* fix(tools): evaluate calc expressions without expr-eval
expr-eval has an unpatched critical advisory for code execution through
toJSFunction(), which compiles expressions with new Function
(GHSA-q9v2-7m5w-4693). The advisory covers every published version, so
`bun run check:audit` fails on every branch and `bun audit fix` has nothing
to upgrade to. The calc tool only ever called evaluate(), so the advisory's
own vector was not reachable, but the dependency stays flagged and the
evaluator's surface was far wider than the tool documents: random(), factorials,
trigonometry, constants, strings, array indexing, property access and
statement sequences all evaluated, while the documented ** operator did not
parse at all, since expr-eval spells power as ^.
Replace it with a recursive-descent evaluator for exactly the documented
grammar. It compiles nothing, reaches no host object, and fixes **, which is
right-associative and binds tighter than a leading sign, so -2 ** 2 is -4 as
in ordinary notation. Non-finite results are still reported by the tool rather
than the evaluator, so 1 / 0 keeps its "Produced Infinity" message.
The tool had no tests; both the evaluator and the tool's JSON-array and
error-reporting paths are covered now.
* refactor(tools): parse calc expressions with jsep
Replace the hand-written tokenizer and recursive-descent parser with jsep,
a maintained zero-dependency expression parser with no advisory history, and
keep only the tree walk: an allowlist of node types, arithmetic operators and
the documented functions. Parsing, where the vulnerabilities in this class of
library live, is no longer ours to maintain.
Behaviour follows the parser rather than the previous hand-written precedence,
so a leading sign now binds tighter than '**' and '-2 ** 2' is 4; the tests
pin that alongside right-associativity. Parse errors keep jsep's own wording
and character positions.
* fix(tools): reject inherited names and fold long calc argument lists
Two findings from review of this branch. The function lookup used `in`, so
an inherited key such as `constructor(1)` passed the guard and then failed
while destructuring a missing arity, reporting a TypeError instead of an
unknown function; it now uses Object.hasOwn. min and max spread their
arguments, which overflows the call stack on V8 at roughly 125k arguments,
so they fold instead. Both paths are covered by tests.
99925e4c25