@aloth/olcli 0.8.0 → 0.9.1

package/README.md

@@ -130,12 +130,14 @@ All commands auto-detect the project when run from a synced directory (contains
 | `olcli list` | List all projects |
 | `olcli info [project]` | Show project details and file list |
 | `olcli pull [project] [dir]` | Download project files to local directory |
-| `olcli push [dir]` | Upload local changes to Overleaf |
+| `olcli push [dir]` | Upload local changes to Overleaf (`--delete` also removes files deleted locally) |
 | `olcli sync [dir]` | Bidirectional sync (pull + push) |
 | `olcli upload <file> [project]` | Upload a single file (`--to <path>` sets the remote destination) |
 | `olcli download <file> [project]` | Download a single file |
 | `olcli delete <file> [project]` | Delete a remote file or folder (alias: `rm`) |
 | `olcli rename <old> <new> [project]` | Rename a remote file or folder (alias: `mv`) |
+| `olcli project rename <new> [project]` | Rename the project itself (`--dry-run`) |
+| `olcli project rename-bulk` | Rename many projects by pattern (dry-run unless `--apply`) |
 | `olcli compile [project]` | Trigger PDF compilation |
 | `olcli pdf [project]` | Compile and download PDF |
 | `olcli output [type]` | Download compile output files |

package/dist/cli.js

@@ -12,7 +12,8 @@ import { writeFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join, dirname, basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { OverleafClient } from './client.js';
-import { resolveRemotePath } from './paths.js';
+import { resolveRemotePath, resolveWithin } from './paths.js';
+import { planProjectRenames } from './rename-plan.js';
 import { loadIgnore, shouldIgnore, buildTexSiblingSet, } from './ignore.js';
 // Read version from package.json
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -709,6 +710,140 @@ program
     }
 });
 // ─────────────────────────────────────────────────────────────────────────────
+// PROJECT COMMANDS (rename the project itself, not files inside it)
+// ─────────────────────────────────────────────────────────────────────────────
+const projectCmd = program
+    .command('project')
+    .description('Operate on projects themselves (rename, bulk rename)');
+projectCmd
+    .command('rename <newname> [project]')
+    .description('Rename a project')
+    .option('--dry-run', 'Show what would change without applying')
+    .option('--cookie <session>', 'Session cookie override')
+    .action(async (newname, project, options) => {
+    const spinner = ora('Renaming project...').start();
+    try {
+        const client = await getClient(options.cookie);
+        const proj = await resolveProject(client, project);
+        if (proj.name === newname) {
+            spinner.info(`Project is already named "${newname}"`);
+            return;
+        }
+        if (options.dryRun) {
+            spinner.stop();
+            console.log(chalk.bold('Would rename project:'));
+            console.log(`  ${chalk.cyan(proj.name)} \u2192 ${chalk.cyan(newname)}  ${chalk.dim(`(${proj.id})`)}`);
+            return;
+        }
+        await client.renameProject(proj.id, newname);
+        spinner.succeed(`Renamed project: ${proj.name} \u2192 ${newname}`);
+        setLastProject(proj.id);
+    }
+    catch (error) {
+        spinner.fail(`Failed: ${error.message}`);
+        process.exit(1);
+    }
+});
+projectCmd
+    .command('rename-bulk')
+    .description('Rename many projects at once by pattern (dry-run unless --apply)')
+    .option('--match <regex>', 'Only consider projects whose name matches this regex')
+    .option('--search <text>', 'Literal substring to replace in the name')
+    .option('--replace <text>', 'Replacement for --search or --match (supports $1, $2 backrefs)')
+    .option('--prefix <text>', 'Prepend this to the name')
+    .option('--suffix <text>', 'Append this to the name')
+    .option('--apply', 'Actually rename. Without this flag nothing is changed.')
+    .option('--max <n>', 'Refuse to apply if more than n projects would change', parseInt)
+    .option('--cookie <session>', 'Session cookie override')
+    .action(async (options) => {
+    // Inverted default on purpose: for a single project a dry-run flag is a
+    // convenience, but a bulk rename that fires on a typo is unrecoverable
+    // (Overleaf keeps no project-name history). So doing nothing is the
+    // default and --apply is the deliberate act.
+    const spinner = ora('Fetching projects...').start();
+    try {
+        const client = await getClient(options.cookie);
+        const projects = await client.listProjects();
+        let plan;
+        try {
+            plan = planProjectRenames(projects, {
+                match: options.match,
+                search: options.search,
+                replace: options.replace,
+                prefix: options.prefix,
+                suffix: options.suffix,
+            });
+        }
+        catch (err) {
+            spinner.fail(err.message);
+            process.exit(1);
+        }
+        const { planned, skipped, collisions } = plan;
+        spinner.stop();
+        if (planned.length === 0) {
+            console.log(chalk.yellow('No project names would change.'));
+            for (const s of skipped) {
+                console.log(chalk.dim(`  skipped ${s.name}: ${s.reason}`));
+            }
+            return;
+        }
+        console.log(chalk.bold(`${planned.length} project(s) would be renamed:`));
+        for (const p of planned) {
+            console.log(`  ${chalk.cyan(p.from)} ${chalk.dim('\u2192')} ${chalk.cyan(p.to)}  ${chalk.dim(`(${p.id})`)}`);
+        }
+        for (const s of skipped) {
+            console.log(chalk.dim(`  skipped ${s.name}: ${s.reason}`));
+        }
+        if (collisions.length > 0) {
+            console.log();
+            console.log(chalk.red(`Name collisions (${collisions.length}):`));
+            for (const c of collisions)
+                console.log(chalk.red(`  ${c}`));
+            console.log(chalk.red('Refusing to apply. Overleaf allows duplicate names, so this would'));
+            console.log(chalk.red('succeed silently and leave projects you cannot tell apart.'));
+            process.exit(1);
+        }
+        if (options.max !== undefined && planned.length > options.max) {
+            console.log();
+            console.log(chalk.red(`Refusing to apply: ${planned.length} changes exceed --max ${options.max}.`));
+            process.exit(1);
+        }
+        if (!options.apply) {
+            console.log();
+            console.log(chalk.yellow('Dry run. Nothing was changed. Re-run with --apply to rename.'));
+            return;
+        }
+        const applySpinner = ora(`Renaming ${planned.length} project(s)...`).start();
+        let renamed = 0;
+        const failures = [];
+        for (const p of planned) {
+            try {
+                await client.renameProject(p.id, p.to);
+                renamed++;
+                applySpinner.text = `Renaming... (${renamed}/${planned.length})`;
+            }
+            catch (error) {
+                // Keep going: a partial rename is recoverable by re-running, while
+                // aborting midway leaves the same partial state plus no report.
+                failures.push({ from: p.from, reason: error.message || String(error) });
+            }
+        }
+        if (failures.length > 0) {
+            applySpinner.warn(`Renamed ${renamed} project(s), ${failures.length} failed`);
+            for (const f of failures) {
+                console.log(chalk.yellow(`  ${f.from}: ${f.reason}`));
+            }
+        }
+        else {
+            applySpinner.succeed(`Renamed ${renamed} project(s)`);
+        }
+    }
+    catch (error) {
+        spinner.fail(`Failed: ${error.message}`);
+        process.exit(1);
+    }
+});
+// ─────────────────────────────────────────────────────────────────────────────
 // COMPILE COMMAND
 // ─────────────────────────────────────────────────────────────────────────────
 program
@@ -799,9 +934,15 @@ program
         let fileCount = 0;
         let skippedCount = 0;
         const skippedFiles = [];
+        const unsafeEntries = [];
         for (const entry of entries) {
             if (!entry.isDirectory) {
-                const filePath = join(targetDir, entry.entryName);
+                const filePath = resolveWithin(targetDir, entry.entryName);
+                if (!filePath) {
+                    // Entry would escape the target directory (zip-slip) - never extract
+                    unsafeEntries.push(entry.entryName);
+                    continue;
+                }
                 const fileDir = dirname(filePath);
                 // Check if local file exists and is newer than last pull
                 if (!options.force && existsSync(filePath) && lastPull) {
@@ -825,11 +966,18 @@ program
                 fileCount++;
             }
         }
+        if (unsafeEntries.length > 0) {
+            console.log(chalk.yellow(`  Skipped ${unsafeEntries.length} unsafe archive entr${unsafeEntries.length === 1 ? 'y' : 'ies'} (path escapes target directory):`));
+            for (const name of unsafeEntries.slice(0, 5)) {
+                console.log(chalk.dim(`    ${name}`));
+            }
+        }
         // Save project metadata (with manifest of remote files for sync deletion tracking)
         const remoteManifest = [];
         for (const e of entries) {
-            if (!e.isDirectory)
+            if (!e.isDirectory && resolveWithin(targetDir, e.entryName)) {
                 remoteManifest.push(e.entryName);
+            }
         }
         writeFileSync(join(targetDir, '.olcli.json'), JSON.stringify({
             projectId,
@@ -863,6 +1011,7 @@ program
     .description('Upload local changes to Overleaf project')
     .option('--project <name>', 'Project name or ID (overrides .olcli.json)')
     .option('--all', 'Upload all files (not just changed)')
+    .option('--delete', 'Propagate local deletions to the remote (opt-in; see docs)')
     .option('--dry-run', 'Show what would be uploaded without uploading')
     .option('--probe-folder', 'Probe for correct folder ID (use if uploads fail with folder_not_found)')
     .option('--no-default-ignore', 'Disable built-in LaTeX artifact ignore list (only .olignore applies)')
@@ -877,12 +1026,21 @@ program
     let projectName;
     let lastPull;
     let rootFolderId;
+    let previousPushManifest = [];
     if (existsSync(metaPath)) {
         const meta = JSON.parse(readFileSync(metaPath, 'utf-8'));
         projectId = meta.projectId;
         projectName = meta.projectName;
         lastPull = meta.lastPull ? new Date(meta.lastPull) : undefined;
         rootFolderId = meta.rootFolderId;
+        // Written by a previous push (pushManifest) or pull (remoteManifest).
+        // Either is a valid baseline for "what did this directory last put there".
+        if (Array.isArray(meta.pushManifest)) {
+            previousPushManifest = meta.pushManifest;
+        }
+        else if (Array.isArray(meta.remoteManifest)) {
+            previousPushManifest = meta.remoteManifest;
+        }
     }
     if (options.project) {
         // Override with command line option
@@ -920,6 +1078,10 @@ program
         const { readdirSync, statSync } = await import('node:fs');
         const filesToUpload = [];
         const filesIgnored = [];
+        // Every local file that survives ignore filtering, regardless of mtime.
+        // filesToUpload is mtime-filtered and therefore useless as a deletion
+        // baseline: an unchanged file would look "absent" and get deleted.
+        const allLocalPaths = new Set();
         function scanDir(currentDir, relativeBase = '') {
             const entries = readdirSync(currentDir, { withFileTypes: true });
             // Pre-compute sibling .tex set for the PDF special rule.
@@ -943,6 +1105,7 @@ program
                         filesIgnored.push(relativePath);
                         continue;
                     }
+                    allLocalPaths.add(relativePath);
                     // Check if file is newer than last pull (unless --all)
                     if (options.all || !lastPull) {
                         filesToUpload.push({ path: fullPath, relativePath });
@@ -965,15 +1128,46 @@ program
             }
             spinner.start('Scanning files...');
         }
-        if (filesToUpload.length === 0) {
+        // Deletion candidates: tracked by a previous push/pull from THIS directory,
+        // gone locally now. Never derived from the remote listing - that would also
+        // sweep away files someone else uploaded through the Overleaf editor.
+        //
+        // Skipped entirely without a baseline manifest: on a first push we cannot
+        // tell "deleted locally" from "never existed here", and guessing wrong
+        // destroys remote work.
+        const filesToDelete = [];
+        if (options.delete && previousPushManifest.length > 0) {
+            for (const path of previousPushManifest) {
+                if (path === 'output.pdf' || path.endsWith('/output.pdf'))
+                    continue;
+                if (!allLocalPaths.has(path))
+                    filesToDelete.push(path);
+            }
+        }
+        const noBaseline = options.delete === true && previousPushManifest.length === 0;
+        if (filesToUpload.length === 0 && filesToDelete.length === 0) {
             spinner.info('No files to upload');
+            if (noBaseline) {
+                console.log(chalk.dim('  --delete skipped: no manifest yet (first push from this directory)'));
+            }
             return;
         }
         if (options.dryRun) {
             spinner.stop();
-            console.log(chalk.bold(`Would upload ${filesToUpload.length} file(s) to "${projectName}":`));
-            for (const f of filesToUpload) {
-                console.log(`  ${chalk.cyan(f.relativePath)}`);
+            if (filesToUpload.length > 0) {
+                console.log(chalk.bold(`Would upload ${filesToUpload.length} file(s) to "${projectName}":`));
+                for (const f of filesToUpload) {
+                    console.log(`  ${chalk.cyan(f.relativePath)}`);
+                }
+            }
+            if (filesToDelete.length > 0) {
+                console.log(chalk.bold(`Would delete ${filesToDelete.length} file(s) on "${projectName}":`));
+                for (const p of filesToDelete) {
+                    console.log(`  ${chalk.red(p)}`);
+                }
+            }
+            if (noBaseline) {
+                console.log(chalk.dim('  --delete skipped: no manifest yet (first push from this directory)'));
             }
             return;
         }
@@ -1024,10 +1218,29 @@ program
                 }
             }
         }
-        // Update last push time
+        // Deletions run after uploads: a rename arrives as add+remove, and doing
+        // it in this order never leaves the remote without the file.
+        let deleted = 0;
+        const deleteSkipped = [];
+        if (filesToDelete.length > 0) {
+            spinner.text = `Deleting ${filesToDelete.length} remote file(s)...`;
+            for (const path of filesToDelete) {
+                try {
+                    await client.deleteByPath(projectId, path);
+                    deleted++;
+                }
+                catch (error) {
+                    // Already gone remotely is the common case and not an error worth
+                    // failing the push over.
+                    deleteSkipped.push({ path, reason: error.message || String(error) });
+                }
+            }
+        }
+        // Update last push time and the manifest that the next --delete reads.
         if (existsSync(metaPath)) {
             const meta = JSON.parse(readFileSync(metaPath, 'utf-8'));
             meta.lastPush = new Date().toISOString();
+            meta.pushManifest = Array.from(allLocalPaths).sort();
             writeFileSync(metaPath, JSON.stringify(meta, null, 2));
         }
         if (failed > 0) {
@@ -1039,6 +1252,18 @@ program
         else {
             spinner.succeed(`Uploaded ${uploaded} file(s) to "${projectName}"`);
         }
+        if (deleted > 0) {
+            console.log(chalk.dim(`  ✖ ${deleted} deleted on remote`));
+        }
+        if (deleteSkipped.length > 0) {
+            console.log(chalk.yellow(`  ${deleteSkipped.length} deletion(s) skipped:`));
+            for (const s of deleteSkipped) {
+                console.log(chalk.dim(`    ${s.path}: ${s.reason}`));
+            }
+        }
+        if (noBaseline) {
+            console.log(chalk.dim('  --delete skipped: no manifest yet; next push has a baseline'));
+        }
         setLastProject(projectId);
     }
     catch (error) {
@@ -1153,13 +1378,23 @@ program
             }
             spinner.start();
         }
-        // Extract remote files
+        // Extract remote files (skipping entries that would escape the target
+        // directory - zip-slip protection)
         const remoteFiles = new Map();
+        const unsafeRemoteEntries = [];
         for (const entry of zip.getEntries()) {
             if (!entry.isDirectory) {
+                if (!resolveWithin(targetDir, entry.entryName)) {
+                    unsafeRemoteEntries.push(entry.entryName);
+                    continue;
+                }
                 remoteFiles.set(entry.entryName, entry.getData());
             }
         }
+        if (unsafeRemoteEntries.length > 0) {
+            spinner.warn(`Skipped ${unsafeRemoteEntries.length} unsafe archive entr${unsafeRemoteEntries.length === 1 ? 'y' : 'ies'} (path escapes target directory)`);
+            spinner.start();
+        }
         // Merge: local changes take precedence for files modified after last pull
         let lastPull;
         let previousManifest = [];
@@ -1215,7 +1450,9 @@ program
         spinner.text = 'Comparing files...';
         // Write remote files, but preserve local modifications
         for (const [path, remoteContent] of remoteFiles) {
-            const filePath = join(targetDir, path);
+            const filePath = resolveWithin(targetDir, path);
+            if (!filePath)
+                continue; // already filtered above; defense in depth
             const fileDir = dirname(filePath);
             if (!existsSync(fileDir)) {
                 mkdirSync(fileDir, { recursive: true });