@expressots/cli 3.0.0 → 4.0.0-preview.3

package/bin/profile/form.js

@@ -0,0 +1,401 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showProfileReport = exports.optimizeContainer = exports.profileImage = exports.profileContainer = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const dockerfile_analyzer_1 = require("./analyzers/dockerfile-analyzer");
+const image_analyzer_1 = require("./analyzers/image-analyzer");
+const optimizers_1 = require("./optimizers");
+const cli_ui_1 = require("../utils/cli-ui");
+/**
+ * Profile a Dockerfile for issues and recommendations
+ */
+async function profileContainer(options) {
+    (0, cli_ui_1.printSection)("🔍 ExpressoTS Container Profiler");
+    const cwd = process.cwd();
+    const dockerfilePath = path_1.default.join(cwd, options.dockerfile);
+    if (!fs_1.default.existsSync(dockerfilePath)) {
+        console.log(chalk_1.default.red(`Error: Dockerfile not found at ${dockerfilePath}`));
+        console.log(chalk_1.default.gray("Run 'expressots containerize' to generate a Dockerfile first."));
+        return;
+    }
+    console.log(chalk_1.default.yellow(`📄 Analyzing ${options.dockerfile}...\n`));
+    const analysis = await (0, dockerfile_analyzer_1.analyzeDockerfile)(dockerfilePath);
+    const result = generateProfileResult(analysis, options);
+    outputResult(result, options);
+}
+exports.profileContainer = profileContainer;
+/**
+ * Profile a built Docker image
+ */
+async function profileImage(options) {
+    (0, cli_ui_1.printSection)("🔍 ExpressoTS Image Profiler");
+    if (!options.target) {
+        console.log(chalk_1.default.red("Error: Please specify an image name."));
+        console.log(chalk_1.default.gray("Usage: expressots profile image <image-name>"));
+        return;
+    }
+    console.log(chalk_1.default.yellow(`🐳 Analyzing image: ${options.target}...\n`));
+    try {
+        const analysis = await (0, image_analyzer_1.analyzeImage)(options.target);
+        console.log(chalk_1.default.bold("Image Analysis:"));
+        console.log(`  Size: ${analysis.size}`);
+        console.log(`  Layers: ${analysis.layers}`);
+        console.log(`  Created: ${analysis.created}`);
+        console.log(`  OS/Arch: ${analysis.os}/${analysis.architecture}`);
+        if (analysis.vulnerabilities && analysis.vulnerabilities.length > 0) {
+            console.log(chalk_1.default.bold("\nVulnerabilities:"));
+            for (const vuln of analysis.vulnerabilities) {
+                const color = vuln.severity === "critical"
+                    ? chalk_1.default.red
+                    : vuln.severity === "high"
+                        ? chalk_1.default.yellow
+                        : chalk_1.default.gray;
+                console.log(`  ${color(`[${vuln.severity.toUpperCase()}]`)} ${vuln.id}: ${vuln.description}`);
+            }
+        }
+        else {
+            console.log(chalk_1.default.green("\n✓ No vulnerabilities found"));
+        }
+    }
+    catch (error) {
+        console.log(chalk_1.default.red(`Error analyzing image: ${error}`));
+        console.log(chalk_1.default.gray("Make sure Docker is running and the image exists."));
+    }
+}
+exports.profileImage = profileImage;
+/**
+ * Generate and optionally apply optimizations
+ */
+async function optimizeContainer(options) {
+    (0, cli_ui_1.printSection)("⚡ ExpressoTS Container Optimizer");
+    const cwd = process.cwd();
+    const dockerfilePath = path_1.default.join(cwd, options.dockerfile);
+    if (!fs_1.default.existsSync(dockerfilePath)) {
+        console.log(chalk_1.default.red(`Error: Dockerfile not found at ${dockerfilePath}`));
+        return;
+    }
+    const analysis = await (0, dockerfile_analyzer_1.analyzeDockerfile)(dockerfilePath);
+    const optimizations = (0, optimizers_1.generateOptimizations)(analysis);
+    if (optimizations.length === 0) {
+        console.log(chalk_1.default.green("✓ No optimizations needed. Your Dockerfile looks great!"));
+        return;
+    }
+    console.log(chalk_1.default.bold(`Found ${optimizations.length} optimization(s):\n`));
+    for (const opt of optimizations) {
+        const priorityColor = opt.priority === "high"
+            ? chalk_1.default.red
+            : opt.priority === "medium"
+                ? chalk_1.default.yellow
+                : chalk_1.default.gray;
+        console.log(`  ${priorityColor(`[${opt.priority.toUpperCase()}]`)} ${opt.title}`);
+        console.log(chalk_1.default.gray(`    ${opt.description}`));
+        console.log(chalk_1.default.green(`    Impact: ${opt.impact}`));
+        console.log();
+    }
+    if (options.autoFix) {
+        console.log(chalk_1.default.yellow("🔧 Applying safe optimizations..."));
+        const applied = await (0, optimizers_1.applyOptimizations)(dockerfilePath, optimizations);
+        console.log(chalk_1.default.green(`✓ Applied ${applied} optimization(s)`));
+    }
+    else {
+        console.log(chalk_1.default.gray("Tip: Use --auto-fix to automatically apply safe optimizations"));
+    }
+}
+exports.optimizeContainer = optimizeContainer;
+/**
+ * Show a comprehensive profile report
+ */
+async function showProfileReport(options) {
+    (0, cli_ui_1.printSection)("📊 ExpressoTS Container Profile Report");
+    const cwd = process.cwd();
+    const dockerfilePath = path_1.default.join(cwd, options.dockerfile);
+    if (!fs_1.default.existsSync(dockerfilePath)) {
+        console.log(chalk_1.default.red(`Error: Dockerfile not found at ${dockerfilePath}`));
+        return;
+    }
+    const analysis = await (0, dockerfile_analyzer_1.analyzeDockerfile)(dockerfilePath);
+    const result = generateProfileResult(analysis, options);
+    // Generate report based on format
+    if (options.format === "json") {
+        const json = JSON.stringify(result, null, 2);
+        if (options.output) {
+            fs_1.default.writeFileSync(options.output, json, "utf-8");
+            console.log(chalk_1.default.green(`✓ Report saved to ${options.output}`));
+        }
+        else {
+            console.log(json);
+        }
+    }
+    else if (options.format === "html") {
+        const html = generateHtmlReport(result);
+        const outputPath = options.output || "container-report.html";
+        fs_1.default.writeFileSync(outputPath, html, "utf-8");
+        console.log(chalk_1.default.green(`✓ HTML report saved to ${outputPath}`));
+    }
+    else {
+        outputResult(result, options);
+    }
+}
+exports.showProfileReport = showProfileReport;
+/**
+ * Generate profile result from analysis
+ */
+function generateProfileResult(analysis, options) {
+    const issues = [];
+    const recommendations = [];
+    // Check for security issues
+    if (!analysis.hasNonRootUser) {
+        issues.push({
+            id: "SEC001",
+            severity: "high",
+            category: "security",
+            message: "Container runs as root user",
+            fix: "Add 'USER node' or create a non-root user",
+        });
+        recommendations.push({
+            priority: "high",
+            category: "Security",
+            title: "Add non-root user",
+            description: "Running containers as root is a security risk",
+            impact: "Reduces attack surface if container is compromised",
+        });
+    }
+    if (!analysis.hasHealthCheck) {
+        issues.push({
+            id: "PERF001",
+            severity: "medium",
+            category: "performance",
+            message: "No HEALTHCHECK instruction found",
+            fix: "Add HEALTHCHECK instruction for orchestration support",
+        });
+        recommendations.push({
+            priority: "medium",
+            category: "Performance",
+            title: "Add health check",
+            description: "Health checks enable better orchestration",
+            impact: "Faster failure detection and recovery",
+        });
+    }
+    if (!analysis.hasMultiStage) {
+        issues.push({
+            id: "SIZE001",
+            severity: "medium",
+            category: "size",
+            message: "Not using multi-stage build",
+            fix: "Use multi-stage build to reduce final image size",
+        });
+        recommendations.push({
+            priority: "medium",
+            category: "Size",
+            title: "Use multi-stage build",
+            description: "Multi-stage builds reduce image size significantly",
+            impact: "Can reduce image size by 50-80%",
+        });
+    }
+    // Check for best practices
+    if (analysis.hasNpmInstallWithoutCi) {
+        issues.push({
+            id: "BP001",
+            severity: "low",
+            category: "best-practice",
+            message: "Using 'npm install' instead of 'npm ci'",
+            fix: "Replace 'npm install' with 'npm ci' for reproducible builds",
+        });
+    }
+    if (!analysis.hasDockerignore) {
+        issues.push({
+            id: "SIZE002",
+            severity: "low",
+            category: "size",
+            message: "No .dockerignore file found",
+            fix: "Create .dockerignore to exclude unnecessary files",
+        });
+    }
+    if (analysis.hasCurlOrWgetWithoutCleanup) {
+        issues.push({
+            id: "SIZE003",
+            severity: "low",
+            category: "size",
+            message: "Downloaded files may not be cleaned up",
+            fix: "Clean up downloaded files in the same RUN layer",
+        });
+    }
+    // Calculate score
+    let score = 100;
+    for (const issue of issues) {
+        switch (issue.severity) {
+            case "critical":
+                score -= 25;
+                break;
+            case "high":
+                score -= 15;
+                break;
+            case "medium":
+                score -= 10;
+                break;
+            case "low":
+                score -= 5;
+                break;
+        }
+    }
+    score = Math.max(0, score);
+    return {
+        score,
+        issues: issues.filter((i) => {
+            const severityOrder = { low: 0, medium: 1, high: 2, critical: 3 };
+            return severityOrder[i.severity] >= severityOrder[options.severity];
+        }),
+        recommendations,
+        metrics: {
+            baseImage: analysis.baseImage,
+            layers: analysis.layers,
+            hasMultiStage: analysis.hasMultiStage,
+            hasHealthCheck: analysis.hasHealthCheck,
+            hasNonRootUser: analysis.hasNonRootUser,
+            nodeVersion: analysis.nodeVersion,
+        },
+    };
+}
+/**
+ * Output result to console
+ */
+function outputResult(result, options) {
+    // Score
+    const scoreColor = result.score >= 80
+        ? chalk_1.default.green
+        : result.score >= 60
+            ? chalk_1.default.yellow
+            : chalk_1.default.red;
+    console.log(chalk_1.default.bold(`Container Health Score: ${scoreColor(`${result.score}/100`)}\n`));
+    // Metrics
+    console.log(chalk_1.default.bold("Metrics:"));
+    console.log(`  Base Image: ${result.metrics.baseImage || "Unknown"}`);
+    console.log(`  Layers: ${result.metrics.layers || "Unknown"}`);
+    console.log(`  Multi-stage: ${result.metrics.hasMultiStage ? chalk_1.default.green("✓") : chalk_1.default.red("✗")}`);
+    console.log(`  Health Check: ${result.metrics.hasHealthCheck ? chalk_1.default.green("✓") : chalk_1.default.red("✗")}`);
+    console.log(`  Non-root User: ${result.metrics.hasNonRootUser ? chalk_1.default.green("✓") : chalk_1.default.red("✗")}`);
+    // Issues
+    if (result.issues.length > 0) {
+        console.log(chalk_1.default.bold(`\nIssues (${result.issues.length}):`));
+        for (const issue of result.issues) {
+            const color = issue.severity === "critical"
+                ? chalk_1.default.red
+                : issue.severity === "high"
+                    ? chalk_1.default.yellow
+                    : issue.severity === "medium"
+                        ? chalk_1.default.cyan
+                        : chalk_1.default.gray;
+            console.log(`  ${color(`[${issue.severity.toUpperCase()}]`)} ${issue.message}`);
+            if (issue.fix) {
+                console.log(chalk_1.default.gray(`    Fix: ${issue.fix}`));
+            }
+        }
+    }
+    else {
+        console.log(chalk_1.default.green("\n✓ No issues found!"));
+    }
+    // Recommendations
+    if (result.recommendations.length > 0) {
+        console.log(chalk_1.default.bold(`\nRecommendations:`));
+        for (const rec of result.recommendations) {
+            const color = rec.priority === "high" ? chalk_1.default.yellow : chalk_1.default.gray;
+            console.log(`  ${color(`[${rec.priority.toUpperCase()}]`)} ${rec.title}`);
+            console.log(chalk_1.default.gray(`    ${rec.description}`));
+        }
+    }
+    console.log();
+}
+/**
+ * Generate HTML report
+ */
+function generateHtmlReport(result) {
+    const scoreColor = result.score >= 80
+        ? "#22c55e"
+        : result.score >= 60
+            ? "#eab308"
+            : "#ef4444";
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Container Profile Report - ExpressoTS</title>
+    <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f3f4f6; padding: 2rem; }
+        .container { max-width: 800px; margin: 0 auto; }
+        .card { background: white; border-radius: 8px; padding: 1.5rem; margin-bottom: 1rem; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+        h1 { color: #111; margin-bottom: 0.5rem; }
+        h2 { color: #333; margin-bottom: 1rem; font-size: 1.25rem; }
+        .score { font-size: 3rem; font-weight: bold; color: ${scoreColor}; }
+        .metric { display: flex; justify-content: space-between; padding: 0.5rem 0; border-bottom: 1px solid #e5e7eb; }
+        .issue { padding: 0.75rem; margin: 0.5rem 0; border-radius: 4px; }
+        .issue.critical { background: #fef2f2; border-left: 4px solid #ef4444; }
+        .issue.high { background: #fffbeb; border-left: 4px solid #f59e0b; }
+        .issue.medium { background: #ecfeff; border-left: 4px solid #06b6d4; }
+        .issue.low { background: #f9fafb; border-left: 4px solid #9ca3af; }
+        .check { color: #22c55e; }
+        .cross { color: #ef4444; }
+        .footer { text-align: center; color: #6b7280; margin-top: 2rem; font-size: 0.875rem; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="card">
+            <h1>🐳 Container Profile Report</h1>
+            <p>Generated by ExpressoTS CLI</p>
+        </div>
+        
+        <div class="card">
+            <h2>Health Score</h2>
+            <div class="score">${result.score}/100</div>
+        </div>
+        
+        <div class="card">
+            <h2>Metrics</h2>
+            <div class="metric"><span>Base Image</span><span>${result.metrics.baseImage || "Unknown"}</span></div>
+            <div class="metric"><span>Layers</span><span>${result.metrics.layers || "Unknown"}</span></div>
+            <div class="metric"><span>Multi-stage Build</span><span class="${result.metrics.hasMultiStage ? "check" : "cross"}">${result.metrics.hasMultiStage ? "✓" : "✗"}</span></div>
+            <div class="metric"><span>Health Check</span><span class="${result.metrics.hasHealthCheck ? "check" : "cross"}">${result.metrics.hasHealthCheck ? "✓" : "✗"}</span></div>
+            <div class="metric"><span>Non-root User</span><span class="${result.metrics.hasNonRootUser ? "check" : "cross"}">${result.metrics.hasNonRootUser ? "✓" : "✗"}</span></div>
+        </div>
+        
+        <div class="card">
+            <h2>Issues (${result.issues.length})</h2>
+            ${result.issues.length === 0
+        ? '<p style="color: #22c55e;">✓ No issues found!</p>'
+        : result.issues
+            .map((i) => `
+                <div class="issue ${i.severity}">
+                    <strong>[${i.severity.toUpperCase()}]</strong> ${i.message}
+                    ${i.fix ? `<br><small style="color: #6b7280;">Fix: ${i.fix}</small>` : ""}
+                </div>
+            `)
+            .join("")}
+        </div>
+        
+        <div class="card">
+            <h2>Recommendations (${result.recommendations.length})</h2>
+            ${result.recommendations
+        .map((r) => `
+                <div class="issue low">
+                    <strong>${r.title}</strong><br>
+                    ${r.description}<br>
+                    <small style="color: #22c55e;">Impact: ${r.impact}</small>
+                </div>
+            `)
+        .join("")}
+        </div>
+        
+        <div class="footer">
+            Generated by ExpressoTS CLI • ${new Date().toISOString()}
+        </div>
+    </div>
+</body>
+</html>`;
+}

package/bin/profile/index.d.ts

@@ -0,0 +1 @@
+export { profileCommand } from "./cli";

package/bin/profile/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileCommand = void 0;
+var cli_1 = require("./cli");
+Object.defineProperty(exports, "profileCommand", { enumerable: true, get: function () { return cli_1.profileCommand; } });

package/bin/profile/optimizers/index.d.ts

@@ -0,0 +1,19 @@
+import type { DockerfileAnalysis } from "../analyzers/dockerfile-analyzer";
+export interface Optimization {
+    id: string;
+    priority: "low" | "medium" | "high";
+    category: string;
+    title: string;
+    description: string;
+    impact: string;
+    autoFixable: boolean;
+    fix?: (content: string) => string;
+}
+/**
+ * Generate optimization recommendations based on Dockerfile analysis
+ */
+export declare function generateOptimizations(analysis: DockerfileAnalysis): Optimization[];
+/**
+ * Apply auto-fixable optimizations to Dockerfile
+ */
+export declare function applyOptimizations(dockerfilePath: string, optimizations: Optimization[]): Promise<number>;

package/bin/profile/optimizers/index.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyOptimizations = exports.generateOptimizations = void 0;
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Generate optimization recommendations based on Dockerfile analysis
+ */
+function generateOptimizations(analysis) {
+    const optimizations = [];
+    // Multi-stage build
+    if (!analysis.hasMultiStage) {
+        optimizations.push({
+            id: "OPT001",
+            priority: "high",
+            category: "Size",
+            title: "Use multi-stage build",
+            description: "Multi-stage builds significantly reduce final image size by separating build and runtime dependencies.",
+            impact: "Can reduce image size by 50-80%",
+            autoFixable: false,
+        });
+    }
+    // Non-root user
+    if (!analysis.hasNonRootUser) {
+        optimizations.push({
+            id: "OPT002",
+            priority: "high",
+            category: "Security",
+            title: "Run as non-root user",
+            description: "Running containers as root is a security risk. Create and use a non-root user.",
+            impact: "Reduces attack surface if container is compromised",
+            autoFixable: false,
+        });
+    }
+    // Health check
+    if (!analysis.hasHealthCheck) {
+        optimizations.push({
+            id: "OPT003",
+            priority: "medium",
+            category: "Reliability",
+            title: "Add HEALTHCHECK instruction",
+            description: "Health checks allow orchestrators to detect and restart unhealthy containers.",
+            impact: "Faster failure detection, better uptime",
+            autoFixable: true,
+            fix: (content) => {
+                // Add health check before CMD
+                const cmdMatch = content.match(/^CMD\s+.*/m);
+                if (cmdMatch) {
+                    const healthCheck = `HEALTHCHECK --interval=30s --timeout=3s --start-period=40s \\
+  CMD node -e "require('http').get('http://localhost:3000/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
+
+`;
+                    return content.replace(cmdMatch[0], healthCheck + cmdMatch[0]);
+                }
+                return content;
+            },
+        });
+    }
+    // npm ci instead of npm install
+    if (analysis.hasNpmInstallWithoutCi) {
+        optimizations.push({
+            id: "OPT004",
+            priority: "low",
+            category: "Best Practice",
+            title: "Use npm ci instead of npm install",
+            description: "npm ci provides faster, more reliable, and reproducible builds.",
+            impact: "Faster builds, reproducible dependencies",
+            autoFixable: true,
+            fix: (content) => {
+                return content.replace(/npm install(?!\s+[-\w])/g, "npm ci");
+            },
+        });
+    }
+    // .dockerignore
+    if (!analysis.hasDockerignore) {
+        optimizations.push({
+            id: "OPT005",
+            priority: "medium",
+            category: "Size",
+            title: "Add .dockerignore file",
+            description: "Exclude unnecessary files from the build context to speed up builds and reduce image size.",
+            impact: "Faster builds, smaller images",
+            autoFixable: false,
+        });
+    }
+    // Combine RUN commands
+    if (analysis.layers > 10) {
+        optimizations.push({
+            id: "OPT006",
+            priority: "low",
+            category: "Size",
+            title: "Combine RUN commands",
+            description: `You have ${analysis.layers} RUN layers. Consider combining related commands to reduce layers.`,
+            impact: "Slightly smaller image, faster pulls",
+            autoFixable: false,
+        });
+    }
+    // Check base image
+    if (analysis.baseImage &&
+        !analysis.baseImage.includes("alpine") &&
+        !analysis.baseImage.includes("slim")) {
+        optimizations.push({
+            id: "OPT007",
+            priority: "medium",
+            category: "Size",
+            title: "Consider using Alpine or slim base image",
+            description: `Current base image: ${analysis.baseImage}. Alpine images are typically 5-10x smaller.`,
+            impact: "Significantly smaller image size",
+            autoFixable: false,
+        });
+    }
+    return optimizations;
+}
+exports.generateOptimizations = generateOptimizations;
+/**
+ * Apply auto-fixable optimizations to Dockerfile
+ */
+async function applyOptimizations(dockerfilePath, optimizations) {
+    let content = fs_1.default.readFileSync(dockerfilePath, "utf-8");
+    let appliedCount = 0;
+    for (const opt of optimizations) {
+        if (opt.autoFixable && opt.fix) {
+            const newContent = opt.fix(content);
+            if (newContent !== content) {
+                content = newContent;
+                appliedCount++;
+            }
+        }
+    }
+    if (appliedCount > 0) {
+        fs_1.default.writeFileSync(dockerfilePath, content, "utf-8");
+    }
+    return appliedCount;
+}
+exports.applyOptimizations = applyOptimizations;

package/bin/providers/add/form.d.ts

@@ -1,2 +1,2 @@
-export declare function addProvider(packageName: string, version?: string, isDevDependency?: boolean): Promise<void>;
+export declare function addProvider(packageName: string, version?: string | false, isDevDependency?: boolean): Promise<void>;
 export declare function removeProvider(packageName: string): Promise<void>;

package/bin/providers/add/form.js

@@ -5,10 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeProvider = exports.addProvider = void 0;
 const chalk_1 = __importDefault(require("chalk"));
-const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_process_1 = require("node:process");
 const cli_ui_1 = require("../../utils/cli-ui");
+const input_validation_1 = require("../../utils/input-validation");
+const safe_spawn_1 = require("../../utils/safe-spawn");
 const PACKAGE_MANAGERS = {
     npm: {
         install: "install",
@@ -38,11 +39,14 @@ function detectPackageManager() {
 }
 async function execProcess({ command, args, directory, }) {
     return new Promise((resolve, reject) => {
-        const isWindows = process.platform === "win32";
-        const execCommand = isWindows ? `${command}.cmd` : command;
-        const processRunner = (0, node_child_process_1.spawn)(execCommand, args, {
+        // `safeSpawn` (cross-spawn) resolves the Windows `.cmd` shim and
+        // applies cmd.exe-aware escaping for every argv entry. Combined
+        // with the `isValidPackageName` / `isValidVersion` guards on the
+        // caller side, this prevents command injection via the package
+        // name or version specifier (which can legitimately contain
+        // `>`, `<`, `|`, etc. in a semver range).
+        const processRunner = (0, safe_spawn_1.safeSpawn)(command, args, {
             cwd: directory,
-            shell: true,
         });
         console.log(chalk_1.default.bold.blue(`Executing: ${command} ${args.join(" ")}`));
         console.log(chalk_1.default.yellow("-------------------------------------------------"));
@@ -66,6 +70,20 @@ async function execProcess({ command, args, directory, }) {
     });
 }
 async function addProvider(packageName, version, isDevDependency = false) {
+    if (!(0, input_validation_1.isValidPackageName)(packageName)) {
+        (0, cli_ui_1.printError)(`Invalid package name: ${JSON.stringify(packageName)}`, "add-package");
+        return;
+    }
+    // yargs assigns `false` for the version flag when the user omits
+    // it (see add/cli.ts). Treat that and "latest" as "no suffix".
+    let versionSuffix = "";
+    if (typeof version === "string" && version !== "latest") {
+        if (!(0, input_validation_1.isValidVersion)(version)) {
+            (0, cli_ui_1.printError)(`Invalid version specifier: ${JSON.stringify(version)}`, "add-package");
+            return;
+        }
+        versionSuffix = `@${version}`;
+    }
     const packageManager = detectPackageManager();
     if (!packageManager) {
         (0, cli_ui_1.printError)("No package manager found in the project", "add-package");
@@ -75,7 +93,6 @@ async function addProvider(packageName, version, isDevDependency = false) {
     const command = isDevDependency
         ? pkgManagerConfig.addDev
         : pkgManagerConfig.install;
-    const versionSuffix = version && version !== "latest" ? `@${version}` : "";
     console.log(`${isDevDependency ? "Adding devDependency" : "Installing"} ${packageName}...`);
     await execProcess({
         command: packageManager,
@@ -85,6 +102,10 @@ async function addProvider(packageName, version, isDevDependency = false) {
 }
 exports.addProvider = addProvider;
 async function removeProvider(packageName) {
+    if (!(0, input_validation_1.isValidPackageName)(packageName)) {
+        (0, cli_ui_1.printError)(`Invalid package name: ${JSON.stringify(packageName)}`, "remove-package");
+        return;
+    }
     const packageManager = detectPackageManager();
     if (!packageManager) {
         (0, cli_ui_1.printError)("No package manager found in the project", "remove-package");