@expressots/cli 3.0.0 → 4.0.0-preview.2

package/bin/profile/optimizers/index.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyOptimizations = exports.generateOptimizations = void 0;
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Generate optimization recommendations based on Dockerfile analysis
+ */
+function generateOptimizations(analysis) {
+    const optimizations = [];
+    // Multi-stage build
+    if (!analysis.hasMultiStage) {
+        optimizations.push({
+            id: "OPT001",
+            priority: "high",
+            category: "Size",
+            title: "Use multi-stage build",
+            description: "Multi-stage builds significantly reduce final image size by separating build and runtime dependencies.",
+            impact: "Can reduce image size by 50-80%",
+            autoFixable: false,
+        });
+    }
+    // Non-root user
+    if (!analysis.hasNonRootUser) {
+        optimizations.push({
+            id: "OPT002",
+            priority: "high",
+            category: "Security",
+            title: "Run as non-root user",
+            description: "Running containers as root is a security risk. Create and use a non-root user.",
+            impact: "Reduces attack surface if container is compromised",
+            autoFixable: false,
+        });
+    }
+    // Health check
+    if (!analysis.hasHealthCheck) {
+        optimizations.push({
+            id: "OPT003",
+            priority: "medium",
+            category: "Reliability",
+            title: "Add HEALTHCHECK instruction",
+            description: "Health checks allow orchestrators to detect and restart unhealthy containers.",
+            impact: "Faster failure detection, better uptime",
+            autoFixable: true,
+            fix: (content) => {
+                // Add health check before CMD
+                const cmdMatch = content.match(/^CMD\s+.*/m);
+                if (cmdMatch) {
+                    const healthCheck = `HEALTHCHECK --interval=30s --timeout=3s --start-period=40s \\
+  CMD node -e "require('http').get('http://localhost:3000/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
+
+`;
+                    return content.replace(cmdMatch[0], healthCheck + cmdMatch[0]);
+                }
+                return content;
+            },
+        });
+    }
+    // npm ci instead of npm install
+    if (analysis.hasNpmInstallWithoutCi) {
+        optimizations.push({
+            id: "OPT004",
+            priority: "low",
+            category: "Best Practice",
+            title: "Use npm ci instead of npm install",
+            description: "npm ci provides faster, more reliable, and reproducible builds.",
+            impact: "Faster builds, reproducible dependencies",
+            autoFixable: true,
+            fix: (content) => {
+                return content.replace(/npm install(?!\s+[-\w])/g, "npm ci");
+            },
+        });
+    }
+    // .dockerignore
+    if (!analysis.hasDockerignore) {
+        optimizations.push({
+            id: "OPT005",
+            priority: "medium",
+            category: "Size",
+            title: "Add .dockerignore file",
+            description: "Exclude unnecessary files from the build context to speed up builds and reduce image size.",
+            impact: "Faster builds, smaller images",
+            autoFixable: false,
+        });
+    }
+    // Combine RUN commands
+    if (analysis.layers > 10) {
+        optimizations.push({
+            id: "OPT006",
+            priority: "low",
+            category: "Size",
+            title: "Combine RUN commands",
+            description: `You have ${analysis.layers} RUN layers. Consider combining related commands to reduce layers.`,
+            impact: "Slightly smaller image, faster pulls",
+            autoFixable: false,
+        });
+    }
+    // Check base image
+    if (analysis.baseImage &&
+        !analysis.baseImage.includes("alpine") &&
+        !analysis.baseImage.includes("slim")) {
+        optimizations.push({
+            id: "OPT007",
+            priority: "medium",
+            category: "Size",
+            title: "Consider using Alpine or slim base image",
+            description: `Current base image: ${analysis.baseImage}. Alpine images are typically 5-10x smaller.`,
+            impact: "Significantly smaller image size",
+            autoFixable: false,
+        });
+    }
+    return optimizations;
+}
+exports.generateOptimizations = generateOptimizations;
+/**
+ * Apply auto-fixable optimizations to Dockerfile
+ */
+async function applyOptimizations(dockerfilePath, optimizations) {
+    let content = fs_1.default.readFileSync(dockerfilePath, "utf-8");
+    let appliedCount = 0;
+    for (const opt of optimizations) {
+        if (opt.autoFixable && opt.fix) {
+            const newContent = opt.fix(content);
+            if (newContent !== content) {
+                content = newContent;
+                appliedCount++;
+            }
+        }
+    }
+    if (appliedCount > 0) {
+        fs_1.default.writeFileSync(dockerfilePath, content, "utf-8");
+    }
+    return appliedCount;
+}
+exports.applyOptimizations = applyOptimizations;

package/bin/providers/add/form.d.ts

@@ -1,2 +1,2 @@
-export declare function addProvider(packageName: string, version?: string, isDevDependency?: boolean): Promise<void>;
+export declare function addProvider(packageName: string, version?: string | false, isDevDependency?: boolean): Promise<void>;
 export declare function removeProvider(packageName: string): Promise<void>;

package/bin/providers/add/form.js

@@ -5,10 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeProvider = exports.addProvider = void 0;
 const chalk_1 = __importDefault(require("chalk"));
-const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_process_1 = require("node:process");
 const cli_ui_1 = require("../../utils/cli-ui");
+const input_validation_1 = require("../../utils/input-validation");
+const safe_spawn_1 = require("../../utils/safe-spawn");
 const PACKAGE_MANAGERS = {
     npm: {
         install: "install",
@@ -38,11 +39,14 @@ function detectPackageManager() {
 }
 async function execProcess({ command, args, directory, }) {
     return new Promise((resolve, reject) => {
-        const isWindows = process.platform === "win32";
-        const execCommand = isWindows ? `${command}.cmd` : command;
-        const processRunner = (0, node_child_process_1.spawn)(execCommand, args, {
+        // `safeSpawn` (cross-spawn) resolves the Windows `.cmd` shim and
+        // applies cmd.exe-aware escaping for every argv entry. Combined
+        // with the `isValidPackageName` / `isValidVersion` guards on the
+        // caller side, this prevents command injection via the package
+        // name or version specifier (which can legitimately contain
+        // `>`, `<`, `|`, etc. in a semver range).
+        const processRunner = (0, safe_spawn_1.safeSpawn)(command, args, {
             cwd: directory,
-            shell: true,
         });
         console.log(chalk_1.default.bold.blue(`Executing: ${command} ${args.join(" ")}`));
         console.log(chalk_1.default.yellow("-------------------------------------------------"));
@@ -66,6 +70,20 @@ async function execProcess({ command, args, directory, }) {
     });
 }
 async function addProvider(packageName, version, isDevDependency = false) {
+    if (!(0, input_validation_1.isValidPackageName)(packageName)) {
+        (0, cli_ui_1.printError)(`Invalid package name: ${JSON.stringify(packageName)}`, "add-package");
+        return;
+    }
+    // yargs assigns `false` for the version flag when the user omits
+    // it (see add/cli.ts). Treat that and "latest" as "no suffix".
+    let versionSuffix = "";
+    if (typeof version === "string" && version !== "latest") {
+        if (!(0, input_validation_1.isValidVersion)(version)) {
+            (0, cli_ui_1.printError)(`Invalid version specifier: ${JSON.stringify(version)}`, "add-package");
+            return;
+        }
+        versionSuffix = `@${version}`;
+    }
     const packageManager = detectPackageManager();
     if (!packageManager) {
         (0, cli_ui_1.printError)("No package manager found in the project", "add-package");
@@ -75,7 +93,6 @@ async function addProvider(packageName, version, isDevDependency = false) {
     const command = isDevDependency
         ? pkgManagerConfig.addDev
         : pkgManagerConfig.install;
-    const versionSuffix = version && version !== "latest" ? `@${version}` : "";
     console.log(`${isDevDependency ? "Adding devDependency" : "Installing"} ${packageName}...`);
     await execProcess({
         command: packageManager,
@@ -85,6 +102,10 @@ async function addProvider(packageName, version, isDevDependency = false) {
 }
 exports.addProvider = addProvider;
 async function removeProvider(packageName) {
+    if (!(0, input_validation_1.isValidPackageName)(packageName)) {
+        (0, cli_ui_1.printError)(`Invalid package name: ${JSON.stringify(packageName)}`, "remove-package");
+        return;
+    }
     const packageManager = detectPackageManager();
     if (!packageManager) {
         (0, cli_ui_1.printError)("No package manager found in the project", "remove-package");

package/bin/providers/create/form.js

@@ -39,7 +39,8 @@ const createExternalProvider = async (provider) => {
             ]);
         }
         try {
-            const emitter = (0, degit_1.default)(`expressots/templates/provider`);
+            // Pinned to the v4.0.0 GA tag, same policy as `expressots new`.
+            const emitter = (0, degit_1.default)(`expressots/templates/provider#v4.0.0-preview.1`);
             await emitter.clone(providerInfo.providerName);
             (0, change_package_info_1.changePackageName)({
                 directory: providerInfo.providerName,

package/bin/scripts/form.js

@@ -4,19 +4,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scriptsForm = void 0;
-const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const inquirer_1 = __importDefault(require("inquirer"));
 const path_1 = __importDefault(require("path"));
 const cli_ui_1 = require("../utils/cli-ui");
+const input_validation_1 = require("../utils/input-validation");
+const safe_spawn_1 = require("../utils/safe-spawn");
 const cwd = process.cwd();
 const packageJsonPath = path_1.default.join(cwd, "package.json");
 function readPackageJson() {
+    let raw;
     try {
-        return JSON.parse(fs_1.default.readFileSync(packageJsonPath, "utf8"));
+        raw = fs_1.default.readFileSync(packageJsonPath, "utf8");
     }
     catch (e) {
-        (0, cli_ui_1.printError)(`Error reading package.json`, "scripts-command");
+        (0, cli_ui_1.printError)(`Error reading package.json: ${e.message}`, "scripts-command");
+        process.exit(1);
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch (e) {
+        (0, cli_ui_1.printError)(`package.json is not valid JSON: ${e.message}`, "scripts-command");
         process.exit(1);
     }
 }
@@ -51,14 +60,27 @@ async function promptUserToSelectScripts(scripts) {
 }
 function executeScripts(scripts, selectedScripts, runner) {
     selectedScripts.forEach((script) => {
+        if (!(0, input_validation_1.isValidScriptName)(script)) {
+            (0, cli_ui_1.printWarning)(`Skipping script with invalid name: ${JSON.stringify(script)}`, "scripts-command");
+            return;
+        }
         console.log(`Running ${script}...`);
         try {
-            const command = `${runner} run ${script}`;
+            // `safeSpawnSync` (cross-spawn) handles Windows `.cmd` shim
+            // resolution and cmd.exe-aware argv escaping. Script names
+            // are also constrained to a strict alphanumeric/dash/dot
+            // charset by `isValidScriptName` above for defense in depth.
             const options = {
                 stdio: "inherit",
                 env: { ...process.env },
             };
-            (0, child_process_1.execSync)(command, options);
+            const result = (0, safe_spawn_1.safeSpawnSync)(runner, ["run", script], options);
+            if (result.error) {
+                throw result.error;
+            }
+            if (typeof result.status === "number" && result.status !== 0) {
+                throw new Error(`exited with code ${result.status}`);
+            }
         }
         catch (e) {
             (0, cli_ui_1.printWarning)(`Command ${script} cancelled or failed - ${e}`, "scripts-command");

package/bin/studio/cli.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Studio command CLI implementation
+ */
+import type { CommandModule } from "yargs";
+interface StudioYargsOptions {
+    port: number;
+    "agent-port": number;
+    "no-browser": boolean;
+    src: string;
+}
+/**
+ * Studio command definition
+ */
+export declare function studioCommand(): CommandModule<object, StudioYargsOptions>;
+export {};

package/bin/studio/cli.js

@@ -0,0 +1,166 @@
+"use strict";
+/**
+ * Studio command CLI implementation
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.studioCommand = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const fs_1 = require("fs");
+const path_1 = require("path");
+const safe_spawn_1 = require("../utils/safe-spawn");
+/**
+ * Check if @expressots/studio is installed
+ */
+function isStudioInstalled() {
+    try {
+        // Check if the package exists in node_modules
+        const studioPath = (0, path_1.resolve)(process.cwd(), "node_modules/@expressots/studio");
+        return (0, fs_1.existsSync)(studioPath);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Install @expressots/studio as a dev dependency
+ */
+async function installStudio() {
+    const spinner = (0, ora_1.default)("Installing @expressots/studio...").start();
+    try {
+        const hasYarn = (0, fs_1.existsSync)((0, path_1.resolve)(process.cwd(), "yarn.lock"));
+        const hasPnpm = (0, fs_1.existsSync)((0, path_1.resolve)(process.cwd(), "pnpm-lock.yaml"));
+        let pkgManager;
+        let args;
+        if (hasPnpm) {
+            pkgManager = "pnpm";
+            args = ["add", "-D", "@expressots/studio"];
+        }
+        else if (hasYarn) {
+            pkgManager = "yarn";
+            args = ["add", "-D", "@expressots/studio"];
+        }
+        else {
+            pkgManager = "npm";
+            args = ["install", "-D", "@expressots/studio"];
+        }
+        // `safeSpawnSync` (cross-spawn) resolves the Windows `.cmd` shim
+        // and properly escapes argv for cmd.exe. The argv here is a
+        // fixed list of literal strings, so it is safe by construction.
+        const result = (0, safe_spawn_1.safeSpawnSync)(pkgManager, args, {
+            stdio: "pipe",
+        });
+        if (result.error)
+            throw result.error;
+        if (typeof result.status === "number" && result.status !== 0) {
+            throw new Error(`exited with code ${result.status}`);
+        }
+        spinner.succeed(chalk_1.default.green("@expressots/studio installed successfully"));
+        return true;
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red("Failed to install @expressots/studio"));
+        console.error(chalk_1.default.yellow("\nPlease install manually: npm install -D @expressots/studio"));
+        return false;
+    }
+}
+/**
+ * Launch the Studio
+ */
+async function launchStudio(options) {
+    const args = ["start"];
+    if (options.port) {
+        args.push("--port", String(options.port));
+    }
+    if (options.agentPort) {
+        args.push("--agent-port", String(options.agentPort));
+    }
+    if (options.noBrowser) {
+        args.push("--no-browser");
+    }
+    if (options.src) {
+        args.push("--src", options.src);
+    }
+    const isWindows = process.platform === "win32";
+    const studioBinName = isWindows
+        ? "expressots-studio.cmd"
+        : "expressots-studio";
+    const studioPath = (0, path_1.resolve)(process.cwd(), "node_modules/.bin", studioBinName);
+    // `safeSpawn` (cross-spawn) handles Windows `.cmd` shim invocation
+    // and per-arg cmd.exe escaping, so user-controlled flags like
+    // `--src` or `--port` cannot break out into shell metacharacters
+    // even if the project path itself contains spaces.
+    const child = (0, safe_spawn_1.safeSpawn)(studioPath, args, {
+        stdio: "inherit",
+        cwd: process.cwd(),
+    });
+    child.on("error", (error) => {
+        console.error(chalk_1.default.red("Failed to start Studio:"), error.message);
+        process.exit(1);
+    });
+    child.on("exit", (code) => {
+        process.exit(code ?? 0);
+    });
+}
+/**
+ * Studio command handler
+ */
+async function studioHandler(options) {
+    // Check if Studio is installed
+    if (!isStudioInstalled()) {
+        console.log(chalk_1.default.yellow("📦 @expressots/studio is not installed in this project."));
+        console.log("");
+        // Try to install
+        const installed = await installStudio();
+        if (!installed) {
+            process.exit(1);
+        }
+        console.log("");
+    }
+    // Launch Studio
+    await launchStudio(options);
+}
+/**
+ * Studio command definition
+ */
+function studioCommand() {
+    return {
+        command: "studio",
+        describe: "Launch ExpressoTS Studio - Developer Experience Platform",
+        builder: (yargs) => yargs
+            .option("port", {
+            alias: "p",
+            type: "number",
+            default: 3333,
+            description: "UI port",
+        })
+            .option("agent-port", {
+            alias: "a",
+            type: "number",
+            default: 3334,
+            description: "Agent WebSocket port",
+        })
+            .option("no-browser", {
+            type: "boolean",
+            default: false,
+            description: "Do not open browser automatically",
+        })
+            .option("src", {
+            type: "string",
+            default: "./src",
+            description: "Source directory to scan",
+        }),
+        handler: async (argv) => {
+            await studioHandler({
+                port: argv.port,
+                agentPort: argv["agent-port"],
+                noBrowser: argv["no-browser"],
+                src: argv.src,
+            });
+        },
+    };
+}
+exports.studioCommand = studioCommand;

package/bin/studio/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * ExpressoTS Studio CLI integration
+ * Launches the local Studio development environment
+ */
+export { studioCommand } from "./cli";

package/bin/studio/index.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * ExpressoTS Studio CLI integration
+ * Launches the local Studio development environment
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.studioCommand = void 0;
+var cli_1 = require("./cli");
+Object.defineProperty(exports, "studioCommand", { enumerable: true, get: function () { return cli_1.studioCommand; } });

package/bin/templates/cache.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Template cache management
+ * Stores templates locally for offline access and performance
+ */
+import type { CacheConfig } from "./types";
+export declare class TemplateCache {
+    private config;
+    constructor(config?: Partial<CacheConfig>);
+    /**
+     * Ensure cache directory exists
+     */
+    private ensureCacheDir;
+    /**
+     * Generate cache key from template identifier
+     */
+    private getCacheKey;
+    /**
+     * Get cache file path
+     */
+    private getCachePath;
+    /**
+     * Check if cache entry is valid (not expired)
+     */
+    private isValid;
+    /**
+     * Get cached template content
+     */
+    get<T>(category: string, platform: string, variant?: string): T | null;
+    /**
+     * Set cached template content
+     */
+    set<T>(category: string, platform: string, data: T, variant?: string, ttl?: number): void;
+    /**
+     * Delete cached template
+     */
+    delete(category: string, platform: string, variant?: string): void;
+    /**
+     * Clear all cached templates
+     */
+    clear(): void;
+    /**
+     * Get cache statistics
+     */
+    getStats(): {
+        files: number;
+        totalSize: number;
+        oldestEntry: Date | null;
+    };
+    /**
+     * Get cache directory path
+     */
+    getCacheDirectory(): string;
+}
+export declare function getTemplateCache(config?: Partial<CacheConfig>): TemplateCache;