@getdial/cli 0.33.3 → 0.33.5

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Command } from "commander";
+import { Command, InvalidArgumentError } from "commander";
 import { VERSION } from "./lib/version.js";
 import { runDoctor } from "./commands/doctor.js";
 import { runBilling } from "./commands/billing.js";
@@ -35,6 +35,13 @@ import { isSandbox, SANDBOX_DISABLED_COMMANDS, sandboxDisabledMessage } from "./
 // keyless so the proxy injects auth. Computed once (memoized in lib/sandbox).
 const sandbox = isSandbox();
 const program = new Command();
+function parsePositiveInteger(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0 || String(parsed) !== value.trim()) {
+        throw new InvalidArgumentError(`must be a positive integer, got: ${value}`);
+    }
+    return parsed;
+}
 program
     .name("dial")
     .description("Dial CLI — set up your account and run the listen service.")
@@ -327,7 +334,7 @@ if (!sandbox) {
         .option("--secret <value>", "HMAC-SHA256 key. The daemon signs each request body and sends the hex digest.")
         .option("--signature-header <name>", "HTTP header for the HMAC signature (defaults to X-Dial-Signature; only used with --secret)")
         .option("--bearer <token>", "static bearer token, sent as `Authorization: Bearer <token>`")
-        .option("--timeout <seconds>", "per-attempt timeout (default 5)", (v) => parseInt(v, 10))
+        .option("--timeout <seconds>", "per-attempt timeout (default 5)", parsePositiveInteger)
         .option("--json", "machine-readable output")
         .action(async (url, opts) => process.exit(await runLocalTargetAddUrl({
         url,
@@ -340,7 +347,7 @@ if (!sandbox) {
     localTargetAdd
         .command("cmd <path> [args...]")
         .description("Register an executable. The daemon spawns it per event with the event JSON as the final positional argument.")
-        .option("--timeout <seconds>", "per-attempt timeout (default 5)", (v) => parseInt(v, 10))
+        .option("--timeout <seconds>", "per-attempt timeout (default 5)", parsePositiveInteger)
         .option("--json", "machine-readable output")
         .passThroughOptions(true)
         .action(async (path, args, opts) => process.exit(await runLocalTargetAddCmd({

package/dist/lib/api.js

@@ -89,7 +89,7 @@ async function apiRequest(method, path, body, apiKey, extraHeaders) {
 /** POST a multipart/form-data body (file uploads). fetch sets the boundary header itself. */
 export async function apiPostMultipart(path, form, apiKey) {
     const url = `${baseUrl()}${path}`;
-    const headers = applyRefParamsHeader({});
+    const headers = applyRefParamsHeader({ "user-agent": USER_AGENT });
     if (apiKey)
         headers.authorization = `Bearer ${apiKey}`;
     try {

package/dist/lib/local-targets.js

@@ -11,13 +11,23 @@ export const UrlTargetSchema = z.object({
     secret: z.string().optional(),
     signatureHeader: z.string().optional(),
     bearer: z.string().optional(),
-    timeoutSeconds: z.number().int().positive().optional(),
+    timeoutSeconds: z
+        .number()
+        .int()
+        .positive()
+        .refine(Number.isSafeInteger, "timeout must be a safe integer")
+        .optional(),
 });
 export const CmdTargetSchema = z.object({
     kind: z.literal("cmd"),
     path: z.string(),
     args: z.array(z.string()).default([]),
-    timeoutSeconds: z.number().int().positive().optional(),
+    timeoutSeconds: z
+        .number()
+        .int()
+        .positive()
+        .refine(Number.isSafeInteger, "timeout must be a safe integer")
+        .optional(),
 });
 export const LocalTargetSchema = z.discriminatedUnion("kind", [UrlTargetSchema, CmdTargetSchema]);
 const RegistrySchema = z.object({
@@ -66,19 +76,28 @@ export function listTargets() {
     return readRegistry().targets;
 }
 export function addTarget(t) {
-    if (t.kind === "url") {
-        assertLoopbackUrl(t.url);
+    const parsed = LocalTargetSchema.safeParse(t);
+    if (!parsed.success) {
+        const timeoutIssue = parsed.error.issues.find((issue) => issue.path[0] === "timeoutSeconds");
+        if (timeoutIssue) {
+            throw new LocalTargetError("invalid_timeout", "timeout must be a positive integer");
+        }
+        throw new LocalTargetError("invalid_target", parsed.error.issues[0]?.message ?? "invalid target");
+    }
+    const target = parsed.data;
+    if (target.kind === "url") {
+        assertLoopbackUrl(target.url);
     }
     else {
-        if (!t.path)
+        if (!target.path)
             throw new LocalTargetError("invalid_path", "executable path is required");
     }
     const reg = readRegistry();
-    const id = targetId(t);
-    if (reg.targets.some((existing) => targetId(existing) === id && existing.kind === t.kind)) {
+    const id = targetId(target);
+    if (reg.targets.some((existing) => targetId(existing) === id && existing.kind === target.kind)) {
         return { added: false };
     }
-    reg.targets.push(t);
+    reg.targets.push(target);
     writeRegistry(reg);
     return { added: true };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.33.3",
+  "version": "0.33.5",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {