@bike4mind/cli 0.18.4 → 0.20.0

package/dist/commands/pluginCommand.mjs

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+import { n as getDefaultPluginsDir, r as isFeatureEnabled, t as PluginStore } from "../PluginStore-DwvOJ-G3.mjs";
+import { t as ConfigStore } from "../ConfigStore-DD3DcC3-.mjs";
+import { execFileSync } from "child_process";
+import { promises } from "fs";
+import path from "path";
+//#region src/commands/pluginCommand.ts
+/**
+* External plugin commands (b4m plugin list, b4m plugin add, b4m plugin remove).
+* These run outside the interactive CLI session. Plugins install to
+* ~/.bike4mind/plugins via npm --prefix; discovery/validation lives in
+* src/plugins/PluginStore.ts and loading in src/features/loadPlugin.ts.
+*/
+const NPM_TIMEOUT_MS = 12e4;
+/**
+* Conservative allowlist over npm's spec grammar: bare and scoped package
+* names (with optional @version/@tag), github:user/repo (optionally #ref),
+* user/repo shorthand, and file:<path>. Defense-in-depth on top of the
+* arg-vector exec - never the primary injection control.
+*/
+function validatePluginSpec(spec) {
+	const dangerous = /^file:/i.test(spec) ? /[;&|<>`$(){}!*?[\]'"%]/ : /[;&|<>`$(){}\\!*?[\]'"%]/;
+	if (!spec || /\s/.test(spec) || dangerous.test(spec)) return false;
+	return [
+		/^[a-z0-9][a-z0-9~._-]*(@[a-z0-9~._^>=<-]+)?$/i,
+		/^@[a-z0-9][a-z0-9~._-]*\/[a-z0-9][a-z0-9~._-]*(@[a-z0-9~._^>=<-]+)?$/i,
+		/^github:[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*(#[a-z0-9._/-]+)?$/i,
+		/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*(#[a-z0-9._/-]+)?$/i,
+		/^file:.+$/i
+	].some((pattern) => pattern.test(spec));
+}
+/** Map a user-supplied name to an installed plugin: configKey, package name, then short name. */
+function resolvePluginByName(descriptors, name) {
+	const exact = descriptors.find((d) => d.valid && d.configKey === name || d.name === name);
+	if (exact) return { plugin: exact };
+	const shortMatches = descriptors.filter((d) => {
+		const bare = d.name.replace(/^@[^/]+\//, "");
+		return bare === name || bare === `b4m-plugin-${name}`;
+	});
+	if (shortMatches.length === 1) return { plugin: shortMatches[0] };
+	if (shortMatches.length > 1) return { candidates: shortMatches };
+	return {};
+}
+function formatPluginList(descriptors, config) {
+	if (descriptors.length === 0) return [
+		"No plugins installed.",
+		"",
+		"Install one with:",
+		"  b4m plugin add <npm-package>",
+		"  b4m plugin add github:user/repo",
+		"  b4m plugin add file:/path/to/local/plugin"
+	].join("\n");
+	const lines = [];
+	for (const descriptor of descriptors) if (descriptor.valid) {
+		const enabled = isFeatureEnabled(config.features, descriptor.configKey);
+		lines.push(`• ${descriptor.name}@${descriptor.version} - ${enabled ? "✅ Enabled" : "⏸️ Disabled"} (key: ${descriptor.configKey})`);
+		if (descriptor.description) lines.push(`  ${descriptor.description}`);
+	} else lines.push(`• ${descriptor.name} - ⚠️ ${descriptor.reason}`);
+	return lines.join("\n");
+}
+/**
+* Run npm with the given args, or print a friendly message and exit. `action`
+* ('install'/'remove') only shapes the error text.
+*/
+/**
+* Quote npm args for the Windows shell path. npm.cmd needs `shell: true`, under
+* which Node joins args with spaces and hands them to cmd.exe - so a homedir
+* path with a metachar (`&`, space, ...) would be split or reinterpreted.
+* Double-quote every arg (escaping embedded `"` as `""`) to keep it literal. A
+* literal `%` in the homedir still env-expands (a pathological username, out of
+* scope); the user-supplied spec - the real untrusted input - already rejects
+* `%`. No-op on posix, where execFileSync runs shell-free.
+*/
+function quoteNpmArgs(args, platform = process.platform) {
+	if (platform !== "win32") return args;
+	return args.map((a) => `"${a.replace(/"/g, "\"\"")}"`);
+}
+function runNpmOrExit(args, cwd, action, target) {
+	try {
+		const isWindows = process.platform === "win32";
+		execFileSync(isWindows ? "npm.cmd" : "npm", quoteNpmArgs(args), {
+			cwd,
+			stdio: "inherit",
+			timeout: NPM_TIMEOUT_MS,
+			shell: isWindows
+		});
+	} catch (error) {
+		if (error.code === "ENOENT") console.error(`❌ npm is required to ${action} plugins. Install Node.js/npm and retry.`);
+		else console.error(`❌ ${action === "install" ? "Install" : "Uninstall"} failed for ${target} - see npm output above.`);
+		process.exit(1);
+	}
+}
+/** Top-level dependency names recorded in the plugins-dir package.json. */
+async function readTopLevelDeps(pluginsDir) {
+	try {
+		const raw = JSON.parse(await promises.readFile(path.join(pluginsDir, "package.json"), "utf-8"));
+		return new Set(Object.keys(raw.dependencies ?? {}));
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
+async function ensurePluginsDir(pluginsDir) {
+	await promises.mkdir(pluginsDir, { recursive: true });
+	const manifestPath = path.join(pluginsDir, "package.json");
+	try {
+		await promises.access(manifestPath);
+	} catch {
+		await promises.writeFile(manifestPath, JSON.stringify({
+			name: "b4m-plugins",
+			private: true,
+			version: "0.0.0"
+		}, null, 2));
+	}
+}
+async function handleAdd(spec, pluginsDir, configStore) {
+	if (!validatePluginSpec(spec)) {
+		console.error(`❌ Unsupported plugin spec: ${spec}`);
+		console.error("Supported forms: <npm-package>, @scope/<package>, github:user/repo, file:<path>");
+		process.exit(1);
+	}
+	await ensurePluginsDir(pluginsDir);
+	const store = new PluginStore({ pluginsDir });
+	const before = new Set((await store.discover()).map((d) => d.name));
+	const depsBefore = await readTopLevelDeps(pluginsDir);
+	runNpmOrExit([
+		"install",
+		"--prefix",
+		pluginsDir,
+		"--no-fund",
+		"--no-audit",
+		spec
+	], pluginsDir, "install", spec);
+	const added = (await store.discover()).filter((d) => !before.has(d.name));
+	const newTopLevel = new Set([...await readTopLevelDeps(pluginsDir)].filter((d) => !depsBefore.has(d)));
+	if (added.length === 0) {
+		if (newTopLevel.size > 0) {
+			console.log(`✅ Installed ${spec}.`);
+			console.warn("⚠️ It has no \"b4m-plugin\" manifest, so it will not load as a plugin.");
+		} else console.log(`✅ Installed ${spec}. No new plugin was enabled (it may already be installed).`);
+		console.log("Run `b4m plugin list` to see installed plugins and their enabled state.");
+		return;
+	}
+	for (const descriptor of added) {
+		if (!descriptor.valid) {
+			console.warn(`⚠️ ${descriptor.name} installed, but its manifest is invalid: ${descriptor.reason}`);
+			console.warn("It will not load until the manifest is fixed.");
+			continue;
+		}
+		if (!newTopLevel.has(descriptor.name)) {
+			console.warn(`ℹ️ ${descriptor.name} is a dependency and carries a plugin manifest; not enabling it.`);
+			console.warn(`   Enable it explicitly with: b4m plugin add ${descriptor.name}`);
+			continue;
+		}
+		const config = await configStore.load();
+		await configStore.save({
+			...config,
+			features: {
+				...config.features,
+				[descriptor.configKey]: true
+			}
+		});
+		console.log(`✅ Installed ${descriptor.name}@${descriptor.version} (plugin key: ${descriptor.configKey})`);
+		console.log(`Enabled feature "${descriptor.configKey}". It will load next time you start b4m.`);
+	}
+}
+async function handleRemove(name, pluginsDir, configStore) {
+	const descriptors = await new PluginStore({ pluginsDir }).discover();
+	const { plugin, candidates } = resolvePluginByName(descriptors, name);
+	if (candidates) {
+		console.error(`❌ "${name}" is ambiguous. Matches: ${candidates.map((c) => c.name).join(", ")}`);
+		process.exit(1);
+	}
+	if (!plugin) {
+		console.error(`❌ No installed plugin matches "${name}".`);
+		if (descriptors.length > 0) console.error(`Installed: ${descriptors.map((d) => d.name).join(", ")}`);
+		process.exit(1);
+		return;
+	}
+	runNpmOrExit([
+		"uninstall",
+		"--prefix",
+		pluginsDir,
+		plugin.name
+	], pluginsDir, "remove", plugin.name);
+	if (plugin.valid) {
+		const config = await configStore.load();
+		await configStore.save({
+			...config,
+			features: {
+				...config.features,
+				[plugin.configKey]: false
+			}
+		});
+	}
+	console.log(`✅ Removed plugin ${plugin.name}${plugin.valid ? ` and disabled "${plugin.configKey}"` : ""}.`);
+}
+async function handleList(pluginsDir, configStore) {
+	const descriptors = await new PluginStore({ pluginsDir }).discover();
+	const config = await configStore.load();
+	console.log("🔌 Plugins");
+	console.log("");
+	console.log(formatPluginList(descriptors, config));
+}
+async function handlePluginCommand(subcommand, argv) {
+	const configStore = new ConfigStore();
+	const pluginsDir = getDefaultPluginsDir();
+	switch (subcommand) {
+		case "list":
+			await handleList(pluginsDir, configStore);
+			break;
+		case "add":
+			if (!argv.spec) {
+				console.error("❌ Usage: b4m plugin add <spec>");
+				process.exit(1);
+			}
+			await handleAdd(argv.spec, pluginsDir, configStore);
+			break;
+		case "remove":
+			if (!argv.name) {
+				console.error("❌ Usage: b4m plugin remove <name>");
+				process.exit(1);
+			}
+			await handleRemove(argv.name, pluginsDir, configStore);
+			break;
+		default:
+			console.error(`❌ Unknown plugin subcommand: ${subcommand}`);
+			console.error("Available: list, add <spec>, remove <name>");
+			process.exit(1);
+	}
+}
+//#endregion
+export { formatPluginList, handleAdd, handlePluginCommand, handleRemove, quoteNpmArgs, resolvePluginByName, validatePluginSpec };

package/dist/commands/updateCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CBaK53NX.mjs";
-import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-C8xsNY2L.mjs";
+import { t as version } from "../package-BqKSCbso.mjs";
+import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-CQW8bxo6.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";
 import { createInterface } from "readline";
@@ -28,7 +28,7 @@ function runGlobalInstall() {
 /**
 * Ask the user how to handle an available update (the `'ask'` preference).
 * Plain readline (not Ink) because this runs in the bin bootstrap before the
-* code-split app loads — the only window in which it's safe to install.
+* code-split app loads - the only window in which it's safe to install.
 *
 * Maps the [U/a/s/n] keys to a choice; an empty line defaults to `'update'`
 * (capital `U` in the prompt is the default). The interface is fully torn down
@@ -65,7 +65,7 @@ async function promptUpdateChoice(currentVersion, latestVersion) {
 }
 /**
 * Install the latest version and re-exec into it so the session the user just
-* opened runs the new code — zero version skew, no mid-session file-swap risk.
+* opened runs the new code - zero version skew, no mid-session file-swap risk.
 *
 * spawnSync inherits the TTY so Ink renders normally in the child; the guard
 * env prevents an update loop. npm install overwrites the global package in
@@ -95,14 +95,14 @@ function installAndReexec(currentVersion, latestVersion) {
 * Auto-update on launch (Claude-Code-style), consent-first.
 *
 * Called from the bin bootstrap on the interactive path *before* the
-* code-split app (`dist/index.mjs`) is imported — the only safe install window
+* code-split app (`dist/index.mjs`) is imported - the only safe install window
 * (running an install while dist chunks are loaded would crash them).
 *
 * Behaviour by `autoUpdate` preference once an update is available on a
 * writable prefix:
-* - `'auto'`  → install silently and re-exec into the new version.
-* - `'never'` → do nothing (the startup notify banner still informs).
-* - `'ask'`   → prompt the user: Update once / Always (persist `auto`) /
+* - `'auto'`  -> install silently and re-exec into the new version.
+* - `'never'` -> do nothing (the startup notify banner still informs).
+* - `'ask'`   -> prompt the user: Update once / Always (persist `auto`) /
 *               Skip (ask again next launch) / Never (persist `never`).
 *
 * It is a safe no-op (returns without installing) when: already re-exec'd this
@@ -112,7 +112,8 @@ function installAndReexec(currentVersion, latestVersion) {
 * user is never blocked from launching the current version.
 */
 async function maybeAutoUpdateOnLaunch() {
-	if (!shouldAttemptAutoUpdate({ isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY) })) return;
+	const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+	if (!shouldAttemptAutoUpdate({ isTTY: isInteractive })) return;
 	const preference = await getAutoUpdatePreference();
 	if (preference === "never") return;
 	const currentVersion = version;

package/dist/{grepSearch-DJs-cubo-Bm0Y8oS3.mjs → grepSearch-BaYUfIYs-C-fxWc9G.mjs}

@@ -5,7 +5,7 @@ import { existsSync } from "fs";
 import path from "path";
 import { stat } from "fs/promises";
 import { promisify } from "util";
-//#region ../../b4m-core/services/dist/grepSearch-DJs-cubo.mjs
+//#region ../../b4m-core/services/dist/grepSearch-BaYUfIYs.mjs
 const execFileAsync = promisify(execFile);
 /** Cached ripgrep binary path after first resolution */
 let cachedRgPath = null;
@@ -13,7 +13,7 @@ let cachedRgPath = null;
 * Resolve ripgrep binary path via the package's exported `rgPath`.
 * `@vscode/ripgrep` is an optional dependency, so we load it lazily; in 1.18+
 * the binary lives in a platform-specific sibling package and is resolved by
-* the package itself — we just have to ask for it.
+* the package itself - we just have to ask for it.
 */
 async function getRipgrepPath() {
 	if (cachedRgPath) return cachedRgPath;
@@ -67,7 +67,7 @@ async function searchFiles(params, allowedDirectories) {
 	rgArgs.push(pattern, targetDir);
 	let stdout;
 	try {
-		stdout = (await execFileAsync(rgPath, rgArgs, { maxBuffer: 50 * 1024 * 1024 })).stdout;
+		stdout = (await execFileAsync(rgPath, rgArgs, { maxBuffer: 52428800 })).stdout;
 	} catch (error) {
 		const execError = error;
 		if (execError.code === 1 && execError.stdout) stdout = execError.stdout;