@algolia/wizard 0.57.0 → 0.58.0

package/dist/main.js

@@ -2038,8 +2038,16 @@ import z6 from "zod";
 import { readdir } from "node:fs/promises";
 
 // src/lib/tools/path.ts
-import { lstat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { lstat, mkdir as mkdir3, open } from "node:fs/promises";
 import { resolve as resolve2, relative, isAbsolute, dirname as dirname2, join as join5, sep } from "node:path";
+var DEFAULT_FILE_MODE = 438;
+function errorCode(err) {
+  if (typeof err === "object" && err !== null && "code" in err && typeof err.code === "string") {
+    return err.code;
+  }
+  return void 0;
+}
 function resolveInRoot(ctx, path) {
   const target = resolve2(ctx.cwd, path);
   const rel = relative(ctx.root, target);
@@ -2059,12 +2067,46 @@ async function hasSymlinkParent(ctx, target) {
     try {
       if ((await lstat(current)).isSymbolicLink()) return true;
     } catch (err) {
-      if (err.code === "ENOENT") return false;
+      if (errorCode(err) === "ENOENT") return false;
       throw err;
     }
   }
   return false;
 }
+function symlinkTargetError(target) {
+  return `Refused: ${target} is a symbolic link.`;
+}
+async function validateSafeWriteTarget(ctx, target) {
+  if (await hasSymlinkParent(ctx, target)) {
+    return `Refused: ${target} is outside the repo root (${ctx.root}).`;
+  }
+  try {
+    if ((await lstat(target)).isSymbolicLink()) return symlinkTargetError(target);
+  } catch (err) {
+    if (errorCode(err) !== "ENOENT") throw err;
+  }
+  return null;
+}
+async function safeWriteFile(ctx, target, content) {
+  const validationError = await validateSafeWriteTarget(ctx, target);
+  if (validationError) return validationError;
+  await mkdir3(dirname2(target), { recursive: true });
+  try {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW;
+    const handle = await open(target, flags, DEFAULT_FILE_MODE);
+    try {
+      await handle.writeFile(content, "utf8");
+    } finally {
+      await handle.close();
+    }
+  } catch (err) {
+    if (errorCode(err) === "ELOOP") {
+      return symlinkTargetError(target);
+    }
+    throw err;
+  }
+  return null;
+}
 
 // src/lib/tools/listFiles.ts
 function listFilesTool(ctx) {
@@ -2240,8 +2282,6 @@ function readFileTool(ctx) {
 // src/lib/tools/writeFile.ts
 import { tool as tool5 } from "ai";
 import z10 from "zod";
-import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
 function writeFileTool(ctx) {
   return tool5({
     description: "Write content to a file at the given path, overwriting it. Writes to secret env files (.env, .env.local, etc.) are refused by this tool \u2014 call it anyway and the tool will tell you how to proceed.",
@@ -2257,11 +2297,8 @@ function writeFileTool(ctx) {
         return `Refused: ${filePath} holds secrets and cannot be written directly. If a writeCredentials tool is available, use it to set Algolia credentials. If not, tell the user to set the value manually \u2014 do not reproduce the secret value in your response.`;
       }
       try {
-        if (await hasSymlinkParent(ctx, resolved2.target)) {
-          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
-        }
-        await mkdir3(dirname3(resolved2.target), { recursive: true });
-        await writeFile3(resolved2.target, content, "utf8");
+        const writeError = await safeWriteFile(ctx, resolved2.target, content);
+        if (writeError) return writeError;
         useWizard.getState().recordWrittenFile(resolved2.target);
         return `Wrote to ${filePath}`;
       } catch (err) {
@@ -2274,8 +2311,8 @@ function writeFileTool(ctx) {
 // src/lib/tools/writeAlgoliaCredentials.ts
 import { tool as tool6 } from "ai";
 import z13 from "zod";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname4, relative as relative3 } from "node:path";
+import { readFile as readFile5 } from "node:fs/promises";
+import { relative as relative3 } from "node:path";
 
 // src/lib/algoliaApiKey.ts
 import { z as z12 } from "zod";
@@ -2475,7 +2512,7 @@ async function resolveSearchOnlyKey(index, appId) {
 
 // src/lib/gitignore.ts
 import { execFile } from "node:child_process";
-import { lstat as lstat2, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import { lstat as lstat2, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join6, relative as relative2 } from "node:path";
 var GIT_ENV_OVERRIDES = [
   "GIT_DIR",
@@ -2540,7 +2577,7 @@ async function ensureGitIgnored(root, target) {
     }
     const existing = link ? await readFile4(gitIgnore, "utf8") : "";
     const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    await writeFile4(gitIgnore, `${existing}${prefix}${pattern}
+    await writeFile3(gitIgnore, `${existing}${prefix}${pattern}
 `, "utf8");
     return tracked ? "tracked" : "added";
   } catch (err) {
@@ -2603,9 +2640,8 @@ function writeCredentialsTool(ctx) {
       let existing = "";
       let present;
       try {
-        if (await hasSymlinkParent(ctx, resolved2.target)) {
-          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
-        }
+        const targetError = await validateSafeWriteTarget(ctx, resolved2.target);
+        if (targetError) return targetError;
         try {
           existing = await readFile5(resolved2.target, "utf8");
         } catch (err) {
@@ -2657,8 +2693,8 @@ function writeCredentialsTool(ctx) {
           (content, [name, value]) => upsertEnv(content, name, value),
           existing
         );
-        await mkdir4(dirname4(resolved2.target), { recursive: true });
-        await writeFile5(resolved2.target, updated, "utf8");
+        const writeError = await safeWriteFile(ctx, resolved2.target, updated);
+        if (writeError) return writeError;
         const sentences = [
           `Wrote ${[...credentials.map(([name]) => name), INDEX_NAME_VAR].join(", ")} to ${filePath}.`
         ];
@@ -3024,11 +3060,66 @@ var FILE_IO_COMMANDS = /* @__PURE__ */ new Set([
   "od",
   "strings"
 ]);
+function hasUnquotedHeredocOperator(command) {
+  const nextCharacterOffset = 1;
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const char = command.at(i);
+    if (char === "\\" && quote !== "'") {
+      i += nextCharacterOffset;
+      continue;
+    }
+    if (quote !== null) {
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (char === "<" && command.at(i + nextCharacterOffset) === "<") {
+      return true;
+    }
+  }
+  return false;
+}
 function commandSegments(command) {
-  return command.split(/&&|;|\|/).map((segment) => segment.trim());
+  const nextCharacterOffset = 1;
+  const segments = [];
+  let start = 0;
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const char = command.at(i);
+    if (char === "\\" && quote !== "'") {
+      i += nextCharacterOffset;
+      continue;
+    }
+    if (quote !== null) {
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    const nextCharacter = command.at(i + nextCharacterOffset);
+    const isDoubleAmpersand = char === "&" && nextCharacter === "&";
+    const isPipe = char === "|";
+    const isLineBreak = char === "\n" || char === "\r";
+    if (char !== ";" && !isDoubleAmpersand && !isPipe && !isLineBreak) {
+      continue;
+    }
+    segments.push(command.slice(start, i).trim());
+    if (isDoubleAmpersand || isPipe && nextCharacter === "|" || char === "\r" && nextCharacter === "\n") {
+      i += nextCharacterOffset;
+    }
+    start = i + nextCharacterOffset;
+  }
+  segments.push(command.slice(start).trim());
+  return segments;
 }
 function isFileIOCommand(command) {
-  return commandSegments(command).map((segment) => segment.split(/\s+/)[0]).some((word) => word !== void 0 && FILE_IO_COMMANDS.has(word));
+  return !hasUnquotedHeredocOperator(command) && commandSegments(command).map((segment) => segment.split(/\s+/)[0]).some((word) => word !== void 0 && FILE_IO_COMMANDS.has(word));
 }
 var READ_ONLY_BINARIES = /* @__PURE__ */ new Set([
   "wc",
@@ -3131,6 +3222,7 @@ function fastPathSegmentSafety(segment) {
   return void 0;
 }
 function fastPathSafety(command) {
+  if (hasUnquotedHeredocOperator(command)) return false;
   const results = commandSegments(command).map(fastPathSegmentSafety);
   if (results.some((r) => r === false)) return false;
   if (results.every((r) => r === true)) return true;
@@ -3172,7 +3264,7 @@ async function classifyCommandSafety(createModel, command, cwd, explanation, app
         "(1) Reporting or listing existing state, with no side effect \u2014 e.g. `git status`, `npm ls`, `npm outdated`, `pip show`, `pip freeze`, `cargo tree`, `docker ps`, `docker images`, `kubectl get pods`, `terraform state list`. This includes a read-only GET-style query to a remote registry or API that only fetches public metadata and changes nothing remote (e.g. `npm view <package>`, `pip index versions <package>`, `curl` with no -X/--request other than GET and no -d/--data) \u2014 safe because nothing changes, not because it stays local.",
         '(2) A "preview" or "check" mode that reports what a change WOULD do, or reports a problem, without making the change. This is a general pattern, not a fixed list \u2014 ANY command that takes a dry-run/check/plan/validate/diff/list-only flag is safe when that flag is present, regardless of whether the same flag would normally appear on a "safe" kind of command: `terraform plan`, `terraform validate`, `terraform fmt -check`, `black --check`, `prettier --check`, `isort --check`, `gofmt -l` (list-only), `stylelint` with no `--fix`, and equally `git push --dry-run`, `npm publish --dry-run`, `kubectl apply --dry-run=client` \u2014 these last three are otherwise-unsafe operations (push, publish, cluster changes) that the dry-run flag turns into a report. The corresponding command WITHOUT that flag (e.g. `terraform apply`, `black .`, `gofmt -w`, `git push`) is a different, unsafe command \u2014 the flag is what makes the difference, for any tool, not just the ones named here. This cuts both ways, so do not assume a bare invocation is the safe one: `cargo fmt`, `black`, `prettier`, `isort`, `rustfmt`, and `terraform fmt` all REWRITE FILES by default and need an explicit check/diff/dry-run flag to become safe, while `gofmt`, `eslint`, `stylelint`, `rubocop`, and `ruff check` default to a safe check-only mode and need an explicit fix/write flag to become unsafe \u2014 the same-looking bare command is safe for one group and unsafe for the other, so judge each by what its own flags actually say, not by resemblance to a tool you already judged.',
         "(3) Running the project's own tests, type checker, linter, or build/compile step (e.g. `npm run build`, `yarn build`, `vite build`, `webpack`, `tsc`, `cargo build`, `go build`, `mvn compile`), as long as it is not passed an autofix/write/update flag (e.g. --fix, -u, --write, rubocop -a) \u2014 this holds even though the point of a build step is to write compiled output to a build/dist/target directory inside the project (e.g. a target/, build/, dist/, or __pycache__ directory): writing that output does not make the command unsafe. It stops being safe the moment the command chain goes past building \u2014 a step that also deploys, publishes, uploads, or pushes the build (e.g. `next build && vercel deploy`, `npm run build && npm publish`) is unsafe for that later segment even though the build segment itself is fine; judge each chained segment on its own, same as elsewhere in this list.",
-        "Deleting or removing anything is unsafe, even something in a cache or build directory (e.g. `rm -rf __pycache__`, `cargo clean`, `git clean`), and even if the command otherwise fits one of the three categories above. Installing, uninstalling, or upgrading a dependency, changing a database schema, or writing to a path outside the project is also unsafe. A command chained with && or ; is only safe if every part of the chain is safe on its own.",
+        "Deleting or removing anything is unsafe, even something in a cache or build directory (e.g. `rm -rf __pycache__`, `cargo clean`, `git clean`), and even if the command otherwise fits one of the three categories above. Installing, uninstalling, or upgrading a dependency, changing a database schema, or writing to a path outside the project is also unsafe. A command chained with &&, ;, a pipe, or a line break (LF or CRLF) is only safe if every command segment is safe on its own. Treat each line as a separate command segment, even when the first line is safe.",
         "One specific, narrow exception to all of the above: when the command literally invokes one of these runner programs BY NAME as the leading command \u2014 npx, bunx, pnpm dlx, yarn dlx, pipx run, uvx \u2014 it is unsafe regardless of what it then runs, even something that looks like a harmless test/lint/typecheck command (e.g. `npx tsc --noEmit`, `uvx ruff check .`), because that runner can fetch and execute a different, unreviewed version of a package from a registry each time. This exception is about that specific syntax, not a general doubt about whether a tool is installed: a plain `ruff check .`, `pytest`, or any other bare command name is NOT this exception merely because you cannot verify from the string alone that it is installed \u2014 judge those the same as any other already-installed project tool, per the categories above. If you are unsure, judge it unsafe.",
         ...approvedHistory.length > 0 ? [
           "The user has already explicitly approved these exact commands earlier in this session (working directory in parentheses, then the command):",
@@ -3326,8 +3418,6 @@ function runShellTool(ctx, createModel = defaultCreateModel) {
 import { tool as tool10, generateText as generateText2, Output as Output2, NoObjectGeneratedError } from "ai";
 import { createAnthropic as createAnthropic2 } from "@ai-sdk/anthropic";
 import { nanoid as nanoid2 } from "nanoid";
-import { mkdir as mkdir5, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname5 } from "node:path";
 import z17 from "zod";
 var DATA_DIR = ".algolia-wizard/data";
 var RECORD_MODEL = "claude-haiku-4-5";
@@ -3404,15 +3494,12 @@ function generateRecordTool(ctx, createModel = defaultCreateModel2) {
         const relPath = `${DATA_DIR}/${slug}.json`;
         const resolved2 = resolveInRoot(ctx, relPath);
         if (resolved2.ok === false) return resolved2.error;
-        if (await hasSymlinkParent(ctx, resolved2.target)) {
-          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
-        }
-        await mkdir5(dirname5(resolved2.target), { recursive: true });
-        await writeFile6(
+        const writeError = await safeWriteFile(
+          ctx,
           resolved2.target,
-          JSON.stringify(records, null, 2),
-          "utf8"
+          JSON.stringify(records, null, 2)
         );
+        if (writeError) return writeError;
         logger.info(
           { entityName, count: records.length, relPath },
           "generateRecord wrote records to disk"
@@ -3811,7 +3898,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.57.0",
+  version: "0.58.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -4256,13 +4343,13 @@ ${formatCompletedSteps(ctx.completedSteps)}`,
 
 // src/actions/implement.ts
 import z28 from "zod";
-import { mkdir as mkdir7 } from "node:fs/promises";
+import { mkdir as mkdir5 } from "node:fs/promises";
 import { join as join10, relative as relative6 } from "node:path";
 
 // src/lib/git.ts
 import { execFile as execFile2 } from "node:child_process";
-import { copyFile, mkdir as mkdir6, stat as stat3 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join8, resolve as resolve3 } from "node:path";
+import { copyFile, mkdir as mkdir4, stat as stat3 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join8, resolve as resolve3 } from "node:path";
 var MAX_BUFFER = 32 * 1024 * 1024;
 function git(args) {
   return new Promise((resolve4, reject) => {
@@ -4305,7 +4392,7 @@ async function copyUploadIntoProject(repoRoot, ingestDir, sourcePath) {
     return { ok: true, relPath };
   }
   try {
-    await mkdir6(dirname6(dest), { recursive: true });
+    await mkdir4(dirname3(dest), { recursive: true });
     await copyFile(source, dest);
   } catch (err) {
     return {
@@ -4339,15 +4426,15 @@ function toRootRelative(p) {
 
 // src/lib/algoliaDocs.ts
 import { readFileSync, readdirSync, existsSync } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 import { fileURLToPath } from "node:url";
 var DOCS_SUBPATH = join9("docs", "algolia-sdk");
 function findDocsDir() {
-  let dir = dirname7(fileURLToPath(import.meta.url));
+  let dir = dirname4(fileURLToPath(import.meta.url));
   for (; ; ) {
     const candidate = join9(dir, DOCS_SUBPATH);
     if (existsSync(candidate)) return candidate;
-    const parent = dirname7(dir);
+    const parent = dirname4(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -4731,7 +4818,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES) {
   useWizard.getState().setTargetIndex(targetIndex ?? null);
   await assertGitRepoWithHead(repoRoot);
   if (useCases.includes("ingestion")) {
-    await mkdir7(join10(repoRoot, INGEST_DIR), { recursive: true });
+    await mkdir5(join10(repoRoot, INGEST_DIR), { recursive: true });
   }
   const normalized = normalizeFindingPaths(findings);
   const confirmed2 = normalized.confirmedEntities;
@@ -5280,7 +5367,7 @@ function getWorkflow(id) {
 }
 
 // src/ui/Welcome.tsx
-import { dirname as dirname8, join as join11 } from "node:path";
+import { dirname as dirname5, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { useState as useState9 } from "react";
 import { Box as Box11, Spacer, Text as Text12, useInput as useInput5, useWindowSize as useWindowSize5 } from "ink";
@@ -5312,7 +5399,7 @@ var sidebarItems = [
 // src/ui/Welcome.tsx
 import Image, { TerminalInfoContext, defaultTerminalInfo } from "ink-picture";
 import { jsx as jsx10, jsxs as jsxs11 } from "react/jsx-runtime";
-var IMAGE_PATH = join11(dirname8(fileURLToPath2(import.meta.url)), "algolia.png");
+var IMAGE_PATH = join11(dirname5(fileURLToPath2(import.meta.url)), "algolia.png");
 var TERMINAL_INFO = {
   ...defaultTerminalInfo,
   supportsUnicode: true,
@@ -6643,7 +6730,7 @@ function delay(ms) {
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "@algolia/wizard",
-  version: "0.57.0",
+  version: "0.58.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {