@jackwener/opencli 1.3.3 → 1.4.1

package/dist/pipeline/steps/fetch.test.js

@@ -0,0 +1,123 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { CliError } from '../../errors.js';
+import { stepFetch } from './fetch.js';
+afterEach(() => {
+    vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+});
+describe('stepFetch', () => {
+    // W1 + W4: non-browser single fetch throws CliError with FETCH_ERROR code and full message
+    it('throws CliError with FETCH_ERROR code on non-ok responses without a browser session', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'rate limited' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 429,
+            statusText: 'Too Many Requests',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const err = await stepFetch(null, { url: 'https://api.example.com/items' }, null, {}).catch((e) => e);
+        expect(err).toBeInstanceOf(CliError);
+        expect(err.code).toBe('FETCH_ERROR');
+        expect(err.message).toBe('HTTP 429 Too Many Requests from https://api.example.com/items');
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    // W1 + W3: browser single fetch returns error status from evaluate, outer code throws CliError
+    it('throws CliError with FETCH_ERROR code on non-ok responses inside the browser session', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'auth required' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 401,
+            statusText: 'Unauthorized',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        // Simulate real CDP behavior: evaluate returns a value, errors are thrown outside
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        const err = await stepFetch(page, { url: 'https://api.example.com/items' }, null, {}).catch((e) => e);
+        expect(err).toBeInstanceOf(CliError);
+        expect(err.code).toBe('FETCH_ERROR');
+        expect(err.message).toBe('HTTP 401 Unauthorized from https://api.example.com/items');
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    it('returns per-item HTTP errors for batch fetches without a browser session', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'upstream unavailable' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 503,
+            statusText: 'Service Unavailable',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        await expect(stepFetch(null, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'HTTP 503 Service Unavailable from https://api.example.com/items/1' },
+        ]);
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    it('returns per-item HTTP errors for batch browser fetches', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'upstream unavailable' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 503,
+            statusText: 'Service Unavailable',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        await expect(stepFetch(page, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'HTTP 503 Service Unavailable from https://api.example.com/items/1' },
+        ]);
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    it('stringifies non-Error batch browser failures consistently', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue('socket hang up'));
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        await expect(stepFetch(page, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'socket hang up' },
+        ]);
+    });
+    it('stringifies non-Error batch non-browser failures consistently', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue('socket hang up'));
+        await expect(stepFetch(null, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'socket hang up' },
+        ]);
+    });
+    // W2: batch item failures emit a warning log
+    it('logs a warning for each failed batch item in non-browser mode', async () => {
+        const { log } = await import('../../logger.js');
+        const warnSpy = vi.spyOn(log, 'warn');
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: false,
+            status: 503,
+            statusText: 'Service Unavailable',
+            json: vi.fn(),
+        }));
+        await stepFetch(null, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }, { id: 2 }], {});
+        expect(warnSpy).toHaveBeenCalledTimes(2);
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/1'));
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/2'));
+    });
+    it('logs a warning for each failed batch item in browser mode', async () => {
+        const { log } = await import('../../logger.js');
+        const warnSpy = vi.spyOn(log, 'warn');
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: false,
+            status: 502,
+            statusText: 'Bad Gateway',
+            json: vi.fn(),
+        }));
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        await stepFetch(page, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }, { id: 2 }], {});
+        expect(warnSpy).toHaveBeenCalledTimes(2);
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/1'));
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/2'));
+    });
+});

package/dist/pipeline/steps/transform.js

@@ -2,9 +2,7 @@
  * Pipeline steps: data transforms — select, map, filter, sort, limit.
  */
 import { render, evalExpr } from '../template.js';
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import { isRecord } from '../../utils.js';
 export async function stepSelect(_page, params, data, args) {
     const pathStr = String(render(params, { args, data }));
     if (data && typeof data === 'object') {
@@ -61,9 +59,7 @@ export async function stepSort(_page, params, data, _args) {
     return [...data].sort((a, b) => {
         const left = isRecord(a) ? a[key] : undefined;
         const right = isRecord(b) ? b[key] : undefined;
-        const va = left ?? '';
-        const vb = right ?? '';
-        const cmp = va < vb ? -1 : va > vb ? 1 : 0;
+        const cmp = String(left ?? '').localeCompare(String(right ?? ''), undefined, { numeric: true });
         return reverse ? -cmp : cmp;
     });
 }

package/dist/pipeline/template.js

@@ -1,9 +1,8 @@
 /**
  * Pipeline template engine: ${{ ... }} expression rendering.
  */
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import vm from 'node:vm';
+import { isRecord } from '../utils.js';
 export function render(template, ctx) {
     if (typeof template !== 'string')
         return template;
@@ -29,46 +28,28 @@ export function evalExpr(expr, ctx) {
     const data = ctx.data;
     const index = ctx.index ?? 0;
     // ── Pipe filters: expr | filter1(arg) | filter2 ──
-    // Supports: default(val), join(sep), upper, lower, truncate(n), trim, replace(old,new)
-    if (expr.includes('|') && !expr.includes('||')) {
-        const segments = expr.split('|').map(s => s.trim());
-        const mainExpr = segments[0];
-        let result = resolvePath(mainExpr, { args, item, data, index });
-        for (let i = 1; i < segments.length; i++) {
-            result = applyFilter(segments[i], result);
+    // Split on single | (not ||) so "item.a || item.b | upper" works correctly.
+    const pipeSegments = expr.split(/(?<!\|)\|(?!\|)/).map(s => s.trim());
+    if (pipeSegments.length > 1) {
+        let result = evalExpr(pipeSegments[0], ctx);
+        for (let i = 1; i < pipeSegments.length; i++) {
+            result = applyFilter(pipeSegments[i], result);
         }
         return result;
     }
-    // Arithmetic: index + 1
-    const arithMatch = expr.match(/^([\w][\w.]*)\s*([+\-*/])\s*(\d+)$/);
-    if (arithMatch) {
-        const [, varName, op, numStr] = arithMatch;
-        const val = resolvePath(varName, { args, item, data, index });
-        if (val !== null && val !== undefined) {
-            const numVal = Number(val);
-            const num = Number(numStr);
-            if (!isNaN(numVal)) {
-                switch (op) {
-                    case '+': return numVal + num;
-                    case '-': return numVal - num;
-                    case '*': return numVal * num;
-                    case '/': return num !== 0 ? numVal / num : 0;
-                }
-            }
-        }
-    }
-    // JS-like fallback expression: item.tweetCount || 'N/A'
-    const orMatch = expr.match(/^(.+?)\s*\|\|\s*(.+)$/);
-    if (orMatch) {
-        const left = evalExpr(orMatch[1].trim(), ctx);
-        if (left)
-            return left;
-        const right = orMatch[2].trim();
-        return right.replace(/^['"]|['"]$/g, '');
-    }
+    // Fast path: quoted string literal — skip VM overhead
+    const strLit = expr.match(/^(['"])(.*)\1$/);
+    if (strLit)
+        return strLit[2];
+    // Fast path: numeric literal
+    if (/^\d+(\.\d+)?$/.test(expr))
+        return Number(expr);
+    // Try resolving as a simple dotted path (item.foo.bar, args.limit, index)
     const resolved = resolvePath(expr, { args, item, data, index });
     if (resolved !== null && resolved !== undefined)
         return resolved;
+    // Fallback: evaluate as JS in a sandboxed VM.
+    // Handles ||, ??, arithmetic, ternary, method calls, etc. natively.
     return evalJsExpr(expr, { args, item, data, index });
 }
 /**
@@ -87,7 +68,7 @@ function applyFilter(filterExpr, value) {
         case 'default': {
             if (value === null || value === undefined || value === '') {
                 const intVal = parseInt(filterArg, 10);
-                if (!isNaN(intVal) && String(intVal) === filterArg.trim())
+                if (!Number.isNaN(intVal) && String(intVal) === filterArg.trim())
                     return intVal;
                 return filterArg;
             }
@@ -103,7 +84,7 @@ function applyFilter(filterExpr, value) {
             return typeof value === 'string' ? value.trim() : value;
         case 'truncate': {
             const n = parseInt(filterArg, 10) || 50;
-            return typeof value === 'string' && value.length > n ? value.slice(0, n) + '...' : value;
+            return typeof value === 'string' && value.length > n ? `${value.slice(0, n)}...` : value;
         }
         case 'replace': {
             if (typeof value !== 'string')
@@ -132,6 +113,7 @@ function applyFilter(filterExpr, value) {
         case 'sanitize':
             // Remove invalid filename characters
             return typeof value === 'string'
+                // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional - strips C0 control chars from filenames
                 ? value.replace(/[<>:"/\\|?*\x00-\x1f]/g, '_')
                 : value;
         case 'ext': {
@@ -196,26 +178,58 @@ export function resolvePath(pathStr, ctx) {
 }
 /**
  * Evaluate arbitrary JS expressions as a last-resort fallback.
- *
- * ⚠️  SECURITY NOTE: Uses `new Function()` to execute the expression.
- * This is acceptable here because:
- *   1. YAML adapters are authored by trusted repo contributors only.
- *   2. The expression runs in the same Node.js process (no sandbox).
- *   3. Only a curated set of globals is exposed (no require/import/process/fs).
- * If opencli ever loads untrusted third-party adapters, this MUST be replaced
- * with a proper sandboxed evaluator.
+ * Runs inside a `node:vm` sandbox with dynamic code generation disabled.
+ */
+const FORBIDDEN_EXPR_PATTERNS = /\b(constructor|__proto__|prototype|globalThis|process|require|import|eval)\b/;
+/**
+ * Deep-copy plain data to sever prototype chains, preventing sandbox escape
+ * via `args.constructor.constructor('return process')()` etc.
  */
+function sanitizeContext(obj) {
+    if (obj === null || obj === undefined)
+        return obj;
+    if (typeof obj !== 'object' && typeof obj !== 'function')
+        return obj;
+    try {
+        return JSON.parse(JSON.stringify(obj));
+    }
+    catch {
+        return {};
+    }
+}
 function evalJsExpr(expr, ctx) {
     // Guard against absurdly long expressions that could indicate injection.
     if (expr.length > 2000)
         return undefined;
-    const args = ctx.args ?? {};
-    const item = ctx.item ?? {};
-    const data = ctx.data;
+    // Block obvious sandbox escape attempts.
+    if (FORBIDDEN_EXPR_PATTERNS.test(expr))
+        return undefined;
+    const args = sanitizeContext(ctx.args ?? {});
+    const item = sanitizeContext(ctx.item ?? {});
+    const data = sanitizeContext(ctx.data);
     const index = ctx.index ?? 0;
     try {
-        const fn = new Function('args', 'item', 'data', 'index', 'encodeURIComponent', 'decodeURIComponent', 'JSON', 'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'Date', `"use strict"; return (${expr});`);
-        return fn(args, item, data, index, encodeURIComponent, decodeURIComponent, JSON, Math, Number, String, Boolean, Array, Object, Date);
+        return vm.runInNewContext(`(${expr})`, {
+            args,
+            item,
+            data,
+            index,
+            encodeURIComponent,
+            decodeURIComponent,
+            JSON,
+            Math,
+            Number,
+            String,
+            Boolean,
+            Array,
+            Date,
+        }, {
+            timeout: 50,
+            contextCodeGeneration: {
+                strings: false,
+                wasm: false,
+            },
+        });
     }
     catch {
         return undefined;

package/dist/pipeline/template.test.js

@@ -51,6 +51,31 @@ describe('evalExpr', () => {
     it('evaluates || with truthy left', () => {
         expect(evalExpr("item.name || 'N/A'", { item: { name: 'Alice' } })).toBe('Alice');
     });
+    it('evaluates chained || fallback (issue #303)', () => {
+        // When first two are falsy, should evaluate through to the string literal
+        expect(evalExpr("item.a || item.b || 'default'", { item: {} })).toBe('default');
+    });
+    it('evaluates chained || with middle value truthy', () => {
+        expect(evalExpr("item.a || item.b || 'default'", { item: { b: 'middle' } })).toBe('middle');
+    });
+    it('evaluates chained || with first value truthy', () => {
+        expect(evalExpr("item.a || item.b || 'default'", { item: { a: 'first', b: 'middle' } })).toBe('first');
+    });
+    it('evaluates || with 0 as falsy left (JS semantics)', () => {
+        expect(evalExpr("item.count || 'N/A'", { item: { count: 0 } })).toBe('N/A');
+    });
+    it('evaluates || with empty string as falsy left', () => {
+        expect(evalExpr("item.name || 'unknown'", { item: { name: '' } })).toBe('unknown');
+    });
+    it('evaluates || with numeric fallback returning number type', () => {
+        expect(evalExpr('item.a || 42', { item: {} })).toBe(42);
+    });
+    it('evaluates 4-way chained ||', () => {
+        expect(evalExpr("item.a || item.b || item.c || 'last'", { item: { c: 'third' } })).toBe('third');
+    });
+    it('handles || combined with pipe filter', () => {
+        expect(evalExpr("item.a || item.b | upper", { item: { b: 'hello' } })).toBe('HELLO');
+    });
     it('resolves simple path', () => {
         expect(evalExpr('item.title', { item: { title: 'Test' } })).toBe('Test');
     });
@@ -63,6 +88,9 @@ describe('evalExpr', () => {
     it('evaluates method calls on values', () => {
         expect(evalExpr("args.username.startsWith('@') ? args.username : '@' + args.username", { args: { username: 'alice' } })).toBe('@alice');
     });
+    it('rejects constructor-based sandbox escapes', () => {
+        expect(evalExpr("args['cons' + 'tructor']['constructor']('return process')()", { args: {} })).toBeUndefined();
+    });
     it('applies join filter', () => {
         expect(evalExpr('item.tags | join(,)', { item: { tags: ['a', 'b', 'c'] } })).toBe('a,b,c');
     });

package/dist/pipeline/transform.test.js

@@ -85,6 +85,24 @@ describe('stepSort', () => {
         await stepSort(null, 'score', SAMPLE_DATA, {});
         expect(SAMPLE_DATA).toEqual(original);
     });
+    it('sorts string-encoded numbers naturally by default', async () => {
+        const data = [
+            { name: 'A', volume: '99' },
+            { name: 'B', volume: '1000' },
+            { name: 'C', volume: '250' },
+        ];
+        const result = await stepSort(null, { by: 'volume', order: 'desc' }, data, {});
+        expect(result.map((r) => r.name)).toEqual(['B', 'C', 'A']);
+    });
+    it('handles missing fields gracefully', async () => {
+        const data = [
+            { name: 'A', value: '10' },
+            { name: 'B' },
+            { name: 'C', value: '5' },
+        ];
+        const result = await stepSort(null, { by: 'value', order: 'asc' }, data, {});
+        expect(result.map((r) => r.name)).toEqual(['B', 'C', 'A']);
+    });
 });
 describe('stepLimit', () => {
     it('limits array to N items', async () => {

package/dist/plugin.d.ts

@@ -4,12 +4,37 @@
  * Plugins live in ~/.opencli/plugins/<name>/.
  * Install source format: "github:user/repo"
  */
+/** Path to the lock file that tracks installed plugin versions. */
+export declare function getLockFilePath(): string;
+export declare const LOCK_FILE: string;
+export interface LockEntry {
+    source: string;
+    commitHash: string;
+    installedAt: string;
+    updatedAt?: string;
+}
 export interface PluginInfo {
     name: string;
     path: string;
     commands: string[];
     source?: string;
+    version?: string;
+    installedAt?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
 }
+export declare function readLockFile(): Record<string, LockEntry>;
+export declare function writeLockFile(lock: Record<string, LockEntry>): void;
+/** Get the HEAD commit hash of a git repo directory. */
+export declare function getCommitHash(dir: string): string | undefined;
+/**
+ * Validate that a downloaded plugin directory is a structurally valid plugin.
+ * Checks for at least one command file (.yaml, .yml, .ts, .js) and a valid
+ * package.json if it contains .ts files.
+ */
+export declare function validatePluginStructure(pluginDir: string): ValidationResult;
 /**
  * Install a plugin from a source.
  * Currently supports "github:user/repo" format (git clone wrapper).
@@ -23,6 +48,16 @@ export declare function uninstallPlugin(name: string): void;
  * Update a plugin by name (git pull + re-install lifecycle).
  */
 export declare function updatePlugin(name: string): void;
+export interface UpdateResult {
+    name: string;
+    success: boolean;
+    error?: string;
+}
+/**
+ * Update all installed plugins.
+ * Continues even if individual plugin updates fail.
+ */
+export declare function updateAllPlugins(): UpdateResult[];
 /**
  * List all installed plugins.
  */
@@ -32,4 +67,8 @@ declare function parseSource(source: string): {
     cloneUrl: string;
     name: string;
 } | null;
-export { parseSource as _parseSource };
+/**
+ * Resolve the path to the esbuild CLI executable with fallback strategies.
+ */
+export declare function resolveEsbuildBin(): string | null;
+export { resolveEsbuildBin as _resolveEsbuildBin, getCommitHash as _getCommitHash, parseSource as _parseSource, readLockFile as _readLockFile, updateAllPlugins as _updateAllPlugins, validatePluginStructure as _validatePluginStructure, writeLockFile as _writeLockFile, };