@apso/cli 0.15.2 → 0.15.3

package/dist/commands/mcp/serve.js

@@ -732,13 +732,11 @@ class McpServe extends base_command_1.default {
                         ],
                     };
                 }
-                // File the issue
-                const { execSync } = await Promise.resolve().then(() => tslib_1.__importStar(require("child_process")));
-                const url = execSync(`gh issue create --repo apsoai/cli --title "${title.replace(/"/g, '\\"')}" --body-file -`, {
-                    input: body,
-                    encoding: "utf-8",
-                    timeout: 30000,
-                }).trim();
+                // File the issue. fileIssue passes the title as a discrete argv
+                // element and the body via a temp file (execFile, shell: false), so
+                // backticks / $() / quotes in user-supplied content are never
+                // shell-evaluated (no command injection).
+                const url = (0, runner_1.fileIssue)(title, body);
                 return {
                     content: [
                         {

package/dist/lib/doctor/runner.d.ts

@@ -14,6 +14,14 @@ export declare function formatFindings(findings: DiagnosticFinding[]): string;
  * Check if the GitHub CLI is installed and authenticated.
  */
 export declare function isGhAvailable(): boolean;
+/**
+ * Build the argv array for `gh issue list --search`.
+ *
+ * Pure function (no side effects) so it can be unit-tested. The search query
+ * is returned as its own array element and is NEVER concatenated into a shell
+ * string, so backticks / quotes / `$()` in the title are treated literally.
+ */
+export declare function buildIssueSearchArgs(title: string): string[];
 /**
  * Search for existing issues that might duplicate what we're about to file.
  */
@@ -22,6 +30,27 @@ export declare function searchExistingIssues(title: string): {
     title: string;
     url: string;
 }[];
+/**
+ * Build the argv array for `gh issue create`.
+ *
+ * Pure function (no side effects) so it can be unit-tested. The title is
+ * returned as its own array element directly after `--title` and the body is
+ * passed via `--body-file <path>`. Nothing is concatenated into a shell string,
+ * so backticks / `$()` / quotes / newlines in the title are passed literally
+ * (no command substitution, no injection).
+ */
+export declare function buildIssueCreateArgs(title: string, bodyFilePath: string): string[];
+/**
+ * File a GitHub issue with an arbitrary title and body.
+ *
+ * The body is written to a temp file and passed via `--body-file`, and the
+ * title is passed as a discrete argv element via execFile (shell: false). The
+ * child's stdin is explicitly not inherited from the parent so it cannot
+ * consume / blank the body.
+ *
+ * Returns the URL of the created issue.
+ */
+export declare function fileIssue(title: string, body: string): string;
 /**
  * Build and file a GitHub issue from diagnostic findings.
  * Returns the URL of the created issue.

package/dist/lib/doctor/runner.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fileGitHubIssue = exports.searchExistingIssues = exports.isGhAvailable = exports.formatFindings = exports.runDiagnostics = void 0;
+exports.fileGitHubIssue = exports.fileIssue = exports.buildIssueCreateArgs = exports.searchExistingIssues = exports.buildIssueSearchArgs = exports.isGhAvailable = exports.formatFindings = exports.runDiagnostics = void 0;
 const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
 const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
 const checks_1 = require("./checks");
 /**
  * Run all diagnostic checks and return aggregated findings.
@@ -74,7 +76,8 @@ function formatFinding(f) {
  */
 function isGhAvailable() {
     try {
-        (0, child_process_1.execSync)("gh auth status", { stdio: "ignore" });
+        // execFile (shell: false) — no shell interpretation of arguments.
+        (0, child_process_1.execFileSync)("gh", ["auth", "status"], { stdio: "ignore" });
         return true;
     }
     catch {
@@ -82,14 +85,47 @@ function isGhAvailable() {
     }
 }
 exports.isGhAvailable = isGhAvailable;
+/**
+ * The GitHub repository issues are filed against.
+ */
+const ISSUE_REPO = "apsoai/cli";
+/**
+ * Build the argv array for `gh issue list --search`.
+ *
+ * Pure function (no side effects) so it can be unit-tested. The search query
+ * is returned as its own array element and is NEVER concatenated into a shell
+ * string, so backticks / quotes / `$()` in the title are treated literally.
+ */
+function buildIssueSearchArgs(title) {
+    // Extract key terms from the title for search (passed as a single argv arg).
+    const searchQuery = title.slice(0, 100);
+    return [
+        "issue",
+        "list",
+        "--repo",
+        ISSUE_REPO,
+        "--search",
+        searchQuery,
+        "--state",
+        "open",
+        "--json",
+        "number,title,url",
+        "--limit",
+        "5",
+    ];
+}
+exports.buildIssueSearchArgs = buildIssueSearchArgs;
 /**
  * Search for existing issues that might duplicate what we're about to file.
  */
 function searchExistingIssues(title) {
     try {
-        // Extract key terms from the title for search
-        const searchQuery = title.slice(0, 100);
-        const result = (0, child_process_1.execSync)(`gh issue list --repo apsoai/cli --search "${searchQuery.replace(/"/g, '\\"')}" --state open --json number,title,url --limit 5`, { encoding: "utf-8", timeout: 15000 });
+        // execFile with an args array (shell: false). The title is passed as a
+        // distinct argv element, so it is never shell-evaluated.
+        const result = (0, child_process_1.execFileSync)("gh", buildIssueSearchArgs(title), {
+            encoding: "utf-8",
+            timeout: 15000,
+        });
         return JSON.parse(result);
     }
     catch {
@@ -97,6 +133,56 @@ function searchExistingIssues(title) {
     }
 }
 exports.searchExistingIssues = searchExistingIssues;
+/**
+ * Build the argv array for `gh issue create`.
+ *
+ * Pure function (no side effects) so it can be unit-tested. The title is
+ * returned as its own array element directly after `--title` and the body is
+ * passed via `--body-file <path>`. Nothing is concatenated into a shell string,
+ * so backticks / `$()` / quotes / newlines in the title are passed literally
+ * (no command substitution, no injection).
+ */
+function buildIssueCreateArgs(title, bodyFilePath) {
+    return [
+        "issue",
+        "create",
+        "--repo",
+        ISSUE_REPO,
+        "--title",
+        title,
+        "--body-file",
+        bodyFilePath,
+    ];
+}
+exports.buildIssueCreateArgs = buildIssueCreateArgs;
+/**
+ * File a GitHub issue with an arbitrary title and body.
+ *
+ * The body is written to a temp file and passed via `--body-file`, and the
+ * title is passed as a discrete argv element via execFile (shell: false). The
+ * child's stdin is explicitly not inherited from the parent so it cannot
+ * consume / blank the body.
+ *
+ * Returns the URL of the created issue.
+ */
+function fileIssue(title, body) {
+    const bodyFilePath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "apso-issue-")), "body.md");
+    try {
+        fs.writeFileSync(bodyFilePath, body, "utf-8");
+        const result = (0, child_process_1.execFileSync)("gh", buildIssueCreateArgs(title, bodyFilePath), {
+            encoding: "utf-8",
+            timeout: 30000,
+            // Do not pipe the parent's stdin into the child (the body is supplied via
+            // file). stdout/stderr are captured by execFileSync.
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return result.trim();
+    }
+    finally {
+        fs.rmSync(path.dirname(bodyFilePath), { recursive: true, force: true });
+    }
+}
+exports.fileIssue = fileIssue;
 /**
  * Build and file a GitHub issue from diagnostic findings.
  * Returns the URL of the created issue.
@@ -105,12 +191,7 @@ function fileGitHubIssue(findings, ctx) {
     const pkg = loadCliVersion();
     const title = buildIssueTitle(findings);
     const body = buildIssueBody(findings, ctx, pkg);
-    const result = (0, child_process_1.execSync)(`gh issue create --repo apsoai/cli --title "${title.replace(/"/g, '\\"')}" --body-file -`, {
-        input: body,
-        encoding: "utf-8",
-        timeout: 30000,
-    });
-    return result.trim();
+    return fileIssue(title, body);
 }
 exports.fileGitHubIssue = fileGitHubIssue;
 function loadCliVersion() {

package/dist/lib/templates/entities/entity-col-enum.eta

@@ -3,8 +3,8 @@
 @Column({
     type: 'enum',
     nullable: <%= Boolean(field.nullable) %>,
-    enum: enums.<%= field.dataType%>,
-    default: enums.<%= field.dataType%>.<%= field.default.toLowerCase().replace(/[^a-z0-9]/g, '_').replace(/^(\d)/, '_$1').replace(/_+/g, '_').replace(/_$/, '') %>
+    enum: enums.<%= field.dataType%><% if (field.default !== null) { %>,
+    default: enums.<%= field.dataType%>.<%= field.default.toLowerCase().replace(/[^a-z0-9]/g, '_').replace(/^(\d)/, '_$1').replace(/_+/g, '_').replace(/_$/, '') %><% } %>
 })
 <% if (field.index ) {%>
 @Index()

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.15.2",
+      "version": "0.15.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@electric-sql/pglite": "^0.2.17",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.15.2",
+  "version": "0.15.3",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",