shakapacker 9.3.0.beta.6 → 9.3.0

data/package/configExporter/cli.ts

@@ -1,35 +1,40 @@
 // This will be a substantial file - the main CLI entry point
-// Migrating from bin/export-bundler-config but streamlined for TypeScript
+// Originally migrated from bin/export-bundler-config, now bin/shakapacker-config
 
 import { existsSync, readFileSync, writeFileSync } from "fs"
 import { resolve, dirname, sep, delimiter, basename } from "path"
 import { inspect } from "util"
 import { load as loadYaml } from "js-yaml"
 import yargs from "yargs"
-import { ExportOptions, ConfigMetadata, FileOutput } from "./types"
+import {
+  ExportOptions,
+  ConfigMetadata,
+  FileOutput,
+  BUILD_ENV_VARS,
+  isBuildEnvVar,
+  isDangerousEnvVar,
+  DEFAULT_EXPORT_DIR,
+  DEFAULT_CONFIG_FILE
+} from "./types"
 import { YamlSerializer } from "./yamlSerializer"
 import { FileWriter } from "./fileWriter"
 import { ConfigFileLoader, generateSampleConfigFile } from "./configFile"
 import { BuildValidator } from "./buildValidator"
+import { safeResolvePath } from "../utils/pathValidation"
 
 // Read version from package.json
-const packageJson = JSON.parse(
-  readFileSync(resolve(__dirname, "../../package.json"), "utf8")
-)
-const VERSION = packageJson.version
-
-/**
- * Environment variable names that can be set by build configurations
- */
-const BUILD_ENV_VARS = [
-  "NODE_ENV",
-  "RAILS_ENV",
-  "NODE_OPTIONS",
-  "BABEL_ENV",
-  "WEBPACK_SERVE",
-  "CLIENT_BUNDLE_ONLY",
-  "SERVER_BUNDLE_ONLY"
-] as const
+let VERSION = "unknown"
+try {
+  const packageJson = JSON.parse(
+    readFileSync(resolve(__dirname, "../../package.json"), "utf8")
+  ) as { version?: string }
+  VERSION = packageJson.version || "unknown"
+} catch (error) {
+  console.warn(
+    "Could not read version from package.json:",
+    error instanceof Error ? error.message : String(error)
+  )
+}
 
 /**
  * Saves current values of build environment variables for later restoration
@@ -103,6 +108,15 @@ export async function run(args: string[]): Promise<number> {
     // Apply defaults
     const resolvedOptions = applyDefaults(options)
 
+    // Validate paths for security AFTER defaults are applied
+    // Use safeResolvePath which validates and resolves symlinks
+    if (resolvedOptions.output) {
+      safeResolvePath(appRoot, resolvedOptions.output)
+    }
+    if (resolvedOptions.saveDir) {
+      safeResolvePath(appRoot, resolvedOptions.saveDir)
+    }
+
     // Validate after defaults are applied
     if (resolvedOptions.annotate && resolvedOptions.format !== "yaml") {
       throw new Error(
@@ -114,8 +128,7 @@ export async function run(args: string[]): Promise<number> {
     if (resolvedOptions.build) {
       const loader = new ConfigFileLoader(resolvedOptions.configFile)
       if (!loader.exists()) {
-        const configPath =
-          resolvedOptions.configFile || "config/shakapacker-builds.yml"
+        const configPath = resolvedOptions.configFile || DEFAULT_CONFIG_FILE
         throw new Error(
           `--build requires a config file but ${configPath} not found. Run --init to create it.`
         )
@@ -144,7 +157,7 @@ export async function run(args: string[]): Promise<number> {
   }
 }
 
-function parseArguments(args: string[]): ExportOptions {
+export function parseArguments(args: string[]): ExportOptions {
   const argv = yargs(args)
     .version(VERSION)
     .usage(
@@ -164,8 +177,7 @@ QUICK START (for troubleshooting):
     .option("init", {
       type: "boolean",
       default: false,
-      description:
-        "Generate config/shakapacker-builds.yml (use with --ssr for SSR builds)"
+      description: `Generate ${DEFAULT_CONFIG_FILE} (use with --ssr for SSR builds)`
     })
     .option("ssr", {
       type: "boolean",
@@ -188,8 +200,7 @@ QUICK START (for troubleshooting):
     })
     .option("config-file", {
       type: "string",
-      description:
-        "Path to config file (default: config/shakapacker-builds.yml)"
+      description: `Path to config file (default: ${DEFAULT_CONFIG_FILE})`
     })
     // Validation Options
     .option("validate", {
@@ -235,11 +246,26 @@ QUICK START (for troubleshooting):
         "Enable inline documentation (YAML only, default with --doctor or file output)"
     })
     .option("depth", {
-      type: "number",
+      // Note: type omitted to allow string "null" (yargs would reject it).
+      // Coerce function handles validation for both numbers and "null".
       default: 20,
       coerce: (value: number | string) => {
+        // Handle "null" string for unlimited depth
         if (value === "null" || value === null) return null
-        return typeof value === "number" ? value : parseInt(String(value), 10)
+
+        // Reject non-numeric types (arrays, objects, etc.)
+        if (typeof value !== "number" && typeof value !== "string") {
+          throw new Error(
+            `--depth must be a number or 'null', got: ${typeof value}`
+          )
+        }
+
+        const parsed =
+          typeof value === "number" ? value : parseInt(String(value), 10)
+        if (Number.isNaN(parsed)) {
+          throw new Error(`--depth must be a number or 'null', got: ${value}`)
+        }
+        return parsed
       },
       description: "Inspection depth (use 'null' for unlimited)"
     })
@@ -319,6 +345,21 @@ QUICK START (for troubleshooting):
           "--validate cannot be used with --build or --all-builds."
         )
       }
+      if (argv["all-builds"] && argv.output) {
+        throw new Error(
+          "--all-builds and --output are mutually exclusive. Use --save-dir instead."
+        )
+      }
+      if (argv["all-builds"] && argv.stdout) {
+        throw new Error(
+          "--all-builds and --stdout are mutually exclusive. Use --save-dir instead."
+        )
+      }
+      if (argv.stdout && argv.output) {
+        throw new Error(
+          "--stdout and --output are mutually exclusive. Use one or the other."
+        )
+      }
       if (argv.ssr && !argv.init) {
         throw new Error(
           "--ssr can only be used with --init. Use: bin/shakapacker-config --init --ssr"
@@ -351,28 +392,25 @@ QUICK START (for troubleshooting):
 
   # Advanced output options
   bin/shakapacker-config --build=dev --stdout             # View in terminal
-  bin/shakapacker-config --build=dev --output=config.yaml # Save to specific file`
+  bin/shakapacker-config --build=dev --output=config.yml # Save to specific file`
     )
     .strict()
     .parseSync()
 
   // Type assertions are safe here because yargs validates choices at runtime
   // Handle --webpack and --rspack flags
-  let bundler: "webpack" | "rspack" | undefined = argv.bundler as
-    | "webpack"
-    | "rspack"
-    | undefined
+  let { bundler } = argv
   if (argv.webpack) bundler = "webpack"
   if (argv.rspack) bundler = "rspack"
 
   return {
     bundler,
-    env: argv.env as "development" | "production" | "test" | undefined,
+    env: argv.env,
     clientOnly: argv["client-only"],
     serverOnly: argv["server-only"],
     output: argv.output,
-    depth: argv.depth as number | null,
-    format: argv.format as "yaml" | "json" | "inspect" | undefined,
+    depth: argv.depth,
+    format: argv.format,
     help: false, // yargs handles help internally
     verbose: argv.verbose,
     doctor: argv.doctor,
@@ -411,17 +449,14 @@ function applyDefaults(options: ExportOptions): ExportOptions {
     !updatedOptions.output &&
     !updatedOptions.saveDir
   ) {
-    updatedOptions.saveDir = resolve(
-      process.cwd(),
-      "shakapacker-config-exports"
-    )
+    updatedOptions.saveDir = resolve(process.cwd(), DEFAULT_EXPORT_DIR)
   }
 
   return updatedOptions
 }
 
 function runInitCommand(options: ExportOptions): number {
-  const configPath = options.configFile || "config/shakapacker-builds.yml"
+  const configPath = options.configFile || DEFAULT_CONFIG_FILE
   const fullPath = resolve(process.cwd(), configPath)
 
   // Check if SSR variant is requested via --ssr flag
@@ -528,7 +563,7 @@ async function runValidateCommand(options: ExportOptions): Promise<number> {
     // Validate that config file exists
     const loader = new ConfigFileLoader(options.configFile)
     if (!loader.exists()) {
-      const configPath = options.configFile || "config/shakapacker-builds.yml"
+      const configPath = options.configFile || DEFAULT_CONFIG_FILE
       throw new Error(
         `Config file ${configPath} not found. Run --init to create it.`
       )
@@ -561,12 +596,12 @@ async function runValidateCommand(options: ExportOptions): Promise<number> {
       // Handle empty builds edge case
       if (buildsToValidate.length === 0) {
         throw new Error(
-          `No builds found in config file. Add at least one build to config/shakapacker-builds.yml or run --init to see examples.`
+          `No builds found in config file. Add at least one build to ${DEFAULT_CONFIG_FILE} or run --init to see examples.`
         )
       }
     }
 
-    console.log("\n" + "=".repeat(80))
+    console.log(`\n${"=".repeat(80)}`)
     console.log("🔍 Validating Builds")
     console.log("=".repeat(80))
     console.log(`\nValidating ${buildsToValidate.length} build(s)...\n`)
@@ -577,7 +612,7 @@ async function runValidateCommand(options: ExportOptions): Promise<number> {
         "   This includes all webpack/rspack compilation logs, warnings, and progress messages"
       )
       console.log("   Use without --verbose to see only errors and summaries\n")
-      console.log("=".repeat(80) + "\n")
+      console.log(`${"=".repeat(80)}\n`)
     }
 
     const results = []
@@ -585,7 +620,7 @@ async function runValidateCommand(options: ExportOptions): Promise<number> {
     // Validate each build
     for (const buildName of buildsToValidate) {
       if (options.verbose) {
-        console.log("\n" + "=".repeat(80))
+        console.log(`\n${"=".repeat(80)}`)
         console.log(`📦 VALIDATING BUILD: ${buildName}`)
         console.log("=".repeat(80))
       } else {
@@ -611,7 +646,11 @@ async function runValidateCommand(options: ExportOptions): Promise<number> {
         "development"
 
       // Auto-detect bundler using the build's environment
-      const defaultBundler = await autoDetectBundler(buildEnv, appRoot)
+      const defaultBundler = await autoDetectBundler(
+        buildEnv,
+        appRoot,
+        options.verbose
+      )
 
       // Resolve build config with the correct default bundler
       const resolvedBuild = loader.resolveBuild(
@@ -670,8 +709,7 @@ async function runAllBuildsCommand(options: ExportOptions): Promise<number> {
 
     const loader = new ConfigFileLoader(resolvedOptions.configFile)
     if (!loader.exists()) {
-      const configPath =
-        resolvedOptions.configFile || "config/shakapacker-builds.yml"
+      const configPath = resolvedOptions.configFile || DEFAULT_CONFIG_FILE
       throw new Error(
         `Config file ${configPath} not found. Run --init to create it.`
       )
@@ -719,7 +757,7 @@ async function runAllBuildsCommand(options: ExportOptions): Promise<number> {
     }
 
     // Print summary
-    console.log("\n" + "=".repeat(80))
+    console.log(`\n${"=".repeat(80)}`)
     console.log("✅ All Builds Exported!")
     console.log("=".repeat(80))
     console.log(`\nCreated ${createdFiles.length} configuration file(s) in:`)
@@ -728,7 +766,7 @@ async function runAllBuildsCommand(options: ExportOptions): Promise<number> {
     createdFiles.forEach((file) => {
       console.log(`  ✓ ${basename(file)}`)
     })
-    console.log("\n" + "=".repeat(80) + "\n")
+    console.log(`\n${"=".repeat(80)}\n`)
 
     return 0
   } catch (error: unknown) {
@@ -749,7 +787,7 @@ async function runDoctorMode(
   const savedEnv = saveBuildEnvironmentVariables()
 
   try {
-    console.log("\n" + "=".repeat(80))
+    console.log(`\n${"=".repeat(80)}`)
     console.log("🔍 Config Exporter - Doctor Mode")
     console.log("=".repeat(80))
 
@@ -758,7 +796,7 @@ async function runDoctorMode(
     const createdFiles: string[] = []
 
     // Check if config file exists - always use it for doctor mode
-    const configFilePath = options.configFile || "config/shakapacker-builds.yml"
+    const configFilePath = options.configFile || DEFAULT_CONFIG_FILE
     const loader = new ConfigFileLoader(configFilePath)
 
     if (loader.exists()) {
@@ -899,7 +937,7 @@ async function runDoctorMode(
 
 function printDoctorSummary(createdFiles: string[], targetDir: string): void {
   // Print summary
-  console.log("\n" + "=".repeat(80))
+  console.log(`\n${"=".repeat(80)}`)
   console.log("✅ Export Complete!")
   console.log("=".repeat(80))
   console.log(`\nCreated ${createdFiles.length} configuration file(s) in:`)
@@ -922,14 +960,14 @@ function printDoctorSummary(createdFiles: string[], targetDir: string): void {
   }
 
   if (shouldSuggestGitignore) {
-    console.log("\n" + "─".repeat(80))
+    console.log(`\n${"─".repeat(80)}`)
     console.log(
       "💡 Tip: Add the export directory to .gitignore to avoid committing config files:"
     )
     console.log(`\n  echo "${dirName}/" >> .gitignore\n`)
   }
 
-  console.log("\n" + "=".repeat(80) + "\n")
+  console.log(`\n${"=".repeat(80)}\n`)
 }
 
 async function runSaveMode(
@@ -946,7 +984,7 @@ async function runSaveMode(
   if (options.output) {
     // Single file output
     const combined = configs.map((c) => c.config)
-    const metadata = configs[0].metadata
+    const { metadata } = configs[0]
     metadata.configCount = combined.length
 
     const output = formatConfig(
@@ -986,15 +1024,15 @@ async function runStdoutMode(
   options: ExportOptions,
   appRoot: string
 ): Promise<void> {
-  const configs = await loadConfigsForEnv(options.env!, options, appRoot)
+  const configs = await loadConfigsForEnv(options.env, options, appRoot)
   const combined = configs.map((c) => c.config)
-  const metadata = configs[0].metadata
+  const { metadata } = configs[0]
   metadata.configCount = combined.length
 
   const config = combined.length === 1 ? combined[0] : combined
   const output = formatConfig(config, metadata, options, appRoot)
 
-  console.log("\n" + "=".repeat(80) + "\n")
+  console.log(`\n${"=".repeat(80)}\n`)
   console.log(output)
 }
 
@@ -1002,9 +1040,9 @@ async function runSingleFileMode(
   options: ExportOptions,
   appRoot: string
 ): Promise<void> {
-  const configs = await loadConfigsForEnv(options.env!, options, appRoot)
+  const configs = await loadConfigsForEnv(options.env, options, appRoot)
   const combined = configs.map((c) => c.config)
-  const metadata = configs[0].metadata
+  const { metadata } = configs[0]
   metadata.configCount = combined.length
 
   const config = combined.length === 1 ? combined[0] : combined
@@ -1031,7 +1069,11 @@ async function loadConfigsForEnv(
     // Use a temporary env for auto-detection, will be overridden by build config
     const tempEnv = env || "development"
     const loader = new ConfigFileLoader(options.configFile)
-    const defaultBundler = await autoDetectBundler(tempEnv, appRoot)
+    const defaultBundler = await autoDetectBundler(
+      tempEnv,
+      appRoot,
+      options.verbose
+    )
     const resolvedBuild = loader.resolveBuild(
       options.build,
       options,
@@ -1046,36 +1088,27 @@ async function loadConfigsForEnv(
 
     // Set environment variables from config
     // Security: Only allow specific environment variables to prevent malicious configs
-    const DANGEROUS_ENV_VARS = [
-      "PATH",
-      "HOME",
-      "LD_PRELOAD",
-      "LD_LIBRARY_PATH",
-      "DYLD_LIBRARY_PATH",
-      "DYLD_INSERT_LIBRARIES"
-    ]
-
-    if (process.env.VERBOSE) {
+    if (options.verbose) {
       console.log(
         `[Config Exporter] Setting environment variables from build config...`
       )
     }
 
     for (const [key, value] of Object.entries(resolvedBuild.environment)) {
-      if (DANGEROUS_ENV_VARS.includes(key)) {
+      if (isDangerousEnvVar(key)) {
         console.warn(
           `[Config Exporter] Warning: Skipping dangerous environment variable: ${key}`
         )
         continue
       }
-      if (!(BUILD_ENV_VARS as readonly string[]).includes(key)) {
+      if (!isBuildEnvVar(key)) {
         console.warn(
           `[Config Exporter] Warning: Skipping non-whitelisted environment variable: ${key}. ` +
             `Allowed variables are: ${BUILD_ENV_VARS.join(", ")}`
         )
         continue
       }
-      if (process.env.VERBOSE) {
+      if (options.verbose) {
         console.log(`[Config Exporter]   ${key}=${value}`)
       }
       process.env[key] = value
@@ -1125,7 +1158,9 @@ async function loadConfigsForEnv(
     finalEnv = env || "development"
 
     // Auto-detect bundler if not specified
-    bundler = options.bundler || (await autoDetectBundler(finalEnv, appRoot))
+    bundler =
+      options.bundler ||
+      (await autoDetectBundler(finalEnv, appRoot, options.verbose))
 
     // Set environment variables
     process.env.NODE_ENV = finalEnv
@@ -1141,9 +1176,10 @@ async function loadConfigsForEnv(
 
   // Find and load config file
   const configFile =
-    customConfigFile || findConfigFile(bundler, appRoot, finalEnv)
+    customConfigFile ||
+    findConfigFile(bundler, appRoot, finalEnv, options.verbose)
   // Quiet mode for cleaner output - only show if verbose or errors
-  if (process.env.VERBOSE) {
+  if (options.verbose) {
     console.log(`[Config Exporter] Loading config: ${configFile}`)
     console.log(`[Config Exporter] Environment: ${finalEnv}`)
     console.log(`[Config Exporter] Bundler: ${bundler}`)
@@ -1156,7 +1192,6 @@ async function loadConfigsForEnv(
   // Register ts-node for TypeScript config files
   if (configFile.endsWith(".ts")) {
     try {
-      // eslint-disable-next-line @typescript-eslint/no-var-requires
       require("ts-node/register/transpile-only")
     } catch (error) {
       throw new Error(
@@ -1205,7 +1240,6 @@ async function loadConfigsForEnv(
     }
   })
 
-  // eslint-disable-next-line @typescript-eslint/no-var-requires
   let loadedConfig: any
   try {
     loadedConfig = require(configFile)
@@ -1283,9 +1317,9 @@ async function loadConfigsForEnv(
       }
 
       throw new Error(
-        `Failed to execute config function: ${errorMessage}\n` +
-          envDetails.join("\n") +
-          `\nTip: ${suggestion}`
+        `Failed to execute config function: ${errorMessage}\n${envDetails.join(
+          "\n"
+        )}\nTip: ${suggestion}`
       )
     }
   }
@@ -1338,7 +1372,7 @@ async function loadConfigsForEnv(
   }
 
   // Debug logging
-  if (process.env.VERBOSE || buildOutputs.length > 0) {
+  if (options.verbose || buildOutputs.length > 0) {
     console.log(
       `[Config Exporter] Webpack returned ${configs.length} config(s), buildOutputs: [${buildOutputs.join(", ")}]`
     )
@@ -1442,39 +1476,37 @@ function formatConfig(
       return value
     }
     return JSON.stringify({ metadata, config }, jsonReplacer, 2)
-  } else {
-    // inspect format
-    const inspectOptions = {
-      depth: options.depth,
-      colors: false,
-      maxArrayLength: null,
-      maxStringLength: null,
-      breakLength: 120,
-      compact: false
-    }
-
-    let output =
-      "=== METADATA ===\n\n" + inspect(metadata, inspectOptions) + "\n\n"
-    output += "=== CONFIG ===\n\n"
+  }
+  // inspect format
+  const inspectOptions = {
+    depth: options.depth,
+    colors: false,
+    maxArrayLength: null,
+    maxStringLength: null,
+    breakLength: 120,
+    compact: false
+  }
 
-    if (Array.isArray(config)) {
-      output += `Total configs: ${config.length}\n\n`
-      config.forEach((cfg, index) => {
-        output += `--- Config [${index}] ---\n\n`
-        output += inspect(cfg, inspectOptions) + "\n\n"
-      })
-    } else {
-      output += inspect(config, inspectOptions) + "\n"
-    }
+  let output = `=== METADATA ===\n\n${inspect(metadata, inspectOptions)}\n\n`
+  output += "=== CONFIG ===\n\n"
 
-    return output
+  if (Array.isArray(config)) {
+    output += `Total configs: ${config.length}\n\n`
+    config.forEach((cfg, index) => {
+      output += `--- Config [${index}] ---\n\n`
+      output += `${inspect(cfg, inspectOptions)}\n\n`
+    })
+  } else {
+    output += `${inspect(config, inspectOptions)}\n`
   }
+
+  return output
 }
 
 function cleanConfig(obj: any, rootPath: string): any {
   const makePathRelative = (str: string): string => {
     if (typeof str === "string" && str.startsWith(rootPath)) {
-      return "./" + str.substring(rootPath.length + 1)
+      return `./${str.substring(rootPath.length + 1)}`
     }
     return str
   }
@@ -1542,11 +1574,12 @@ let shakapackerConfigCache: {
 
 function loadShakapackerConfig(
   env: string,
-  appRoot: string
+  appRoot: string,
+  verbose = false
 ): { bundler: "webpack" | "rspack"; configPath: string } {
   // Return cached result if same environment
   if (shakapackerConfigCache && shakapackerConfigCache.env === env) {
-    if (process.env.VERBOSE) {
+    if (verbose) {
       console.log(
         `[Config Exporter] Using cached bundler config for env: ${env}`
       )
@@ -1554,7 +1587,7 @@ function loadShakapackerConfig(
     return shakapackerConfigCache.result
   }
 
-  if (process.env.VERBOSE) {
+  if (verbose) {
     console.log(`[Config Exporter] Loading shakapacker config for env: ${env}`)
   }
 
@@ -1623,18 +1656,20 @@ function loadShakapackerConfig(
  */
 async function autoDetectBundler(
   env: string,
-  appRoot: string
+  appRoot: string,
+  verbose = false
 ): Promise<"webpack" | "rspack"> {
-  const { bundler } = loadShakapackerConfig(env, appRoot)
+  const { bundler } = loadShakapackerConfig(env, appRoot, verbose)
   return bundler
 }
 
 function findConfigFile(
   bundler: "webpack" | "rspack",
   appRoot: string,
-  env: string
+  env: string,
+  verbose = false
 ): string {
-  const { configPath } = loadShakapackerConfig(env, appRoot)
+  const { configPath } = loadShakapackerConfig(env, appRoot, verbose)
   const extensions = ["ts", "js"]
 
   if (bundler === "rspack") {
@@ -1692,7 +1727,6 @@ function setupNodePath(appRoot: string): void {
       ? `${nodePaths.join(delimiter)}${delimiter}${existingNodePath}`
       : nodePaths.join(delimiter)
 
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
     require("module").Module._initPaths()
   }
 }