@jackwener/opencli 1.3.2 → 1.4.0

package/src/pipeline/template.ts

@@ -2,6 +2,8 @@
  * Pipeline template engine: ${{ ... }} expression rendering.
  */
 
+import vm from 'node:vm';
+
 export interface RenderContext {
   args?: Record<string, unknown>;
   data?: unknown;
@@ -9,9 +11,7 @@ export interface RenderContext {
   index?: number;
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import { isRecord } from '../utils.js';
 
 export function render(template: unknown, ctx: RenderContext): unknown {
   if (typeof template !== 'string') return template;
@@ -37,45 +37,29 @@ export function evalExpr(expr: string, ctx: RenderContext): unknown {
   const index = ctx.index ?? 0;
 
   // ── Pipe filters: expr | filter1(arg) | filter2 ──
-  // Supports: default(val), join(sep), upper, lower, truncate(n), trim, replace(old,new)
-  if (expr.includes('|') && !expr.includes('||')) {
-    const segments = expr.split('|').map(s => s.trim());
-    const mainExpr = segments[0];
-    let result = resolvePath(mainExpr, { args, item, data, index });
-    for (let i = 1; i < segments.length; i++) {
-      result = applyFilter(segments[i], result);
+  // Split on single | (not ||) so "item.a || item.b | upper" works correctly.
+  const pipeSegments = expr.split(/(?<!\|)\|(?!\|)/).map(s => s.trim());
+  if (pipeSegments.length > 1) {
+    let result = evalExpr(pipeSegments[0], ctx);
+    for (let i = 1; i < pipeSegments.length; i++) {
+      result = applyFilter(pipeSegments[i], result);
     }
     return result;
   }
 
-  // Arithmetic: index + 1
-  const arithMatch = expr.match(/^([\w][\w.]*)\s*([+\-*/])\s*(\d+)$/);
-  if (arithMatch) {
-    const [, varName, op, numStr] = arithMatch;
-    const val = resolvePath(varName, { args, item, data, index });
-    if (val !== null && val !== undefined) {
-      const numVal = Number(val); const num = Number(numStr);
-      if (!isNaN(numVal)) {
-        switch (op) {
-          case '+': return numVal + num; case '-': return numVal - num;
-          case '*': return numVal * num; case '/': return num !== 0 ? numVal / num : 0;
-        }
-      }
-    }
-  }
+  // Fast path: quoted string literal — skip VM overhead
+  const strLit = expr.match(/^(['"])(.*)\1$/);
+  if (strLit) return strLit[2];
 
-  // JS-like fallback expression: item.tweetCount || 'N/A'
-  const orMatch = expr.match(/^(.+?)\s*\|\|\s*(.+)$/);
-  if (orMatch) {
-    const left = evalExpr(orMatch[1].trim(), ctx);
-    if (left) return left;
-    const right = orMatch[2].trim();
-    return right.replace(/^['"]|['"]$/g, '');
-  }
+  // Fast path: numeric literal
+  if (/^\d+(\.\d+)?$/.test(expr)) return Number(expr);
 
+  // Try resolving as a simple dotted path (item.foo.bar, args.limit, index)
   const resolved = resolvePath(expr, { args, item, data, index });
   if (resolved !== null && resolved !== undefined) return resolved;
 
+  // Fallback: evaluate as JS in a sandboxed VM.
+  // Handles ||, ??, arithmetic, ternary, method calls, etc. natively.
   return evalJsExpr(expr, { args, item, data, index });
 }
 
@@ -95,7 +79,7 @@ function applyFilter(filterExpr: string, value: unknown): unknown {
     case 'default': {
       if (value === null || value === undefined || value === '') {
         const intVal = parseInt(filterArg, 10);
-        if (!isNaN(intVal) && String(intVal) === filterArg.trim()) return intVal;
+        if (!Number.isNaN(intVal) && String(intVal) === filterArg.trim()) return intVal;
         return filterArg;
       }
       return value;
@@ -110,7 +94,7 @@ function applyFilter(filterExpr: string, value: unknown): unknown {
       return typeof value === 'string' ? value.trim() : value;
     case 'truncate': {
       const n = parseInt(filterArg, 10) || 50;
-      return typeof value === 'string' && value.length > n ? value.slice(0, n) + '...' : value;
+      return typeof value === 'string' && value.length > n ? `${value.slice(0, n)}...` : value;
     }
     case 'replace': {
       if (typeof value !== 'string') return value;
@@ -138,6 +122,7 @@ function applyFilter(filterExpr: string, value: unknown): unknown {
     case 'sanitize':
       // Remove invalid filename characters
       return typeof value === 'string'
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional - strips C0 control chars from filenames
         ? value.replace(/[<>:"/\\|?*\x00-\x1f]/g, '_')
         : value;
     case 'ext': {
@@ -186,58 +171,61 @@ export function resolvePath(pathStr: string, ctx: RenderContext): unknown {
 
 /**
  * Evaluate arbitrary JS expressions as a last-resort fallback.
- *
- * ⚠️  SECURITY NOTE: Uses `new Function()` to execute the expression.
- * This is acceptable here because:
- *   1. YAML adapters are authored by trusted repo contributors only.
- *   2. The expression runs in the same Node.js process (no sandbox).
- *   3. Only a curated set of globals is exposed (no require/import/process/fs).
- * If opencli ever loads untrusted third-party adapters, this MUST be replaced
- * with a proper sandboxed evaluator.
+ * Runs inside a `node:vm` sandbox with dynamic code generation disabled.
  */
+const FORBIDDEN_EXPR_PATTERNS = /\b(constructor|__proto__|prototype|globalThis|process|require|import|eval)\b/;
+
+/**
+ * Deep-copy plain data to sever prototype chains, preventing sandbox escape
+ * via `args.constructor.constructor('return process')()` etc.
+ */
+function sanitizeContext(obj: unknown): unknown {
+  if (obj === null || obj === undefined) return obj;
+  if (typeof obj !== 'object' && typeof obj !== 'function') return obj;
+  try {
+    return JSON.parse(JSON.stringify(obj));
+  } catch {
+    return {};
+  }
+}
+
 function evalJsExpr(expr: string, ctx: RenderContext): unknown {
   // Guard against absurdly long expressions that could indicate injection.
   if (expr.length > 2000) return undefined;
 
-  const args = ctx.args ?? {};
-  const item = ctx.item ?? {};
-  const data = ctx.data;
+  // Block obvious sandbox escape attempts.
+  if (FORBIDDEN_EXPR_PATTERNS.test(expr)) return undefined;
+
+  const args = sanitizeContext(ctx.args ?? {});
+  const item = sanitizeContext(ctx.item ?? {});
+  const data = sanitizeContext(ctx.data);
   const index = ctx.index ?? 0;
 
   try {
-    const fn = new Function(
-      'args',
-      'item',
-      'data',
-      'index',
-      'encodeURIComponent',
-      'decodeURIComponent',
-      'JSON',
-      'Math',
-      'Number',
-      'String',
-      'Boolean',
-      'Array',
-      'Object',
-      'Date',
-      `"use strict"; return (${expr});`,
-    );
-
-    return fn(
-      args,
-      item,
-      data,
-      index,
-      encodeURIComponent,
-      decodeURIComponent,
-      JSON,
-      Math,
-      Number,
-      String,
-      Boolean,
-      Array,
-      Object,
-      Date,
+    return vm.runInNewContext(
+      `(${expr})`,
+      {
+        args,
+        item,
+        data,
+        index,
+        encodeURIComponent,
+        decodeURIComponent,
+        JSON,
+        Math,
+        Number,
+        String,
+        Boolean,
+        Array,
+        Date,
+      },
+      {
+        timeout: 50,
+        contextCodeGeneration: {
+          strings: false,
+          wasm: false,
+        },
+      },
     );
   } catch {
     return undefined;

package/src/pipeline/transform.test.ts

@@ -101,6 +101,26 @@ describe('stepSort', () => {
     await stepSort(null, 'score', SAMPLE_DATA, {});
     expect(SAMPLE_DATA).toEqual(original);
   });
+
+  it('sorts string-encoded numbers naturally by default', async () => {
+    const data = [
+      { name: 'A', volume: '99' },
+      { name: 'B', volume: '1000' },
+      { name: 'C', volume: '250' },
+    ];
+    const result = await stepSort(null, { by: 'volume', order: 'desc' }, data, {});
+    expect((result as typeof data).map((r) => r.name)).toEqual(['B', 'C', 'A']);
+  });
+
+  it('handles missing fields gracefully', async () => {
+    const data = [
+      { name: 'A', value: '10' },
+      { name: 'B' },
+      { name: 'C', value: '5' },
+    ];
+    const result = await stepSort(null, { by: 'value', order: 'asc' }, data, {});
+    expect((result as typeof data).map((r) => r.name)).toEqual(['B', 'C', 'A']);
+  });
 });
 
 describe('stepLimit', () => {

package/src/plugin.test.ts

@@ -1,12 +1,28 @@
 /**
- * Tests for plugin management: install, uninstall, list.
+ * Tests for plugin management: install, uninstall, list, and lock file support.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { PLUGINS_DIR } from './discovery.js';
-import { listPlugins, uninstallPlugin, updatePlugin, _parseSource } from './plugin.js';
+import type { LockEntry } from './plugin.js';
+import * as pluginModule from './plugin.js';
+
+const {
+  LOCK_FILE,
+  _getCommitHash,
+  listPlugins,
+  _readLockFile,
+  _resolveEsbuildBin,
+  uninstallPlugin,
+  updatePlugin,
+  _parseSource,
+  _updateAllPlugins,
+  _validatePluginStructure,
+  _writeLockFile,
+} = pluginModule;
 
 describe('parseSource', () => {
   it('parses github:user/repo format', () => {
@@ -41,6 +57,142 @@ describe('parseSource', () => {
   });
 });
 
+describe('validatePluginStructure', () => {
+  const testDir = path.join(PLUGINS_DIR, '__test-validate__');
+
+  beforeEach(() => {
+    fs.mkdirSync(testDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    try { fs.rmSync(testDir, { recursive: true }); } catch {}
+  });
+
+  it('returns invalid for non-existent directory', () => {
+    const res = _validatePluginStructure(path.join(PLUGINS_DIR, '__does_not_exist__'));
+    expect(res.valid).toBe(false);
+    expect(res.errors[0]).toContain('does not exist');
+  });
+
+  it('returns invalid for empty directory', () => {
+    const res = _validatePluginStructure(testDir);
+    expect(res.valid).toBe(false);
+    expect(res.errors[0]).toContain('No command files found');
+  });
+
+  it('returns valid for YAML plugin', () => {
+    fs.writeFileSync(path.join(testDir, 'cmd.yaml'), 'site: test');
+    const res = _validatePluginStructure(testDir);
+    expect(res.valid).toBe(true);
+    expect(res.errors).toHaveLength(0);
+  });
+
+  it('returns valid for JS plugin', () => {
+    fs.writeFileSync(path.join(testDir, 'cmd.js'), 'console.log("hi");');
+    const res = _validatePluginStructure(testDir);
+    expect(res.valid).toBe(true);
+    expect(res.errors).toHaveLength(0);
+  });
+
+  it('returns invalid for TS plugin without package.json', () => {
+    fs.writeFileSync(path.join(testDir, 'cmd.ts'), 'console.log("hi");');
+    const res = _validatePluginStructure(testDir);
+    expect(res.valid).toBe(false);
+    expect(res.errors[0]).toContain('contains .ts files but no package.json');
+  });
+
+  it('returns invalid for TS plugin with missing type: module', () => {
+    fs.writeFileSync(path.join(testDir, 'cmd.ts'), 'console.log("hi");');
+    fs.writeFileSync(path.join(testDir, 'package.json'), JSON.stringify({ name: 'test' }));
+    const res = _validatePluginStructure(testDir);
+    expect(res.valid).toBe(false);
+    expect(res.errors[0]).toContain('must have "type": "module"');
+  });
+
+  it('returns valid for TS plugin with correct package.json', () => {
+    fs.writeFileSync(path.join(testDir, 'cmd.ts'), 'console.log("hi");');
+    fs.writeFileSync(path.join(testDir, 'package.json'), JSON.stringify({ type: 'module' }));
+    const res = _validatePluginStructure(testDir);
+    expect(res.valid).toBe(true);
+    expect(res.errors).toHaveLength(0);
+  });
+});
+
+describe('lock file', () => {
+  const backupPath = `${LOCK_FILE}.test-backup`;
+  let hadOriginal = false;
+
+  beforeEach(() => {
+    hadOriginal = fs.existsSync(LOCK_FILE);
+    if (hadOriginal) {
+      fs.mkdirSync(path.dirname(backupPath), { recursive: true });
+      fs.copyFileSync(LOCK_FILE, backupPath);
+    }
+  });
+
+  afterEach(() => {
+    if (hadOriginal) {
+      fs.copyFileSync(backupPath, LOCK_FILE);
+      fs.unlinkSync(backupPath);
+      return;
+    }
+    try { fs.unlinkSync(LOCK_FILE); } catch {}
+  });
+
+  it('reads empty lock when file does not exist', () => {
+    try { fs.unlinkSync(LOCK_FILE); } catch {}
+    expect(_readLockFile()).toEqual({});
+  });
+
+  it('round-trips lock entries', () => {
+    const entries: Record<string, LockEntry> = {
+      'test-plugin': {
+        source: 'https://github.com/user/repo.git',
+        commitHash: 'abc1234567890def',
+        installedAt: '2025-01-01T00:00:00.000Z',
+      },
+      'another-plugin': {
+        source: 'https://github.com/user/another.git',
+        commitHash: 'def4567890123abc',
+        installedAt: '2025-02-01T00:00:00.000Z',
+        updatedAt: '2025-03-01T00:00:00.000Z',
+      },
+    };
+
+    _writeLockFile(entries);
+    expect(_readLockFile()).toEqual(entries);
+  });
+
+  it('handles malformed lock file gracefully', () => {
+    fs.mkdirSync(path.dirname(LOCK_FILE), { recursive: true });
+    fs.writeFileSync(LOCK_FILE, 'not valid json');
+    expect(_readLockFile()).toEqual({});
+  });
+});
+
+describe('getCommitHash', () => {
+  it('returns a hash for a git repo', () => {
+    const hash = _getCommitHash(process.cwd());
+    expect(hash).toBeDefined();
+    expect(hash).toMatch(/^[0-9a-f]{40}$/);
+  });
+
+  it('returns undefined for non-git directory', () => {
+    expect(_getCommitHash(os.tmpdir())).toBeUndefined();
+  });
+});
+
+describe('resolveEsbuildBin', () => {
+  it('resolves a usable esbuild executable path', () => {
+    const binPath = _resolveEsbuildBin();
+    expect(binPath).not.toBeNull();
+    expect(typeof binPath).toBe('string');
+    expect(fs.existsSync(binPath!)).toBe(true);
+    // On Windows the resolved path ends with 'esbuild.cmd', on Unix 'esbuild'
+    expect(binPath).toMatch(/esbuild(\.cmd)?$/);
+  });
+});
+
 describe('listPlugins', () => {
   const testDir = path.join(PLUGINS_DIR, '__test-list-plugin__');
 
@@ -58,6 +210,28 @@ describe('listPlugins', () => {
     expect(found!.commands).toContain('hello');
   });
 
+  it('includes version metadata from the lock file', () => {
+    fs.mkdirSync(testDir, { recursive: true });
+    fs.writeFileSync(path.join(testDir, 'hello.yaml'), 'site: test\nname: hello\n');
+
+    const lock = _readLockFile();
+    lock['__test-list-plugin__'] = {
+      source: 'https://github.com/user/repo.git',
+      commitHash: 'abcdef1234567890abcdef1234567890abcdef12',
+      installedAt: '2025-01-01T00:00:00.000Z',
+    };
+    _writeLockFile(lock);
+
+    const plugins = listPlugins();
+    const found = plugins.find(p => p.name === '__test-list-plugin__');
+    expect(found).toBeDefined();
+    expect(found!.version).toBe('abcdef1');
+    expect(found!.installedAt).toBe('2025-01-01T00:00:00.000Z');
+
+    delete lock['__test-list-plugin__'];
+    _writeLockFile(lock);
+  });
+
   it('returns empty array when no plugins dir', () => {
     // listPlugins should handle missing dir gracefully
     const plugins = listPlugins();
@@ -80,6 +254,22 @@ describe('uninstallPlugin', () => {
     expect(fs.existsSync(testDir)).toBe(false);
   });
 
+  it('removes lock entry on uninstall', () => {
+    fs.mkdirSync(testDir, { recursive: true });
+    fs.writeFileSync(path.join(testDir, 'test.yaml'), 'site: test');
+
+    const lock = _readLockFile();
+    lock['__test-uninstall__'] = {
+      source: 'https://github.com/user/repo.git',
+      commitHash: 'abc123',
+      installedAt: '2025-01-01T00:00:00.000Z',
+    };
+    _writeLockFile(lock);
+
+    uninstallPlugin('__test-uninstall__');
+    expect(_readLockFile()['__test-uninstall__']).toBeUndefined();
+  });
+
   it('throws for non-existent plugin', () => {
     expect(() => uninstallPlugin('__nonexistent__')).toThrow('not installed');
   });
@@ -90,3 +280,61 @@ describe('updatePlugin', () => {
     expect(() => updatePlugin('__nonexistent__')).toThrow('not installed');
   });
 });
+
+vi.mock('node:child_process', () => {
+  return {
+    execFileSync: vi.fn((_cmd, args, opts) => {
+      if (Array.isArray(args) && args[0] === 'rev-parse' && args[1] === 'HEAD') {
+        if (opts?.cwd === os.tmpdir()) {
+          throw new Error('not a git repository');
+        }
+        return '1234567890abcdef1234567890abcdef12345678\n';
+      }
+      if (opts && opts.cwd && String(opts.cwd).endsWith('plugin-b')) {
+        throw new Error('Network error');
+      }
+      return '';
+    }),
+    execSync: vi.fn(() => ''),
+  };
+});
+
+describe('updateAllPlugins', () => {
+  const testDirA = path.join(PLUGINS_DIR, 'plugin-a');
+  const testDirB = path.join(PLUGINS_DIR, 'plugin-b');
+  const testDirC = path.join(PLUGINS_DIR, 'plugin-c');
+
+  beforeEach(() => {
+    fs.mkdirSync(testDirA, { recursive: true });
+    fs.mkdirSync(testDirB, { recursive: true });
+    fs.mkdirSync(testDirC, { recursive: true });
+    fs.writeFileSync(path.join(testDirA, 'cmd.yaml'), 'site: a');
+    fs.writeFileSync(path.join(testDirB, 'cmd.yaml'), 'site: b');
+    fs.writeFileSync(path.join(testDirC, 'cmd.yaml'), 'site: c');
+  });
+
+  afterEach(() => {
+    try { fs.rmSync(testDirA, { recursive: true }); } catch {}
+    try { fs.rmSync(testDirB, { recursive: true }); } catch {}
+    try { fs.rmSync(testDirC, { recursive: true }); } catch {}
+    vi.clearAllMocks();
+  });
+
+  it('collects successes and failures without throwing', () => {
+    const results = _updateAllPlugins();
+
+    const resA = results.find(r => r.name === 'plugin-a');
+    const resB = results.find(r => r.name === 'plugin-b');
+    const resC = results.find(r => r.name === 'plugin-c');
+
+    expect(resA).toBeDefined();
+    expect(resA!.success).toBe(true);
+
+    expect(resB).toBeDefined();
+    expect(resB!.success).toBe(false);
+    expect(resB!.error).toContain('Network error');
+
+    expect(resC).toBeDefined();
+    expect(resC!.success).toBe(true);
+  });
+});