@astryxdesign/cli 0.0.0-bootstrap.0 → 0.1.0-canary.0b5b49f

package/src/commands/swizzle.path-safety.test.mjs

@@ -0,0 +1,117 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+/**
+ * @file Path-traversal regression tests for `astryx swizzle --output`.
+ *
+ * Spawns the CLI bin with a fake monorepo as cwd and asserts that
+ * `--output ../escaped` is rejected with a clear error AND that no
+ * file is created outside the project root.
+ */
+
+import {describe, it, expect, beforeEach, afterEach} from 'vitest';
+import {execFileSync} from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import {fileURLToPath} from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const CLI_BIN = path.resolve(__dirname, '../../bin/astryx.mjs');
+
+// Build a minimal fake monorepo: <root>/project/ contains a
+// node_modules/@astryxdesign/core/src/Button so findCoreDir succeeds, and
+// <root>/outside/ is the would-be traversal target.
+function buildFakeRepo(tmpDir) {
+  const project = path.join(tmpDir, 'project');
+  const outside = path.join(tmpDir, 'outside');
+  const core = path.join(project, 'node_modules', '@astryxdesign', 'core');
+  const buttonDir = path.join(core, 'src', 'Button');
+  fs.mkdirSync(buttonDir, {recursive: true});
+  fs.mkdirSync(outside, {recursive: true});
+  fs.writeFileSync(
+    path.join(buttonDir, 'Button.tsx'),
+    `// fake source\nexport const Button = () => null;\n`,
+  );
+  // Make findCoreDir's heuristic (or its node_modules branch) succeed by
+  // also creating packages/core symlink-style structure if needed:
+  fs.writeFileSync(path.join(core, 'package.json'), '{"name":"@astryxdesign/core"}');
+  return {project, outside};
+}
+
+function runCli(args, cwd) {
+  try {
+    const out = execFileSync('node', [CLI_BIN, ...args], {
+      cwd,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: {...process.env, FORCE_COLOR: '0'},
+    });
+    return {code: 0, stdout: out, stderr: ''};
+  } catch (e) {
+    return {
+      code: e.status ?? 1,
+      stdout: e.stdout?.toString() ?? '',
+      stderr: e.stderr?.toString() ?? '',
+    };
+  }
+}
+
+let tmpDir;
+beforeEach(() => {
+  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xds-swizzle-paths-'));
+});
+afterEach(() => {
+  fs.rmSync(tmpDir, {recursive: true, force: true});
+});
+
+describe('swizzle path safety', () => {
+  it('rejects --output with ../ traversal and writes no file outside root', () => {
+    const {project, outside} = buildFakeRepo(tmpDir);
+
+    const result = runCli(
+      ['swizzle', 'Button', '--output', '../outside-project', '--no-report'],
+      project,
+    );
+
+    expect(result.code).not.toBe(0);
+    expect(result.stderr + result.stdout).toMatch(/traversal|outside the project root/i);
+
+    // Hard check: nothing was written outside the project.
+    expect(fs.readdirSync(outside)).toEqual([]);
+    const escaped = path.join(tmpDir, 'outside-project');
+    expect(fs.existsSync(escaped)).toBe(false);
+  });
+
+  it('rejects --output with absolute path', () => {
+    const {project} = buildFakeRepo(tmpDir);
+    const absTarget = path.join(tmpDir, 'absolute-target');
+
+    const result = runCli(
+      ['swizzle', 'Button', '--output', absTarget, '--no-report'],
+      project,
+    );
+
+    expect(result.code).not.toBe(0);
+    expect(result.stderr + result.stdout).toMatch(/absolute paths are not allowed/i);
+    expect(fs.existsSync(absTarget)).toBe(false);
+  });
+
+  it('requires --overwrite in non-interactive mode when files already exist', () => {
+    const {project} = buildFakeRepo(tmpDir);
+    const outDir = path.join(project, 'components', 'astryx', 'Button');
+    fs.mkdirSync(outDir, {recursive: true});
+    const existingPath = path.join(outDir, 'Button.tsx');
+    fs.writeFileSync(existingPath, '// my customizations\n');
+
+    // Use --json to force non-interactive mode.
+    const result = runCli(
+      ['--json', 'swizzle', 'Button', '--no-report'],
+      project,
+    );
+
+    expect(result.code).not.toBe(0);
+    expect(result.stderr + result.stdout).toMatch(/overwrite/i);
+    // Existing file unchanged
+    expect(fs.readFileSync(existingPath, 'utf-8')).toBe('// my customizations\n');
+  });
+});

package/src/commands/swizzle.test.mjs

@@ -0,0 +1,53 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+import {describe, it, expect} from 'vitest';
+import {rewriteImports} from './swizzle.mjs';
+
+describe('rewriteImports', () => {
+  it('rewrites ../theme/tokens to @astryxdesign/core/theme', () => {
+    const input = `import { tokens } from '../theme/tokens.stylex';`;
+    const result = rewriteImports(input);
+    expect(result).toBe(`import { tokens } from '@astryxdesign/core/theme';`);
+  });
+
+  it('rewrites ../utils/mergeProps to @astryxdesign/core/utils', () => {
+    const input = `import { mergeProps } from '../utils/mergeProps';`;
+    const result = rewriteImports(input);
+    expect(result).toBe(`import { mergeProps } from '@astryxdesign/core/utils';`);
+  });
+
+  it('leaves same-level relative imports untouched', () => {
+    const input = `import { helper } from './helper';`;
+    const result = rewriteImports(input);
+    expect(result).toBe(`import { helper } from './helper';`);
+  });
+
+  it('rewrites export from statements', () => {
+    const input = `export { foo } from '../hooks/useLayout';`;
+    const result = rewriteImports(input);
+    expect(result).toBe(`export { foo } from '@astryxdesign/core/hooks';`);
+  });
+
+  it('handles double quotes', () => {
+    const input = `import { tokens } from "../theme/tokens.stylex";`;
+    const result = rewriteImports(input);
+    expect(result).toBe(`import { tokens } from "@astryxdesign/core/theme";`);
+  });
+
+  it('handles multiple imports in one file', () => {
+    const input = [
+      `import { tokens } from '../theme/tokens.stylex';`,
+      `import { mergeProps } from '../utils/mergeProps';`,
+      `import { helper } from './helper';`,
+    ].join('\n');
+
+    const result = rewriteImports(input);
+    expect(result).toBe(
+      [
+        `import { tokens } from '@astryxdesign/core/theme';`,
+        `import { mergeProps } from '@astryxdesign/core/utils';`,
+        `import { helper } from './helper';`,
+      ].join('\n'),
+    );
+  });
+});

package/src/commands/template.mjs

@@ -0,0 +1,196 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+/**
+ * @file template command — thin CLI wrapper around api/template.mjs
+ */
+
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import * as p from '@clack/prompts';
+import {isNonInteractive} from '../utils/path-safety.mjs';
+import {jsonOut, humanLog} from '../lib/json.mjs';
+import {cliError} from '../lib/cli-error.mjs';
+import {ERROR_CODES} from '../lib/error-codes.mjs';
+import {template as templateApi, getTemplateById} from '../api/template.mjs';
+
+export {discoverTemplates, listTemplates, getTemplateById} from '../api/template.mjs';
+
+function isCancel(value) {
+  if (p.isCancel(value)) {
+    p.cancel('Cancelled.');
+    process.exit(0);
+  }
+  return value;
+}
+
+export function registerTemplate(program) {
+  const templateCmd = program
+    .command('template [name] [path]')
+    .description('Inject a page or block template')
+    .option('--list', 'List available templates')
+    .option('--type <type>', 'Filter by template type: page or block')
+    .option('--skeleton', 'Show layout skeleton with spatial annotations (padding, gap, nesting)')
+    .option('-f, --overwrite', 'Overwrite existing files without prompting')
+    .action(async (name, targetPath, options) => {
+      const json = program.opts().json || false;
+
+      // Pre-flight overwrite check (only when we'd actually copy a file).
+      // The API resolves the destination; we need to mirror its logic
+      // narrowly enough to detect collisions before invoking it.
+      if (
+        name &&
+        targetPath &&
+        !options.list &&
+        !options.skeleton
+      ) {
+        const collision = await detectTemplateCollision(name, targetPath);
+        if (collision && !options.overwrite) {
+          const rel = path.relative(process.cwd(), collision) || collision;
+          if (json || isNonInteractive({json})) {
+            const msg =
+              `Refusing to overwrite existing file ${rel}. ` +
+              `Re-run with --overwrite (or -f) to replace it.`;
+            cliError(msg, {code: ERROR_CODES.ERR_FILE_EXISTS});
+            return;
+          }
+          const confirmed = isCancel(
+            await p.confirm({
+              message: `Overwrite existing file ${rel}?`,
+              initialValue: false,
+            }),
+          );
+          if (!confirmed) {
+            humanLog('Aborted. Re-run with --overwrite to replace the file.');
+            return;
+          }
+        }
+      }
+
+      let result;
+      try {
+        result = await templateApi(name, {
+          list: options.list,
+          skeleton: options.skeleton,
+          type: options.type,
+          targetPath,
+          cwd: process.cwd(),
+        });
+      } catch (e) {
+        // template API throws structured errors with {name, reason} suggestions —
+        // pass them through untouched so the CLI envelope matches the API.
+        cliError(e.message, {suggestions: e.suggestions || [], code: e.code});
+        return;
+      }
+
+      if (json) return jsonOut(result.type, result.data);
+
+      switch (result.type) {
+        case 'template.list': {
+          const pages = result.data.filter(t => t.type === 'page');
+          const blocks = result.data.filter(t => t.type === 'block');
+          if (pages.length > 0) {
+            humanLog('\nPage Templates:\n');
+            for (const t of pages) {
+              const status = t.isReady ? '' : ' (WIP)';
+              humanLog(`  ${t.name}${status}`);
+              if (t.description) humanLog(`    ${t.description}`);
+            }
+          }
+          if (blocks.length > 0) {
+            humanLog('\nBlock Templates:\n');
+            for (const t of blocks) {
+              const status = t.isReady ? '' : ' (WIP)';
+              humanLog(`  ${t.name}${status}`);
+              if (t.description) humanLog(`    ${t.description}`);
+            }
+          }
+          humanLog('\nUsage:');
+          humanLog('  astryx template <name> [target-path]   Scaffold page or block');
+          humanLog('  astryx template <name> --skeleton      Layout reference');
+          humanLog('  astryx template --list --type block    List only blocks\n');
+          break;
+        }
+
+        case 'template.skeleton': {
+          const {template: tName, description, components, skeleton} = result.data;
+          humanLog(`\n# ${tName}${description ? ' — ' + description : ''}`);
+          humanLog(`# Components: ${components.join(', ')}\n`);
+          humanLog(skeleton);
+          humanLog('');
+          break;
+        }
+
+        case 'template.show': {
+          humanLog(result.data.source);
+          break;
+        }
+
+        case 'template.copy': {
+          humanLog(`\n✓ Copied template to ${result.data.outputDir}/${result.data.fileName}\n`);
+          break;
+        }
+      }
+    });
+
+  templateCmd
+    .command('get')
+    .description('Fetch a template by ID via the astryx.config.mjs hook')
+    .requiredOption('--id <id>', 'Template identifier to fetch')
+    .action(async (options) => {
+      const json = program.opts().json || false;
+
+      let result;
+      try {
+        result = await getTemplateById(options.id, {cwd: process.cwd()});
+      } catch (e) {
+        cliError(e.message, {suggestions: e.suggestions, code: e.code});
+        return;
+      }
+
+      if (json) return jsonOut(result.type, result.data);
+
+      humanLog(result.data.source);
+    });
+}
+
+/**
+ * Mirror the destination-resolution logic in api/template.mjs so we can
+ * detect a clobber before invoking the API.
+ *
+ * Returns the absolute destination file path if it already exists, or
+ * `null` otherwise (template missing, no collision, or list/skeleton mode).
+ *
+ * Path-safety enforcement happens inside the API; here we only need
+ * enough precision to check existence — a false negative just means the
+ * API will catch the issue and abort.
+ */
+async function detectTemplateCollision(name, targetPath) {
+  const {discoverTemplates} = await import('../api/template.mjs');
+  let templates;
+  try {
+    templates = await discoverTemplates();
+  } catch {
+    return null;
+  }
+  const match = templates.find(t => t.dirName === name);
+  if (!match) return null;
+
+  // Resolve target as the API will. We can't call assertWithin here
+  // because the API does it itself; we just need to know "is there a
+  // file at the destination?".
+  const resolved = path.resolve(process.cwd(), targetPath);
+
+  // File-arg branch: targetPath looks like `./foo.tsx`.
+  const {isFilePathArg} = await import('../utils/path-safety.mjs');
+  let dest;
+  if (isFilePathArg(targetPath)) {
+    dest = resolved;
+  } else {
+    const fileName = match.type === 'block'
+      ? path.basename(match.filePath)
+      : 'page.tsx';
+    dest = path.join(resolved, fileName);
+  }
+
+  return fs.existsSync(dest) ? dest : null;
+}

package/src/commands/template.path-safety.test.mjs

@@ -0,0 +1,82 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+/**
+ * @file Path-traversal regression tests for `astryx template <name> <path>`.
+ *
+ * Drives the template API directly (it owns destination resolution +
+ * path-safety enforcement). Spawning the CLI bin is unnecessary because
+ * `template()` resolves and writes to disk itself.
+ */
+
+import {describe, it, expect, beforeEach, afterEach, vi} from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+
+let tmpDir;
+let templateApi;
+
+beforeEach(async () => {
+  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xds-template-paths-'));
+  templateApi = (await import('../api/template.mjs')).template;
+});
+afterEach(() => {
+  fs.rmSync(tmpDir, {recursive: true, force: true});
+  vi.restoreAllMocks();
+});
+
+describe('template path safety', () => {
+  it('rejects targetPath with ../ traversal and writes no file outside cwd', async () => {
+    const cwd = path.join(tmpDir, 'project');
+    const outside = path.join(tmpDir, 'outside');
+    fs.mkdirSync(cwd, {recursive: true});
+    fs.mkdirSync(outside, {recursive: true});
+
+    await expect(
+      templateApi('blank', {targetPath: '../outside/leaked', cwd}),
+    ).rejects.toThrow(/traversal|outside the project root/i);
+
+    // Nothing escaped.
+    expect(fs.readdirSync(outside)).toEqual([]);
+  });
+
+  it('rejects absolute targetPath', async () => {
+    const cwd = path.join(tmpDir, 'project');
+    fs.mkdirSync(cwd, {recursive: true});
+    const absTarget = path.join(tmpDir, 'absolute-out');
+
+    await expect(
+      templateApi('blank', {targetPath: absTarget, cwd}),
+    ).rejects.toThrow(/absolute paths are not allowed/i);
+
+    expect(fs.existsSync(absTarget)).toBe(false);
+  });
+
+  it('treats targetPath with .tsx extension as a file, not a directory', async () => {
+    const cwd = path.join(tmpDir, 'project');
+    fs.mkdirSync(cwd, {recursive: true});
+
+    // Use a real template name from the discovered set.
+    const {discoverTemplates} = await import('../api/template.mjs');
+    const all = await discoverTemplates();
+    const page = all.find(t => t.type === 'page');
+    if (!page) {
+      // No page templates packaged in this checkout — skip without failing the suite.
+      return;
+    }
+
+    const result = await templateApi(page.dirName, {
+      targetPath: './foo.tsx',
+      cwd,
+    });
+
+    // The file MUST be at ./foo.tsx, not ./foo.tsx/page.tsx.
+    expect(result.type).toBe('template.copy');
+    expect(result.data.fileName).toBe('foo.tsx');
+
+    expect(fs.existsSync(path.join(cwd, 'foo.tsx'))).toBe(true);
+    expect(fs.statSync(path.join(cwd, 'foo.tsx')).isFile()).toBe(true);
+    // The bad-old behavior would have left foo.tsx as a directory.
+    expect(fs.statSync(path.join(cwd, 'foo.tsx')).isDirectory()).toBe(false);
+  });
+});

package/src/commands/template.test.mjs

@@ -0,0 +1,62 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+import {describe, it, expect, beforeEach, afterEach, vi} from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+
+// We need to test listTemplates which depends on CLI_ROOT.
+// Since CLI_ROOT is computed from import.meta.url in paths.mjs,
+// we test listTemplates indirectly by mocking the module.
+
+let tmpDir;
+
+beforeEach(() => {
+  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xds-template-test-'));
+});
+
+afterEach(() => {
+  fs.rmSync(tmpDir, {recursive: true, force: true});
+  vi.restoreAllMocks();
+});
+
+describe('listTemplates', () => {
+  it('returns sorted template directory names', async () => {
+    // Create mock templates directory structure
+    const templatesDir = path.join(tmpDir, 'templates');
+    fs.mkdirSync(path.join(templatesDir, 'table'), {recursive: true});
+    fs.mkdirSync(path.join(templatesDir, 'blank'), {recursive: true});
+    fs.mkdirSync(path.join(templatesDir, 'login'), {recursive: true});
+    // Add a file (should be filtered out)
+    fs.writeFileSync(path.join(templatesDir, 'README.md'), '');
+
+    // listTemplates uses CLI_ROOT which is hardcoded from import.meta.url.
+    // Instead, we replicate its logic directly against our tmpDir.
+    const entries = fs
+      .readdirSync(templatesDir, {withFileTypes: true})
+      .filter(e => e.isDirectory())
+      .map(e => e.name)
+      .sort();
+
+    expect(entries).toEqual(['blank', 'login', 'table']);
+  });
+
+  it('returns empty array when templates dir is missing', async () => {
+    // No templates directory exists under tmpDir
+    const templatesDir = path.join(tmpDir, 'templates');
+    expect(fs.existsSync(templatesDir)).toBe(false);
+    // Replicate listTemplates logic
+    const result = fs.existsSync(templatesDir) ? [] : [];
+    expect(result).toEqual([]);
+  });
+});
+
+describe('listTemplates integration', () => {
+  it('can import listTemplates from the module', async () => {
+    const {listTemplates} = await import('./template.mjs');
+    // listTemplates returns based on CLI_ROOT/templates.
+    // It should return an array (possibly empty if templates dir doesn't exist).
+    const result = listTemplates();
+    expect(Array.isArray(result)).toBe(true);
+  });
+});