{{ message }}
Repository navigation
Expand file tree
/
Copy pathcheck-utils-enforcement.ts
More file actions
420 lines (389 loc) · 16.3 KB
/
Copy pathcheck-utils-enforcement.ts
File metadata and controls
420 lines (389 loc) · 16.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
#!/usr/bin/env bun
/**
* Bans inline idioms that a shared helper or a written rule already replaces.
*
* Most patterns point at an `@sim/utils` helper (CLAUDE.md "Common utilities"). A few encode
* render-path rules from `.claude/rules/sim-react-performance.md` and `sim-styling.md` that no
* linter covers: `useRef(new X())` allocating on every render, and `h-N w-N` where `size-N` is the
* convention.
*
* ES2023 array methods (`toSorted`, `with`, …) throw on Safari/iOS 15, and SWC does not polyfill
* them. Every tsconfig keeps `lib` at or below ES2022 so `tsc` rejects them at each call site,
* telling `Array.prototype.with` apart from OpenTelemetry's `context.with` by type; this script
* fails if a tsconfig raises `lib` past that, which is how they shipped once (#5340). The three
* names nothing else uses are also matched in source, since tsc accepts them on an `any` receiver.
*
* Biome's noRestrictedImports covers the import-based bans it lists — today `nanoid` and
* `uuid`. It does NOT cover named crypto imports; `import { randomBytes } from 'node:crypto'`
* passes both gates, and deliberately so, since server code building cipher IVs and tokens
* wants node's crypto rather than the cross-context wrapper in `@sim/utils/random`.
*
* Patterns are matched against the whole file, not line by line: every idiom banned here is a
* multi-token expression that the formatter wraps at 100 columns, and a line-scoped scan sees
* none of the wrapped forms. Deliberate exceptions carry `// utils-lint-allow: <reason>`.
*/
import { readFileSync } from 'node:fs'
import { readdir, readFile } from 'node:fs/promises'
import path from 'node:path'
import { fileURLToPath } from 'node:url'
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
const SCAN_DIRS = [path.join(ROOT, 'apps'), path.join(ROOT, 'packages')]
const SKIP_DIRS = new Set(['node_modules', 'dist', '.next', '.turbo', 'coverage', 'bundles'])
/** `@sim/utils` implements the helpers, so it may use the primitives they replace. */
const UTILS_SOURCE = 'packages/utils/src/'
/** Other files allowed to use the underlying primitives. */
const ALLOWLISTED_FILES = new Set([
// Published standalone CLIs: `@sim/utils` is private, so they carry local
// copies rather than a dependency that only resolves inside the monorepo.
'packages/cli/src/index.ts',
'packages/ts-sdk/src/index.ts',
// CJS bundle — cannot use ES module imports
'apps/sim/lib/execution/isolated-vm-worker.cjs',
// Emits the sandbox-side event filter as plain JS source, which cannot import @sim/utils
'apps/sim/executor/handlers/pi/cloud/event-filter-source.ts',
])
/** `s.slice(0, n)` plus a suffix, by `+` or in a template literal; `\1` is `s` and `\2` is `n`. */
const TRUNCATED = String.raw`(?:\`\$\{\1\.(?:slice|substring)\(\s*0\s*,\s*\2\s*\)\}[^\`$]*\`|\1\.(?:slice|substring)\(\s*0\s*,\s*\2\s*\)\s*\+\s*(?:'[^']*'|"[^"]*"|\w+))`
/** Literal gate for both truncate patterns, whose backreferences are slow over every file. */
const TRUNCATE_PREFILTER = /\.(?:slice|substring)\(\s*0\s*,[^)]*\)\s*(?:\}|\+)/
/** `a`, `a.b`, `a?.b.c`: a property path, with or without optional chaining. */
const MEMBER_PATH = String.raw`[\w$]+(?:\??\.[\w$]+)*`
/**
* The fallback is the whole operand: past whitespace and comments, the next token does not continue
* the expression, so `: null === value` or `: null` then `?? other` on the next line (a different
* fallback) is not read as `: null`. A newline does not end an expression that the next line
* continues; this mirrors JavaScript, which inserts no semicolon there either.
*/
const FALLBACK_END = String.raw`(?!(?:\s|\/\/[^\n]*|\/\*[\s\S]*?\*\/)*(?:[=!<>+\-*%&|^?.[(\x60]|\/(?![/*])|\b(?:instanceof|in|as|satisfies)\b))`
/**
* Whether the guarded path and the returned path are the same property. Optional chaining is
* spelling, not meaning, once the guard has passed: `isRecordLike(a?.b) ? a.b : {}` is `toRecord(a?.b)`.
*/
function sameMemberPath(match: RegExpExecArray): boolean {
return match[1].replaceAll('?.', '.') === match[2].replaceAll('?.', '.')
}
/** Literal gate shared by the `filterUndefined` and `omit` patterns. */
const FROM_ENTRIES = /Object\.fromEntries\(/
const BANNED_PATTERNS: Array<{
pattern: RegExp
description: string
suggestion: string
/** Cheap literal test that skips the pattern on files that cannot match; memoized per file. */
prefilter?: RegExp
/** Bans re-implementing a helper, so `@sim/utils` and the allowlisted files are exempt. */
replacesHelper?: true
/** A further condition on a match that a regex backreference cannot express. */
accept?: (match: RegExpExecArray) => boolean
}> = [
// Randomness / ID generation — global property access that import bans miss
{
pattern: /\bMath\.random\s*\(/g,
description: 'Math.random()',
suggestion: 'randomInt / randomFloat / randomItem from @sim/utils/random',
replacesHelper: true,
},
{
pattern: /\bcrypto\.randomUUID\s*\(/g,
description: 'crypto.randomUUID()',
suggestion: 'generateId() or generateShortId() from @sim/utils/id',
replacesHelper: true,
},
{
pattern: /\bcrypto\.randomBytes\s*\(/g,
description: 'crypto.randomBytes()',
suggestion: 'generateRandomBytes() or generateRandomHex() from @sim/utils/random',
replacesHelper: true,
},
// Deep clone idiom
{
pattern: /JSON\.parse\s*\(\s*JSON\.stringify\s*\(/g,
description: 'JSON.parse(JSON.stringify(...))',
suggestion: 'structuredClone() — built-in, no import needed',
replacesHelper: true,
},
// Inline error message extraction (excludes null/undefined/false fallbacks — those have different semantics)
{
pattern: /instanceof Error\s*\?\s*\w+\.message\s*:\s*(?!\s*null\b|\s*undefined\b|\s*false\b)./g,
description: 'e instanceof Error ? e.message : fallback',
suggestion: 'getErrorMessage(e, fallback?) from @sim/utils/errors',
replacesHelper: true,
},
// Inline sleep
{
pattern: /new Promise\s*[(<]\s*(?:resolve|\(resolve\))\s*=>\s*setTimeout\s*\(\s*resolve/g,
description: 'new Promise(resolve => setTimeout(resolve, ms))',
suggestion: 'sleep(ms) from @sim/utils/helpers',
replacesHelper: true,
},
{
pattern:
/\b([\w.]+)\s+instanceof\s+Error\s*\?\s*\1\s*:\s*new\s+Error\(\s*String\(\s*\1\s*\)\s*\)/g,
description: 'e instanceof Error ? e : new Error(String(e))',
suggestion: 'toError(e) from @sim/utils/errors',
prefilter: /new\s+Error\(\s*String\(/,
replacesHelper: true,
},
{
pattern:
/typeof\s+([\w.]+)\s*===\s*'object'\s*&&\s*\1\s*!==\s*null\s*&&\s*!Array\.isArray\(\s*\1\s*\)/g,
description: "typeof v === 'object' && v !== null && !Array.isArray(v)",
suggestion: 'isRecordLike(v) from @sim/utils/object',
prefilter: /!Array\.isArray\(/,
replacesHelper: true,
},
{
pattern: new RegExp(
String.raw`\bisRecordLike\(\s*(${MEMBER_PATH})\s*\)\s*\?\s*(${MEMBER_PATH})\s*:\s*\{\s*\}${FALLBACK_END}`,
'g'
),
description: 'isRecordLike(v) ? v : {}',
suggestion: 'toRecord(v) from @sim/utils/object',
prefilter: /isRecordLike\(/,
replacesHelper: true,
accept: sameMemberPath,
},
{
pattern: new RegExp(
String.raw`\bisRecordLike\(\s*(${MEMBER_PATH})\s*\)\s*\?\s*(${MEMBER_PATH})\s*:\s*null\b${FALLBACK_END}`,
'g'
),
description: 'isRecordLike(v) ? v : null',
suggestion: 'toRecordOrNull(v) from @sim/utils/object',
prefilter: /isRecordLike\(/,
replacesHelper: true,
accept: sameMemberPath,
},
{
pattern:
/Object\.fromEntries\(\s*Object\.entries\([^()]*\)\s*\.filter\(\s*\(\[\s*\w*\s*,\s*(\w+)\s*\]\)\s*=>\s*\1\s*!==\s*undefined\s*\)\s*,?\s*\)/g,
description: 'Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined))',
suggestion: 'filterUndefined(obj) from @sim/utils/object',
prefilter: FROM_ENTRIES,
replacesHelper: true,
},
{
pattern:
/Object\.fromEntries\(\s*Object\.entries\([^()]*\)\s*\.filter\(\s*\(\[\s*(\w+)\s*\]\)\s*=>\s*\1\s*!==\s*[\w.'"]+\s*\)\s*,?\s*\)/g,
description: 'Object.fromEntries(Object.entries(obj).filter(([k]) => k !== key))',
suggestion: 'omit(obj, [key]) from @sim/utils/object',
prefilter: FROM_ENTRIES,
replacesHelper: true,
},
{
pattern: new RegExp(
String.raw`\b([\w.]+)\.length\s*>\s*([\w.]+)\s*\?\s*${TRUNCATED}\s*:\s*\1\b(?!\.)`,
'g'
),
description: 's.length > n ? s.slice(0, n) + suffix : s',
prefilter: TRUNCATE_PREFILTER,
suggestion: "truncate(s, n, suffix?) from @sim/utils/string (suffix defaults to '...')",
replacesHelper: true,
},
{
pattern: new RegExp(
String.raw`\b([\w.]+)\.length\s*<=\s*([\w.]+)\s*\?\s*\1\s*:\s*${TRUNCATED}`,
'g'
),
description: 's.length <= n ? s : s.slice(0, n) + suffix',
prefilter: TRUNCATE_PREFILTER,
suggestion: "truncate(s, n, suffix?) from @sim/utils/string (suffix defaults to '...')",
replacesHelper: true,
},
{
pattern: /\/\[\.\*\+\?\^\$\{\}\(\)\|\[\\\]\\\\\]\/g/g,
description: 'hand-rolled regex-metacharacter escape',
suggestion: 'escapeRegExp(value) from @sim/utils/string',
replacesHelper: true,
},
// Render-path rules (.claude/rules/sim-react-performance.md, sim-styling.md)
{
// tsc rejects these under the ES2022 lib, except on an `any` receiver (`JSON.parse(s).toSorted()`).
pattern: /\.(?:toSorted|toReversed|toSpliced)\s*\(/g,
description: 'ES2023 array method (throws on Safari/iOS 15; SWC does not polyfill it)',
suggestion: 'a copy you then mutate: [...arr].sort(), [...arr].reverse(), [...arr].splice()',
},
{
pattern: /\buseRef(?:<(?:[^<>]|<[^<>]*>)*>)?\(\s*new\s+[A-Z]\w*/g,
description: 'useRef(new X()) allocates a throwaway X on every render',
suggestion: 'useRef<X | null>(null), then `ref.current ??= new X()` before first use',
prefilter: /useRef/,
},
{
pattern:
/(?:^|[ \t'"`])((?:[\w-]+:)*)(?:h-(\[[^\]\s]+\]|[\d.]+|px|full|auto|fit|min|max)\s+\1w-\2|w-(\[[^\]\s]+\]|[\d.]+|px|full|auto|fit|min|max)\s+\1h-\3)(?=[\s'"`]|$)/gm,
prefilter: /[hw]-\S+\s+(?:[\w-]+:)*[hw]-/,
description: 'h-N w-N with equal N',
suggestion: 'size-N (Tailwind) — e.g. `size-4`, `size-full`',
},
]
async function walk(dir: string, results: string[] = []): Promise<string[]> {
let entries
try {
entries = await readdir(dir, { withFileTypes: true })
} catch {
return results
}
for (const entry of entries) {
if (SKIP_DIRS.has(entry.name)) continue
const full = path.join(dir, entry.name)
if (entry.isDirectory()) {
await walk(full, results)
} else if (/\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(entry.name)) {
results.push(full)
}
}
return results
}
interface Violation {
file: string
line: number
description: string
suggestion: string
snippet: string
}
/** Escape hatch for a deliberate use, mirroring `rq-lint-allow:` in check-react-query-patterns.ts. */
const ALLOW = 'utils-lint-allow:'
/** Offset of the first character of each line, for mapping a match index back to a line number. */
function buildLineStarts(content: string): number[] {
const starts = [0]
for (let i = 0; i < content.length; i++) {
if (content[i] === '\n') starts.push(i + 1)
}
return starts
}
/** 1-based line containing `offset`, by binary search over {@link buildLineStarts}. */
function lineAt(lineStarts: number[], offset: number): number {
let low = 0
let high = lineStarts.length - 1
while (low < high) {
const mid = Math.ceil((low + high) / 2)
if (lineStarts[mid] <= offset) low = mid
else high = mid - 1
}
return low + 1
}
/** The line before ends mid-expression: an open bracket, a comma, or a binary/arrow operator. */
const ENDS_OPEN = /(?:[([,=?:+]|=>|&&|\|\||\?\?)$/
/** The line starts mid-expression: a member access, a closing bracket, or a ternary/logical operator. */
const STARTS_CONTINUED = /^(?:[.?:)\]]|&&|\|\|)/
/**
* True if a `// utils-lint-allow: <reason>` annotation sits just above `line` (1-based).
*
* The reason must be non-empty: an annotation that does not say why is the thing this
* check exists to prevent. A match the formatter wrapped onto a continuation line is first
* walked up to its statement's first line (the repo omits semicolons, so continuation is
* read from the bracket or operator at the seam), then up to three comment lines above
* that are scanned, so the annotation can carry context lines with it.
*/
function hasAllow(lines: string[], line: number): boolean {
let start = line - 1
while (start > 0) {
const previous = lines[start - 1].trim()
if (!ENDS_OPEN.test(previous) && !STARTS_CONTINUED.test(lines[start].trim())) break
start--
}
for (let i = start - 1; i >= 0 && i >= start - 4; i--) {
const text = lines[i]?.trim() ?? ''
if (text.includes(ALLOW)) {
return text.slice(text.indexOf(ALLOW) + ALLOW.length).trim().length > 0
}
if (text.length > 0 && !text.startsWith('//') && !text.startsWith('*')) break
}
return false
}
/** A `lib` entry at ES2023 or later, including its sub-libs (`ES2023.Array`) and `ESNext`. */
const LIB_PAST_ES2022 = /^es(?:20(?:2[3-9]|[3-9]\d)|next)\b/i
/** Tracked tsconfigs whose `lib` admits the ES2023 runtime methods `tsc` would otherwise reject. */
function es2023LibViolations(): Violation[] {
const listed = Bun.spawnSync(['git', 'ls-files', '*tsconfig*.json'], { cwd: ROOT })
const violations: Violation[] = []
for (const file of listed.stdout.toString().split('\n').filter(Boolean)) {
const content = readFileSync(path.join(ROOT, file), 'utf8')
const lib = /"lib"\s*:\s*\[([^\]]*)\]/.exec(content)
const entries = lib?.[1]?.match(/"[^"]*"/g) ?? []
if (!entries.some((entry) => LIB_PAST_ES2022.test(entry.slice(1, -1)))) continue
const line = content.slice(0, lib?.index).split('\n').length
violations.push({
file,
line,
description:
'"lib" past ES2022 lets ES2023 array methods (toSorted, with, …) type-check; they throw on Safari/iOS 15 and SWC does not polyfill them',
suggestion: '"lib" at ES2022, and a copy in code: [...arr].sort(), [...arr].reverse()',
snippet: (content.split('\n')[line - 1] ?? '').trim(),
})
}
return violations
}
/** Every banned-pattern hit in one file; `file` is repo-relative, which decides its exemptions. */
export function findViolations(file: string, content: string): Violation[] {
const violations: Violation[] = []
const helperSource = file.startsWith(UTILS_SOURCE) || ALLOWLISTED_FILES.has(file)
const matches: Array<{
index: number
description: string
suggestion: string
}> = []
const prefilterHits = new Map<RegExp, boolean>()
for (const {
pattern,
description,
suggestion,
prefilter,
replacesHelper,
accept,
} of BANNED_PATTERNS) {
if (helperSource && replacesHelper) continue
if (prefilter) {
let hit = prefilterHits.get(prefilter)
if (hit === undefined) {
hit = prefilter.test(content)
prefilterHits.set(prefilter, hit)
}
if (!hit) continue
}
pattern.lastIndex = 0
for (let match = pattern.exec(content); match !== null; match = pattern.exec(content)) {
if (accept && !accept(match)) continue
matches.push({ index: match.index, description, suggestion })
}
}
if (matches.length === 0) return []
const lines = content.split('\n')
const lineStarts = buildLineStarts(content)
for (const match of matches) {
const line = lineAt(lineStarts, match.index)
if (hasAllow(lines, line)) continue
violations.push({
file,
line,
description: match.description,
suggestion: match.suggestion,
snippet: (lines[line - 1] ?? '').trim(),
})
}
return violations
}
async function main() {
const allFiles: string[] = []
for (const dir of SCAN_DIRS) {
await walk(dir, allFiles)
}
const violations: Violation[] = []
for (const file of allFiles) {
const rel = path.relative(ROOT, file)
violations.push(...findViolations(rel, await readFile(file, 'utf8')))
}
violations.push(...es2023LibViolations())
if (violations.length === 0) {
console.log('✓ No banned patterns found.')
process.exit(0)
}
console.error(`\nFound ${violations.length} banned pattern(s):\n`)
for (const v of violations) {
console.error(` ${v.file}:${v.line}`)
console.error(` ✗ ${v.description} → use ${v.suggestion}`)
console.error(` ${v.snippet}\n`)
}
process.exit(1)
}
if (import.meta.main) main()
You can’t perform that action at this time.