||||
return (env ?? process.env).HOME || homedir();
|
||||
}
|
||||
|
||||
/** Cache path computed fresh on each call so tests can mutate GSTACK_HOME per case. */
|
||||
export function cacheFilePath(): string {
|
||||
return join(
|
||||
process.env.GSTACK_HOME || join(userHome(), ".gstack"),
|
||||
".gbrain-local-status-cache.json",
|
||||
);
|
||||
}
|
||||
|
||||
/** Honors GBRAIN_HOME (codex D11) — same resolution as buildGbrainEnv. */
|
||||
function gbrainConfigPath(env?: NodeJS.ProcessEnv): string {
|
||||
const e = env ?? process.env;
|
||||
const gbrainHome = e.GBRAIN_HOME || join(userHome(e), ".gbrain");
|
||||
return join(gbrainHome, "config.json");
|
||||
}
|
||||
|
||||
function hashPath(p: string): string {
|
||||
return createHash("sha256").update(p).digest("hex").slice(0, 16);
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the absolute path of `gbrain` on PATH. Returns null when missing.
|
||||
* Memoized per-process keyed on PATH so detect's call and the classifier's
|
||||
* call share one fork-exec (~200ms saved per skill preamble).
|
||||
*/
|
||||
const _gbrainBinCache = new Map<string, string | null>();
|
||||
export function resolveGbrainBin(env?: NodeJS.ProcessEnv): string | null {
|
||||
const e = env ?? process.env;
|
||||
const key = e.PATH || "";
|
||||
if (_gbrainBinCache.has(key)) return _gbrainBinCache.get(key)!;
|
||||
let result: string | null = null;
|
||||
try {
|
||||
execFileSync("gbrain", ["--version"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 2_000,
|
||||
stdio: ["ignore", "ignore", "ignore"],
|
||||
env: e,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
result = "gbrain";
|
||||
} catch {
|
||||
result = null;
|
||||
}
|
||||
_gbrainBinCache.set(key, result);
|
||||
return result;
|
||||
}
|
||||
|
||||
/** Memoized per-process. */
|
||||
const _gbrainVersionCache = new Map<string, string>();
|
||||
export function readGbrainVersion(env?: NodeJS.ProcessEnv): string {
|
||||
const e = env ?? process.env;
|
||||
const key = `${e.PATH || ""}|${resolveGbrainBin(e) || ""}`;
|
||||
if (_gbrainVersionCache.has(key)) return _gbrainVersionCache.get(key)!;
|
||||
let result = "";
|
||||
try {
|
||||
const out = execFileSync("gbrain", ["--version"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 2_000,
|
||||
stdio: ["ignore", "pipe", "ignore"],
|
||||
env: e,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
result = out.trim().split("\n")[0] || "";
|
||||
} catch {
|
||||
result = "";
|
||||
}
|
||||
_gbrainVersionCache.set(key, result);
|
||||
return result;
|
||||
}
|
||||
|
||||
function configFingerprint(env?: NodeJS.ProcessEnv): { mtime: number; size: number } {
|
||||
try {
|
||||
const st = statSync(gbrainConfigPath(env));
|
||||
return { mtime: Math.floor(st.mtimeMs), size: st.size };
|
||||
} catch {
|
||||
return { mtime: 0, size: 0 };
|
||||
}
|
||||
}
|
||||
|
||||
function buildCacheKey(
|
||||
gbrainBin: string | null,
|
||||
gbrainVersion: string,
|
||||
env?: NodeJS.ProcessEnv,
|
||||
): CacheEntry["key"] {
|
||||
const e = env ?? process.env;
|
||||
const config = configFingerprint(e);
|
||||
return {
|
||||
home: e.HOME || "",
|
||||
gbrain_home: e.GBRAIN_HOME || "",
|
||||
path_hash: hashPath(e.PATH || ""),
|
||||
gbrain_bin_path: gbrainBin || "",
|
||||
gbrain_version: gbrainVersion,
|
||||
config_mtime: config.mtime,
|
||||
config_size: config.size,
|
||||
probe_timeout_ms: probeTimeoutMs(e),
|
||||
};
|
||||
}
|
||||
|
||||
function keysEqual(a: CacheEntry["key"], b: CacheEntry["key"]): boolean {
|
||||
return (
|
||||
a.home === b.home &&
|
||||
a.gbrain_home === b.gbrain_home &&
|
||||
a.path_hash === b.path_hash &&
|
||||
a.gbrain_bin_path === b.gbrain_bin_path &&
|
||||
a.gbrain_version === b.gbrain_version &&
|
||||
a.config_mtime === b.config_mtime &&
|
||||
a.config_size === b.config_size &&
|
||||
a.probe_timeout_ms === b.probe_timeout_ms
|
||||
);
|
||||
}
|
||||
|
||||
function readCache(key: CacheEntry["key"]): LocalEngineStatus | null {
|
||||
if (!existsSync(cacheFilePath())) return null;
|
||||
try {
|
||||
const raw = JSON.parse(readFileSync(cacheFilePath(), "utf-8")) as CacheEntry;
|
||||
if (raw.schema_version !== 1) return null;
|
||||
if (Date.now() - raw.cached_at > CACHE_TTL_MS) return null;
|
||||
if (!keysEqual(raw.key, key)) return null;
|
||||
return raw.status;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function writeCache(status: LocalEngineStatus, key: CacheEntry["key"]): void {
|
||||
const entry: CacheEntry = {
|
||||
schema_version: 1,
|
||||
status,
|
||||
cached_at: Date.now(),
|
||||
key,
|
||||
};
|
||||
try {
|
||||
mkdirSync(dirname(cacheFilePath()), { recursive: true });
|
||||
const tmp = cacheFilePath() + ".tmp." + process.pid;
|
||||
writeFileSync(tmp, JSON.stringify(entry, null, 2), "utf-8");
|
||||
renameSync(tmp, cacheFilePath());
|
||||
} catch {
|
||||
// Cache write failure is non-fatal — we re-probe next call.
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Probe via `gbrain sources list --json`. Classify the outcome.
|
||||
*
|
||||
* Pattern strings ("Cannot connect to database", "config.json") are deliberately
|
||||
* the same strings used in lib/gbrain-sources.ts:66-67. If gbrain reworks its
|
||||
* error messages, classifier returns broken-config defensively (codex #8).
|
||||
*/
|
||||
function freshClassify(env?: NodeJS.ProcessEnv): LocalEngineStatus {
|
||||
// 1. CLI on PATH?
|
||||
const gbrainBin = resolveGbrainBin(env);
|
||||
if (!gbrainBin) return "no-cli";
|
||||
|
||||
// 2. Config file present?
|
||||
if (!existsSync(gbrainConfigPath(env))) return "missing-config";
|
||||
|
||||
// 3. Probe gbrain sources list.
|
||||
//
|
||||
// Seed DATABASE_URL from ~/.gbrain/config.json (via buildGbrainEnv, the
|
||||
// same helper the sync orchestrator uses in lib/gbrain-exec.ts). Without
|
||||
// this, Bun autoloads a project's .env when the probe runs inside a repo
|
||||
// that defines its own DATABASE_URL (e.g. an app DB on a different port),
|
||||
// gbrain connects to the wrong DB, and the classifier falsely reports
|
||||
// broken-db. This also makes the result cwd-independent, so the 60s cache
|
||||
// can no longer propagate a poisoned negative to clean directories.
|
||||
try {
|
||||
execFileSync("gbrain", ["sources", "list", "--json"], {
|
||||
encoding: "utf-8",
|
||||
timeout: probeTimeoutMs(env),
|
||||
stdio: ["ignore", "pipe", "pipe"],
|
||||
env: buildGbrainEnv({ baseEnv: env ?? process.env }),
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
return "ok";
|
||||
} catch (err) {
|
||||
const e = err as NodeJS.ErrnoException & {
|
||||
stderr?: Buffer | string;
|
||||
killed?: boolean;
|
||||
signal?: NodeJS.Signals | null;
|
||||
};
|
||||
const stderr = (e.stderr ? e.stderr.toString() : "") || "";
|
||||
|
||||
// ENOENT can happen if gbrain disappeared between resolveGbrainBin and now.
|
||||
if (e.code === "ENOENT") return "no-cli";
|
||||
|
||||
// Pattern match against gbrain's known error strings. Order matters:
|
||||
// "Cannot connect to database" is the more specific DB-unreachable signal.
|
||||
if (stderr.includes("Cannot connect to database")) return "broken-db";
|
||||
if (stderr.includes("config.json")) return "broken-config";
|
||||
|
||||
// Probe killed by the timeout with no recognized error: the engine is
|
||||
// most likely healthy but slow (cold pooler connections measured at
|
||||
// 6.9-10.7s in #1964). Don't tell the user their config is malformed.
|
||||
if (e.killed === true || e.signal === "SIGTERM" || e.code === "ETIMEDOUT") {
|
||||
return "timeout";
|
||||
}
|
||||
|
||||
// Defensive default per codex #8: unrecognized failures classify as
|
||||
// broken-config so the user sees the raw stderr surfaced upstream.
|
||||
return "broken-config";
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Classify the local gbrain engine status. Cached for 60s; bypassable.
|
||||
*
|
||||
* Returns one of 5 states. Never throws — failure modes are surfaced as states.
|
||||
*/
|
||||
export function localEngineStatus(opts: ClassifyOptions = {}): LocalEngineStatus {
|
||||
const env = opts.env ?? process.env;
|
||||
const gbrainBin = resolveGbrainBin(env);
|
||||
const gbrainVersion = gbrainBin ? readGbrainVersion(env) : "";
|
||||
const key = buildCacheKey(gbrainBin, gbrainVersion, env);
|
||||
|
||||
if (!opts.noCache) {
|
||||
const cached = readCache(key);
|
||||
if (cached) return cached;
|
||||
}
|
||||
|
||||
const fresh = freshClassify(env);
|
||||
writeCache(fresh, key);
|
||||
return fresh;
|
||||
}
|
||||
@@ -0,0 +1,276 @@
|
||||
/**
|
||||
* gbrain-sources — TypeScript helper for idempotent gbrain federated source registration.
|
||||
*
|
||||
* Mirrors the bash logic in bin/gstack-gbrain-source-wireup:204-310 but in a form
|
||||
* importable by other TS callers (currently bin/gstack-gbrain-sync.ts; future
|
||||
* callers welcome). gbrain has no `sources update` — drift recovery is
|
||||
* `sources remove` followed by `sources add`.
|
||||
*
|
||||
* Per /plan-eng-review D3 (DRY extraction).
|
||||
*/
|
||||
|
||||
import { execFileSync, spawnSync } from "child_process";
|
||||
import { withErrorContext } from "./gstack-memory-helpers";
|
||||
import { execGbrainJson, NEEDS_SHELL_ON_WINDOWS } from "./gbrain-exec";
|
||||
|
||||
export interface SourceState {
|
||||
/** "absent" — id not registered. "match" — id at expected path. "drift" — id at different path. */
|
||||
status: "absent" | "match" | "drift";
|
||||
/** Path gbrain has registered for this id. Only set when status !== "absent". */
|
||||
registered_path?: string;
|
||||
}
|
||||
|
||||
export interface EnsureResult {
|
||||
/** True if registration state changed (added or re-registered). False on no-op. */
|
||||
changed: boolean;
|
||||
/** Final source state after the call. */
|
||||
state: SourceState;
|
||||
}
|
||||
|
||||
/**
|
||||
* One row of `gbrain sources list --json`. `config.remote_url` distinguishes
|
||||
* URL-managed sources (gbrain owns the clone, may auto-reclone) from
|
||||
* path-managed ones (user owns the working tree) — load-bearing for the #1734
|
||||
* destructive-op guards.
|
||||
*/
|
||||
export interface GbrainSourceRow {
|
||||
id?: string;
|
||||
local_path?: string;
|
||||
page_count?: number;
|
||||
config?: { remote_url?: string | null } | null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize `gbrain sources list --json` output to an array of source rows.
|
||||
*
|
||||
* gbrain has shipped two shapes: a wrapped `{ sources: [...] }` object (v0.20+)
|
||||
* and, in older/other variants, a bare top-level array. #1576 was a crash when a
|
||||
* reader assumed one shape; the parse is centralized here so every reader
|
||||
* (probeSource, sourcePageCount, sourceLocalPath, the #1734 remote_url audit)
|
||||
* agrees on the shape in ONE place. Returns [] for null/garbage rather than
|
||||
* throwing — callers treat "no rows" as absent.
|
||||
*/
|
||||
export function parseSourcesList(raw: unknown): GbrainSourceRow[] {
|
||||
if (Array.isArray(raw)) return raw as GbrainSourceRow[];
|
||||
if (raw && typeof raw === "object" && Array.isArray((raw as { sources?: unknown }).sources)) {
|
||||
return (raw as { sources: GbrainSourceRow[] }).sources;
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
export interface EnsureOptions {
|
||||
/** Pass --federated to `gbrain sources add`. Default false. */
|
||||
federated?: boolean;
|
||||
/** When status=drift, force a remove+add to update the registered path. Default true. */
|
||||
reregister_on_drift?: boolean;
|
||||
/**
|
||||
* Optional env override for the spawned `gbrain` calls. Production callers
|
||||
* leave this unset (inherit process.env). Tests pass a custom env to point
|
||||
* at a fake `gbrain` on PATH (Bun's execFileSync does not respect runtime
|
||||
* mutations of process.env.PATH unless env is passed explicitly).
|
||||
*/
|
||||
env?: NodeJS.ProcessEnv;
|
||||
}
|
||||
|
||||
/**
|
||||
* Probe the registration state of a source by id.
|
||||
*
|
||||
* Errors:
|
||||
* - "gbrain CLI not on PATH" (exit 127) — caller should treat as absent + skip stage.
|
||||
* - "gbrain DB connection failed" — caller should treat as absent + skip stage.
|
||||
* - JSON parse error — propagate via withErrorContext caller.
|
||||
*/
|
||||
export function probeSource(id: string, env?: NodeJS.ProcessEnv): SourceState {
|
||||
let stdout: string;
|
||||
try {
|
||||
stdout = execFileSync("gbrain", ["sources", "list", "--json"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 30_000,
|
||||
stdio: ["ignore", "pipe", "pipe"],
|
||||
env,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
} catch (err) {
|
||||
const e = err as NodeJS.ErrnoException & { stderr?: Buffer };
|
||||
const stderr = e.stderr?.toString() || "";
|
||||
if (e.code === "ENOENT" || stderr.includes("command not found")) {
|
||||
throw new Error("gbrain CLI not on PATH");
|
||||
}
|
||||
if (stderr.includes("Cannot connect to database") || stderr.includes("config.json")) {
|
||||
throw new Error("gbrain not configured (run /setup-gbrain)");
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
|
||||
let parsed: unknown;
|
||||
try {
|
||||
parsed = JSON.parse(stdout);
|
||||
} catch (err) {
|
||||
throw new Error(`gbrain sources list returned non-JSON output: ${(err as Error).message}`);
|
||||
}
|
||||
|
||||
const sources = parseSourcesList(parsed);
|
||||
const match = sources.find((s) => s.id === id);
|
||||
if (!match) return { status: "absent" };
|
||||
return {
|
||||
status: "match",
|
||||
registered_path: match.local_path,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure source <id> is registered at <path>. Idempotent.
|
||||
*
|
||||
* Behavior:
|
||||
* - status=absent → `gbrain sources add <id> --path <path> [--federated]`, returns changed=true.
|
||||
* - status=match + same path → no-op, returns changed=false.
|
||||
* - status=match + different path → `sources remove` + `sources add`, returns changed=true.
|
||||
* (Skip when reregister_on_drift=false; returns changed=false.)
|
||||
*
|
||||
* Caller is responsible for catching errors. The function uses withErrorContext for
|
||||
* forensic logging to ~/.gstack/.gbrain-errors.jsonl.
|
||||
*/
|
||||
export async function ensureSourceRegistered(
|
||||
id: string,
|
||||
path: string,
|
||||
options: EnsureOptions = {}
|
||||
): Promise<EnsureResult> {
|
||||
const federated = options.federated ?? false;
|
||||
const reregister_on_drift = options.reregister_on_drift ?? true;
|
||||
const env = options.env;
|
||||
|
||||
return withErrorContext(`ensureSourceRegistered:${id}`, () => {
|
||||
const probed = probeSource(id, env);
|
||||
|
||||
// Disambiguate match-but-different-path
|
||||
let state: SourceState = probed;
|
||||
if (probed.status === "match" && probed.registered_path !== path) {
|
||||
state = { status: "drift", registered_path: probed.registered_path };
|
||||
}
|
||||
|
||||
if (state.status === "match") {
|
||||
return { changed: false, state };
|
||||
}
|
||||
|
||||
if (state.status === "drift" && !reregister_on_drift) {
|
||||
return { changed: false, state };
|
||||
}
|
||||
|
||||
// For drift, remove first.
|
||||
if (state.status === "drift") {
|
||||
const rm = spawnSync("gbrain", ["sources", "remove", id, "--yes"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 30_000,
|
||||
env,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
if (rm.status !== 0) {
|
||||
throw new Error(`gbrain sources remove ${id} failed: ${rm.stderr || rm.stdout || `exit ${rm.status}`}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Add.
|
||||
const addArgs = ["sources", "add", id, "--path", path];
|
||||
if (federated) addArgs.push("--federated");
|
||||
const add = spawnSync("gbrain", addArgs, {
|
||||
encoding: "utf-8",
|
||||
timeout: 30_000,
|
||||
env,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
if (add.status !== 0) {
|
||||
throw new Error(`gbrain sources add ${id} failed: ${add.stderr || add.stdout || `exit ${add.status}`}`);
|
||||
}
|
||||
|
||||
return {
|
||||
changed: true,
|
||||
state: { status: "match", registered_path: path },
|
||||
};
|
||||
}, "gbrain-sources");
|
||||
}
|
||||
|
||||
/**
|
||||
* Get page_count for a registered source. Returns null if source is absent or if
|
||||
* page_count is missing/invalid in the JSON. Used by the verdict block + preamble
|
||||
* variant selection.
|
||||
*/
|
||||
export function sourcePageCount(id: string, env?: NodeJS.ProcessEnv): number | null {
|
||||
let stdout: string;
|
||||
try {
|
||||
stdout = execFileSync("gbrain", ["sources", "list", "--json"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 30_000,
|
||||
stdio: ["ignore", "pipe", "pipe"],
|
||||
env,
|
||||
shell: NEEDS_SHELL_ON_WINDOWS, // #1731: gbrain is a .cmd shim on Windows
|
||||
});
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
|
||||
try {
|
||||
const match = parseSourcesList(JSON.parse(stdout)).find((s) => s.id === id);
|
||||
if (!match) return null;
|
||||
if (typeof match.page_count !== "number") return null;
|
||||
return match.page_count;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a source's call graph has been built.
|
||||
*
|
||||
* "completed" — `gbrain dream` has run a full maintenance cycle, so the
|
||||
* brain-global `resolve_symbol_edges` phase populated this
|
||||
* source's call graph (`gbrain code-callers`/`code-callees`
|
||||
* return edges).
|
||||
* "never" — a cycle has provably NOT completed for this source.
|
||||
* "unknown" — doctor is unavailable, unparseable, or reports a failure
|
||||
* that doesn't name this source. Callers MUST treat unknown
|
||||
* conservatively (the orchestrator skips auto-dream and WARNs
|
||||
* rather than launch a ~35-min cycle on a flaky-doctor signal —
|
||||
* see the `gbrain-doctor-overstrict` learning).
|
||||
*/
|
||||
export type CycleStatus = "completed" | "never" | "unknown";
|
||||
|
||||
interface DoctorCheck {
|
||||
name?: string;
|
||||
status?: string;
|
||||
message?: string;
|
||||
}
|
||||
interface DoctorReport {
|
||||
checks?: DoctorCheck[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Read `gbrain doctor --json --fast` and decide whether <sourceId>'s call
|
||||
* graph is built, by inspecting the `cycle_freshness` check.
|
||||
*
|
||||
* Decision table (cycle_freshness.status / message):
|
||||
* - ok → "completed"
|
||||
* - fail|warn AND message names <sourceId> → "never"
|
||||
* - fail|warn AND message omits <sourceId> → "unknown" (a real failure
|
||||
* about OTHER sources must not be silently read as completed for us)
|
||||
* - check absent / doctor null / other status → "unknown"
|
||||
*
|
||||
* `sourceId` is matched as a LITERAL substring (not a regex) so an id with
|
||||
* regex metacharacters can never misfire. Routes through `execGbrainJson` so
|
||||
* DATABASE_URL is seeded from gbrain's config (consistent with every other
|
||||
* gstack-side gbrain call). `env` is the caller's base env (tests inject a
|
||||
* shim on PATH).
|
||||
*/
|
||||
export function cycleCompleted(sourceId: string, env?: NodeJS.ProcessEnv): CycleStatus {
|
||||
const report = execGbrainJson<DoctorReport>(["doctor", "--json", "--fast"], { baseEnv: env });
|
||||
if (!report || !Array.isArray(report.checks)) return "unknown";
|
||||
|
||||
const check = report.checks.find((c) => c.name === "cycle_freshness");
|
||||
if (!check) return "unknown";
|
||||
|
||||
if (check.status === "ok") return "completed";
|
||||
if (check.status === "fail" || check.status === "warn") {
|
||||
const msg = check.message || "";
|
||||
return msg.includes(sourceId) ? "never" : "unknown";
|
||||
}
|
||||
return "unknown";
|
||||
}
|
||||
@@ -0,0 +1,93 @@
|
||||
/**
|
||||
* gstack-decision-semantic — OPTIONAL gbrain enhancement for decision resurfacing.
|
||||
*
|
||||
* This is the ONLY decision module that touches gbrain. The reliable core
|
||||
* (lib/gstack-decision.ts) has zero gbrain imports and works with gbrain OFF; this
|
||||
* module is loaded lazily by `gstack-decision-search` only on `--semantic`, and every
|
||||
* path degrades to `null` (caller shows the reliable file results) when gbrain is
|
||||
* absent, unconfigured, times out, or returns nothing. It NEVER throws and NEVER
|
||||
* hangs (10s spawn timeout). We do not wire core function to this — gbrain is an
|
||||
* enhancement, never a dependency (the code-search lesson).
|
||||
*
|
||||
* Surface reality (verified against gbrain 0.42.x, not guessed):
|
||||
* - `gbrain search "<q>"` prints TEXT lines `[score] slug -- snippet`, NOT JSON
|
||||
* (so we parse the text surface; execGbrainJson would always null here).
|
||||
* - The curated-memory source is the one whose local_path is the gstack brain
|
||||
* worktree (`~/.gstack-brain-worktree`), id `default` by convention — NOT a
|
||||
* `gstack-brain-<user>` id. Scoping search to it keeps code/doc corpora out.
|
||||
*/
|
||||
|
||||
import { spawnGbrain } from "./gbrain-exec";
|
||||
import { parseSourcesList } from "./gbrain-sources";
|
||||
|
||||
const TIMEOUT_MS = 10_000;
|
||||
const BRAIN_WORKTREE_SUFFIX = ".gstack-brain-worktree";
|
||||
|
||||
export interface SemanticHit {
|
||||
score: number;
|
||||
slug: string;
|
||||
snippet: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the curated-memory source id (the gstack brain worktree). Returns null
|
||||
* when gbrain is down/unparseable OR no worktree-backed source is registered — the
|
||||
* caller then searches unscoped (best-effort) rather than failing.
|
||||
*/
|
||||
export function resolveMemorySourceId(env?: NodeJS.ProcessEnv): string | null {
|
||||
const r = spawnGbrain(["sources", "list", "--json"], { baseEnv: env, timeout: TIMEOUT_MS });
|
||||
if (r.status !== 0) return null;
|
||||
let rows;
|
||||
try {
|
||||
rows = parseSourcesList(JSON.parse(r.stdout || "null"));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
const atWorktree = rows.filter(
|
||||
(s) => typeof s.local_path === "string" && s.local_path.endsWith(BRAIN_WORKTREE_SUFFIX),
|
||||
);
|
||||
const pick = atWorktree.find((s) => s.id === "default") ?? atWorktree[0];
|
||||
return pick?.id ?? null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse gbrain search's text output into scored hits. Lines look like:
|
||||
* `[0.4361] slug -- snippet text...`
|
||||
* Non-matching lines (banners, blanks) are skipped. Exported for deterministic
|
||||
* unit testing of the parser without a live gbrain.
|
||||
*/
|
||||
export function parseSearchHits(stdout: string, minScore: number, limit: number): SemanticHit[] {
|
||||
const hits: SemanticHit[] = [];
|
||||
for (const line of stdout.split("\n")) {
|
||||
const m = line.match(/^\[([\d.]+)\]\s+(\S+)\s+--\s+(.*)$/);
|
||||
if (!m) continue;
|
||||
const score = parseFloat(m[1]);
|
||||
if (!Number.isFinite(score) || score < minScore) continue;
|
||||
hits.push({ score, slug: m[2], snippet: m[3].trim() });
|
||||
}
|
||||
return hits.slice(0, limit);
|
||||
}
|
||||
|
||||
/**
|
||||
* Semantic recall over the curated-memory source. Returns parsed hits, or `null`
|
||||
* when gbrain is unavailable / errors (caller MUST degrade to the reliable file
|
||||
* results on null). An empty array means gbrain ran but found nothing relevant
|
||||
* (e.g. memory not synced yet) — also honest, distinct from null. Never throws,
|
||||
* never hangs.
|
||||
*/
|
||||
export function semanticRecall(
|
||||
query: string,
|
||||
env?: NodeJS.ProcessEnv,
|
||||
minScore = 0.1,
|
||||
limit = 3,
|
||||
): SemanticHit[] | null {
|
||||
if (!query.trim()) return null;
|
||||
// Require the curated-memory source. If it's absent (gbrain down OR no worktree-backed
|
||||
// source), degrade to null rather than searching UNSCOPED — an unscoped search pulls
|
||||
// code/doc corpora that would be mislabeled as "related decisions" (Codex finding).
|
||||
const sourceId = resolveMemorySourceId(env);
|
||||
if (!sourceId) return null;
|
||||
const r = spawnGbrain(["search", query, "--source", sourceId], { baseEnv: env, timeout: TIMEOUT_MS });
|
||||
if (r.status !== 0) return null; // gbrain down / not on PATH / errored → degrade
|
||||
return parseSearchHits(r.stdout || "", minScore, limit);
|
||||
}
|
||||
@@ -0,0 +1,325 @@
|
||||
/**
|
||||
* gstack-decision — event-sourced institutional decision memory.
|
||||
*
|
||||
* decisions.jsonl is an APPEND-ONLY EVENT LOG (not mutable rows): `decide`,
|
||||
* `supersede`, and `redact` events. "Active" is COMPUTED — a `decide` whose id is
|
||||
* not later referenced by a `supersede`/`redact`. This is the eng-review event-
|
||||
* sourcing decision (a mutable `status` field would contradict append-only).
|
||||
*
|
||||
* Built on lib/jsonl-store.ts (shared injection-reject + atomic append + tolerant
|
||||
* read). Free-text fields are injection-checked AND redact-scanned on write
|
||||
* (HIGH-tier secret → reject), so a secret never silently persists and resurfaced
|
||||
* text can't carry instructions. gbrain is never required — this is the reliable
|
||||
* file-only core; semantic recall is a later, optional enhancement.
|
||||
*/
|
||||
|
||||
import { join } from "path";
|
||||
import { homedir } from "os";
|
||||
import { randomUUID } from "crypto";
|
||||
import { writeFileSync, renameSync, existsSync, readFileSync, appendFileSync, statSync, openSync, closeSync, unlinkSync } from "fs";
|
||||
import { appendJsonl, readJsonl, hasInjection } from "./jsonl-store";
|
||||
import { scan } from "./redact-engine";
|
||||
|
||||
export type DecisionKind = "decide" | "supersede" | "redact";
|
||||
export type DecisionScope = "repo" | "branch" | "issue";
|
||||
export type DecisionSource = "user" | "skill" | "agent";
|
||||
|
||||
export const DECISION_SCOPES: readonly DecisionScope[] = ["repo", "branch", "issue"];
|
||||
export const DECISION_SOURCES: readonly DecisionSource[] = ["user", "skill", "agent"];
|
||||
|
||||
export interface DecisionEvent {
|
||||
id: string;
|
||||
kind: DecisionKind;
|
||||
decision?: string;
|
||||
rationale?: string;
|
||||
alternatives_considered?: string;
|
||||
/** For supersede/redact: the id of the `decide` event being acted on. */
|
||||
supersedes?: string;
|
||||
scope: DecisionScope;
|
||||
branch?: string;
|
||||
issue?: string;
|
||||
date: string;
|
||||
session?: string;
|
||||
source: DecisionSource;
|
||||
confidence?: number;
|
||||
}
|
||||
|
||||
export interface ActiveDecision extends DecisionEvent {
|
||||
kind: "decide";
|
||||
}
|
||||
|
||||
export interface DecisionPaths {
|
||||
log: string;
|
||||
snapshot: string;
|
||||
archive: string;
|
||||
}
|
||||
|
||||
/** Resolve the per-project decision store paths. Bins pass slug + GSTACK_HOME. */
|
||||
export function decisionPaths(slug: string, gstackHome?: string): DecisionPaths {
|
||||
const home = gstackHome || process.env.GSTACK_HOME || join(homedir(), ".gstack");
|
||||
const dir = join(home, "projects", slug || "unknown");
|
||||
return {
|
||||
log: join(dir, "decisions.jsonl"),
|
||||
snapshot: join(dir, "decisions.active.json"),
|
||||
archive: join(dir, "decisions.archive.jsonl"),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Datamark resurfaced decision text so a stored string can't masquerade as
|
||||
* instructions or break out of the Context Recovery fence when it lands in agent
|
||||
* context (codex hardening #3: resurface = DATA, not instructions). Write-time
|
||||
* `hasInjection` is a denylist; this is the render-boundary defense-in-depth that
|
||||
* also covers `--all`/snapshot reads and records written before a pattern existed.
|
||||
* Neutralizes: control chars, newlines (defensive — events are single-line),
|
||||
* code fences, `---` banner sentinels, and `<|role|>` / `</system>` markers.
|
||||
*/
|
||||
export function datamark(text: string): string {
|
||||
const ZWSP = "\u200b"; // zero-width space: breaks token recognition, near-invisible
|
||||
return text
|
||||
// strip C0/C1 control chars + Unicode line terminators (U+0085/2028/2029 render as
|
||||
// newlines in many tokenizers/markdown; "strip newlines" must cover them)
|
||||
.replace(/[\u0000-\u001f\u007f\u0085\u2028\u2029]/g, " ")
|
||||
.replace(/`{3,}/g, "'''") // neutralize markdown code fences
|
||||
.replace(/-{3,}/g, "\u2014") // neutralize `---` banner sentinels (em dash)
|
||||
.replace(/<\|/g, `<${ZWSP}|`) // neutralize <|im_start|>-style chat markers
|
||||
.replace(/\|>/g, `|${ZWSP}>`)
|
||||
.replace(/<(\/?)(system|user|assistant|tool)>/gi, `<${ZWSP}$1$2>`) // neutralize role tags
|
||||
// neutralize chat turn-prefixes (Human:/Assistant:/System:/User:) — defeat the
|
||||
// angle-tag pass and are Claude's native turn delimiters
|
||||
.replace(/\b(human|assistant|system|user)(\s*):/gi, `$1${ZWSP}$2:`);
|
||||
}
|
||||
|
||||
export type ValidateResult =
|
||||
| { ok: true; event: DecisionEvent }
|
||||
| { ok: false; error: string };
|
||||
|
||||
/**
|
||||
* Validate + stamp a `decide` event. Rejects (no silent persist) on:
|
||||
* - missing/empty decision text or invalid scope/source,
|
||||
* - injection-like content in any free-text field (datamark-on-write),
|
||||
* - a HIGH-tier secret (redact engine) in any free-text field.
|
||||
*/
|
||||
export function validateDecide(input: Partial<DecisionEvent>): ValidateResult {
|
||||
if (!input.decision || typeof input.decision !== "string" || !input.decision.trim()) {
|
||||
return { ok: false, error: "decision text is required" };
|
||||
}
|
||||
const scope = input.scope ?? "repo";
|
||||
if (!DECISION_SCOPES.includes(scope)) {
|
||||
return { ok: false, error: `invalid scope "${scope}"; must be ${DECISION_SCOPES.join("|")}` };
|
||||
}
|
||||
const source = input.source ?? "agent";
|
||||
if (!DECISION_SOURCES.includes(source)) {
|
||||
return { ok: false, error: `invalid source "${source}"; must be ${DECISION_SOURCES.join("|")}` };
|
||||
}
|
||||
if (input.confidence !== undefined) {
|
||||
const c = Number(input.confidence);
|
||||
if (!Number.isInteger(c) || c < 1 || c > 10) {
|
||||
return { ok: false, error: "confidence must be integer 1-10" };
|
||||
}
|
||||
}
|
||||
|
||||
// Scan ALL stored free-text — incl. branch/issue, which are surfaced (and emitted raw
|
||||
// via --json), so they must not carry secrets or injection either (Codex finding).
|
||||
const freeText = [input.decision, input.rationale, input.alternatives_considered, input.branch, input.issue]
|
||||
.filter((s): s is string => typeof s === "string")
|
||||
.join("\n");
|
||||
|
||||
if (hasInjection(freeText)) {
|
||||
return { ok: false, error: "decision contains instruction-like content (injection), rejected" };
|
||||
}
|
||||
const redacted = scan(freeText);
|
||||
if (redacted.counts.HIGH > 0) {
|
||||
return {
|
||||
ok: false,
|
||||
error: `decision contains a HIGH-tier secret (${redacted.counts.HIGH} finding(s)); rotate + remove it, do not log secrets`,
|
||||
};
|
||||
}
|
||||
// MEDIUM = PII / credential-shaped content. The taxonomy says "confirm via
|
||||
// AskUserQuestion", but this store is NON-INTERACTIVE and syncs cross-machine,
|
||||
// so there is no confirm path — fail closed rather than silently persist + sync a
|
||||
// secret that later resurfaces into agent context.
|
||||
if (redacted.counts.MEDIUM > 0) {
|
||||
return {
|
||||
ok: false,
|
||||
error: `decision contains MEDIUM-tier sensitive content (${redacted.counts.MEDIUM} finding(s): PII or credential-shaped). This store is non-interactive and syncs across machines, so it fails closed — remove or rephrase the value before logging.`,
|
||||
};
|
||||
}
|
||||
|
||||
const event: DecisionEvent = {
|
||||
id: input.id || randomUUID(),
|
||||
kind: "decide",
|
||||
decision: input.decision.trim(),
|
||||
rationale: input.rationale,
|
||||
alternatives_considered: input.alternatives_considered,
|
||||
scope,
|
||||
branch: input.branch || undefined,
|
||||
issue: input.issue || undefined,
|
||||
date: input.date || new Date().toISOString(),
|
||||
session: input.session,
|
||||
source,
|
||||
confidence: input.confidence === undefined ? undefined : Number(input.confidence),
|
||||
};
|
||||
return { ok: true, event };
|
||||
}
|
||||
|
||||
/** Build a supersede/redact event referencing an existing decide-event id. */
|
||||
export function makeRefEvent(kind: "supersede" | "redact", targetId: string, opts: { session?: string; source?: DecisionSource } = {}): DecisionEvent {
|
||||
return {
|
||||
id: randomUUID(),
|
||||
kind,
|
||||
supersedes: targetId,
|
||||
scope: "repo",
|
||||
date: new Date().toISOString(),
|
||||
session: opts.session,
|
||||
source: opts.source ?? "agent",
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Compute the ACTIVE decisions: `decide` events whose id is NOT referenced by any
|
||||
* later `supersede`/`redact`. Dangling refs (supersede/redact pointing at an id
|
||||
* that has no `decide`) are tolerated — ignored, never thrown. Returned in date
|
||||
* order (oldest first).
|
||||
*/
|
||||
export function computeActive(events: DecisionEvent[]): ActiveDecision[] {
|
||||
const retired = new Set<string>();
|
||||
for (const e of events) {
|
||||
if ((e.kind === "supersede" || e.kind === "redact") && e.supersedes) {
|
||||
retired.add(e.supersedes); // dangling target id is harmless — just a no-op
|
||||
}
|
||||
}
|
||||
return events
|
||||
.filter((e): e is ActiveDecision => e.kind === "decide" && !retired.has(e.id))
|
||||
.sort((a, b) => (a.date < b.date ? -1 : a.date > b.date ? 1 : 0));
|
||||
}
|
||||
|
||||
/**
|
||||
* Scope filter for resurfacing: repo-scoped decisions always apply; branch-scoped
|
||||
* only when the branch matches the current context; issue-scoped only when the
|
||||
* issue matches. (Recency != relevance — callers filter by scope, not just date.)
|
||||
*/
|
||||
export function filterByScope(active: ActiveDecision[], ctx: { branch?: string; issue?: string }): ActiveDecision[] {
|
||||
return active.filter((d) => {
|
||||
if (d.scope === "repo") return true;
|
||||
if (d.scope === "branch") return !!ctx.branch && d.branch === ctx.branch;
|
||||
if (d.scope === "issue") return !!ctx.issue && d.issue === ctx.issue;
|
||||
return false; // unknown/garbage scope: fail conservative, don't leak into every context
|
||||
});
|
||||
}
|
||||
|
||||
/** Append a validated event atomically (single-line, concurrency-safe). */
|
||||
export function appendEvent(paths: DecisionPaths, event: DecisionEvent): void {
|
||||
appendJsonl(paths.log, event);
|
||||
}
|
||||
|
||||
/** Read all events tolerantly (skips malformed/partial-tail lines). */
|
||||
export function readEvents(paths: DecisionPaths): DecisionEvent[] {
|
||||
return readJsonl<DecisionEvent>(paths.log);
|
||||
}
|
||||
|
||||
/**
|
||||
* Write the bounded active snapshot (`decisions.active.json`) atomically. Context
|
||||
* Recovery and search read THIS, not the full history — session start stays
|
||||
* O(active), not O(history).
|
||||
*/
|
||||
export function writeSnapshot(paths: DecisionPaths, active: ActiveDecision[]): void {
|
||||
const tmp = `${paths.snapshot}.tmp.${process.pid}`;
|
||||
writeFileSync(tmp, JSON.stringify(active), "utf-8");
|
||||
renameSync(tmp, paths.snapshot);
|
||||
}
|
||||
|
||||
/** Read the bounded active snapshot. Returns [] if missing/corrupt (caller may rebuild). */
|
||||
export function readSnapshot(paths: DecisionPaths): ActiveDecision[] {
|
||||
if (!existsSync(paths.snapshot)) return [];
|
||||
try {
|
||||
const v = JSON.parse(readFileSync(paths.snapshot, "utf-8"));
|
||||
return Array.isArray(v) ? (v as ActiveDecision[]) : [];
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
}
|
||||
|
||||
/** Recompute active from the event log and refresh the snapshot. Returns active. */
|
||||
export function rebuildSnapshot(paths: DecisionPaths): ActiveDecision[] {
|
||||
const active = computeActive(readEvents(paths));
|
||||
writeSnapshot(paths, active);
|
||||
return active;
|
||||
}
|
||||
|
||||
export interface CompactResult {
|
||||
activeCount: number;
|
||||
/** superseded decisions moved to the archive (history kept). */
|
||||
archivedCount: number;
|
||||
/** redacted decisions DROPPED entirely (expunged, NOT archived). */
|
||||
expungedCount: number;
|
||||
/** true when compaction was skipped to avoid clobbering a concurrent writer/compactor. */
|
||||
skipped?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Compact the event log to the active set.
|
||||
* - active decisions → kept in `decisions.jsonl`,
|
||||
* - superseded decisions → appended to `decisions.archive.jsonl` (history),
|
||||
* - REDACTED decisions → expunged (dropped, NOT archived) — that's redact's job:
|
||||
* a `redact` is how an accidentally-captured secret leaves the store for good.
|
||||
*
|
||||
* Concurrency: appends are lock-free (O_APPEND), but compact is a read-modify-rewrite
|
||||
* that would clobber an append landing in its window. Two guards: (1) an O_EXCL lock
|
||||
* file serializes compactions (no double-archive / tmp tear); (2) the log size is
|
||||
* re-checked immediately before the destructive write — if an append landed since the
|
||||
* read, compact ABORTS untouched (returns skipped) so no decision is ever lost. The
|
||||
* caller re-runs. Atomic rewrite (tmp + rename); refreshes the snapshot.
|
||||
*/
|
||||
export function compact(paths: DecisionPaths): CompactResult {
|
||||
const lockPath = `${paths.log}.compact.lock`;
|
||||
let lockFd: number;
|
||||
try {
|
||||
lockFd = openSync(lockPath, "wx"); // O_EXCL|O_CREAT — throws EEXIST if a compact holds it
|
||||
} catch (err) {
|
||||
if ((err as NodeJS.ErrnoException).code === "EEXIST") {
|
||||
return { activeCount: computeActive(readEvents(paths)).length, archivedCount: 0, expungedCount: 0, skipped: true };
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
try {
|
||||
const sizeBefore = existsSync(paths.log) ? statSync(paths.log).size : 0;
|
||||
const events = readEvents(paths);
|
||||
const active = computeActive(events);
|
||||
const activeIds = new Set(active.map((d) => d.id));
|
||||
const redactedIds = new Set(
|
||||
events.filter((e) => e.kind === "redact" && e.supersedes).map((e) => e.supersedes as string),
|
||||
);
|
||||
// Superseded = a decide that's neither active nor redacted. Archive these for history.
|
||||
const superseded = events.filter(
|
||||
(e): e is DecisionEvent => e.kind === "decide" && !activeIds.has(e.id) && !redactedIds.has(e.id),
|
||||
);
|
||||
|
||||
// Append-race guard: if the log grew/changed since we read it, an append landed —
|
||||
// rewriting now would drop it. Abort untouched; the caller re-runs.
|
||||
const sizeNow = existsSync(paths.log) ? statSync(paths.log).size : 0;
|
||||
if (sizeNow !== sizeBefore) {
|
||||
return { activeCount: active.length, archivedCount: 0, expungedCount: 0, skipped: true };
|
||||
}
|
||||
|
||||
// One batched append (not one open/write/close per event) — matches the atomic
|
||||
// batched rewrite of the active log below and shrinks the mid-compact crash window.
|
||||
if (superseded.length) {
|
||||
appendFileSync(paths.archive, superseded.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf-8");
|
||||
}
|
||||
|
||||
const tmp = `${paths.log}.tmp.${process.pid}`;
|
||||
writeFileSync(tmp, active.map((d) => JSON.stringify(d)).join("\n") + (active.length ? "\n" : ""), "utf-8");
|
||||
renameSync(tmp, paths.log);
|
||||
writeSnapshot(paths, active);
|
||||
|
||||
return { activeCount: active.length, archivedCount: superseded.length, expungedCount: redactedIds.size };
|
||||
} finally {
|
||||
closeSync(lockFd);
|
||||
try {
|
||||
unlinkSync(lockPath);
|
||||
} catch {
|
||||
// best-effort lock cleanup; a leftover lock only blocks the NEXT compact, which re-runs
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,476 @@
|
||||
/**
|
||||
* gstack-memory-helpers — shared helpers for the V1 memory ingest + retrieval pipeline.
|
||||
*
|
||||
* Imported by:
|
||||
* - bin/gstack-memory-ingest.ts (Lane A)
|
||||
* - bin/gstack-gbrain-sync.ts (Lane B)
|
||||
* - bin/gstack-brain-context-load.ts (Lane C)
|
||||
* - scripts/gen-skill-docs.ts (manifest validation)
|
||||
*
|
||||
* Design refs in the plan:
|
||||
* §"Eng review additions" — DRY refactor (Section 1A)
|
||||
* §"V1 final scope clarification" — schema_version: 1 standardization (Section 2A)
|
||||
* ED1 — engine-tier cache lives in ~/.gstack/.gbrain-engine-cache.json (60s TTL)
|
||||
*
|
||||
* NOTE: secretScanFile() currently shells out to `gitleaks` from PATH; the vendored
|
||||
* binary install is part of Lane E (setup-gbrain). When gitleaks is missing, the
|
||||
* helper warns once and returns an empty findings list — fail-safe defaults.
|
||||
*/
|
||||
|
||||
import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, appendFileSync } from "fs";
|
||||
import { dirname, join } from "path";
|
||||
import { execFileSync } from "child_process";
|
||||
import { homedir } from "os";
|
||||
|
||||
// ── Types ──────────────────────────────────────────────────────────────────
|
||||
|
||||
export interface SecretFinding {
|
||||
rule_id: string;
|
||||
description: string;
|
||||
line: number;
|
||||
redacted_match: string;
|
||||
}
|
||||
|
||||
export interface SecretScanResult {
|
||||
scanned: boolean;
|
||||
findings: SecretFinding[];
|
||||
scanner: "gitleaks" | "missing" | "error";
|
||||
}
|
||||
|
||||
export type EngineTier = "pglite" | "supabase" | "unknown";
|
||||
|
||||
export interface EngineDetect {
|
||||
engine: EngineTier;
|
||||
supabase_url?: string;
|
||||
detected_at: number;
|
||||
schema_version: 1;
|
||||
}
|
||||
|
||||
export interface GbrainManifestQuery {
|
||||
id: string;
|
||||
kind: "vector" | "list" | "filesystem";
|
||||
render_as: string;
|
||||
// kind=vector
|
||||
query?: string;
|
||||
// kind=list
|
||||
filter?: Record<string, unknown>;
|
||||
sort?: string;
|
||||
// kind=filesystem
|
||||
glob?: string;
|
||||
tail?: number;
|
||||
// common
|
||||
limit?: number;
|
||||
}
|
||||
|
||||
export interface GbrainManifest {
|
||||
schema: number; // gbrain.schema in frontmatter; V1 = 1
|
||||
context_queries: GbrainManifestQuery[];
|
||||
}
|
||||
|
||||
export interface ErrorContextEntry {
|
||||
ts: string;
|
||||
op: string;
|
||||
duration_ms: number;
|
||||
outcome: "ok" | "error";
|
||||
error?: string;
|
||||
schema_version: 1;
|
||||
last_writer: string;
|
||||
}
|
||||
|
||||
// ── Public: canonicalizeRemote ────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Normalize a git remote URL to a canonical form: `host/org/repo` (no scheme,
|
||||
* no trailing `.git`). Used as the dedup key for cross-Mac transcript routing
|
||||
* (per ED1 — gbrain-side session_id dedup uses repo as a tag).
|
||||
*
|
||||
* Examples:
|
||||
* https://github.com/garrytan/gstack.git → github.com/garrytan/gstack
|
||||
* git@github.com:garrytan/gstack.git → github.com/garrytan/gstack
|
||||
* ssh://git@gitlab.com/foo/bar → gitlab.com/foo/bar
|
||||
* (empty / null) → ""
|
||||
*/
|
||||
export function canonicalizeRemote(url: string | null | undefined): string {
|
||||
if (!url) return "";
|
||||
let s = url.trim();
|
||||
if (!s) return "";
|
||||
// strip surrounding quotes that some configs add
|
||||
s = s.replace(/^['"]|['"]$/g, "");
|
||||
// git@host:path/repo → host/path/repo
|
||||
const scpMatch = s.match(/^[^@\s]+@([^:]+):(.+)$/);
|
||||
if (scpMatch) {
|
||||
s = `${scpMatch[1]}/${scpMatch[2]}`;
|
||||
} else {
|
||||
// strip scheme (https://, ssh://, git://, http://)
|
||||
s = s.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
|
||||
// strip user@ prefix on URL-style remotes
|
||||
s = s.replace(/^[^@\/]+@/, "");
|
||||
}
|
||||
// strip trailing .git
|
||||
s = s.replace(/\.git$/i, "");
|
||||
// strip trailing slash
|
||||
s = s.replace(/\/+$/, "");
|
||||
// collapse multiple slashes (after path normalization)
|
||||
s = s.replace(/\/{2,}/g, "/");
|
||||
return s.toLowerCase();
|
||||
}
|
||||
|
||||
// ── Public: secretScanFile (gitleaks wrapper) ─────────────────────────────
|
||||
|
||||
let _gitleaksAvailability: boolean | null = null;
|
||||
|
||||
function gitleaksAvailable(): boolean {
|
||||
if (_gitleaksAvailability !== null) return _gitleaksAvailability;
|
||||
try {
|
||||
execFileSync("gitleaks", ["version"], {
|
||||
env: process.env,
|
||||
stdio: "ignore",
|
||||
timeout: 2_000,
|
||||
});
|
||||
_gitleaksAvailability = true;
|
||||
} catch {
|
||||
_gitleaksAvailability = false;
|
||||
// Only warn once per process — Lane E will vendor the binary.
|
||||
process.stderr.write(
|
||||
"[gstack-memory-helpers] gitleaks not in PATH; secret scanning disabled. " +
|
||||
"Run /setup-gbrain to install (or `brew install gitleaks`).\n"
|
||||
);
|
||||
}
|
||||
return _gitleaksAvailability;
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan a file for embedded secrets using gitleaks. Returns findings list
|
||||
* (empty if clean). When gitleaks is not in PATH, returns scanned=false with
|
||||
* scanner="missing" — caller decides whether to skip the file or proceed.
|
||||
*
|
||||
* Per D19: gitleaks runs at ingest time before any put_page / put_file write.
|
||||
* Replaces the inadequate regex scanner in bin/gstack-brain-sync (which only
|
||||
* applies to staged git diffs).
|
||||
*/
|
||||
export function secretScanFile(path: string): SecretScanResult {
|
||||
if (!existsSync(path)) {
|
||||
return { scanned: false, findings: [], scanner: "error" };
|
||||
}
|
||||
if (!gitleaksAvailable()) {
|
||||
return { scanned: false, findings: [], scanner: "missing" };
|
||||
}
|
||||
try {
|
||||
// gitleaks detect --no-git --source <path> --report-format json --report-path -
|
||||
// Returns 0 on clean, 1 on findings, 126/127 on bad invocation.
|
||||
const out = execFileSync(
|
||||
"gitleaks",
|
||||
["detect", "--no-git", "--source", path, "--report-format", "json", "--report-path", "/dev/stdout", "--exit-code", "0"],
|
||||
{ encoding: "utf-8", env: process.env, maxBuffer: 16 * 1024 * 1024 }
|
||||
);
|
||||
const trimmed = out.trim();
|
||||
if (!trimmed) return { scanned: true, findings: [], scanner: "gitleaks" };
|
||||
const parsed = JSON.parse(trimmed) as Array<{
|
||||
RuleID: string;
|
||||
Description: string;
|
||||
StartLine: number;
|
||||
Match?: string;
|
||||
Secret?: string;
|
||||
}>;
|
||||
const findings: SecretFinding[] = (parsed || []).map((f) => ({
|
||||
rule_id: f.RuleID || "unknown",
|
||||
description: f.Description || "",
|
||||
line: f.StartLine || 0,
|
||||
redacted_match: redactMatch(f.Secret || f.Match || ""),
|
||||
}));
|
||||
return { scanned: true, findings, scanner: "gitleaks" };
|
||||
} catch (err) {
|
||||
return {
|
||||
scanned: false,
|
||||
findings: [],
|
||||
scanner: "error",
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
function redactMatch(s: string): string {
|
||||
if (!s) return "";
|
||||
if (s.length <= 8) return "[REDACTED]";
|
||||
return `${s.slice(0, 4)}...${s.slice(-4)}`;
|
||||
}
|
||||
|
||||
// ── Public: detectEngineTier (cached) ─────────────────────────────────────
|
||||
|
||||
const ENGINE_CACHE_TTL_MS = 60 * 1000;
|
||||
|
||||
function gstackHome(): string {
|
||||
return process.env.GSTACK_HOME || join(homedir(), ".gstack");
|
||||
}
|
||||
|
||||
function engineCachePath(): string {
|
||||
return join(gstackHome(), ".gbrain-engine-cache.json");
|
||||
}
|
||||
|
||||
function errorLogPath(): string {
|
||||
return join(gstackHome(), ".gbrain-errors.jsonl");
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect which gbrain engine is active (PGLite vs Supabase) and cache the
|
||||
* answer for 60s in ~/.gstack/.gbrain-engine-cache.json. Caching avoids
|
||||
* fork+exec'ing `gbrain doctor --json` on every skill start.
|
||||
*
|
||||
* Per ED1 (state files local-only): this cache is gitignored from the brain
|
||||
* repo. Per Section 2A: schema_version: 1 + last_writer field for forensic
|
||||
* tracing.
|
||||
*/
|
||||
export function detectEngineTier(): EngineDetect {
|
||||
// Try cache first
|
||||
if (existsSync(engineCachePath())) {
|
||||
try {
|
||||
const stat = statSync(engineCachePath());
|
||||
const ageMs = Date.now() - stat.mtimeMs;
|
||||
if (ageMs < ENGINE_CACHE_TTL_MS) {
|
||||
const cached = JSON.parse(readFileSync(engineCachePath(), "utf-8")) as EngineDetect;
|
||||
if (cached.schema_version === 1) return cached;
|
||||
}
|
||||
} catch {
|
||||
// Cache corrupt; fall through to fresh detect.
|
||||
}
|
||||
}
|
||||
|
||||
const fresh = freshDetectEngineTier();
|
||||
try {
|
||||
mkdirSync(dirname(engineCachePath()), { recursive: true });
|
||||
writeFileSync(
|
||||
engineCachePath(),
|
||||
JSON.stringify({ ...fresh, last_writer: "gstack-memory-helpers.detectEngineTier" }, null, 2),
|
||||
"utf-8"
|
||||
);
|
||||
} catch {
|
||||
// Cache write failure is non-fatal.
|
||||
}
|
||||
return fresh;
|
||||
}
|
||||
|
||||
// Returns gbrain's config.json path, honoring GBRAIN_HOME env var with a
|
||||
// fallback to ~/.gbrain. gbrain >=0.25 dropped the top-level `engine` field
|
||||
// from doctor output, so this file is the only reliable source for engine
|
||||
// detection on that version. See #1415.
|
||||
function gbrainConfigPath(): string {
|
||||
const root = process.env.GBRAIN_HOME || join(homedir(), ".gbrain");
|
||||
return join(root, "config.json");
|
||||
}
|
||||
|
||||
// Best-effort JSONL append to ~/.gstack/.gbrain-errors.jsonl. Never throws.
|
||||
function logGbrainError(kind: string, detail: string): void {
|
||||
try {
|
||||
const path = errorLogPath();
|
||||
mkdirSync(dirname(path), { recursive: true });
|
||||
appendFileSync(
|
||||
path,
|
||||
JSON.stringify({ ts: new Date().toISOString(), kind, detail: detail.slice(0, 500) }) + "\n",
|
||||
"utf-8"
|
||||
);
|
||||
} catch { /* logging is best-effort */ }
|
||||
}
|
||||
|
||||
function freshDetectEngineTier(): EngineDetect {
|
||||
const now = Date.now();
|
||||
let parsed: Record<string, unknown> | null = null;
|
||||
|
||||
// execFileSync (not execSync) avoids shell redirection — portable to
|
||||
// environments where `2>/dev/null` is bash-specific. The stdio array
|
||||
// suppresses stderr without invoking a shell.
|
||||
try {
|
||||
const out = execFileSync("gbrain", ["doctor", "--json", "--fast"], {
|
||||
encoding: "utf-8",
|
||||
timeout: 5000,
|
||||
stdio: ["ignore", "pipe", "ignore"],
|
||||
});
|
||||
parsed = JSON.parse(out);
|
||||
} catch (err: unknown) {
|
||||
// execFileSync throws on non-zero exit; stdout is still on the error
|
||||
// object. gbrain doctor exits 1 whenever health_score < 100, which is
|
||||
// essentially always on fresh installs (resolver_health warnings are
|
||||
// normal). Recover stdout and re-parse. See #1415.
|
||||
try {
|
||||
const stdout = (err as { stdout?: Buffer | string })?.stdout ?? "";
|
||||
const stdoutStr = typeof stdout === "string" ? stdout : stdout.toString("utf-8");
|
||||
if (stdoutStr) parsed = JSON.parse(stdoutStr);
|
||||
} catch (parseErr) {
|
||||
logGbrainError("doctor_parse_failure", String(parseErr));
|
||||
}
|
||||
}
|
||||
|
||||
let engine: EngineTier =
|
||||
parsed?.engine === "supabase" ? "supabase" :
|
||||
parsed?.engine === "pglite" ? "pglite" : "unknown";
|
||||
|
||||
// gbrain >=0.25 ships schema_version:2 doctor output which dropped the
|
||||
// top-level `engine` field. Fall back to gbrain's config.json (respects
|
||||
// GBRAIN_HOME). "supabase" here means "remote postgres" — gbrain config
|
||||
// uses engine:"postgres" for real Supabase AND any other remote postgres
|
||||
// (e.g. local-postgres-for-testing). Downstream sync code treats them the
|
||||
// same, so the label compression is intentional.
|
||||
if (engine === "unknown") {
|
||||
try {
|
||||
const cfg = JSON.parse(readFileSync(gbrainConfigPath(), "utf-8"));
|
||||
if (cfg?.engine === "pglite") engine = "pglite";
|
||||
else if (cfg?.engine === "postgres" || cfg?.database_url) engine = "supabase";
|
||||
} catch (cfgErr) {
|
||||
logGbrainError("config_read_failure", String(cfgErr));
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
engine,
|
||||
supabase_url: parsed?.supabase_url as string | undefined,
|
||||
detected_at: now,
|
||||
schema_version: 1,
|
||||
};
|
||||
}
|
||||
|
||||
// ── Public: parseSkillManifest ────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Parse the `gbrain:` section out of a SKILL.md.tmpl frontmatter block.
|
||||
* Returns null if no manifest is declared OR if the file has no frontmatter.
|
||||
*
|
||||
* Schema validation (full kind/required-fields check) lives in
|
||||
* scripts/gen-skill-docs.ts and runs at generation time. This parser is the
|
||||
* runtime read path used by gstack-brain-context-load; it tolerates extra
|
||||
* fields and relies on validation having already happened upstream.
|
||||
*/
|
||||
export function parseSkillManifest(skillFilePath: string): GbrainManifest | null {
|
||||
if (!existsSync(skillFilePath)) return null;
|
||||
const content = readFileSync(skillFilePath, "utf-8");
|
||||
const frontmatter = extractFrontmatter(content);
|
||||
if (!frontmatter) return null;
|
||||
const gbrain = extractGbrainBlock(frontmatter);
|
||||
if (!gbrain) return null;
|
||||
return gbrain;
|
||||
}
|
||||
|
||||
function extractFrontmatter(content: string): string | null {
|
||||
// Supports both `---\n...\n---` (YAML) and `+++\n...\n+++` (TOML, rare).
|
||||
const yamlMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
|
||||
if (yamlMatch) return yamlMatch[1];
|
||||
return null;
|
||||
}
|
||||
|
||||
function extractGbrainBlock(frontmatter: string): GbrainManifest | null {
|
||||
// Naive YAML extraction — finds the `gbrain:` key and parses its sub-tree.
|
||||
// Real YAML parsing avoided to keep zero-deps; gen-skill-docs validates the
|
||||
// shape strictly at build time.
|
||||
const lines = frontmatter.split("\n");
|
||||
const start = lines.findIndex((l) => /^gbrain\s*:/.test(l));
|
||||
if (start === -1) return null;
|
||||
|
||||
// Collect indented lines under `gbrain:` until next top-level key or EOF
|
||||
const block: string[] = [];
|
||||
for (let i = start + 1; i < lines.length; i++) {
|
||||
const line = lines[i];
|
||||
if (/^[A-Za-z_][A-Za-z0-9_-]*\s*:/.test(line)) break; // next top-level key
|
||||
block.push(line);
|
||||
}
|
||||
|
||||
const text = block.join("\n");
|
||||
// Extract schema number
|
||||
const schemaMatch = text.match(/\n\s*schema\s*:\s*(\d+)/);
|
||||
const schema = schemaMatch ? parseInt(schemaMatch[1], 10) : 1;
|
||||
|
||||
// Extract context_queries items
|
||||
const queries: GbrainManifestQuery[] = [];
|
||||
const cqMatch = text.match(/\n\s*context_queries\s*:\s*\n([\s\S]+)/);
|
||||
if (cqMatch) {
|
||||
const cqText = cqMatch[1];
|
||||
// Split using a positive lookahead so each chunk begins with the list-item dash.
|
||||
// Pattern: line starting with 4-6 spaces + "-" + whitespace.
|
||||
const rawItems = cqText.split(/(?=^[ ]{4,6}-\s)/m);
|
||||
const items = rawItems.filter((s) => /^[ ]{4,6}-\s/.test(s));
|
||||
for (const item of items) {
|
||||
const q: Partial<GbrainManifestQuery> = {};
|
||||
// Strip the leading list-item marker so id/kind/etc. regexes can use line-start.
|
||||
const body = item.replace(/^[ ]{4,6}-\s+/, " ");
|
||||
const idM = body.match(/(?:^|\n)\s*id\s*:\s*([^\n]+)/);
|
||||
const kindM = body.match(/(?:^|\n)\s*kind\s*:\s*([^\n]+)/);
|
||||
const renderM = body.match(/(?:^|\n)\s*render_as\s*:\s*"?([^"\n]+?)"?\s*$/m);
|
||||
const queryM = body.match(/(?:^|\n)\s*query\s*:\s*"?([^"\n]+?)"?\s*$/m);
|
||||
const limitM = body.match(/(?:^|\n)\s*limit\s*:\s*(\d+)/);
|
||||
const globM = body.match(/(?:^|\n)\s*glob\s*:\s*"?([^"\n]+?)"?\s*$/m);
|
||||
const sortM = body.match(/(?:^|\n)\s*sort\s*:\s*([^\n]+)/);
|
||||
const tailM = body.match(/(?:^|\n)\s*tail\s*:\s*(\d+)/);
|
||||
|
||||
if (idM) q.id = idM[1].trim();
|
||||
if (kindM) {
|
||||
const k = kindM[1].trim();
|
||||
if (k === "vector" || k === "list" || k === "filesystem") q.kind = k;
|
||||
}
|
||||
if (renderM) q.render_as = renderM[1].trim();
|
||||
if (queryM) q.query = queryM[1].trim();
|
||||
if (limitM) q.limit = parseInt(limitM[1], 10);
|
||||
if (globM) q.glob = globM[1].trim();
|
||||
if (sortM) q.sort = sortM[1].trim();
|
||||
if (tailM) q.tail = parseInt(tailM[1], 10);
|
||||
|
||||
if (q.id && q.kind && q.render_as) {
|
||||
queries.push(q as GbrainManifestQuery);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return { schema, context_queries: queries };
|
||||
}
|
||||
|
||||
// ── Public: withErrorContext ──────────────────────────────────────────────
|
||||
|
||||
const ERROR_LOG_PATH = join(gstackHome(), ".gbrain-errors.jsonl");
|
||||
|
||||
/**
|
||||
* Wrap an op with structured error logging. Logs success/failure + duration
|
||||
* to ~/.gstack/.gbrain-errors.jsonl for forensic debugging. Replaces ad-hoc
|
||||
* try/catch sites across the three Bun helpers (Section 2B).
|
||||
*
|
||||
* On error: the error is RE-THROWN after logging — caller still owns flow.
|
||||
*/
|
||||
export async function withErrorContext<T>(
|
||||
op: string,
|
||||
fn: () => T | Promise<T>,
|
||||
caller: string = "unknown"
|
||||
): Promise<T> {
|
||||
const t0 = Date.now();
|
||||
try {
|
||||
const result = await fn();
|
||||
logErrorContext({
|
||||
ts: new Date().toISOString(),
|
||||
op,
|
||||
duration_ms: Date.now() - t0,
|
||||
outcome: "ok",
|
||||
schema_version: 1,
|
||||
last_writer: caller,
|
||||
});
|
||||
return result;
|
||||
} catch (err) {
|
||||
logErrorContext({
|
||||
ts: new Date().toISOString(),
|
||||
op,
|
||||
duration_ms: Date.now() - t0,
|
||||
outcome: "error",
|
||||
error: err instanceof Error ? err.message : String(err),
|
||||
schema_version: 1,
|
||||
last_writer: caller,
|
||||
});
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
function logErrorContext(entry: ErrorContextEntry): void {
|
||||
try {
|
||||
const path = errorLogPath();
|
||||
mkdirSync(dirname(path), { recursive: true });
|
||||
appendFileSync(path, JSON.stringify(entry) + "\n", "utf-8");
|
||||
} catch {
|
||||
// Logging failure is non-fatal — never block the op.
|
||||
}
|
||||
}
|
||||
|
||||
// Test-only export for resetting the gitleaks availability cache between tests.
|
||||
export function _resetGitleaksAvailabilityCache(): void {
|
||||
_gitleaksAvailability = null;
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
/**
|
||||
* Conductor host detection — single source of truth for TS consumers.
|
||||
*
|
||||
* Conductor (the Mac app that runs many coding agents in parallel) sets
|
||||
* CONDUCTOR_WORKSPACE_PATH / CONDUCTOR_PORT in the session env. The same two
|
||||
* vars are what `bin/gstack-session-kind` keys on (it collapses Conductor into
|
||||
* `interactive`, so it can't be reused to distinguish Conductor specifically —
|
||||
* hence this dedicated helper).
|
||||
*
|
||||
* IMPORTANT: detection is a CALL-TIME read of the passed-in env (default
|
||||
* `process.env`), never a module-load-time snapshot. ESM hoists static imports
|
||||
* above any in-file `process.env.X = ...`, so a load-time read can't be pinned
|
||||
* by a test without Bun --preload. Reading at call time lets unit tests set
|
||||
* `process.env.CONDUCTOR_WORKSPACE_PATH` inline before invoking. See the
|
||||
* `esm-hoist-breaks-env-pin-bootstrap` learning.
|
||||
*/
|
||||
export function isConductor(env: NodeJS.ProcessEnv = process.env): boolean {
|
||||
return !!(env.CONDUCTOR_WORKSPACE_PATH || env.CONDUCTOR_PORT);
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
/**
|
||||
* jsonl-store — shared, audited plumbing for gstack's append-only JSONL stores.
|
||||
*
|
||||
* Single source of truth for the three things every JSONL store must get right:
|
||||
* 1. Injection sanitization (the prompt-injection patterns that must NOT survive
|
||||
* into agent context when a record is later resurfaced).
|
||||
* 2. Atomic single-line append (concurrent agents must not corrupt the file).
|
||||
* 3. Tolerant read (a partially-written tail or one corrupt line must not take
|
||||
* down the whole read).
|
||||
*
|
||||
* Extracted from `bin/gstack-learnings-log` (D2A) so `gstack-learnings-*` and the
|
||||
* new `gstack-decision-*` bins share ONE audited path — a new injection pattern or
|
||||
* a write-atomicity fix lands in both at once, never drifts. Per the
|
||||
* `squash-with-regen` / DRY discipline + the eng-review D2A decision.
|
||||
*/
|
||||
|
||||
import { appendFileSync, readFileSync, existsSync } from "fs";
|
||||
|
||||
/**
|
||||
* Prompt-injection patterns. If any matches a free-text field (insight, rationale,
|
||||
* decision), the record is REJECTED at write time — these strings could otherwise
|
||||
* be replayed into a future agent's context as instructions when the record is
|
||||
* resurfaced. Keep this list the ONLY copy (callers import it; do not re-declare).
|
||||
*/
|
||||
export const INJECTION_PATTERNS: readonly RegExp[] = [
|
||||
/ignore\s+(all\s+)?previous\s+(instructions|context|rules)/i,
|
||||
/you\s+are\s+now\s+/i,
|
||||
/always\s+output\s+no\s+findings/i,
|
||||
/skip\s+(all\s+)?(security|review|checks)/i,
|
||||
/override[:\s]/i,
|
||||
/\bsystem\s*:/i,
|
||||
/\bassistant\s*:/i,
|
||||
/\buser\s*:/i,
|
||||
/\bhuman\s*:/i, // Claude's native turn prefix — bypassed the denylist AND datamark
|
||||
/disregard\s+(all\s+)?(previous|above|prior)/i,
|
||||
/from\s+now\s+on\b/i,
|
||||
/do\s+not\s+(report|flag|mention)/i,
|
||||
/approve\s+(all|every|this)/i,
|
||||
];
|
||||
|
||||
/** True if `text` contains an instruction-like injection pattern. */
|
||||
export function hasInjection(text: string): boolean {
|
||||
return INJECTION_PATTERNS.some((p) => p.test(text));
|
||||
}
|
||||
|
||||
/** Returns the first injection pattern that matches, or null. For actionable errors. */
|
||||
export function firstInjectionMatch(text: string): RegExp | null {
|
||||
return INJECTION_PATTERNS.find((p) => p.test(text)) ?? null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Atomic single-line append of `obj` as one JSON line.
|
||||
*
|
||||
* Concurrency: opens with `a` (O_APPEND); a single write under PIPE_BUF (>=512,
|
||||
* 4096+ on macOS/Linux) is atomic across processes, so concurrent agents appending
|
||||
* never interleave. Records MUST serialize to a single line (no embedded newline) —
|
||||
* we throw rather than risk a multi-line record breaking the one-record-per-line
|
||||
* invariant the tolerant reader relies on.
|
||||
*
|
||||
* Caveat: a record larger than PIPE_BUF loses the cross-process atomicity guarantee.
|
||||
* Keep records line-bounded; very large free-text should be truncated by the caller.
|
||||
*/
|
||||
export function appendJsonl(path: string, obj: unknown): void {
|
||||
const line = JSON.stringify(obj);
|
||||
if (line.includes("\n")) {
|
||||
throw new Error("jsonl-store: record serialized to multiple lines (embedded newline)");
|
||||
}
|
||||
appendFileSync(path, line + "\n", { encoding: "utf-8" });
|
||||
}
|
||||
|
||||
/**
|
||||
* Tolerant reader: parse each line, SKIP malformed ones (partial-write tail, a
|
||||
* corrupt line, a non-JSON line) rather than throwing. A broken line never takes
|
||||
* down the whole read. Missing file → empty array. Unknown fields are preserved
|
||||
* (forward-compatible: a schema bump on the writer doesn't break older readers).
|
||||
*/
|
||||
export function readJsonl<T = unknown>(path: string): T[] {
|
||||
if (!existsSync(path)) return [];
|
||||
let raw: string;
|
||||
try {
|
||||
raw = readFileSync(path, "utf-8");
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
const out: T[] = [];
|
||||
for (const line of raw.split("\n")) {
|
||||
const trimmed = line.trim();
|
||||
if (!trimmed) continue;
|
||||
try {
|
||||
out.push(JSON.parse(trimmed) as T);
|
||||
} catch {
|
||||
// Malformed line (partial tail / corruption) — skip, keep reading.
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
/**
|
||||
* redact-audit-log — append-only forensic trail for the Phase 4.5a semantic
|
||||
* review (D5). Records WHETHER the semantic pass marked a body clean/flagged and
|
||||
* WHICH categories fired — never the body content. A body_sha256 lets a later
|
||||
* investigation confirm "the pass saw this exact draft and called it clean."
|
||||
*
|
||||
* The file (`~/.gstack/security/semantic-reviews.jsonl`) is sensitive metadata,
|
||||
* not "safe": it leaks repo names, timing, and a membership oracle via the hash.
|
||||
* Written 0600. Local-only — no third-party egress.
|
||||
*
|
||||
* Usable two ways:
|
||||
* - CLI: bun lib/redact-audit-log.ts '<json-line-without-ts/hash>' [body-file]
|
||||
* (the skill passes the outcome JSON + a path to the scanned body; we
|
||||
* stamp ts + body_sha256 and append.)
|
||||
* - import { appendSemanticReview } from "./redact-audit-log";
|
||||
*/
|
||||
import * as fs from "fs";
|
||||
import * as os from "os";
|
||||
import * as path from "path";
|
||||
import { createHash } from "crypto";
|
||||
|
||||
export interface SemanticReviewEntry {
|
||||
ts: string;
|
||||
spec_archive_path?: string;
|
||||
repo_visibility: string;
|
||||
outcome: "clean" | "flagged";
|
||||
categories_flagged: string[];
|
||||
body_sha256: string;
|
||||
}
|
||||
|
||||
function securityDir(): string {
|
||||
const home = process.env.GSTACK_HOME || path.join(os.homedir(), ".gstack");
|
||||
return path.join(home, "security");
|
||||
}
|
||||
|
||||
export function sha256(s: string): string {
|
||||
return createHash("sha256").update(s, "utf8").digest("hex");
|
||||
}
|
||||
|
||||
/** Append one entry. Best-effort: never throws into the caller's flow. */
|
||||
export function appendSemanticReview(entry: SemanticReviewEntry): void {
|
||||
try {
|
||||
const dir = securityDir();
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
const file = path.join(dir, "semantic-reviews.jsonl");
|
||||
fs.appendFileSync(file, JSON.stringify(entry) + "\n");
|
||||
try {
|
||||
fs.chmodSync(file, 0o600);
|
||||
} catch {
|
||||
// chmod can fail on some filesystems; the append still happened.
|
||||
}
|
||||
} catch {
|
||||
// audit log is best-effort, not the security boundary
|
||||
}
|
||||
}
|
||||
|
||||
// ── CLI ───────────────────────────────────────────────────────────────────────
|
||||
|
||||
function now(): string {
|
||||
// Date is allowed here (CLI process, not a resumable workflow).
|
||||
return new Date().toISOString();
|
||||
}
|
||||
|
||||
if (import.meta.main) {
|
||||
const json = process.argv[2];
|
||||
const bodyFile = process.argv[3];
|
||||
if (!json) {
|
||||
process.stderr.write(
|
||||
'usage: redact-audit-log \'{"repo_visibility":"public","outcome":"flagged","categories_flagged":["legal"],"spec_archive_path":"..."}\' [body-file]\n',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
let partial: Partial<SemanticReviewEntry>;
|
||||
try {
|
||||
partial = JSON.parse(json);
|
||||
} catch {
|
||||
process.stderr.write("redact-audit-log: invalid JSON\n");
|
||||
process.exit(1);
|
||||
}
|
||||
const body = bodyFile && fs.existsSync(bodyFile) ? fs.readFileSync(bodyFile, "utf8") : "";
|
||||
appendSemanticReview({
|
||||
ts: now(),
|
||||
repo_visibility: partial.repo_visibility ?? "unknown",
|
||||
outcome: partial.outcome === "flagged" ? "flagged" : "clean",
|
||||
categories_flagged: partial.categories_flagged ?? [],
|
||||
body_sha256: sha256(body),
|
||||
...(partial.spec_archive_path ? { spec_archive_path: partial.spec_archive_path } : {}),
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,540 @@
|
||||
/**
|
||||
* redact-engine — pure scanning + auto-redaction over the shared taxonomy.
|
||||
*
|
||||
* No I/O. Deterministic. The CLI shim (`bin/gstack-redact`), the pre-push hook
|
||||
* (`bin/gstack-redact-prepush`), and tests all import from here.
|
||||
*
|
||||
* Key behaviors (locked in /plan-eng-review + two Codex passes):
|
||||
* - Normalization BEFORE matching (NFKC + strip zero-width + decode a small
|
||||
* set of HTML entities) so Unicode-confusable / zero-width evasion fails.
|
||||
* Findings map back to ORIGINAL offsets via an index map.
|
||||
* - ReDoS safety: a hard input-size cap that fails CLOSED (oversize input
|
||||
* returns a single synthetic HIGH "input too large to scan safely" finding,
|
||||
* so callers block rather than skip). Patterns are linear-time (lint-tested).
|
||||
* - NO visibility-based tier mutation. `repoVisibility` is recorded on each
|
||||
* finding (drives sterner AUQ wording in the skill) but never promotes a
|
||||
* MEDIUM to HIGH. (TENSION-2-followup.)
|
||||
* - Placeholder suppression is per-matched-span.
|
||||
* - Tool-attributed fences (``` ```codex-review ``` / ``` ```greptile ```)
|
||||
* degrade credential findings to a non-blocking WARN — UNLESS the span is a
|
||||
* live-format credential the doc-example heuristic can't excuse. No nonce,
|
||||
* no trust exemption (the marker scheme was dropped as theater).
|
||||
*/
|
||||
|
||||
import {
|
||||
PATTERNS,
|
||||
PATTERNS_BY_ID,
|
||||
isPlaceholderSpan,
|
||||
type RedactPattern,
|
||||
type Tier,
|
||||
type Category,
|
||||
} from "./redact-patterns";
|
||||
|
||||
export type RepoVisibility = "public" | "private" | "unknown";
|
||||
|
||||
/** A WARN is a finding that does not block but is surfaced (tool-fence degrade). */
|
||||
export type Severity = Tier | "WARN";
|
||||
|
||||
export interface Finding {
|
||||
id: string;
|
||||
tier: Tier;
|
||||
/** Effective severity after tool-fence degrade. HIGH/MEDIUM/LOW or WARN. */
|
||||
severity: Severity;
|
||||
category: Category;
|
||||
description: string;
|
||||
/** 1-based line in the ORIGINAL (un-normalized) text. */
|
||||
line: number;
|
||||
/** 1-based column in the ORIGINAL text. */
|
||||
col: number;
|
||||
/** Safe-masked preview (never more than 4 leading chars of the secret). */
|
||||
preview: string;
|
||||
/** Whether this finding offers one-keystroke auto-redact (PII subset). */
|
||||
autoRedactable: boolean;
|
||||
/** Repo visibility at scan time — drives sterner AUQ wording, not the tier. */
|
||||
repoVisibility: RepoVisibility;
|
||||
/** True when degraded to WARN because it sat in a tool-attributed fence. */
|
||||
toolFenceDegraded?: boolean;
|
||||
}
|
||||
|
||||
export interface ScanOptions {
|
||||
repoVisibility?: RepoVisibility;
|
||||
/** Extra allowlist entries (exact strings) that suppress a matched span. */
|
||||
allowlist?: string[];
|
||||
/** The invoking user's own email (from `git config user.email`) — allowlisted. */
|
||||
selfEmail?: string;
|
||||
/**
|
||||
* Emails already public in the repo (git log authors, package.json, CODEOWNERS).
|
||||
* Suppressed for `pii.email` since they're not a new leak.
|
||||
*/
|
||||
repoPublicEmails?: string[];
|
||||
/** Hard byte cap. Oversize input fails CLOSED. Default 1 MiB. */
|
||||
maxBytes?: number;
|
||||
}
|
||||
|
||||
export interface ScanResult {
|
||||
findings: Finding[];
|
||||
counts: { HIGH: number; MEDIUM: number; LOW: number; WARN: number };
|
||||
repoVisibility: RepoVisibility;
|
||||
/** True when the input-size cap tripped (caller should BLOCK). */
|
||||
oversize: boolean;
|
||||
}
|
||||
|
||||
const DEFAULT_MAX_BYTES = 1024 * 1024; // 1 MiB
|
||||
|
||||
const EMAIL_ALLOW_DOMAINS = [/@example\.(com|org|net)$/i, /@example\.[a-z]{2,}$/i];
|
||||
const EMAIL_ALLOW_LOCALPARTS = [/^noreply@/i, /^no-reply@/i, /^donotreply@/i];
|
||||
|
||||
// ── Normalization ─────────────────────────────────────────────────────────────
|
||||
|
||||
const ZERO_WIDTH = /[]/g;
|
||||
const HTML_ENTITIES: Record<string, string> = {
|
||||
"&": "&",
|
||||
"<": "<",
|
||||
">": ">",
|
||||
""": '"',
|
||||
"'": "'",
|
||||
"'": "'",
|
||||
};
|
||||
|
||||
/**
|
||||
* Normalize text for matching while producing an index map back to the original.
|
||||
* Returns the normalized string and a function mapping a normalized offset to
|
||||
* the corresponding original offset.
|
||||
*
|
||||
* Strategy: walk the original char-by-char, applying NFKC per char, dropping
|
||||
* zero-width chars, and expanding a small fixed set of HTML entities. Each
|
||||
* emitted normalized char records the original offset it came from. This keeps
|
||||
* the map exact for the transformations we apply (which are all local).
|
||||
*/
|
||||
export function normalizeWithMap(input: string): {
|
||||
normalized: string;
|
||||
map: number[];
|
||||
} {
|
||||
const out: string[] = [];
|
||||
const map: number[] = [];
|
||||
let i = 0;
|
||||
while (i < input.length) {
|
||||
// HTML entity expansion (fixed small set; longest first).
|
||||
let matchedEntity = false;
|
||||
for (const ent in HTML_ENTITIES) {
|
||||
if (input.startsWith(ent, i)) {
|
||||
const rep = HTML_ENTITIES[ent];
|
||||
for (const ch of rep) {
|
||||
out.push(ch);
|
||||
map.push(i);
|
||||
}
|
||||
i += ent.length;
|
||||
matchedEntity = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (matchedEntity) continue;
|
||||
|
||||
const ch = input[i];
|
||||
if (ZERO_WIDTH.test(ch)) {
|
||||
ZERO_WIDTH.lastIndex = 0;
|
||||
i += 1;
|
||||
continue;
|
||||
}
|
||||
ZERO_WIDTH.lastIndex = 0;
|
||||
|
||||
const norm = ch.normalize("NFKC");
|
||||
for (const nch of norm) {
|
||||
out.push(nch);
|
||||
map.push(i);
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
// Sentinel so an offset == length maps to the original length.
|
||||
map.push(input.length);
|
||||
return { normalized: out.join(""), map };
|
||||
}
|
||||
|
||||
// ── Offset → line/col on the ORIGINAL text ────────────────────────────────────
|
||||
|
||||
function lineColAt(original: string, offset: number): { line: number; col: number } {
|
||||
let line = 1;
|
||||
let col = 1;
|
||||
for (let i = 0; i < offset && i < original.length; i++) {
|
||||
if (original[i] === "\n") {
|
||||
line += 1;
|
||||
col = 1;
|
||||
} else {
|
||||
col += 1;
|
||||
}
|
||||
}
|
||||
return { line, col };
|
||||
}
|
||||
|
||||
// ── Safe preview masking ──────────────────────────────────────────────────────
|
||||
|
||||
/** Show ≤4 leading chars, mask the rest. Never reconstructable. */
|
||||
export function maskPreview(span: string): string {
|
||||
const visible = span.slice(0, 4);
|
||||
const masked = span.length > 4 ? "*".repeat(Math.min(span.length - 4, 8)) : "";
|
||||
return `${visible}${masked}${span.length > 12 ? "…" : ""}`;
|
||||
}
|
||||
|
||||
// ── Tool-attributed fence detection ───────────────────────────────────────────
|
||||
|
||||
const TOOL_FENCE_INFO = /^```(codex-review|greptile|eval|codex|tool-output)\b/;
|
||||
|
||||
/**
|
||||
* Returns a sorted list of [start, end) offset ranges (in normalized text) that
|
||||
* sit inside a tool-attributed fenced code block. Credential findings inside
|
||||
* these ranges degrade to WARN (unless the doc-example heuristic says the span
|
||||
* is live-format and must still block).
|
||||
*/
|
||||
function toolFenceRanges(normalized: string): Array<[number, number]> {
|
||||
const ranges: Array<[number, number]> = [];
|
||||
const lines = normalized.split("\n");
|
||||
let offset = 0;
|
||||
let inFence = false;
|
||||
let fenceStart = 0;
|
||||
for (const ln of lines) {
|
||||
const isFenceMarker = ln.startsWith("```");
|
||||
if (isFenceMarker) {
|
||||
if (!inFence && TOOL_FENCE_INFO.test(ln)) {
|
||||
inFence = true;
|
||||
fenceStart = offset + ln.length + 1; // content starts after this line
|
||||
} else if (inFence) {
|
||||
ranges.push([fenceStart, offset]); // up to start of closing fence
|
||||
inFence = false;
|
||||
}
|
||||
}
|
||||
offset += ln.length + 1; // +1 for the \n
|
||||
}
|
||||
if (inFence) ranges.push([fenceStart, normalized.length]); // unterminated → still degrade its own body
|
||||
return ranges;
|
||||
}
|
||||
|
||||
function inRanges(offset: number, ranges: Array<[number, number]>): boolean {
|
||||
for (const [s, e] of ranges) if (offset >= s && offset < e) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Doc-example heuristic: a credential span inside a tool fence still BLOCKS if
|
||||
* it looks like a LIVE credential (not an obvious placeholder/example). We only
|
||||
* downgrade-to-WARN spans that are clearly illustrative.
|
||||
*/
|
||||
function isObviousDocExample(span: string): boolean {
|
||||
return isPlaceholderSpan(span);
|
||||
}
|
||||
|
||||
// ── Proximity check ───────────────────────────────────────────────────────────
|
||||
|
||||
function hasNear(
|
||||
normalized: string,
|
||||
matchStart: number,
|
||||
matchEnd: number,
|
||||
nearRegex: RegExp,
|
||||
window: number,
|
||||
): boolean {
|
||||
const from = Math.max(0, matchStart - window);
|
||||
const to = Math.min(normalized.length, matchEnd + window);
|
||||
const slice = normalized.slice(from, to);
|
||||
const re = new RegExp(nearRegex.source, nearRegex.flags.replace(/g/g, ""));
|
||||
return re.test(slice);
|
||||
}
|
||||
|
||||
// ── Email allowlist ───────────────────────────────────────────────────────────
|
||||
|
||||
function emailAllowed(email: string, opts: ScanOptions): boolean {
|
||||
const lower = email.toLowerCase();
|
||||
if (opts.selfEmail && lower === opts.selfEmail.toLowerCase()) return true;
|
||||
if (opts.repoPublicEmails?.some((e) => e.toLowerCase() === lower)) return true;
|
||||
if (EMAIL_ALLOW_DOMAINS.some((re) => re.test(email))) return true;
|
||||
if (EMAIL_ALLOW_LOCALPARTS.some((re) => re.test(email))) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
// ── The scan ──────────────────────────────────────────────────────────────────
|
||||
|
||||
export function scan(input: string, opts: ScanOptions = {}): ScanResult {
|
||||
const repoVisibility: RepoVisibility = opts.repoVisibility ?? "unknown";
|
||||
// #1824: ?? only catches null/undefined, not NaN or <= 0. A bad value
|
||||
// (NaN from a malformed --max-bytes, or a negative) would make `byteLen >
|
||||
// maxBytes` always false and silently disable the fail-closed oversize guard.
|
||||
// Guardrail: any non-finite or non-positive value falls back to the default
|
||||
// cap. The CLI is the layer that rejects bad args; this is belt-and-suspenders
|
||||
// so the engine never silently runs uncapped.
|
||||
const maxBytes =
|
||||
Number.isFinite(opts.maxBytes) && (opts.maxBytes as number) > 0
|
||||
? (opts.maxBytes as number)
|
||||
: DEFAULT_MAX_BYTES;
|
||||
|
||||
// Fail CLOSED on oversize input. Check byte length BEFORE heavy work.
|
||||
const byteLen = Buffer.byteLength(input, "utf8");
|
||||
if (byteLen > maxBytes) {
|
||||
const finding: Finding = {
|
||||
id: "engine.input_too_large",
|
||||
tier: "HIGH",
|
||||
severity: "HIGH",
|
||||
category: "secret",
|
||||
description: `Input too large to scan safely (${byteLen} > ${maxBytes} bytes) — blocking fail-closed`,
|
||||
line: 1,
|
||||
col: 1,
|
||||
preview: "",
|
||||
autoRedactable: false,
|
||||
repoVisibility,
|
||||
};
|
||||
return {
|
||||
findings: [finding],
|
||||
counts: { HIGH: 1, MEDIUM: 0, LOW: 0, WARN: 0 },
|
||||
repoVisibility,
|
||||
oversize: true,
|
||||
};
|
||||
}
|
||||
|
||||
const { normalized, map } = normalizeWithMap(input);
|
||||
const fenceRanges = toolFenceRanges(normalized);
|
||||
const allow = new Set(opts.allowlist ?? []);
|
||||
|
||||
const findings: Finding[] = [];
|
||||
// Dedup by (id, original-offset) so overlapping global matches don't double-count.
|
||||
const seen = new Set<string>();
|
||||
|
||||
for (const pat of PATTERNS) {
|
||||
const re = new RegExp(pat.regex.source, withFlags(pat.regex.flags));
|
||||
let m: RegExpExecArray | null;
|
||||
while ((m = re.exec(normalized)) !== null) {
|
||||
// Guard against zero-width matches looping forever.
|
||||
if (m.index === re.lastIndex) re.lastIndex++;
|
||||
|
||||
const span = m[1] ?? m[0];
|
||||
const spanStartInMatch = m[1] !== undefined ? m[0].indexOf(m[1]) : 0;
|
||||
const normOffset = m.index + Math.max(0, spanStartInMatch);
|
||||
|
||||
// Per-span placeholder suppression.
|
||||
if (isPlaceholderSpan(span)) continue;
|
||||
if (allow.has(span)) continue;
|
||||
|
||||
// Pattern-specific validators (Luhn, entropy, RFC1918, etc).
|
||||
if (pat.validate && !pat.validate(span, m)) continue;
|
||||
|
||||
// Proximity requirement.
|
||||
if (
|
||||
pat.nearRegex &&
|
||||
!hasNear(normalized, m.index, m.index + m[0].length, pat.nearRegex, pat.nearWindow ?? 100)
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Email allowlist (layered on top of the pattern).
|
||||
if (pat.id === "pii.email" && emailAllowed(span, opts)) continue;
|
||||
|
||||
const origOffset = map[Math.min(normOffset, map.length - 1)] ?? 0;
|
||||
const key = `${pat.id}:${origOffset}`;
|
||||
if (seen.has(key)) continue;
|
||||
seen.add(key);
|
||||
|
||||
const { line, col } = lineColAt(input, origOffset);
|
||||
|
||||
// Tool-fence degrade: only credential-category, only obvious doc examples.
|
||||
let severity: Severity = pat.tier;
|
||||
let toolFenceDegraded = false;
|
||||
if (
|
||||
pat.category === "secret" &&
|
||||
inRanges(normOffset, fenceRanges) &&
|
||||
isObviousDocExample(span)
|
||||
) {
|
||||
severity = "WARN";
|
||||
toolFenceDegraded = true;
|
||||
}
|
||||
|
||||
findings.push({
|
||||
id: pat.id,
|
||||
tier: pat.tier,
|
||||
severity,
|
||||
category: pat.category,
|
||||
description: pat.description,
|
||||
line,
|
||||
col,
|
||||
preview: maskPreview(span),
|
||||
autoRedactable: !!pat.autoRedactable,
|
||||
repoVisibility,
|
||||
...(toolFenceDegraded ? { toolFenceDegraded } : {}),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Stable order: by line, then col, then id.
|
||||
findings.sort((a, b) => a.line - b.line || a.col - b.col || a.id.localeCompare(b.id));
|
||||
|
||||
const counts = { HIGH: 0, MEDIUM: 0, LOW: 0, WARN: 0 };
|
||||
for (const f of findings) counts[f.severity] += 1;
|
||||
|
||||
return { findings, counts, repoVisibility, oversize: false };
|
||||
}
|
||||
|
||||
function withFlags(flags: string): string {
|
||||
let f = flags;
|
||||
if (!f.includes("g")) f += "g";
|
||||
if (!f.includes("m")) f += "m";
|
||||
return f;
|
||||
}
|
||||
|
||||
// ── Auto-redaction ────────────────────────────────────────────────────────────
|
||||
|
||||
export interface RedactResult {
|
||||
body: string;
|
||||
/** ASCII unified-diff preview of the substitutions. */
|
||||
diff: string;
|
||||
/** Findings that could NOT be auto-redacted (structural-corruption guard). */
|
||||
skipped: Finding[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Substitute redact tokens for the given finding ids, right-to-left so offsets
|
||||
* stay valid. Refuses to redact a span that sits inside a structural token
|
||||
* (markdown link target, JSON string value) — those fall back to `skipped` so
|
||||
* the skill drops the user to manual edit rather than silently mangling output.
|
||||
*/
|
||||
export function applyRedactions(
|
||||
input: string,
|
||||
findingIds: string[],
|
||||
opts: ScanOptions = {},
|
||||
): RedactResult {
|
||||
const ids = new Set(findingIds);
|
||||
const { findings } = scan(input, opts);
|
||||
const targets = findings
|
||||
.filter((f) => ids.has(f.id) && f.autoRedactable)
|
||||
.map((f) => ({ f, ...locateSpan(input, f) }))
|
||||
.filter((t) => t.start >= 0);
|
||||
|
||||
// Right-to-left so earlier offsets remain valid after splicing.
|
||||
targets.sort((a, b) => b.start - a.start);
|
||||
|
||||
const skipped: Finding[] = [];
|
||||
const diffLines: string[] = [];
|
||||
let body = input;
|
||||
|
||||
for (const t of targets) {
|
||||
const pat = PATTERNS_BY_ID[t.f.id];
|
||||
const token = pat?.redactToken ?? "<REDACTED>";
|
||||
if (inStructuralToken(body, t.start, t.end)) {
|
||||
skipped.push(t.f);
|
||||
continue;
|
||||
}
|
||||
const before = lineContaining(body, t.start);
|
||||
body = body.slice(0, t.start) + token + body.slice(t.end);
|
||||
const after = lineContaining(body, t.start);
|
||||
diffLines.push(`- ${before}`);
|
||||
diffLines.push(`+ ${after}`);
|
||||
}
|
||||
|
||||
return { body, diff: diffLines.reverse().join("\n"), skipped };
|
||||
}
|
||||
|
||||
/**
|
||||
* Patterns whose regex captures only a MARKER, not the secret payload itself
|
||||
* (the PEM header line; the GCP JSON key prefix). Span replacement on these
|
||||
* would redact the header and forward the key body — so redactFindingSpans
|
||||
* drops the whole payload instead.
|
||||
*/
|
||||
const MARKER_ONLY_PATTERN_IDS = new Set(["pem.private_key", "gcp.service_account"]);
|
||||
|
||||
/**
|
||||
* Replace EVERY finding's span with `<REDACTED-{id}>`, regardless of tier or
|
||||
* autoRedactable. For machine egress surfaces (telemetry error_message,
|
||||
* #1947) where structure preservation doesn't matter and fail-closed beats
|
||||
* fidelity. Returns null — caller must drop the whole payload — when:
|
||||
* - any finding's span cannot be located, or
|
||||
* - any finding matched a marker-only pattern (PEM / GCP service-account
|
||||
* JSON): their regexes capture the header, not the key material, so a
|
||||
* span splice would leak the body that follows the marker.
|
||||
* Overlapping spans (e.g. a Bearer token that is also a JWT) are coalesced
|
||||
* before splicing so stale offsets never leave partial secret bytes behind.
|
||||
* (Contrast applyRedactions, which is the interactive, autoRedactable-only,
|
||||
* structure-preserving path.)
|
||||
*/
|
||||
export function redactFindingSpans(input: string, opts: ScanOptions = {}): string | null {
|
||||
const { findings } = scan(input, opts);
|
||||
if (findings.some((f) => MARKER_ONLY_PATTERN_IDS.has(f.id))) return null;
|
||||
const targets = findings.map((f) => ({ f, ...locateSpan(input, f) }));
|
||||
if (targets.some((t) => t.start < 0)) return null;
|
||||
|
||||
// Coalesce overlapping/touching ranges — splicing two intersecting spans
|
||||
// independently applies a stale end offset to already-modified text and
|
||||
// can leave trailing secret bytes in place.
|
||||
targets.sort((a, b) => a.start - b.start);
|
||||
const merged: Array<{ start: number; end: number; ids: string[] }> = [];
|
||||
for (const t of targets) {
|
||||
const last = merged[merged.length - 1];
|
||||
if (last && t.start <= last.end) {
|
||||
last.end = Math.max(last.end, t.end);
|
||||
if (!last.ids.includes(t.f.id)) last.ids.push(t.f.id);
|
||||
} else {
|
||||
merged.push({ start: t.start, end: t.end, ids: [t.f.id] });
|
||||
}
|
||||
}
|
||||
|
||||
// Right-to-left so earlier offsets remain valid after splicing.
|
||||
let body = input;
|
||||
for (let i = merged.length - 1; i >= 0; i--) {
|
||||
const m = merged[i];
|
||||
body = body.slice(0, m.start) + `<REDACTED-${m.ids.join("+")}>` + body.slice(m.end);
|
||||
}
|
||||
return body;
|
||||
}
|
||||
|
||||
function locateSpan(input: string, f: Finding): { start: number; end: number } {
|
||||
// Re-derive the offset from line/col on the original text.
|
||||
let offset = 0;
|
||||
let line = 1;
|
||||
while (line < f.line && offset < input.length) {
|
||||
if (input[offset] === "\n") line++;
|
||||
offset++;
|
||||
}
|
||||
offset += f.col - 1;
|
||||
const pat = PATTERNS_BY_ID[f.id];
|
||||
if (!pat) return { start: -1, end: -1 };
|
||||
const re = new RegExp(pat.regex.source, withFlags(pat.regex.flags));
|
||||
re.lastIndex = Math.max(0, offset - 2);
|
||||
const m = re.exec(input);
|
||||
if (!m) return { start: -1, end: -1 };
|
||||
const span = m[1] ?? m[0];
|
||||
const start = m.index + (m[1] !== undefined ? m[0].indexOf(m[1]) : 0);
|
||||
return { start, end: start + span.length };
|
||||
}
|
||||
|
||||
function inStructuralToken(body: string, start: number, end: number): boolean {
|
||||
// Markdown link target: [text](...span...). The span may sit anywhere inside
|
||||
// the parenthesized target (e.g. an email embedded in a URL). Walk backward
|
||||
// from the span: if we reach `](` before hitting `)`/whitespace, and forward
|
||||
// we reach `)` before whitespace, the span is inside a link target.
|
||||
for (let i = start - 1; i >= 0; i--) {
|
||||
const ch = body[i];
|
||||
if (ch === ")" || ch === "\n" || ch === " " || ch === "\t") break;
|
||||
if (ch === "(" && i > 0 && body[i - 1] === "]") {
|
||||
for (let j = end; j < body.length; j++) {
|
||||
const c = body[j];
|
||||
if (c === " " || c === "\t" || c === "\n") break;
|
||||
if (c === ")") return true;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
// JSON string value: "key": "...span..." — span is inside a quoted value.
|
||||
const before = body.slice(Math.max(0, start - 80), start);
|
||||
const after = body.slice(end, Math.min(body.length, end + 4));
|
||||
if (/:\s*"$/.test(before) && /^"/.test(after)) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
function lineContaining(body: string, offset: number): string {
|
||||
const start = body.lastIndexOf("\n", offset - 1) + 1;
|
||||
let end = body.indexOf("\n", offset);
|
||||
if (end === -1) end = body.length;
|
||||
return body.slice(start, end);
|
||||
}
|
||||
|
||||
// ── Exit-code helper for the CLI shim ─────────────────────────────────────────
|
||||
|
||||
/** 0 clean, 2 MEDIUM present (no HIGH), 3 HIGH present. WARN does not gate. */
|
||||
export function exitCodeFor(result: ScanResult): 0 | 2 | 3 {
|
||||
if (result.counts.HIGH > 0) return 3;
|
||||
if (result.counts.MEDIUM > 0) return 2;
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,532 @@
|
||||
/**
|
||||
* redact-patterns — the canonical redaction taxonomy.
|
||||
*
|
||||
* Single source of truth shared by `lib/redact-engine.ts`, `bin/gstack-redact`,
|
||||
* `bin/gstack-redact-prepush`, and (via `scripts/resolvers/redact-doc.ts`) the
|
||||
* generated SKILL.md docs for /spec, /ship, /cso, /document-release, and
|
||||
* /document-generate.
|
||||
*
|
||||
* Design notes (locked in /plan-eng-review + two Codex passes):
|
||||
*
|
||||
* - Three tiers. HIGH = genuinely-secret credentials (block). MEDIUM = PII,
|
||||
* legal/damaging, internal-leak, plus credential-shaped patterns that have
|
||||
* high false-positive rates (confirm via AskUserQuestion). LOW = surface only.
|
||||
* - NO wholesale MEDIUM->HIGH promotion on public repos (TENSION-2-followup).
|
||||
* Public repos get sterner per-finding confirmation, not auto-block. The
|
||||
* engine never mutates a finding's tier based on visibility.
|
||||
* - Tier-1 calibration: a gate that cries wolf gets ignored. Stripe
|
||||
* publishable keys, Google AIza keys, JWTs, and env-style KV are MEDIUM, not
|
||||
* HIGH (they are context-variable / high-FP). Only genuinely-secret
|
||||
* credentials block.
|
||||
* - ReDoS safety: every pattern here MUST be linear-time (no nested unbounded
|
||||
* quantifiers). `test/redact-pattern-lint.test.ts` fails CI on a catastrophic
|
||||
* form. The engine also enforces a hard input-size cap that fails CLOSED.
|
||||
* - Placeholder suppression is per-matched-span, not per-line.
|
||||
*
|
||||
* Pattern matching contract: every `regex` is used with the global+multiline
|
||||
* flags the engine applies (`g`, `m`). Capture group 1, when present, is the
|
||||
* "secret span" the engine masks and (for proximity rules) anchors on; when
|
||||
* absent, match[0] is the span.
|
||||
*/
|
||||
|
||||
export type Tier = "HIGH" | "MEDIUM" | "LOW";
|
||||
|
||||
export type Category =
|
||||
| "secret"
|
||||
| "pii"
|
||||
| "legal"
|
||||
| "internal"
|
||||
| "hygiene";
|
||||
|
||||
export interface RedactPattern {
|
||||
/** Stable dotted id, e.g. "aws.access_key". Used in findings + tests. */
|
||||
id: string;
|
||||
tier: Tier;
|
||||
category: Category;
|
||||
/** Human-readable one-liner for the findings table + docs. */
|
||||
description: string;
|
||||
/**
|
||||
* The detection regex. Linter-enforced linear-time. The engine adds the
|
||||
* `gm` flags; do not bake `g`/`m` into the source here (keeps `.source`
|
||||
* clean for the docs table and avoids double-global bugs).
|
||||
*/
|
||||
regex: RegExp;
|
||||
/**
|
||||
* Patterns whose redaction is unambiguous enough to offer one-keystroke
|
||||
* auto-redact at MEDIUM tier (email / phone / ssn / cc). The engine wires
|
||||
* the `<REDACTED-*>` replacement token from `redactToken`.
|
||||
*/
|
||||
autoRedactable?: boolean;
|
||||
/** Replacement token for auto-redact, e.g. "<REDACTED-EMAIL>". */
|
||||
redactToken?: string;
|
||||
/**
|
||||
* Extra validators run AFTER the regex matches, ALL must pass for the match
|
||||
* to count. Used for Luhn (credit cards), entropy (env-KV), checksum
|
||||
* (crypto wallets), RFC1918-exclusion (public IPs), etc. Receives the
|
||||
* matched secret span (group 1 or match[0]) and the full match array.
|
||||
*/
|
||||
validate?: (span: string, match: RegExpExecArray) => boolean;
|
||||
/**
|
||||
* Proximity requirement: the pattern only counts if `nearRegex` also matches
|
||||
* within `nearWindow` chars of the match. Used for AWS secret keys (need
|
||||
* `aws_secret_access_key` nearby) and Twilio auth tokens (need an SID nearby).
|
||||
*/
|
||||
nearRegex?: RegExp;
|
||||
nearWindow?: number;
|
||||
}
|
||||
|
||||
// ── Validators ──────────────────────────────────────────────────────────────
|
||||
|
||||
/** Luhn checksum — credit-card validity. Strips spaces/dashes first. */
|
||||
export function luhnValid(span: string): boolean {
|
||||
const digits = span.replace(/[ \-]/g, "");
|
||||
if (!/^\d{13,19}$/.test(digits)) return false;
|
||||
let sum = 0;
|
||||
let alt = false;
|
||||
for (let i = digits.length - 1; i >= 0; i--) {
|
||||
let d = digits.charCodeAt(i) - 48;
|
||||
if (alt) {
|
||||
d *= 2;
|
||||
if (d > 9) d -= 9;
|
||||
}
|
||||
sum += d;
|
||||
alt = !alt;
|
||||
}
|
||||
return sum % 10 === 0;
|
||||
}
|
||||
|
||||
/** Shannon entropy in bits/char. Used to gate env-style KV (skip placeholders). */
|
||||
export function shannonEntropy(s: string): number {
|
||||
if (!s.length) return 0;
|
||||
const freq: Record<string, number> = {};
|
||||
for (const ch of s) freq[ch] = (freq[ch] || 0) + 1;
|
||||
let h = 0;
|
||||
for (const ch in freq) {
|
||||
const p = freq[ch] / s.length;
|
||||
h -= p * Math.log2(p);
|
||||
}
|
||||
return h;
|
||||
}
|
||||
|
||||
/** True when an IPv4 string is a public address (not RFC1918/loopback/etc). */
|
||||
export function isPublicIPv4(ip: string): boolean {
|
||||
const m = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
|
||||
if (!m) return false;
|
||||
const o = m.slice(1, 5).map(Number);
|
||||
if (o.some((n) => n > 255)) return false;
|
||||
const [a, b] = o;
|
||||
if (a === 10) return false; // 10.0.0.0/8
|
||||
if (a === 127) return false; // loopback
|
||||
if (a === 0) return false; // this-network
|
||||
if (a === 192 && b === 168) return false; // 192.168.0.0/16
|
||||
if (a === 169 && b === 254) return false; // link-local
|
||||
if (a === 172 && b >= 16 && b <= 31) return false; // 172.16.0.0/12
|
||||
if (a === 100 && b >= 64 && b <= 127) return false; // CGNAT 100.64.0.0/10
|
||||
if (a >= 224) return false; // multicast / reserved
|
||||
return true;
|
||||
}
|
||||
|
||||
// EIP-55 checksum is out of scope (heavy); we require a length+charset match and
|
||||
// reject all-same-char vanity strings to cut the worst FPs.
|
||||
function looksLikeWallet(span: string): boolean {
|
||||
if (/^0x[a-fA-F0-9]{40}$/.test(span)) {
|
||||
// reject 0x000...0 / 0xfff...f style
|
||||
const body = span.slice(2).toLowerCase();
|
||||
return !/^(.)\1{39}$/.test(body);
|
||||
}
|
||||
// bech32 / base58 — length sanity only
|
||||
return span.length >= 26 && span.length <= 62;
|
||||
}
|
||||
|
||||
// ── Placeholder suppression (per-matched-span, NOT per-line) ─────────────────
|
||||
|
||||
/**
|
||||
* A finding is suppressed only if the MATCHED SPAN itself is a placeholder
|
||||
* form — not merely co-located on a line with the word EXAMPLE. This is the
|
||||
* tightened rule from the Codex review (line-based suppression was dangerous).
|
||||
*/
|
||||
// Structural placeholder forms — apply to ANY span (including URLs).
|
||||
const PLACEHOLDER_STRUCTURAL = [
|
||||
/^your[_-]/i,
|
||||
/^<[^>]*>$/, // <REDACTED-FOO>, <your-key>
|
||||
/^\*+$/, // all-asterisks mask
|
||||
/^x{6,}$/i, // xxxxxx mask
|
||||
];
|
||||
|
||||
// Substring placeholder words (example/test/dummy/...). These are NOT applied to
|
||||
// compound spans containing `://` or `@`, because a legit URL/host can contain
|
||||
// "example" (e.g. db.example.com) without being a placeholder secret. AWS docs
|
||||
// keys like AKIAIOSFODNN7EXAMPLE are bare tokens, so the guard still catches them.
|
||||
const PLACEHOLDER_SUBSTRING = [
|
||||
/example/i, // AKIAIOSFODNN7EXAMPLE etc — AWS docs convention
|
||||
/^changeme$/i,
|
||||
/^redacted/i,
|
||||
/^placeholder/i,
|
||||
/^dummy/i,
|
||||
/^fake/i,
|
||||
/test[_-]?(key|token|secret)/i,
|
||||
];
|
||||
|
||||
export function isPlaceholderSpan(span: string): boolean {
|
||||
if (PLACEHOLDER_STRUCTURAL.some((re) => re.test(span))) return true;
|
||||
const isCompound = span.includes("://") || span.includes("@");
|
||||
if (!isCompound && PLACEHOLDER_SUBSTRING.some((re) => re.test(span))) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
// ── The taxonomy ─────────────────────────────────────────────────────────────
|
||||
|
||||
export const PATTERNS: RedactPattern[] = [
|
||||
// ===== HIGH — genuinely-secret credentials (block) =====
|
||||
{
|
||||
id: "aws.access_key",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "AWS access key ID (AKIA…)",
|
||||
regex: /\b(AKIA[0-9A-Z]{16})\b/,
|
||||
},
|
||||
{
|
||||
id: "aws.secret_key",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "AWS secret access key (with aws_secret_access_key nearby)",
|
||||
regex: /\b([A-Za-z0-9/+=]{40})\b/,
|
||||
nearRegex: /aws.{0,3}secret.{0,3}access.{0,3}key/i,
|
||||
nearWindow: 100,
|
||||
},
|
||||
{
|
||||
id: "github.pat",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "GitHub personal access token (classic)",
|
||||
regex: /\b(ghp_[A-Za-z0-9]{36})\b/,
|
||||
},
|
||||
{
|
||||
id: "github.oauth",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "GitHub OAuth token",
|
||||
regex: /\b(gho_[A-Za-z0-9]{36})\b/,
|
||||
},
|
||||
{
|
||||
id: "github.server",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "GitHub server-to-server token",
|
||||
regex: /\b(ghs_[A-Za-z0-9]{36})\b/,
|
||||
},
|
||||
{
|
||||
id: "github.fine_grained",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "GitHub fine-grained PAT",
|
||||
regex: /\b(github_pat_[A-Za-z0-9_]{82})\b/,
|
||||
},
|
||||
{
|
||||
id: "gitlab.token",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "GitLab token (personal/pipeline-trigger/deploy)",
|
||||
// glpat- personal access, glptt- pipeline trigger, gldt- deploy token.
|
||||
// gstack drives glab first-class — these were a coverage gap (#1946).
|
||||
regex: /\b(gl(?:pat|ptt|dt)-[A-Za-z0-9_-]{20,})\b/,
|
||||
},
|
||||
{
|
||||
id: "huggingface.token",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "HuggingFace access token",
|
||||
regex: /\b(hf_[A-Za-z0-9]{30,})\b/,
|
||||
},
|
||||
{
|
||||
id: "npm.token",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "npm granular access token",
|
||||
regex: /\b(npm_[A-Za-z0-9]{36})\b/,
|
||||
},
|
||||
{
|
||||
id: "digitalocean.token",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "DigitalOcean personal access token",
|
||||
regex: /\b(dop_v1_[a-f0-9]{64})\b/,
|
||||
},
|
||||
{
|
||||
id: "gcp.service_account",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "GCP service-account JSON private key",
|
||||
// The JSON-escaped form ("private_key": "-----BEGIN PRIVATE KEY-----\n...)
|
||||
// dodges pem.private_key's literal-block match when minified to one line.
|
||||
// Proximity to "private_key_id" confirms the GCP service-account shape.
|
||||
regex: /("private_key"\s*:\s*"-----BEGIN (?:RSA |EC )?PRIVATE KEY-----)/,
|
||||
nearRegex: /"private_key_id"/,
|
||||
nearWindow: 300,
|
||||
},
|
||||
{
|
||||
id: "anthropic.key",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Anthropic API key",
|
||||
regex: /\b(sk-ant-[A-Za-z0-9_\-]{20,})\b/,
|
||||
},
|
||||
{
|
||||
id: "openai.key",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "OpenAI API key (incl. sk-proj-/sk-svcacct-/sk-admin-)",
|
||||
// Two explicit shapes (NOT a globally-optional prefix, which would match
|
||||
// malformed sk--... or separator-less sk-projabc...):
|
||||
// prefixed: sk-{proj,svcacct,admin}- + base64url-ish body (allows -_)
|
||||
// bare: sk- + contiguous alphanumeric run (legacy), keeps {32,} floor
|
||||
regex:
|
||||
/\b(sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9]{32,})\b/,
|
||||
},
|
||||
{
|
||||
id: "sendgrid.key",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "SendGrid API key",
|
||||
regex: /\b(SG\.[A-Za-z0-9_\-]{22}\.[A-Za-z0-9_\-]{43})\b/,
|
||||
},
|
||||
{
|
||||
id: "stripe.secret",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Stripe live SECRET key",
|
||||
regex: /\b(sk_live_[A-Za-z0-9]{24,})\b/,
|
||||
},
|
||||
{
|
||||
id: "slack.token",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Slack token (bot/user/app)",
|
||||
regex: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/,
|
||||
},
|
||||
{
|
||||
id: "slack.webhook",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Slack incoming webhook URL",
|
||||
regex: /(https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{24})/,
|
||||
},
|
||||
{
|
||||
id: "discord.webhook",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Discord webhook URL",
|
||||
regex: /(https:\/\/(?:canary\.|ptb\.)?discord(?:app)?\.com\/api\/webhooks\/[0-9]{17,20}\/[A-Za-z0-9_\-]{60,})/,
|
||||
},
|
||||
{
|
||||
id: "twilio.auth_token",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Twilio auth token (32 hex, with an Account SID nearby)",
|
||||
regex: /\b([a-f0-9]{32})\b/,
|
||||
nearRegex: /\bAC[a-f0-9]{32}\b/,
|
||||
nearWindow: 200,
|
||||
},
|
||||
{
|
||||
id: "pem.private_key",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "PEM private key block",
|
||||
regex: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----)/,
|
||||
},
|
||||
{
|
||||
id: "db.url_with_password",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "Database URL with embedded password",
|
||||
regex: /\b((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s/@]+:[^@\s/]+@[^\s/]+)/,
|
||||
// Skip when the password segment is itself a placeholder.
|
||||
validate: (span) => {
|
||||
const m = span.match(/:\/\/[^:]+:([^@]+)@/);
|
||||
const pw = m?.[1] ?? "";
|
||||
return !isPlaceholderSpan(pw) && pw !== "" && !/^\$\{?[A-Z_]+\}?$/.test(pw);
|
||||
},
|
||||
},
|
||||
{
|
||||
id: "creds.basic_auth_url",
|
||||
tier: "HIGH",
|
||||
category: "secret",
|
||||
description: "HTTP(S) URL with embedded basic-auth credentials",
|
||||
regex: /(https?:\/\/[^:\s/@]+:[^@\s/]+@[^\s/]+)/,
|
||||
validate: (span) => {
|
||||
const m = span.match(/:\/\/[^:]+:([^@]+)@/);
|
||||
const pw = m?.[1] ?? "";
|
||||
return !isPlaceholderSpan(pw) && pw !== "" && !/^\$\{?[A-Z_]+\}?$/.test(pw);
|
||||
},
|
||||
},
|
||||
|
||||
// ===== MEDIUM — demoted credential-shaped (high-FP / context-variable) =====
|
||||
{
|
||||
id: "stripe.publishable",
|
||||
tier: "MEDIUM",
|
||||
category: "secret",
|
||||
description: "Stripe live publishable key (often intentionally public)",
|
||||
regex: /\b(pk_live_[A-Za-z0-9]{24,})\b/,
|
||||
},
|
||||
{
|
||||
id: "google.api_key",
|
||||
tier: "MEDIUM",
|
||||
category: "secret",
|
||||
description: "Google API key (AIza…; sometimes a public client key)",
|
||||
regex: /\b(AIza[0-9A-Za-z\-_]{35})\b/,
|
||||
},
|
||||
{
|
||||
id: "jwt",
|
||||
tier: "MEDIUM",
|
||||
category: "secret",
|
||||
description: "JSON Web Token (3-segment base64url)",
|
||||
regex: /\b(eyJ[A-Za-z0-9_\-]{8,}\.eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,})\b/,
|
||||
},
|
||||
{
|
||||
id: "env.kv",
|
||||
tier: "MEDIUM",
|
||||
category: "secret",
|
||||
description: "Env-style SECRET assignment with high-entropy value",
|
||||
regex: /^[ \t]*(?:export[ \t]+)?[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?|DSN|AUTH|COOKIE|SESSION|PRIVATE)[ \t]*=[ \t]*['"]?([^\s'"]{8,})['"]?/,
|
||||
// Only fire on high-entropy values — kills `FOO_KEY=changeme` FPs.
|
||||
validate: (span) =>
|
||||
!isPlaceholderSpan(span) &&
|
||||
!/^\$\{?[A-Za-z_]/.test(span) &&
|
||||
shannonEntropy(span) >= 3.0,
|
||||
},
|
||||
{
|
||||
id: "auth.bearer",
|
||||
tier: "MEDIUM",
|
||||
category: "secret",
|
||||
description: "Authorization Bearer token (high-entropy, header context)",
|
||||
// FP-prone shape (docs and examples are full of "Bearer <token>"), so:
|
||||
// MEDIUM tier, requires "authorization" nearby, and the same entropy
|
||||
// recipe as env.kv to kill Bearer YOUR_TOKEN_HERE placeholders.
|
||||
regex: /\bBearer[ \t]+([A-Za-z0-9._~+/=-]{20,})\b/,
|
||||
nearRegex: /authorization/i,
|
||||
nearWindow: 80,
|
||||
validate: (span) =>
|
||||
!isPlaceholderSpan(span) &&
|
||||
!/^\$\{?[A-Za-z_]/.test(span) &&
|
||||
shannonEntropy(span) >= 3.0,
|
||||
},
|
||||
|
||||
// ===== MEDIUM — PII (auto-redactable subset) =====
|
||||
{
|
||||
id: "pii.email",
|
||||
tier: "MEDIUM",
|
||||
category: "pii",
|
||||
description: "Email address",
|
||||
regex: /\b([A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,})\b/,
|
||||
autoRedactable: true,
|
||||
redactToken: "<REDACTED-EMAIL>",
|
||||
// Engine layers the email allowlist (example.com, noreply@, user's own,
|
||||
// repo-public authors) on top of this — see redact-engine.ts.
|
||||
},
|
||||
{
|
||||
id: "pii.phone.e164",
|
||||
tier: "MEDIUM",
|
||||
category: "pii",
|
||||
description: "Phone number (E.164 / common national formats; US/EU-biased)",
|
||||
regex: /(?<![\w.])(\+?[1-9]\d{0,2}[ \-.]?\(?\d{2,4}\)?[ \-.]?\d{3,4}[ \-.]?\d{3,4})(?![\w.])/,
|
||||
autoRedactable: true,
|
||||
redactToken: "<REDACTED-PHONE>",
|
||||
validate: (span) => span.replace(/\D/g, "").length >= 10,
|
||||
},
|
||||
{
|
||||
id: "pii.ssn",
|
||||
tier: "MEDIUM",
|
||||
category: "pii",
|
||||
description: "US Social Security Number",
|
||||
regex: /\b(\d{3}-\d{2}-\d{4})\b/,
|
||||
autoRedactable: true,
|
||||
redactToken: "<REDACTED-SSN>",
|
||||
// Reject the all-zero-octet placeholders SSNs never use.
|
||||
validate: (span) => {
|
||||
const [a, b, c] = span.split("-");
|
||||
return a !== "000" && b !== "00" && c !== "0000" && a !== "666" && a[0] !== "9";
|
||||
},
|
||||
},
|
||||
{
|
||||
id: "pii.cc",
|
||||
tier: "MEDIUM",
|
||||
category: "pii",
|
||||
description: "Credit-card number (Luhn-valid)",
|
||||
regex: /\b((?:\d[ \-]?){13,19})\b/,
|
||||
autoRedactable: true,
|
||||
redactToken: "<REDACTED-CC>",
|
||||
validate: (span) => luhnValid(span),
|
||||
},
|
||||
{
|
||||
id: "pii.ip_public",
|
||||
tier: "MEDIUM",
|
||||
category: "pii",
|
||||
description: "Public IPv4 address",
|
||||
regex: /\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/,
|
||||
validate: (span) => isPublicIPv4(span),
|
||||
},
|
||||
{
|
||||
id: "pii.wallet",
|
||||
tier: "MEDIUM",
|
||||
category: "pii",
|
||||
description: "Crypto wallet address (ETH/BTC)",
|
||||
regex: /\b(0x[a-fA-F0-9]{40}|bc1[a-z0-9]{25,39}|[13][a-km-zA-HJ-NP-Z1-9]{25,34})\b/,
|
||||
validate: (span) => looksLikeWallet(span),
|
||||
},
|
||||
|
||||
// ===== MEDIUM — internal-leak =====
|
||||
{
|
||||
id: "internal.hostname",
|
||||
tier: "MEDIUM",
|
||||
category: "internal",
|
||||
description: "Internal hostname (*.internal/.corp/.local/.prod/.staging)",
|
||||
regex: /\b([a-z0-9][a-z0-9\-]*\.(?:internal|corp|local|lan|prod|staging))\b/i,
|
||||
},
|
||||
{
|
||||
id: "internal.url_private",
|
||||
tier: "MEDIUM",
|
||||
category: "internal",
|
||||
description: "localhost URL with a non-trivial path",
|
||||
regex: /(https?:\/\/(?:localhost|127\.0\.0\.1):\d{2,5}\/[^\s)]+)/,
|
||||
},
|
||||
|
||||
// ===== MEDIUM — legal / damaging =====
|
||||
{
|
||||
id: "legal.nda_marker",
|
||||
tier: "MEDIUM",
|
||||
category: "legal",
|
||||
description: "Confidentiality / NDA marker",
|
||||
regex: /\b(CONFIDENTIAL|UNDER NDA|ATTORNEY[- ]CLIENT|PRIVILEGED|DO NOT DISTRIBUTE|EYES ONLY)\b/,
|
||||
},
|
||||
{
|
||||
id: "legal.named_criticism",
|
||||
tier: "MEDIUM",
|
||||
category: "legal",
|
||||
description: "Negative judgment near a capitalized full name (semantic pass is primary)",
|
||||
regex: /\b(incompetent|negligent|fraudulent|fraud|fired|terminated|harassed|underperforming)\b/i,
|
||||
// Require a Capitalized Two-Word name within the window.
|
||||
nearRegex: /\b[A-Z][a-z]+ [A-Z][a-z]+\b/,
|
||||
nearWindow: 80,
|
||||
},
|
||||
|
||||
// ===== LOW — surface only =====
|
||||
{
|
||||
id: "internal.user_path",
|
||||
tier: "LOW",
|
||||
category: "internal",
|
||||
description: "Absolute path under a user home dir",
|
||||
regex: /(\/(?:Users|home)\/[a-z][a-z0-9_\-]+\/[^\s)]*)/,
|
||||
},
|
||||
{
|
||||
id: "hygiene.todo",
|
||||
tier: "LOW",
|
||||
category: "hygiene",
|
||||
description: "TODO(owner) marker carried into the artifact",
|
||||
regex: /\b(TODO\([^)]+\))/,
|
||||
},
|
||||
];
|
||||
|
||||
/** Lookup by id. */
|
||||
export const PATTERNS_BY_ID: Record<string, RedactPattern> = Object.fromEntries(
|
||||
PATTERNS.map((p) => [p.id, p]),
|
||||
);
|
||||
@@ -0,0 +1,116 @@
|
||||
/**
|
||||
* staging-guard — fail-closed ownership proof for gstack ingest staging dirs.
|
||||
*
|
||||
* Fixes #1802. The /sync-gbrain memory stage stages prepared pages to a
|
||||
* throwaway dir under ~/.gstack and `rm -rf`s it when done. The resume path
|
||||
* (#1611) reused gbrain's `import-checkpoint.json` `dir` field as that staging
|
||||
* dir WITHOUT proving it was one. A poisoned checkpoint — `dir` = the repo
|
||||
* root, written when an autopilot `gbrain import` was SIGTERM'd while CWD was
|
||||
* the repo — was then adopted as the staging dir and recursively deleted,
|
||||
* destroying the user's working tree.
|
||||
*
|
||||
* Root cause is a TRUST failure, not path math: code deleted a path it never
|
||||
* proved it owned. This module is the single definition of "a path gstack is
|
||||
* allowed to recurse-delete or resume into", shared by the resume gate
|
||||
* (decideResume) and the deletion chokepoint (cleanupStagingDir).
|
||||
*
|
||||
* Ownership requires ALL of the following (fail-closed — any failure ⇒ refuse):
|
||||
* 1. Resolvable — realpathSync succeeds (resolves symlinks and `..` to a
|
||||
* real location before any structural reasoning).
|
||||
* 2. Structural — canonical path is a DIRECT child of $GSTACK_HOME named
|
||||
* `.staging-ingest-*` (makeStagingDir's contract).
|
||||
* 3. Not a repo — no `.git` entry inside. A screaming last-line tripwire:
|
||||
* even a logic error elsewhere can never recurse-delete a
|
||||
* git working tree.
|
||||
* 4. Minted by us — a `.gstack-staging` marker file (written by
|
||||
* makeStagingDir) is present. Turns "looks like ours"
|
||||
* into "was created by us this lineage".
|
||||
*
|
||||
* Design note (steelman, 2026-06-02): a 4-model review panel split 3-1 on the
|
||||
* marker. The dissent argued the structural check alone is sufficient and the
|
||||
* marker adds a missing-token failure mode. Adopted anyway because that failure
|
||||
* mode is fail-SAFE: a missing marker only forces an unnecessary re-stage
|
||||
* (seconds), never a wrong deletion. The asymmetry — the marker can cost work
|
||||
* but never data — settles it. The structural check still runs first and cheap.
|
||||
*
|
||||
* The deeper, "inevitable" fix lives upstream in gbrain: checkpoint.dir should
|
||||
* always be a gbrain-minted staging dir, never CWD. This guard is the
|
||||
* mitigation at gstack's own rm -rf boundary; see the companion gbrain issue.
|
||||
*/
|
||||
import { realpathSync, existsSync, statSync, lstatSync } from "fs";
|
||||
import { join, dirname, basename } from "path";
|
||||
|
||||
/** Basename prefix every makeStagingDir() directory carries. */
|
||||
export const STAGING_PREFIX = ".staging-ingest-";
|
||||
|
||||
/** Marker file minted inside each staging dir at creation. */
|
||||
export const STAGING_MARKER = ".gstack-staging";
|
||||
|
||||
export interface StagingVerdict {
|
||||
ok: boolean;
|
||||
/** Precise rejection reason, for actionable logging. Undefined when ok. */
|
||||
reason?: string;
|
||||
/**
|
||||
* The realpath-resolved directory the verdict actually validated. Present only
|
||||
* when ok. Callers that delete MUST `rmSync` this path, not the raw input —
|
||||
* deleting the canonical path closes the TOCTOU gap where the input is a
|
||||
* symlink swapped between this check and the delete (#1802 C5).
|
||||
*/
|
||||
canonicalPath?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Prove (fail-closed) that `dir` is a gstack-owned ingest staging directory
|
||||
* that is safe to recurse-delete or resume into. Returns a structured verdict
|
||||
* so callers can log exactly why a path was rejected.
|
||||
*
|
||||
* @param dir Candidate path (e.g. gbrain checkpoint.dir, or the active staging dir).
|
||||
* @param gstackHome Resolved $GSTACK_HOME (injected for testability).
|
||||
*/
|
||||
export function checkOwnedStagingDir(dir: string, gstackHome: string): StagingVerdict {
|
||||
if (!dir || typeof dir !== "string") {
|
||||
return { ok: false, reason: "empty or non-string path" };
|
||||
}
|
||||
let canon: string;
|
||||
let home: string;
|
||||
try {
|
||||
canon = realpathSync(dir);
|
||||
home = realpathSync(gstackHome);
|
||||
} catch {
|
||||
// Missing path or broken symlink ⇒ cannot prove ownership ⇒ refuse.
|
||||
return { ok: false, reason: "unresolvable path (missing dir or broken symlink)" };
|
||||
}
|
||||
// The target itself must be a directory (not a file/socket/etc named like one).
|
||||
try {
|
||||
if (!statSync(canon).isDirectory()) {
|
||||
return { ok: false, reason: "not a directory" };
|
||||
}
|
||||
} catch {
|
||||
return { ok: false, reason: "unstattable target" };
|
||||
}
|
||||
if (dirname(canon) !== home) {
|
||||
return { ok: false, reason: `not a direct child of GSTACK_HOME (${home})` };
|
||||
}
|
||||
if (!basename(canon).startsWith(STAGING_PREFIX)) {
|
||||
return { ok: false, reason: `basename does not start with "${STAGING_PREFIX}"` };
|
||||
}
|
||||
if (existsSync(join(canon, ".git"))) {
|
||||
// Tripwire: never recurse-delete anything that looks like a git work tree.
|
||||
return { ok: false, reason: "path contains .git — refusing to touch a git working tree" };
|
||||
}
|
||||
// Marker must be a REGULAR FILE we minted — not a directory or symlink that
|
||||
// merely shares the name (lstat, not stat, so a symlink can't impersonate it).
|
||||
try {
|
||||
if (!lstatSync(join(canon, STAGING_MARKER)).isFile()) {
|
||||
return { ok: false, reason: `"${STAGING_MARKER}" exists but is not a regular file` };
|
||||
}
|
||||
} catch {
|
||||
return { ok: false, reason: `missing "${STAGING_MARKER}" marker — not minted by makeStagingDir` };
|
||||
}
|
||||
return { ok: true, canonicalPath: canon };
|
||||
}
|
||||
|
||||
/** Boolean convenience wrapper around {@link checkOwnedStagingDir}. */
|
||||
export function isOwnedStagingDir(dir: string, gstackHome: string): boolean {
|
||||
return checkOwnedStagingDir(dir, gstackHome).ok;
|
||||
}
|
||||
+307
@@ -0,0 +1,307 @@
|
||||
/**
|
||||
* Git worktree manager for isolated test execution with change harvesting.
|
||||
*
|
||||
* Creates git worktrees for test suites that need real repo context,
|
||||
* harvests any changes the test agent makes as patches, and provides
|
||||
* deduplication across runs.
|
||||
*
|
||||
* Reusable platform module — future /batch or /codex challenge skills
|
||||
* can import this directly.
|
||||
*/
|
||||
|
||||
import { spawnSync } from 'child_process';
|
||||
import * as crypto from 'crypto';
|
||||
import * as fs from 'fs';
|
||||
import * as path from 'path';
|
||||
import * as os from 'os';
|
||||
|
||||
// --- Interfaces ---
|
||||
|
||||
export interface WorktreeInfo {
|
||||
path: string;
|
||||
testName: string;
|
||||
originalSha: string;
|
||||
createdAt: number;
|
||||
}
|
||||
|
||||
export interface HarvestResult {
|
||||
testName: string;
|
||||
worktreePath: string;
|
||||
diffStat: string;
|
||||
patchPath: string;
|
||||
changedFiles: string[];
|
||||
isDuplicate: boolean;
|
||||
}
|
||||
|
||||
// --- Utility ---
|
||||
|
||||
/** Recursive directory copy (pure TypeScript, no external deps). */
|
||||
function copyDirSync(src: string, dest: string): void {
|
||||
fs.mkdirSync(dest, { recursive: true });
|
||||
for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
|
||||
// Skip symlinks to avoid infinite recursion (e.g., .claude/skills/gstack → repo root)
|
||||
if (entry.isSymbolicLink()) continue;
|
||||
const srcPath = path.join(src, entry.name);
|
||||
const destPath = path.join(dest, entry.name);
|
||||
if (entry.isDirectory()) {
|
||||
copyDirSync(srcPath, destPath);
|
||||
} else {
|
||||
fs.copyFileSync(srcPath, destPath);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Run a git command and return stdout. Throws on failure unless tolerateFailure is set. */
|
||||
function git(args: string[], cwd: string, tolerateFailure = false): string {
|
||||
const result = spawnSync('git', args, { cwd, stdio: 'pipe', timeout: 30_000 });
|
||||
const stdout = result.stdout?.toString().trim() ?? '';
|
||||
const stderr = result.stderr?.toString().trim() ?? '';
|
||||
if (result.status !== 0 && !tolerateFailure) {
|
||||
throw new Error(`git ${args.join(' ')} failed (exit ${result.status}): ${stderr || stdout}`);
|
||||
}
|
||||
return stdout;
|
||||
}
|
||||
|
||||
// --- Dedup index ---
|
||||
|
||||
interface DedupIndex {
|
||||
hashes: Record<string, string>; // hash → first-seen runId
|
||||
}
|
||||
|
||||
function getDedupPath(): string {
|
||||
return path.join(os.homedir(), '.gstack-dev', 'harvests', 'dedup.json');
|
||||
}
|
||||
|
||||
function loadDedupIndex(): DedupIndex {
|
||||
try {
|
||||
const raw = fs.readFileSync(getDedupPath(), 'utf-8');
|
||||
return JSON.parse(raw);
|
||||
} catch {
|
||||
return { hashes: {} };
|
||||
}
|
||||
}
|
||||
|
||||
function saveDedupIndex(index: DedupIndex): void {
|
||||
const dir = path.dirname(getDedupPath());
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
const tmp = getDedupPath() + '.tmp';
|
||||
fs.writeFileSync(tmp, JSON.stringify(index, null, 2));
|
||||
fs.renameSync(tmp, getDedupPath());
|
||||
}
|
||||
|
||||
// --- WorktreeManager ---
|
||||
|
||||
export class WorktreeManager {
|
||||
private repoRoot: string;
|
||||
private runId: string;
|
||||
private active: Map<string, WorktreeInfo> = new Map();
|
||||
private harvestResults: HarvestResult[] = [];
|
||||
|
||||
constructor(repoRoot?: string) {
|
||||
if (repoRoot) {
|
||||
this.repoRoot = repoRoot;
|
||||
} else {
|
||||
this.repoRoot = git(['rev-parse', '--show-toplevel'], process.cwd());
|
||||
}
|
||||
this.runId = crypto.randomUUID();
|
||||
|
||||
// Register cleanup on process exit
|
||||
process.on('exit', () => {
|
||||
this.cleanupAll();
|
||||
});
|
||||
}
|
||||
|
||||
/** Create an isolated worktree. Returns the worktree path. Throws on failure. */
|
||||
create(testName: string): string {
|
||||
const originalSha = git(['rev-parse', 'HEAD'], this.repoRoot);
|
||||
|
||||
const worktreeBase = path.join(this.repoRoot, '.gstack-worktrees', this.runId);
|
||||
fs.mkdirSync(worktreeBase, { recursive: true });
|
||||
|
||||
const worktreePath = path.join(worktreeBase, testName);
|
||||
|
||||
// Create detached worktree at current HEAD
|
||||
git(['worktree', 'add', '--detach', worktreePath, 'HEAD'], this.repoRoot);
|
||||
|
||||
// Copy gitignored build artifacts that tests need (config-driven)
|
||||
const { getExternalHosts } = require('../hosts/index');
|
||||
for (const hostConfig of getExternalHosts()) {
|
||||
const hostSrc = path.join(this.repoRoot, hostConfig.hostSubdir);
|
||||
if (fs.existsSync(hostSrc)) {
|
||||
copyDirSync(hostSrc, path.join(worktreePath, hostConfig.hostSubdir));
|
||||
}
|
||||
}
|
||||
|
||||
const browseDist = path.join(this.repoRoot, 'browse', 'dist');
|
||||
if (fs.existsSync(browseDist)) {
|
||||
copyDirSync(browseDist, path.join(worktreePath, 'browse', 'dist'));
|
||||
}
|
||||
|
||||
const info: WorktreeInfo = {
|
||||
path: worktreePath,
|
||||
testName,
|
||||
originalSha,
|
||||
createdAt: Date.now(),
|
||||
};
|
||||
this.active.set(testName, info);
|
||||
|
||||
return worktreePath;
|
||||
}
|
||||
|
||||
/** Harvest changes from a worktree. Returns null if clean or on error. */
|
||||
harvest(testName: string): HarvestResult | null {
|
||||
const info = this.active.get(testName);
|
||||
if (!info) return null;
|
||||
|
||||
try {
|
||||
// Check if worktree directory still exists (agent may have deleted it)
|
||||
if (!fs.existsSync(info.path)) {
|
||||
process.stderr.write(` HARVEST [${testName}]: worktree dir deleted, skipping\n`);
|
||||
return null;
|
||||
}
|
||||
|
||||
// Stage everything including untracked files
|
||||
git(['-C', info.path, 'add', '-A'], info.path, true);
|
||||
|
||||
// Get diff against original SHA (captures both committed and uncommitted changes)
|
||||
const patch = git(['-C', info.path, 'diff', info.originalSha, '--cached'], info.path, true);
|
||||
|
||||
if (!patch) return null;
|
||||
|
||||
// Get diff stat for human-readable output
|
||||
const diffStat = git(['-C', info.path, 'diff', info.originalSha, '--cached', '--stat'], info.path, true);
|
||||
|
||||
// Get changed file names
|
||||
const nameOnly = git(['-C', info.path, 'diff', info.originalSha, '--cached', '--name-only'], info.path, true);
|
||||
const changedFiles = nameOnly.split('\n').filter(Boolean);
|
||||
|
||||
// Dedup check
|
||||
const hash = crypto.createHash('sha256').update(patch).digest('hex');
|
||||
const dedupIndex = loadDedupIndex();
|
||||
const isDuplicate = hash in dedupIndex.hashes;
|
||||
|
||||
let patchPath = '';
|
||||
|
||||
if (!isDuplicate) {
|
||||
// Save patch
|
||||
const harvestDir = path.join(os.homedir(), '.gstack-dev', 'harvests', this.runId);
|
||||
fs.mkdirSync(harvestDir, { recursive: true });
|
||||
patchPath = path.join(harvestDir, `${testName}.patch`);
|
||||
fs.writeFileSync(patchPath, patch);
|
||||
|
||||
// Update dedup index
|
||||
dedupIndex.hashes[hash] = this.runId;
|
||||
saveDedupIndex(dedupIndex);
|
||||
}
|
||||
|
||||
const result: HarvestResult = {
|
||||
testName,
|
||||
worktreePath: info.path,
|
||||
diffStat,
|
||||
patchPath,
|
||||
changedFiles,
|
||||
isDuplicate,
|
||||
};
|
||||
|
||||
this.harvestResults.push(result);
|
||||
return result;
|
||||
} catch (err) {
|
||||
process.stderr.write(` HARVEST [${testName}]: error — ${err}\n`);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/** Remove a worktree. Non-fatal on error. */
|
||||
cleanup(testName: string): void {
|
||||
const info = this.active.get(testName);
|
||||
if (!info) return;
|
||||
|
||||
try {
|
||||
git(['worktree', 'remove', '--force', info.path], this.repoRoot, true);
|
||||
} catch {
|
||||
// Force remove the directory if git worktree remove fails
|
||||
try {
|
||||
fs.rmSync(info.path, { recursive: true, force: true });
|
||||
git(['worktree', 'prune'], this.repoRoot, true);
|
||||
} catch { /* non-fatal */ }
|
||||
}
|
||||
|
||||
this.active.delete(testName);
|
||||
}
|
||||
|
||||
/** Force-remove all active worktrees (for process exit handler). */
|
||||
cleanupAll(): void {
|
||||
for (const testName of [...this.active.keys()]) {
|
||||
this.cleanup(testName);
|
||||
}
|
||||
|
||||
// Clean up the run directory if empty
|
||||
const runDir = path.join(this.repoRoot, '.gstack-worktrees', this.runId);
|
||||
try {
|
||||
const entries = fs.readdirSync(runDir);
|
||||
if (entries.length === 0) {
|
||||
fs.rmdirSync(runDir);
|
||||
}
|
||||
} catch { /* non-fatal */ }
|
||||
}
|
||||
|
||||
/** Remove worktrees from previous runs that weren't cleaned up. */
|
||||
pruneStale(): void {
|
||||
try {
|
||||
git(['worktree', 'prune'], this.repoRoot, true);
|
||||
|
||||
const worktreeBase = path.join(this.repoRoot, '.gstack-worktrees');
|
||||
if (!fs.existsSync(worktreeBase)) return;
|
||||
|
||||
for (const entry of fs.readdirSync(worktreeBase)) {
|
||||
// Don't prune our own run
|
||||
if (entry === this.runId) continue;
|
||||
|
||||
const entryPath = path.join(worktreeBase, entry);
|
||||
try {
|
||||
// Skip recent worktrees (< 1 hour old) to avoid killing
|
||||
// worktrees from concurrent test runs still in progress
|
||||
const stat = fs.statSync(entryPath);
|
||||
const ageMs = Date.now() - stat.mtimeMs;
|
||||
if (ageMs < 3600_000) continue;
|
||||
fs.rmSync(entryPath, { recursive: true, force: true });
|
||||
} catch { /* non-fatal */ }
|
||||
}
|
||||
} catch {
|
||||
process.stderr.write(' WORKTREE: prune failed (non-fatal)\n');
|
||||
}
|
||||
}
|
||||
|
||||
/** Print harvest report summary. */
|
||||
printReport(): void {
|
||||
if (this.harvestResults.length === 0) return;
|
||||
|
||||
const nonDuplicates = this.harvestResults.filter(r => !r.isDuplicate);
|
||||
process.stderr.write('\n=== HARVEST REPORT ===\n');
|
||||
process.stderr.write(`${nonDuplicates.length} of ${this.harvestResults.length} test suites produced new changes:\n\n`);
|
||||
|
||||
for (const result of this.harvestResults) {
|
||||
if (result.isDuplicate) {
|
||||
process.stderr.write(` ${result.testName}: duplicate patch (skipped)\n`);
|
||||
} else {
|
||||
process.stderr.write(` ${result.testName}: ${result.changedFiles.length} files changed\n`);
|
||||
process.stderr.write(` Patch: ${result.patchPath}\n`);
|
||||
process.stderr.write(` Apply: git apply ${result.patchPath}\n`);
|
||||
if (result.diffStat) {
|
||||
process.stderr.write(` ${result.diffStat}\n`);
|
||||
}
|
||||
}
|
||||
process.stderr.write('\n');
|
||||
}
|
||||
}
|
||||
|
||||
/** Get the run ID (for testing). */
|
||||
getRunId(): string {
|
||||
return this.runId;
|
||||
}
|
||||
|
||||
/** Get active worktree info (for testing). */
|
||||
getInfo(testName: string): WorktreeInfo | undefined {
|
||||
return this.active.get(testName);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user