vetto 0.2.7

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

//! SemVer parsing and npm registry response extraction.

use std::cmp::Ordering;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct SemVer {
    pub major: u64,
    pub minor: u64,
    pub patch: u64,
    pub prerelease: Option<String>,
}

impl SemVer {
    pub fn parse(s: &str) -> Option<Self> {
        let clean = s.trim().strip_prefix('v').unwrap_or(s.trim());
        let (ver_part, prerelease) = match clean.split_once('-') {
            Some((v, pre)) => (v, Some(pre.to_string())),
            None => (clean, None),
        };

        let parts: Vec<&str> = ver_part.split('.').collect();
        if parts.len() != 3 {
            return None;
        }

        let major = parts[0].parse::<u64>().ok()?;
        let minor = parts[1].parse::<u64>().ok()?;
        let patch = parts[2].parse::<u64>().ok()?;

        Some(Self {
            major,
            minor,
            patch,
            prerelease,
        })
    }

    pub fn is_newer_than(&self, other: &Self) -> bool {
        match (self.major, self.minor, self.patch).cmp(&(other.major, other.minor, other.patch)) {
            Ordering::Greater => true,
            Ordering::Less => false,
            Ordering::Equal => match (&self.prerelease, &other.prerelease) {
                // Release is newer than pre-release for identical (major, minor, patch)
                (None, Some(_)) => true,
                (Some(_), None) => false,
                (None, None) => false,
                (Some(a), Some(b)) => a > b,
            },
        }
    }
}

/// Extracts the target version string for the requested channel from npm registry response.
///
/// Handles both direct version objects `{"version": "0.2.6"}` and full package manifests
/// with `{"dist-tags": {"latest": "0.2.6", "alpha": "0.2.7-alpha.1"}}`.
pub fn parse_registry_version(json_str: &str, channel: &str) -> Option<String> {
    let val: serde_json::Value = serde_json::from_str(json_str).ok()?;

    // 1. Check if dist-tags is present
    if let Some(dist_tags) = val.get("dist-tags").and_then(|v| v.as_object()) {
        let tag_key = match channel {
            "alpha" => "alpha",
            _ => "latest",
        };
        if let Some(ver) = dist_tags.get(tag_key).and_then(|v| v.as_str()) {
            return Some(ver.to_string());
        }
        // Fallback to latest if requested tag not found
        if let Some(ver) = dist_tags.get("latest").and_then(|v| v.as_str()) {
            return Some(ver.to_string());
        }
    }

    // 2. Direct version field (e.g. from /latest endpoint)
    if let Some(ver) = val.get("version").and_then(|v| v.as_str()) {
        return Some(ver.to_string());
    }

    None
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn semver_parsing_and_comparison() {
        let v025 = SemVer::parse("0.2.5").unwrap();
        let v026 = SemVer::parse("v0.2.6").unwrap();
        let v026_alpha = SemVer::parse("0.2.6-alpha.1").unwrap();
        let v026_alpha2 = SemVer::parse("0.2.6-alpha.2").unwrap();

        assert!(v026.is_newer_than(&v025));
        assert!(!v025.is_newer_than(&v026));
        assert!(!v025.is_newer_than(&v025));

        assert!(v026.is_newer_than(&v026_alpha));
        assert!(v026_alpha2.is_newer_than(&v026_alpha));
        assert!(v026_alpha.is_newer_than(&v025));
    }

    #[test]
    fn parse_registry_response_dist_tags() {
        let json = r#"{
            "name": "@shledery/vetto",
            "dist-tags": {
                "latest": "0.2.6",
                "alpha": "0.2.7-alpha.1"
            }
        }"#;

        assert_eq!(
            parse_registry_version(json, "stable").as_deref(),
            Some("0.2.6")
        );
        assert_eq!(
            parse_registry_version(json, "alpha").as_deref(),
            Some("0.2.7-alpha.1")
        );
    }

    #[test]
    fn parse_registry_response_direct_version() {
        let json = r#"{"version": "0.2.6"}"#;
        assert_eq!(
            parse_registry_version(json, "stable").as_deref(),
            Some("0.2.6")
        );
    }

    #[test]
    fn parse_registry_response_invalid_json() {
        assert_eq!(parse_registry_version("not json", "stable"), None);
    }
}