@calo-design/cli 0.4.6 → 0.4.8

package/bin/cli.js

@@ -32,7 +32,10 @@ const PEERS = [
   // The Mirror loads each prototype as an EAS Update at runtime; prototypes need
   // the expo-updates JS API (the "back to Mirror" chrome `push` injects calls it).
   // The shell binary provides the native module; prototypes ship JS only.
-  "expo-updates"
+  "expo-updates",
+  // Video + bundled-asset support (Mirror shell ships the native side from build 7).
+  "expo-video",
+  "expo-asset"
 ];
 // Install via explicit HTTPS git URLs. Auth is a short-lived GitHub token the Calo
 // broker mints after `calo-design login` — injected into git for the install
@@ -52,8 +55,17 @@ const ok = (s) => log(`${c.g("✓")} ${s}`);
 const warn = (s) => log(`${c.y("!")} ${s}`);
 const tilde = (p) => p.replace(os.homedir(), "~");
 
+// npm/npx are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
@@ -65,7 +77,8 @@ function sleep(sec) {
 // races / rate limits) and recover on retry. Retry before giving up.
 function runWithRetry(bin, argv, tries = 3, opts = {}) {
   for (let i = 1; i <= tries; i++) {
-    const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+    const [b, a, shell] = winShell(bin, argv);
+    const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
     if (!r.error && r.status === 0) return r;
     if (i < tries) { warn(`install hiccup — retrying (${i}/${tries - 1})…`); sleep(3); }
   }
@@ -185,6 +198,17 @@ function staleCaloDeps(rt, env) {
   return stale;
 }
 
+// Peers added to PEERS after a runtime was built (e.g. expo-video) never arrive
+// via the @calo git-dep refresh, so detect them from the runtime's package.json.
+function missingPeers(rt) {
+  try {
+    const deps = JSON.parse(fs.readFileSync(path.join(rt, "package.json"), "utf8")).dependencies || {};
+    return PEERS.filter((p) => !deps[p]);
+  } catch {
+    return [];
+  }
+}
+
 async function ensureRuntime({ force } = {}) {
   const rt = runtimeDir();
   if (!force && runtimeExists()) {
@@ -195,22 +219,35 @@ async function ensureRuntime({ force } = {}) {
       env = gitTokenEnv(await githubToken());
       stale = staleCaloDeps(rt, env);
     } catch {} // offline / broker hiccup — keep the existing runtime, don't block init
-    if (!stale.length) {
+    const missing = missingPeers(rt);
+    if (!stale.length && !missing.length) {
       ok(`shared runtime ready (${tilde(rt)})`);
       return;
     }
-    log(c.b(`\n[runtime] ${stale.join(" + ")} behind latest — refreshing the shared runtime`));
-    try {
-      // Non-destructive: `npm install` of the git specs re-resolves HEAD and updates
-      // node_modules in place; a failure aborts cleanly and leaves the runtime working.
-      runWithRetry("npm", ["install", ...PKG_SPECS, "--legacy-peer-deps"], 3, { cwd: rt, env });
-      let manifest = { pkgSpecs: PKG_SPECS, peers: PEERS };
-      try { manifest = { ...JSON.parse(fs.readFileSync(runtimeManifestPath(), "utf8")), ...manifest }; } catch {}
-      manifest.refreshedAt = new Date().toISOString();
-      fs.writeFileSync(runtimeManifestPath(), JSON.stringify(manifest, null, 2) + "\n");
-      ok("shared runtime refreshed — every linked prototype now uses the latest Calo stack");
-    } catch (e) {
-      warn(`couldn't refresh the runtime (${e.message}) — continuing with the existing install; \`calo-design update\` retries this.`);
+    if (stale.length) {
+      log(c.b(`\n[runtime] ${stale.join(" + ")} behind latest — refreshing the shared runtime`));
+      try {
+        // Non-destructive: `npm install` of the git specs re-resolves HEAD and updates
+        // node_modules in place; a failure aborts cleanly and leaves the runtime working.
+        runWithRetry("npm", ["install", ...PKG_SPECS, "--legacy-peer-deps"], 3, { cwd: rt, env });
+        let manifest = { pkgSpecs: PKG_SPECS, peers: PEERS };
+        try { manifest = { ...JSON.parse(fs.readFileSync(runtimeManifestPath(), "utf8")), ...manifest }; } catch {}
+        manifest.refreshedAt = new Date().toISOString();
+        fs.writeFileSync(runtimeManifestPath(), JSON.stringify(manifest, null, 2) + "\n");
+        ok("shared runtime refreshed — every linked prototype now uses the latest Calo stack");
+      } catch (e) {
+        warn(`couldn't refresh the runtime (${e.message}) — continuing with the existing install; \`calo-design update\` retries this.`);
+      }
+    }
+    if (missing.length) {
+      log(c.b(`\n[runtime] adding shared deps: ${missing.join(", ")}`));
+      try {
+        // `expo install` pins the version matching the runtime's Expo SDK.
+        run("npx", ["expo", "install", ...missing], { cwd: rt });
+        ok(`shared runtime now provides ${missing.join(", ")}`);
+      } catch (e) {
+        warn(`couldn't add ${missing.join(", ")} (${e.message}) — \`calo-design update\` retries this.`);
+      }
     }
     return;
   }

package/bin/mirror-push.js

@@ -50,14 +50,24 @@ const flag = (args, name, def) => {
 };
 const has = (args, name) => args.includes(name);
 
+// npm/npx/eas are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
 }
 function capture(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { encoding: "utf8", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, ...opts });
   return { status: r.status == null ? 1 : r.status, out: `${r.stdout || ""}${r.stderr || ""}` };
 }
 
@@ -134,13 +144,27 @@ function ensureBabelConfig(dir, fallbackFrom) {
   fs.writeFileSync(dst, 'module.exports = (api) => {\n  api.cache(true);\n  return { presets: ["babel-preset-expo"] };\n};\n');
 }
 
+// Never staged: installed/build/native output and editor state. Everything else
+// is the author's source and must be copied verbatim — prototypes keep code in
+// sibling folders (src/components, src/lib, public/, …) that the routes import
+// via the `@/*` tsconfig alias, so staging only src/app breaks the export.
+const STAGE_SKIP_DIRS = new Set([
+  "node_modules", ".git", ".expo", ".expo-shared", "dist", "build",
+  "ios", "android", ".tamagui", ".vscode", ".idea",
+]);
+
 function stageProject({ root, stage, slug, title, ad }) {
-  // Copy the author's routes + assets verbatim.
-  const stageSrcParent = path.join(stage, path.relative(root, path.dirname(ad)));
-  fs.mkdirSync(stageSrcParent, { recursive: true });
-  fs.cpSync(ad, path.join(stageSrcParent, path.basename(ad)), { recursive: true });
-  const assets = path.join(root, "assets");
-  if (fs.existsSync(assets)) fs.cpSync(assets, path.join(stage, "assets"), { recursive: true });
+  // Copy the author's whole project (minus STAGE_SKIP_DIRS). Managed files
+  // (app.json, package.json, tsconfig, babel, metro, node_modules, .gitignore,
+  // the root _layout) are overwritten below, exactly as before.
+  fs.cpSync(root, stage, {
+    recursive: true,
+    filter: (src) => {
+      const name = path.basename(src);
+      if (name === ".DS_Store" || name.endsWith(".log")) return false;
+      return !STAGE_SKIP_DIRS.has(name);
+    },
+  });
 
   const usesSrc = path.basename(path.dirname(ad)) === "src";
   const stagedAppDir = path.join(stage, usesSrc ? "src" : "", "app");
@@ -220,9 +244,11 @@ function linkNodeModules(stage) {
   fs.symlinkSync(target, link, process.platform === "win32" ? "junction" : "dir");
 }
 
-// Overwrite the root _layout with a managed one that wraps the app in a floating
-// "← Mirror" control. NOTE (v1): a custom root _layout (custom providers/Tabs) is
-// not preserved — we warn when the layout looks non-standard.
+// Overwrite the root _layout with a managed one. Returning to the launcher is now
+// handled natively by the Mirror shell (shake the device — see withCaloMirrorIos),
+// so no visible "back" control is injected; MirrorChrome is a pass-through kept as
+// a seam for any future prototype-side chrome. NOTE (v1): a custom root _layout
+// (custom providers/Tabs) is not preserved — we warn when it looks non-standard.
 function injectBackChrome({ stagedAppDir, mirrorChromeDir, libRel }) {
   const layout = path.join(stagedAppDir, "_layout.tsx");
   if (fs.existsSync(layout)) {
@@ -251,80 +277,15 @@ export default function RootLayout() {
   fs.writeFileSync(
     path.join(mirrorChromeDir, "mirror-chrome.tsx"),
     `import type { ReactNode } from "react";
-import { useState } from "react";
-import { ActivityIndicator, Platform, Pressable, Text, View } from "react-native";
-import * as Updates from "expo-updates";
-
-// One return at a time. A second tap before the reload lands fires a second
-// reloadAsync(), racing two runtime teardowns -> SIGBUS in ExpoModulesJSI. The
-// latch (plus the disabled button) drops extra taps; a failure clears it to retry.
-let returning = false;
-
-// Injected by \`calo-design push\`. Flips the binary back to the Mirror launcher.
-async function backToMirror() {
-  if (returning || !Updates.isEnabled) return;
-  returning = true;
-  try {
-    await Updates.setUpdateURLAndRequestHeadersOverride({
-      updateUrl: ${JSON.stringify(UPDATES_URL)},
-      requestHeaders: {
-        "expo-channel-name": ${JSON.stringify(LAUNCHER_CHANNEL)},
-        "expo-runtime-version": Updates.runtimeVersion ?? ${JSON.stringify(RUNTIME_VERSION)},
-        "expo-platform": Platform.OS,
-      },
-    });
-    // EAS requires channel + runtime-version + platform (400 otherwise); the
-    // override replaces headers, so send all three, then download.
-    await Updates.fetchUpdateAsync();
-  } catch {
-    returning = false;
-    return;
-  }
-  // Defer the reload to a fresh macrotask. Reloading inside the awaited chain
-  // races the fetch's JSI promise + the expo-updates reaper teardown -> SIGBUS
-  // in ExpoModulesJSI. Let the chain unwind + reaper settle, then reload.
-  // reloadAsync never resolves (the app reloads), so it is not awaited.
-  setTimeout(() => {
-    void Updates.reloadAsync().catch(() => {
-      returning = false;
-    });
-  }, 300);
-}
 
+// Returning to the Mirror launcher is handled NATIVELY by the shell binary:
+// shake the device and the shell flips its EAS Update channel back to the
+// launcher and relaunches (see calo-design-mirror/plugins/withCaloMirrorIos.js,
+// CaloShakeWindow + CaloMirrorBack). That works for every loaded prototype
+// without any JS here, so this wrapper no longer renders a "back" control — it
+// stays as a pass-through seam for any future prototype-side chrome.
 export function MirrorChrome({ children }: { children: ReactNode }) {
-  const [going, setGoing] = useState(false);
-  return (
-    <View style={{ flex: 1 }}>
-      {children}
-      <Pressable
-        accessibilityLabel="Back to Mirror"
-        accessibilityRole="button"
-        disabled={going}
-        onPress={() => {
-          setGoing(true);
-          void backToMirror();
-        }}
-        hitSlop={8}
-        style={({ pressed }) => ({
-          position: "absolute",
-          left: 16,
-          bottom: 36,
-          flexDirection: "row",
-          alignItems: "center",
-          gap: 8,
-          backgroundColor: "#208AEF",
-          paddingHorizontal: 16,
-          paddingVertical: 10,
-          borderRadius: 999,
-          opacity: going ? 0.85 : pressed ? 0.7 : 1,
-          transform: [{ scale: pressed ? 0.96 : 1 }],
-        })}
-      >
-        {going ? <ActivityIndicator size="small" color="#fff" /> : null}
-        <Text style={{ color: "#fff", fontWeight: "600" }}>{going ? "Returning…" : "← Mirror"}</Text>
-      </Pressable>
-    </View>
-  );
+  return <>{children}</>;
 }
 `
   );
@@ -519,6 +480,20 @@ async function cmdPush(args) {
     }
 
     log(c.b("\n✨ Live in the Mirror.") + " Open Calo Mirror and tap Refresh — your prototype is at the top.");
+
+    // Share target: the deep link the Mirror scanner (and iOS camera) opens.
+    // Print it + a scannable QR so a teammate can jump straight in.
+    const deepLink = `designchef://open/${slug}`;
+    log(c.b("\n📱 Share this prototype") + c.dim("  (teammate needs Calo Mirror installed)"));
+    log(c.dim("  Scan the QR with Calo Mirror — or share the link:"));
+    log("  " + c.b(deepLink) + "\n");
+    try {
+      require("qrcode-terminal").generate(deepLink, { small: true }, (qr) =>
+        log(qr.replace(/^/gm, "  ")),
+      );
+    } catch {
+      /* qrcode-terminal missing — the link above is enough to share */
+    }
   } finally {
     if (!keepStage) fs.rmSync(stage, { recursive: true, force: true });
   }

package/bin/share.js

@@ -54,8 +54,17 @@ function readPkg(root) {
   try { return JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")); } catch { return null; }
 }
 
+// npm/npx/wrangler are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
@@ -63,7 +72,8 @@ function run(bin, argv, opts = {}) {
 
 // Run while capturing combined output (to parse the deploy URL) but still show it.
 function runCapture(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { encoding: "utf8", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, ...opts });
   if (r.error) throw r.error;
   const out = (r.stdout || "") + (r.stderr || "");
   process.stdout.write(out);
@@ -74,9 +84,9 @@ function runCapture(bin, argv, opts = {}) {
 // Prefer an installed wrangler (project-local, then global); else npx. Only used by
 // --direct — the default path needs no wrangler on this machine.
 function wranglerCmd(root) {
-  const local = path.join(root, "node_modules", ".bin", "wrangler");
+  const local = path.join(root, "node_modules", ".bin", process.platform === "win32" ? "wrangler.cmd" : "wrangler");
   if (fs.existsSync(local)) return [local, []];
-  const probe = spawnSync("wrangler", ["--version"], { stdio: "ignore" });
+  const probe = spawnSync("wrangler", ["--version"], { stdio: "ignore", shell: process.platform === "win32" });
   if (!probe.error && probe.status === 0) return ["wrangler", []];
   return ["npx", ["--yes", "wrangler@latest"]];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calo-design/cli",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "One-line setup for Calo design tooling: logs in with your Calo email and installs the calo-design skill + design-system packages. No GitHub account needed.",
   "bin": {
     "calo-design": "bin/cli.js"
@@ -14,5 +14,8 @@
   "license": "UNLICENSED",
   "engines": {
     "node": ">=18"
+  },
+  "dependencies": {
+    "qrcode-terminal": "^0.12.0"
   }
 }