fix(evaluator): validate number tokens, fix power associativity and precedence

Author: VariableThe

AUDIT_LOG.md

@@ -9,7 +9,7 @@ This log tracks all significant changes, updates, and versions in the PaperCache
 1. **Version Bump**: Bumped version to 0.5.8 across `package.json`, `package-lock.json`, `Cargo.toml`, `Cargo.lock`, and `tauri.conf.json`. Added release note `notes/New Features in v0.5.8.md`.
 2. **expr-eval Replacement**: `expr-eval` had a high-severity prototype pollution vulnerability (GHSA-8gw3-rxh4-v6jx, GHSA-jc85-fpwf-qm7x) with no fix available. Replaced with `src/lib/evaluator.ts` — a ~150-line recursive descent parser supporting `+`, `-`, `*`, `/`, `%`, `^`, parentheses, unary operators, and variable scope resolution. Includes 26 unit tests covering arithmetic, precedence, variables, and error cases. Removed `expr-eval` from `package.json`.
 3. **TypeScript Strict Mode**: Enabled `"strict": true` in `tsconfig.app.json`. Codebase was already compatible — zero new type errors.
-4. **Unused Dependency Removal**: Removed `@tauri-apps/plugin-fs`, `@tauri-apps/plugin-shell` (not in Cargo.toml), and `@emnapi/core`, `@emnapi/runtime` (not imported anywhere).
+4. **Unused Dependency Removal**: Removed `@tauri-apps/plugin-fs` and `@tauri-apps/plugin-shell` from `package.json` — these npm packages were not imported anywhere in the JS/TS codebase and had no corresponding Rust plugin in `Cargo.toml`. Note: `@emnapi/core` and `@emnapi/runtime` were initially removed but restored because they are required in the lockfile as transitive WASM fallback dependencies for Linux/Windows CI runners.
 5. **API Type Safety**: Changed `onEvent` from `(payload: any) => void` to generic `<T>(name, callback: (payload: T) => void)`, removing the eslint-disable comment.
 6. **Coverage Thresholds**: Added minimum coverage guardrails to `vite.config.ts` (statements 65%, branches 50%, functions 55%, lines 65%).
 

src/lib/evaluator.test.ts

@@ -105,4 +105,16 @@ describe('evaluate', () => {
   it('performs power before multiplication', () => {
     expect(evaluate('2 * 3 ^ 2')).toBe(18)
   })
+
+  it('power is right-associative (2^3^2 = 2^(3^2) = 512)', () => {
+    expect(evaluate('2 ^ 3 ^ 2')).toBe(512)
+  })
+
+  it('unary minus binds looser than power (-2^2 = -(2^2) = -4)', () => {
+    expect(evaluate('-2 ^ 2')).toBe(-4)
+  })
+
+  it('rejects malformed number with multiple dots', () => {
+    expect(() => evaluate('1..2')).toThrow(ParseError)
+  })
 })

src/lib/evaluator.ts

@@ -36,10 +36,15 @@ function tokenize(input: string): Token[] {
     }
     if (ch >= '0' && ch <= '9') {
       let num = ''
+      let dotCount = 0
       while (i < input.length && ((input[i] >= '0' && input[i] <= '9') || input[i] === '.')) {
+        if (input[i] === '.') dotCount++
         num += input[i]
         i++
       }
+      if (dotCount > 1) {
+        throw new ParseError(`Invalid number: '${num}'`)
+      }
       tokens.push({ type: NUMBER, value: num })
       continue
     }
@@ -152,13 +157,7 @@ class Parser {
   }
 
   factor(): number {
-    let left = this.unary()
-    while (this.peek().type === OPERATOR && this.peek().value === '^') {
-      this.consume()
-      const right = this.unary()
-      left = Math.pow(left, right)
-    }
-    return left
+    return this.unary()
   }
 
   unary(): number {
@@ -167,7 +166,17 @@ class Parser {
       const right = this.unary()
       return op === '-' ? -right : right
     }
-    return this.primary()
+    return this.power()
+  }
+
+  power(): number {
+    const left = this.primary()
+    if (this.peek().type === OPERATOR && this.peek().value === '^') {
+      this.consume()
+      const right = this.power()
+      return Math.pow(left, right)
+    }
+    return left
   }
 
   primary(): number {