@cpmai/cli 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +157 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.js +2167 -0
- package/package.json +65 -0
package/README.md
ADDED
|
@@ -0,0 +1,157 @@
|
|
|
1
|
+
# @cpm/cli
|
|
2
|
+
|
|
3
|
+
The command-line interface for CPM (Claude Package Manager).
|
|
4
|
+
|
|
5
|
+
## Installation
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install -g @cpm/cli
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Commands
|
|
12
|
+
|
|
13
|
+
### `cpm install <package>`
|
|
14
|
+
|
|
15
|
+
Install a package from the registry.
|
|
16
|
+
|
|
17
|
+
```bash
|
|
18
|
+
cpm install commit # Installs @cpm/commit
|
|
19
|
+
cpm install @cpm/nextjs-rules # Full package name
|
|
20
|
+
cpm install @affaan-m/claude-rules # Package from another author
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
**Options:**
|
|
24
|
+
- `-p, --platform <platform>` - Target platform (default: `claude-code`)
|
|
25
|
+
|
|
26
|
+
### `cpm uninstall <package>`
|
|
27
|
+
|
|
28
|
+
Remove an installed package.
|
|
29
|
+
|
|
30
|
+
```bash
|
|
31
|
+
cpm uninstall commit
|
|
32
|
+
cpm rm @cpm/nextjs-rules # Alias: rm
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
### `cpm search <query>`
|
|
36
|
+
|
|
37
|
+
Search for packages in the registry.
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
cpm search react
|
|
41
|
+
cpm search github --type mcp
|
|
42
|
+
cpm search typescript --limit 5
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
**Options:**
|
|
46
|
+
- `-t, --type <type>` - Filter by type (`rules`, `skill`, `mcp`)
|
|
47
|
+
- `-l, --limit <number>` - Limit results (default: 10)
|
|
48
|
+
|
|
49
|
+
### `cpm list`
|
|
50
|
+
|
|
51
|
+
List all installed packages.
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
cpm list
|
|
55
|
+
cpm ls # Alias: ls
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
### `cpm init`
|
|
59
|
+
|
|
60
|
+
Create a new `cpm.yaml` manifest file.
|
|
61
|
+
|
|
62
|
+
```bash
|
|
63
|
+
cpm init
|
|
64
|
+
cpm init -y # Skip prompts
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
### Global Options
|
|
68
|
+
|
|
69
|
+
```bash
|
|
70
|
+
cpm -q <command> # Quiet mode (errors only)
|
|
71
|
+
cpm -v <command> # Verbose mode (debug output)
|
|
72
|
+
cpm --version # Show version
|
|
73
|
+
cpm --help # Show help
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
## Package Types
|
|
77
|
+
|
|
78
|
+
| Type | Description | Installed To |
|
|
79
|
+
|------|-------------|--------------|
|
|
80
|
+
| `rules` | Coding guidelines | `~/.claude/rules/<name>/` |
|
|
81
|
+
| `skill` | Slash commands | `~/.claude/skills/<name>/` |
|
|
82
|
+
| `mcp` | MCP servers | `~/.claude.json` |
|
|
83
|
+
|
|
84
|
+
## Development
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
# Install dependencies
|
|
88
|
+
pnpm install
|
|
89
|
+
|
|
90
|
+
# Build
|
|
91
|
+
pnpm build
|
|
92
|
+
|
|
93
|
+
# Run tests
|
|
94
|
+
pnpm test
|
|
95
|
+
|
|
96
|
+
# Type check
|
|
97
|
+
pnpm typecheck
|
|
98
|
+
|
|
99
|
+
# Run in dev mode
|
|
100
|
+
pnpm dev
|
|
101
|
+
```
|
|
102
|
+
|
|
103
|
+
## Architecture
|
|
104
|
+
|
|
105
|
+
```
|
|
106
|
+
src/
|
|
107
|
+
├── index.ts # CLI entry point (commander setup)
|
|
108
|
+
├── commands/ # Command implementations
|
|
109
|
+
│ ├── install.ts # Install command
|
|
110
|
+
│ ├── uninstall.ts # Uninstall command
|
|
111
|
+
│ ├── search.ts # Search command
|
|
112
|
+
│ ├── list.ts # List command
|
|
113
|
+
│ └── init.ts # Init command
|
|
114
|
+
├── adapters/ # Platform adapters
|
|
115
|
+
│ ├── base.ts # Base adapter interface
|
|
116
|
+
│ ├── index.ts # Adapter factory
|
|
117
|
+
│ └── claude-code.ts # Claude Code adapter
|
|
118
|
+
├── utils/ # Utilities
|
|
119
|
+
│ ├── logger.ts # Production logger (consola)
|
|
120
|
+
│ ├── config.ts # Configuration helpers
|
|
121
|
+
│ ├── downloader.ts # Package downloader
|
|
122
|
+
│ ├── registry.ts # Registry client
|
|
123
|
+
│ ├── platform.ts # Platform detection
|
|
124
|
+
│ └── embedded-packages.ts # Fallback manifests
|
|
125
|
+
└── types.ts # Type definitions
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
## Security
|
|
129
|
+
|
|
130
|
+
The CLI implements several security measures:
|
|
131
|
+
|
|
132
|
+
### MCP Command Validation
|
|
133
|
+
|
|
134
|
+
Only these commands are allowed for MCP servers:
|
|
135
|
+
- `npx`, `node`, `python`, `python3`, `deno`, `bun`, `uvx`
|
|
136
|
+
|
|
137
|
+
Blocked argument patterns:
|
|
138
|
+
- `--eval`, `-e`, `-c` (code execution)
|
|
139
|
+
- `curl`, `wget` (network commands)
|
|
140
|
+
- `rm`, `sudo`, `chmod`, `chown` (system commands)
|
|
141
|
+
- Shell metacharacters (`|`, `;`, `&`, `` ` ``, `$`)
|
|
142
|
+
|
|
143
|
+
### Path Traversal Prevention
|
|
144
|
+
|
|
145
|
+
- Package names are sanitized before use as folder names
|
|
146
|
+
- File paths are validated to stay within allowed directories
|
|
147
|
+
- Tarball extraction blocks path traversal attempts
|
|
148
|
+
|
|
149
|
+
### File Sanitization
|
|
150
|
+
|
|
151
|
+
- File names are validated and sanitized
|
|
152
|
+
- Hidden files (starting with `.`) are blocked
|
|
153
|
+
- Only `.md` files are allowed for rules/skills
|
|
154
|
+
|
|
155
|
+
## License
|
|
156
|
+
|
|
157
|
+
MIT
|
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
#!/usr/bin/env node
|