@cloudcli-ai/cloudcli 1.36.3 → 1.37.1

package/server/routes/tests/commands.test.js

@@ -1,82 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-import { executeModelsCommand } from '../commands.js';
-import { providerModelsService } from '../../modules/providers/services/provider-models.service.js';
-
-test('models command returns available models only for the active provider', async () => {
-  const originalGetProviderModels = providerModelsService.getProviderModels;
-  const originalGetCurrentActiveModel = providerModelsService.getCurrentActiveModel;
-  let getCurrentActiveModelCalls = 0;
-
-  providerModelsService.getProviderModels = async () => ({
-    models: {
-      OPTIONS: [{ value: 'gpt-5.4', label: 'gpt-5.4' }],
-      DEFAULT: 'gpt-5.4',
-    },
-    cache: {
-      updatedAt: '2026-01-01T00:00:00.000Z',
-      expiresAt: '2026-01-04T00:00:00.000Z',
-      source: 'fresh',
-    },
-  });
-  providerModelsService.getCurrentActiveModel = async () => {
-    getCurrentActiveModelCalls += 1;
-    return {
-      model: 'gpt-5.3-codex',
-    };
-  };
-
-  try {
-    const result = await executeModelsCommand([], {
-      provider: 'codex',
-      model: 'gpt-5.4',
-    });
-
-    assert.equal(result.type, 'builtin');
-    assert.equal(result.action, 'models');
-    assert.equal(result.data.current.provider, 'codex');
-    assert.equal(result.data.current.model, 'gpt-5.4');
-    assert.deepEqual(Object.keys(result.data.available), ['codex']);
-    assert.deepEqual(result.data.available.codex, result.data.availableModels);
-    assert.ok(result.data.availableModels.includes('gpt-5.4'));
-    assert.equal(result.data.available.claude, undefined);
-    assert.equal(result.data.available.cursor, undefined);
-    assert.equal(getCurrentActiveModelCalls, 0);
-  } finally {
-    providerModelsService.getProviderModels = originalGetProviderModels;
-    providerModelsService.getCurrentActiveModel = originalGetCurrentActiveModel;
-  }
-});
-
-test('models command falls back to claude for unsupported providers', async () => {
-  const originalGetProviderModels = providerModelsService.getProviderModels;
-  const originalGetCurrentActiveModel = providerModelsService.getCurrentActiveModel;
-
-  providerModelsService.getProviderModels = async () => ({
-    models: {
-      OPTIONS: [{ value: 'default', label: 'Default (recommended)' }],
-      DEFAULT: 'default',
-    },
-    cache: {
-      updatedAt: '2026-01-01T00:00:00.000Z',
-      expiresAt: '2026-01-04T00:00:00.000Z',
-      source: 'fresh',
-    },
-  });
-  providerModelsService.getCurrentActiveModel = async () => ({
-    model: 'default',
-  });
-
-  try {
-    const result = await executeModelsCommand([], {
-      provider: 'unknown-provider',
-    });
-
-    assert.equal(result.data.current.provider, 'claude');
-    assert.deepEqual(Object.keys(result.data.available), ['claude']);
-  } finally {
-    providerModelsService.getProviderModels = originalGetProviderModels;
-    providerModelsService.getCurrentActiveModel = originalGetCurrentActiveModel;
-  }
-});

package/server/routes/user.js

@@ -1,124 +0,0 @@
-import express from 'express';
-// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
-import spawn from 'cross-spawn';
-import { userDb } from '../modules/database/index.js';
-import { authenticateToken } from '../middleware/auth.js';
-import { getSystemGitConfig } from '../utils/gitConfig.js';
-
-const router = express.Router();
-
-function spawnAsync(command, args, options = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { ...options, shell: false });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', (data) => { stdout += data.toString(); });
-    child.stderr.on('data', (data) => { stderr += data.toString(); });
-    child.on('error', (error) => { reject(error); });
-    child.on('close', (code) => {
-      if (code === 0) { resolve({ stdout, stderr }); return; }
-      const error = new Error(`Command failed: ${command} ${args.join(' ')}`);
-      error.code = code;
-      error.stdout = stdout;
-      error.stderr = stderr;
-      reject(error);
-    });
-  });
-}
-
-router.get('/git-config', authenticateToken, async (req, res) => {
-  try {
-    const userId = req.user.id;
-    let gitConfig = userDb.getGitConfig(userId);
-
-    // If database is empty, try to get from system git config
-    if (!gitConfig || (!gitConfig.git_name && !gitConfig.git_email)) {
-      const systemConfig = await getSystemGitConfig();
-
-      // If system has values, save them to database for this user
-      if (systemConfig.git_name || systemConfig.git_email) {
-        userDb.updateGitConfig(userId, systemConfig.git_name, systemConfig.git_email);
-        gitConfig = systemConfig;
-        console.log(`Auto-populated git config from system for user ${userId}: ${systemConfig.git_name} <${systemConfig.git_email}>`);
-      }
-    }
-
-    res.json({
-      success: true,
-      gitName: gitConfig?.git_name || null,
-      gitEmail: gitConfig?.git_email || null
-    });
-  } catch (error) {
-    console.error('Error getting git config:', error);
-    res.status(500).json({ error: 'Failed to get git configuration' });
-  }
-});
-
-// Apply git config globally via git config --global
-router.post('/git-config', authenticateToken, async (req, res) => {
-  try {
-    const userId = req.user.id;
-    const { gitName, gitEmail } = req.body;
-
-    if (!gitName || !gitEmail) {
-      return res.status(400).json({ error: 'Git name and email are required' });
-    }
-
-    // Validate email format
-    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    if (!emailRegex.test(gitEmail)) {
-      return res.status(400).json({ error: 'Invalid email format' });
-    }
-
-    userDb.updateGitConfig(userId, gitName, gitEmail);
-
-    try {
-      await spawnAsync('git', ['config', '--global', 'user.name', gitName]);
-      await spawnAsync('git', ['config', '--global', 'user.email', gitEmail]);
-      console.log(`Applied git config globally: ${gitName} <${gitEmail}>`);
-    } catch (gitError) {
-      console.error('Error applying git config:', gitError);
-    }
-
-    res.json({
-      success: true,
-      gitName,
-      gitEmail
-    });
-  } catch (error) {
-    console.error('Error updating git config:', error);
-    res.status(500).json({ error: 'Failed to update git configuration' });
-  }
-});
-
-router.post('/complete-onboarding', authenticateToken, async (req, res) => {
-  try {
-    const userId = req.user.id;
-    userDb.completeOnboarding(userId);
-
-    res.json({
-      success: true,
-      message: 'Onboarding completed successfully'
-    });
-  } catch (error) {
-    console.error('Error completing onboarding:', error);
-    res.status(500).json({ error: 'Failed to complete onboarding' });
-  }
-});
-
-router.get('/onboarding-status', authenticateToken, async (req, res) => {
-  try {
-    const userId = req.user.id;
-    const hasCompleted = userDb.hasCompletedOnboarding(userId);
-
-    res.json({
-      success: true,
-      hasCompletedOnboarding: hasCompleted
-    });
-  } catch (error) {
-    console.error('Error checking onboarding status:', error);
-    res.status(500).json({ error: 'Failed to check onboarding status' });
-  }
-});
-
-export default router;

package/server/services/notification-orchestrator.js

@@ -1,7 +0,0 @@
-export {
-  buildNotificationPayload,
-  createNotificationEvent,
-  notifyUserIfEnabled,
-  notifyRunStopped,
-  notifyRunFailed,
-} from '../modules/notifications/services/notification-orchestrator.service.js';

package/server/services/tests/notification-orchestrator.test.js

@@ -1,80 +0,0 @@
-import assert from 'node:assert/strict';
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-
-import webPush from 'web-push';
-
-import {
-  closeConnection,
-  initializeDatabase,
-  notificationPreferencesDb,
-  pushSubscriptionsDb,
-  sessionsDb,
-  userDb,
-} from '../../modules/database/index.js';
-
-import { notifyRunStopped } from '../notification-orchestrator.js';
-
-async function withIsolatedDatabase(runTest) {
-  const previousDatabasePath = process.env.DATABASE_PATH;
-  const tempDirectory = await mkdtemp(path.join(tmpdir(), 'notification-orchestrator-'));
-  const databasePath = path.join(tempDirectory, 'auth.db');
-
-  closeConnection();
-  process.env.DATABASE_PATH = databasePath;
-  await initializeDatabase();
-
-  try {
-    await runTest();
-  } finally {
-    closeConnection();
-    if (previousDatabasePath === undefined) {
-      delete process.env.DATABASE_PATH;
-    } else {
-      process.env.DATABASE_PATH = previousDatabasePath;
-    }
-    await rm(tempDirectory, { recursive: true, force: true });
-  }
-}
-
-test('push payload uses the app session id when notified with a provider session id', async () => {
-  const originalSendNotification = webPush.sendNotification;
-  const sentPayloads = [];
-
-  webPush.sendNotification = async (_subscription, payload) => {
-    sentPayloads.push(JSON.parse(payload));
-    return {};
-  };
-
-  try {
-    await withIsolatedDatabase(async () => {
-      const user = userDb.createUser('notify-user', 'hash');
-      const userId = Number(user.id);
-
-      notificationPreferencesDb.updatePreferences(userId, {
-        channels: { webPush: true },
-        events: { actionRequired: true, stop: true, error: true },
-      });
-      pushSubscriptionsDb.saveSubscription(userId, 'https://example.test/push', 'p256dh', 'auth');
-      sessionsDb.createAppSession('app-session-1', 'claude', '/workspace/demo');
-      sessionsDb.assignProviderSessionId('app-session-1', 'claude-native-1');
-
-      notifyRunStopped({
-        userId,
-        provider: 'claude',
-        sessionId: 'claude-native-1',
-        stopReason: 'completed',
-      });
-
-      await new Promise((resolve) => setImmediate(resolve));
-
-      assert.equal(sentPayloads.length, 1);
-      assert.equal(sentPayloads[0]?.data?.sessionId, 'app-session-1');
-      assert.match(sentPayloads[0]?.data?.tag, /app-session-1/);
-    });
-  } finally {
-    webPush.sendNotification = originalSendNotification;
-  }
-});

package/server/utils/colors.js

@@ -1,21 +0,0 @@
-// ANSI color codes for terminal output
-const colors = {
-    reset: '\x1b[0m',
-    bright: '\x1b[1m',
-    cyan: '\x1b[36m',
-    green: '\x1b[32m',
-    yellow: '\x1b[33m',
-    blue: '\x1b[34m',
-    dim: '\x1b[2m',
-};
-
-const c = {
-    info: (text) => `${colors.cyan}${text}${colors.reset}`,
-    ok: (text) => `${colors.green}${text}${colors.reset}`,
-    warn: (text) => `${colors.yellow}${text}${colors.reset}`,
-    tip: (text) => `${colors.blue}${text}${colors.reset}`,
-    bright: (text) => `${colors.bright}${text}${colors.reset}`,
-    dim: (text) => `${colors.dim}${text}${colors.reset}`,
-};
-
-export { colors, c };

package/server/utils/commandParser.js

@@ -1,305 +0,0 @@
-import { execFile } from 'child_process';
-import { promises as fs } from 'fs';
-import path from 'path';
-import { promisify } from 'util';
-
-import { parse as parseShellCommand } from 'shell-quote';
-
-import { parseFrontMatter } from '../shared/frontmatter.js';
-
-const execFileAsync = promisify(execFile);
-
-// Configuration
-const MAX_INCLUDE_DEPTH = 3;
-const BASH_TIMEOUT = 30000; // 30 seconds
-const BASH_COMMAND_ALLOWLIST = [
-  'echo',
-  'ls',
-  'pwd',
-  'date',
-  'whoami',
-  'git',
-  'npm',
-  'node',
-  'cat',
-  'grep',
-  'find',
-  'task-master'
-];
-
-/**
- * Parse a markdown command file and extract frontmatter and content
- * @param {string} content - Raw markdown content
- * @returns {object} Parsed command with data (frontmatter) and content
- */
-export function parseCommand(content) {
-  try {
-    const parsed = parseFrontMatter(content);
-    return {
-      data: parsed.data || {},
-      content: parsed.content || '',
-      raw: content
-    };
-  } catch (error) {
-    throw new Error(`Failed to parse command: ${error.message}`);
-  }
-}
-
-/**
- * Replace argument placeholders in content
- * @param {string} content - Content with placeholders
- * @param {string|array} args - Arguments to replace (string or array)
- * @returns {string} Content with replaced arguments
- */
-export function replaceArguments(content, args) {
-  if (!content) return content;
-
-  let result = content;
-
-  // Convert args to array if it's a string
-  const argsArray = Array.isArray(args) ? args : (args ? [args] : []);
-
-  // Replace $ARGUMENTS with all arguments joined by space
-  const allArgs = argsArray.join(' ');
-  result = result.replace(/\$ARGUMENTS/g, allArgs);
-
-  // Replace positional arguments $1-$9
-  for (let i = 1; i <= 9; i++) {
-    const regex = new RegExp(`\\$${i}`, 'g');
-    const value = argsArray[i - 1] || '';
-    result = result.replace(regex, value);
-  }
-
-  return result;
-}
-
-/**
- * Validate file path to prevent directory traversal
- * @param {string} filePath - Path to validate
- * @param {string} basePath - Base directory path
- * @returns {boolean} True if path is safe
- */
-export function isPathSafe(filePath, basePath) {
-  const resolvedPath = path.resolve(basePath, filePath);
-  const resolvedBase = path.resolve(basePath);
-  const relative = path.relative(resolvedBase, resolvedPath);
-  return (
-    relative !== '' &&
-    !relative.startsWith('..') &&
-    !path.isAbsolute(relative)
-  );
-}
-
-/**
- * Process file includes in content (@filename syntax)
- * @param {string} content - Content with @filename includes
- * @param {string} basePath - Base directory for resolving file paths
- * @param {number} depth - Current recursion depth
- * @returns {Promise<string>} Content with includes resolved
- */
-export async function processFileIncludes(content, basePath, depth = 0) {
-  if (!content) return content;
-
-  // Prevent infinite recursion
-  if (depth >= MAX_INCLUDE_DEPTH) {
-    throw new Error(`Maximum include depth (${MAX_INCLUDE_DEPTH}) exceeded`);
-  }
-
-  // Match @filename patterns (at start of line or after whitespace)
-  const includePattern = /(?:^|\s)@([^\s]+)/gm;
-  const matches = [...content.matchAll(includePattern)];
-
-  if (matches.length === 0) {
-    return content;
-  }
-
-  let result = content;
-
-  for (const match of matches) {
-    const fullMatch = match[0];
-    const filename = match[1];
-
-    // Security: prevent directory traversal
-    if (!isPathSafe(filename, basePath)) {
-      throw new Error(`Invalid file path (directory traversal detected): ${filename}`);
-    }
-
-    try {
-      const filePath = path.resolve(basePath, filename);
-      const fileContent = await fs.readFile(filePath, 'utf-8');
-
-      // Recursively process includes in the included file
-      const processedContent = await processFileIncludes(fileContent, basePath, depth + 1);
-
-      // Replace the @filename with the file content
-      result = result.replace(fullMatch, fullMatch.startsWith(' ') ? ' ' + processedContent : processedContent);
-    } catch (error) {
-      if (error.code === 'ENOENT') {
-        throw new Error(`File not found: ${filename}`);
-      }
-      throw error;
-    }
-  }
-
-  return result;
-}
-
-/**
- * Validate that a command and its arguments are safe
- * @param {string} commandString - Command string to validate
- * @returns {{ allowed: boolean, command: string, args: string[], error?: string }} Validation result
- */
-export function validateCommand(commandString) {
-  const trimmedCommand = commandString.trim();
-  if (!trimmedCommand) {
-    return { allowed: false, command: '', args: [], error: 'Empty command' };
-  }
-
-  // Parse the command using shell-quote to handle quotes properly
-  const parsed = parseShellCommand(trimmedCommand);
-
-  // Check for shell operators or control structures
-  const hasOperators = parsed.some(token =>
-    typeof token === 'object' && token.op
-  );
-
-  if (hasOperators) {
-    return {
-      allowed: false,
-      command: '',
-      args: [],
-      error: 'Shell operators (&&, ||, |, ;, etc.) are not allowed'
-    };
-  }
-
-  // Extract command and args (all should be strings after validation)
-  const tokens = parsed.filter(token => typeof token === 'string');
-
-  if (tokens.length === 0) {
-    return { allowed: false, command: '', args: [], error: 'No valid command found' };
-  }
-
-  const [command, ...args] = tokens;
-
-  // Extract just the command name (remove path if present)
-  const commandName = path.basename(command);
-
-  // Check if command exactly matches allowlist (no prefix matching)
-  const isAllowed = BASH_COMMAND_ALLOWLIST.includes(commandName);
-
-  if (!isAllowed) {
-    return {
-      allowed: false,
-      command: commandName,
-      args,
-      error: `Command '${commandName}' is not in the allowlist`
-    };
-  }
-
-  // Validate arguments don't contain dangerous metacharacters
-  const dangerousPattern = /[;&|`$()<>{}[\]\\]/;
-  for (const arg of args) {
-    if (dangerousPattern.test(arg)) {
-      return {
-        allowed: false,
-        command: commandName,
-        args,
-        error: `Argument contains dangerous characters: ${arg}`
-      };
-    }
-  }
-
-  return { allowed: true, command: commandName, args };
-}
-
-/**
- * Backward compatibility: Check if command is allowed (deprecated)
- * @deprecated Use validateCommand() instead for better security
- * @param {string} command - Command to validate
- * @returns {boolean} True if command is allowed
- */
-export function isBashCommandAllowed(command) {
-  const result = validateCommand(command);
-  return result.allowed;
-}
-
-/**
- * Sanitize bash command output
- * @param {string} output - Raw command output
- * @returns {string} Sanitized output
- */
-export function sanitizeOutput(output) {
-  if (!output) return '';
-
-  // Remove control characters except \t, \n, \r
-  return [...output]
-    .filter(ch => {
-      const code = ch.charCodeAt(0);
-      return code === 9  // \t
-          || code === 10 // \n
-          || code === 13 // \r
-          || (code >= 32 && code !== 127);
-    })
-    .join('');
-}
-
-/**
- * Process bash commands in content (!command syntax)
- * @param {string} content - Content with !command syntax
- * @param {object} options - Options for bash execution
- * @returns {Promise<string>} Content with bash commands executed and replaced
- */
-export async function processBashCommands(content, options = {}) {
-  if (!content) return content;
-
-  const { cwd = process.cwd(), timeout = BASH_TIMEOUT } = options;
-
-  // Match !command patterns (at start of line or after whitespace)
-  const commandPattern = /(?:^|\n)!(.+?)(?=\n|$)/g;
-  const matches = [...content.matchAll(commandPattern)];
-
-  if (matches.length === 0) {
-    return content;
-  }
-
-  let result = content;
-
-  for (const match of matches) {
-    const fullMatch = match[0];
-    const commandString = match[1].trim();
-
-    // Security: validate command and parse args
-    const validation = validateCommand(commandString);
-
-    if (!validation.allowed) {
-      throw new Error(`Command not allowed: ${commandString} - ${validation.error}`);
-    }
-
-    try {
-      // Execute without shell using execFile with parsed args
-      const { stdout, stderr } = await execFileAsync(
-        validation.command,
-        validation.args,
-        {
-          cwd,
-          timeout,
-          maxBuffer: 1024 * 1024, // 1MB max output
-          shell: false, // IMPORTANT: No shell interpretation
-          env: { ...process.env, PATH: process.env.PATH } // Inherit PATH for finding commands
-        }
-      );
-
-      const output = sanitizeOutput(stdout || stderr || '');
-
-      // Replace the !command with the output
-      result = result.replace(fullMatch, fullMatch.startsWith('\n') ? '\n' + output : output);
-    } catch (error) {
-      if (error.killed) {
-        throw new Error(`Command timeout: ${commandString}`);
-      }
-      throw new Error(`Command failed: ${commandString} - ${error.message}`);
-    }
-  }
-
-  return result;
-}

package/server/utils/gitConfig.js

@@ -1,35 +0,0 @@
-// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
-import spawn from 'cross-spawn';
-
-function spawnAsync(command, args) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { shell: false });
-    let stdout = '';
-    child.stdout.on('data', (data) => { stdout += data.toString(); });
-    child.on('error', (error) => { reject(error); });
-    child.on('close', (code) => {
-      if (code === 0) { resolve({ stdout }); return; }
-      reject(new Error(`Command failed with code ${code}`));
-    });
-  });
-}
-
-/**
- * Read git configuration from system's global git config
- * @returns {Promise<{git_name: string|null, git_email: string|null}>}
- */
-export async function getSystemGitConfig() {
-  try {
-    const [nameResult, emailResult] = await Promise.all([
-      spawnAsync('git', ['config', '--global', 'user.name']).catch(() => ({ stdout: '' })),
-      spawnAsync('git', ['config', '--global', 'user.email']).catch(() => ({ stdout: '' }))
-    ]);
-
-    return {
-      git_name: nameResult.stdout.trim() || null,
-      git_email: emailResult.stdout.trim() || null
-    };
-  } catch (error) {
-    return { git_name: null, git_email: null };
-  }
-}