@jackwener/opencli 1.6.2 → 1.6.3

package/src/pipeline/template.ts

@@ -1,269 +0,0 @@
-/**
- * Pipeline template engine: ${{ ... }} expression rendering.
- */
-
-import vm from 'node:vm';
-
-export interface RenderContext {
-  args?: Record<string, unknown>;
-  data?: unknown;
-  item?: unknown;
-  index?: number;
-}
-
-import { isRecord } from '../utils.js';
-
-export function render(template: unknown, ctx: RenderContext): unknown {
-  if (typeof template !== 'string') return template;
-  const trimmed = template.trim();
-  // Full expression: entire string is a single ${{ ... }}
-  // Use [^}] to prevent matching across }} boundaries (e.g. "${{ a }}-${{ b }}")
-  const fullMatch = trimmed.match(/^\$\{\{\s*([^}]*(?:\}[^}][^}]*)*)\s*\}\}$/);
-  if (fullMatch && !trimmed.includes('}}-') && !trimmed.includes('}}${{')) return evalExpr(fullMatch[1].trim(), ctx);
-  // Check if the entire string is a single expression (no other text around it)
-  const singleExpr = trimmed.match(/^\$\{\{\s*([\s\S]*?)\s*\}\}$/);
-  if (singleExpr) {
-    // Verify it's truly a single expression (no other ${{ inside)
-    const inner = singleExpr[1];
-    if (!inner.includes('${{')) return evalExpr(inner.trim(), ctx);
-  }
-  return template.replace(/\$\{\{\s*(.*?)\s*\}\}/g, (_m, expr) => String(evalExpr(expr.trim(), ctx)));
-}
-
-export function evalExpr(expr: string, ctx: RenderContext): unknown {
-  const args = ctx.args ?? {};
-  const item = ctx.item ?? {};
-  const data = ctx.data;
-  const index = ctx.index ?? 0;
-
-  // ── Pipe filters: expr | filter1(arg) | filter2 ──
-  // Split on single | (not ||) so "item.a || item.b | upper" works correctly.
-  const pipeSegments = expr.split(/(?<!\|)\|(?!\|)/).map(s => s.trim());
-  if (pipeSegments.length > 1) {
-    let result = evalExpr(pipeSegments[0], ctx);
-    for (let i = 1; i < pipeSegments.length; i++) {
-      result = applyFilter(pipeSegments[i], result);
-    }
-    return result;
-  }
-
-  // Fast path: quoted string literal — skip VM overhead
-  const strLit = expr.match(/^(['"])(.*)\1$/);
-  if (strLit) return strLit[2];
-
-  // Fast path: numeric literal
-  if (/^\d+(\.\d+)?$/.test(expr)) return Number(expr);
-
-  // Try resolving as a simple dotted path (item.foo.bar, args.limit, index)
-  const resolved = resolvePath(expr, { args, item, data, index });
-  if (resolved !== null && resolved !== undefined) return resolved;
-
-  // Fallback: evaluate as JS in a sandboxed VM.
-  // Handles ||, ??, arithmetic, ternary, method calls, etc. natively.
-  return evalJsExpr(expr, { args, item, data, index });
-}
-
-/**
- * Apply a named filter to a value.
- * Supported filters:
- *   default(val), join(sep), upper, lower, truncate(n), trim,
- *   replace(old,new), keys, length, first, last, json
- */
-function applyFilter(filterExpr: string, value: unknown): unknown {
-  const match = filterExpr.match(/^(\w+)(?:\((.+)\))?$/);
-  if (!match) return value;
-  const [, name, rawArgs] = match;
-  const filterArg = rawArgs?.replace(/^['"]|['"]$/g, '') ?? '';
-
-  switch (name) {
-    case 'default': {
-      if (value === null || value === undefined || value === '') {
-        const intVal = parseInt(filterArg, 10);
-        if (!Number.isNaN(intVal) && String(intVal) === filterArg.trim()) return intVal;
-        return filterArg;
-      }
-      return value;
-    }
-    case 'join':
-      return Array.isArray(value) ? value.join(filterArg || ', ') : value;
-    case 'upper':
-      return typeof value === 'string' ? value.toUpperCase() : value;
-    case 'lower':
-      return typeof value === 'string' ? value.toLowerCase() : value;
-    case 'trim':
-      return typeof value === 'string' ? value.trim() : value;
-    case 'truncate': {
-      const n = parseInt(filterArg, 10) || 50;
-      return typeof value === 'string' && value.length > n ? `${value.slice(0, n)}...` : value;
-    }
-    case 'replace': {
-      if (typeof value !== 'string') return value;
-      const parts = rawArgs?.split(',').map(s => s.trim().replace(/^['"]|['"]$/g, '')) ?? [];
-      return parts.length >= 2 ? value.replaceAll(parts[0], parts[1]) : value;
-    }
-    case 'keys':
-      return value && typeof value === 'object' ? Object.keys(value) : value;
-    case 'length':
-      return Array.isArray(value) ? value.length : typeof value === 'string' ? value.length : value;
-    case 'first':
-      return Array.isArray(value) ? value[0] : value;
-    case 'last':
-      return Array.isArray(value) ? value[value.length - 1] : value;
-    case 'json':
-      return JSON.stringify(value ?? null);
-    case 'slugify':
-      // Convert to URL-safe slug
-      return typeof value === 'string'
-        ? value
-            .toLowerCase()
-            .replace(/[^\p{L}\p{N}]+/gu, '-')
-            .replace(/^-|-$/g, '')
-        : value;
-    case 'sanitize':
-      // Remove invalid filename characters
-      return typeof value === 'string'
-        // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional - strips C0 control chars from filenames
-        ? value.replace(/[<>:"/\\|?*\x00-\x1f]/g, '_')
-        : value;
-    case 'ext': {
-      // Extract file extension from URL or path
-      if (typeof value !== 'string') return value;
-      const lastDot = value.lastIndexOf('.');
-      const lastSlash = Math.max(value.lastIndexOf('/'), value.lastIndexOf('\\'));
-      return lastDot > lastSlash ? value.slice(lastDot) : '';
-    }
-    case 'basename': {
-      // Extract filename from URL or path
-      if (typeof value !== 'string') return value;
-      const parts = value.split(/[/\\]/);
-      return parts[parts.length - 1] || value;
-    }
-    case 'urlencode':
-      return typeof value === 'string' ? encodeURIComponent(value) : value;
-    case 'urldecode':
-      return typeof value === 'string' ? decodeURIComponent(value) : value;
-    default:
-      return value;
-  }
-}
-
-export function resolvePath(pathStr: string, ctx: RenderContext): unknown {
-  const args = ctx.args ?? {};
-  const item = ctx.item ?? {};
-  const data = ctx.data;
-  const index = ctx.index ?? 0;
-  const parts = pathStr.split('.');
-  const rootName = parts[0];
-  let obj: unknown;
-  let rest: string[];
-  if (rootName === 'args') { obj = args; rest = parts.slice(1); }
-  else if (rootName === 'item') { obj = item; rest = parts.slice(1); }
-  else if (rootName === 'data') { obj = data; rest = parts.slice(1); }
-  else if (rootName === 'index') return index;
-  else { obj = item; rest = parts; }
-  for (const part of rest) {
-    if (isRecord(obj)) obj = obj[part];
-    else if (Array.isArray(obj) && /^\d+$/.test(part)) obj = obj[parseInt(part, 10)];
-    else return null;
-  }
-  return obj;
-}
-
-/**
- * Evaluate arbitrary JS expressions as a last-resort fallback.
- * Runs inside a `node:vm` sandbox with dynamic code generation disabled.
- *
- * Compiled functions are cached by expression string to avoid re-creating
- * VM contexts on every invocation — critical for loops where the same
- * expression is evaluated hundreds of times.
- */
-const FORBIDDEN_EXPR_PATTERNS = /\b(constructor|__proto__|prototype|globalThis|process|require|import|eval)\b/;
-
-/**
- * Deep-copy plain data to sever prototype chains, preventing sandbox escape
- * via `args.constructor.constructor('return process')()` etc.
- */
-function sanitizeContext(obj: unknown): unknown {
-  if (obj === null || obj === undefined) return obj;
-  if (typeof obj !== 'object' && typeof obj !== 'function') return obj;
-  try {
-    return JSON.parse(JSON.stringify(obj));
-  } catch {
-    return {};
-  }
-}
-
-/** LRU-bounded cache for compiled VM scripts — prevents unbounded memory growth. */
-const MAX_VM_CACHE_SIZE = 256;
-const _vmCache = new Map<string, vm.Script>();
-
-function getOrCompileScript(expr: string): vm.Script {
-  let script = _vmCache.get(expr);
-  if (script) return script;
-
-  // Evict oldest entry when cache is full
-  if (_vmCache.size >= MAX_VM_CACHE_SIZE) {
-    const firstKey = _vmCache.keys().next().value;
-    if (firstKey !== undefined) _vmCache.delete(firstKey);
-  }
-
-  script = new vm.Script(`(${expr})`);
-  _vmCache.set(expr, script);
-  return script;
-}
-
-function evalJsExpr(expr: string, ctx: RenderContext): unknown {
-  // Guard against absurdly long expressions that could indicate injection.
-  if (expr.length > 2000) return undefined;
-
-  // Block obvious sandbox escape attempts.
-  if (FORBIDDEN_EXPR_PATTERNS.test(expr)) return undefined;
-
-  const args = sanitizeContext(ctx.args ?? {});
-  const item = sanitizeContext(ctx.item ?? {});
-  const data = sanitizeContext(ctx.data);
-  const index = ctx.index ?? 0;
-
-  try {
-    const script = getOrCompileScript(expr);
-    const sandbox = vm.createContext(
-      {
-        args,
-        item,
-        data,
-        index,
-        encodeURIComponent,
-        decodeURIComponent,
-        JSON,
-        Math,
-        Number,
-        String,
-        Boolean,
-        Array,
-        Date,
-      },
-      {
-        codeGeneration: {
-          strings: false,
-          wasm: false,
-        },
-      },
-    );
-    return script.runInContext(sandbox, { timeout: 50 });
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Normalize JavaScript source for browser evaluate() calls.
- */
-export function normalizeEvaluateSource(source: string): string {
-  const stripped = source.trim();
-  if (!stripped) return '() => undefined';
-  if (stripped.startsWith('(') && stripped.endsWith(')()')) return `() => (${stripped})`;
-  if (/^(async\s+)?\([^)]*\)\s*=>/.test(stripped)) return stripped;
-  if (/^(async\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=>/.test(stripped)) return stripped;
-  if (stripped.startsWith('function ') || stripped.startsWith('async function ')) return stripped;
-  return `() => (${stripped})`;
-}

package/src/pipeline/transform.test.ts

@@ -1,140 +0,0 @@
-/**
- * Tests for pipeline transform steps: select, map, filter, sort, limit.
- */
-
-import { describe, it, expect } from 'vitest';
-import { stepSelect, stepMap, stepFilter, stepSort, stepLimit } from './steps/transform.js';
-
-const SAMPLE_DATA = [
-  { title: 'Alpha', score: 10, author: 'Alice' },
-  { title: 'Beta', score: 30, author: 'Bob' },
-  { title: 'Gamma', score: 20, author: 'Charlie' },
-];
-
-describe('stepSelect', () => {
-  it('selects nested path', async () => {
-    const data = { result: { items: [1, 2, 3] } };
-    const result = await stepSelect(null, 'result.items', data, {});
-    expect(result).toEqual([1, 2, 3]);
-  });
-
-  it('selects array by index', async () => {
-    const data = { list: ['a', 'b', 'c'] };
-    const result = await stepSelect(null, 'list.1', data, {});
-    expect(result).toBe('b');
-  });
-
-  it('returns null for missing path', async () => {
-    const result = await stepSelect(null, 'missing.path', { foo: 1 }, {});
-    expect(result).toBeNull();
-  });
-
-  it('returns data as-is for non-object', async () => {
-    const result = await stepSelect(null, 'foo', 'string-data', {});
-    expect(result).toBe('string-data');
-  });
-});
-
-describe('stepMap', () => {
-  it('maps array items', async () => {
-    const result = await stepMap(null, {
-      name: '${{ item.title }}',
-      rank: '${{ index + 1 }}',
-    }, SAMPLE_DATA, {});
-    expect(result).toEqual([
-      { name: 'Alpha', rank: 1 },
-      { name: 'Beta', rank: 2 },
-      { name: 'Gamma', rank: 3 },
-    ]);
-  });
-
-  it('handles single object', async () => {
-    const result = await stepMap(null, {
-      name: '${{ item.title }}',
-    }, { title: 'Solo' }, {});
-    expect(result).toEqual([{ name: 'Solo' }]);
-  });
-
-  it('returns null/undefined as-is', async () => {
-    expect(await stepMap(null, { x: '${{ item.x }}' }, null, {})).toBeNull();
-  });
-
-  it('supports inline select before mapping', async () => {
-    const result = await stepMap(null, {
-      select: 'posts',
-      title: '${{ item.title }}',
-      rank: '${{ index + 1 }}',
-    }, { posts: [{ title: 'One' }, { title: 'Two' }] }, {});
-
-    expect(result).toEqual([
-      { title: 'One', rank: 1 },
-      { title: 'Two', rank: 2 },
-    ]);
-  });
-});
-
-describe('stepFilter', () => {
-  it('filters by expression', async () => {
-    const result = await stepFilter(null, 'item.score', SAMPLE_DATA, {});
-    expect(result).toHaveLength(3); // all truthy
-  });
-
-  it('returns non-array as-is', async () => {
-    const result = await stepFilter(null, 'item.x', 'not-array', {});
-    expect(result).toBe('not-array');
-  });
-});
-
-describe('stepSort', () => {
-  it('sorts ascending by key', async () => {
-    const result = await stepSort(null, 'score', SAMPLE_DATA, {});
-    expect((result as typeof SAMPLE_DATA).map((r) => r.title)).toEqual(['Alpha', 'Gamma', 'Beta']);
-  });
-
-  it('sorts descending', async () => {
-    const result = await stepSort(null, { by: 'score', order: 'desc' }, SAMPLE_DATA, {});
-    expect((result as typeof SAMPLE_DATA).map((r) => r.title)).toEqual(['Beta', 'Gamma', 'Alpha']);
-  });
-
-  it('does not mutate original', async () => {
-    const original = [...SAMPLE_DATA];
-    await stepSort(null, 'score', SAMPLE_DATA, {});
-    expect(SAMPLE_DATA).toEqual(original);
-  });
-
-  it('sorts string-encoded numbers naturally by default', async () => {
-    const data = [
-      { name: 'A', volume: '99' },
-      { name: 'B', volume: '1000' },
-      { name: 'C', volume: '250' },
-    ];
-    const result = await stepSort(null, { by: 'volume', order: 'desc' }, data, {});
-    expect((result as typeof data).map((r) => r.name)).toEqual(['B', 'C', 'A']);
-  });
-
-  it('handles missing fields gracefully', async () => {
-    const data = [
-      { name: 'A', value: '10' },
-      { name: 'B' },
-      { name: 'C', value: '5' },
-    ];
-    const result = await stepSort(null, { by: 'value', order: 'asc' }, data, {});
-    expect((result as typeof data).map((r) => r.name)).toEqual(['B', 'C', 'A']);
-  });
-});
-
-describe('stepLimit', () => {
-  it('limits array to N items', async () => {
-    const result = await stepLimit(null, '2', SAMPLE_DATA, {});
-    expect(result).toHaveLength(2);
-  });
-
-  it('limits using template expression', async () => {
-    const result = await stepLimit(null, '${{ args.limit }}', SAMPLE_DATA, { limit: 1 });
-    expect(result).toHaveLength(1);
-  });
-
-  it('returns non-array as-is', async () => {
-    expect(await stepLimit(null, '5', 'string', {})).toBe('string');
-  });
-});

package/src/plugin-manifest.test.ts

@@ -1,223 +0,0 @@
-/**
- * Tests for plugin manifest: reading, validating, and compatibility checks.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import {
-  _readPluginManifest as readPluginManifest,
-  _isMonorepo as isMonorepo,
-  _getEnabledPlugins as getEnabledPlugins,
-  _parseVersion as parseVersion,
-  _satisfiesRange as satisfiesRange,
-  MANIFEST_FILENAME,
-  type PluginManifest,
-} from './plugin-manifest.js';
-
-// ── readPluginManifest ──────────────────────────────────────────────────────
-
-describe('readPluginManifest', () => {
-  let tmpDir: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'opencli-manifest-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('returns null when no manifest file exists', () => {
-    expect(readPluginManifest(tmpDir)).toBeNull();
-  });
-
-  it('returns null for malformed JSON', () => {
-    fs.writeFileSync(path.join(tmpDir, MANIFEST_FILENAME), 'not json {{{');
-    expect(readPluginManifest(tmpDir)).toBeNull();
-  });
-
-  it('returns null for non-object JSON (array)', () => {
-    fs.writeFileSync(path.join(tmpDir, MANIFEST_FILENAME), '["a","b"]');
-    expect(readPluginManifest(tmpDir)).toBeNull();
-  });
-
-  it('returns null for non-object JSON (string)', () => {
-    fs.writeFileSync(path.join(tmpDir, MANIFEST_FILENAME), '"hello"');
-    expect(readPluginManifest(tmpDir)).toBeNull();
-  });
-
-  it('reads a single-plugin manifest', () => {
-    const manifest: PluginManifest = {
-      name: 'polymarket',
-      version: '1.2.0',
-      opencli: '>=1.0.0',
-      description: 'Prediction market analysis',
-    };
-    fs.writeFileSync(path.join(tmpDir, MANIFEST_FILENAME), JSON.stringify(manifest));
-    const result = readPluginManifest(tmpDir);
-    expect(result).toEqual(manifest);
-  });
-
-  it('reads a monorepo manifest', () => {
-    const manifest: PluginManifest = {
-      version: '1.0.0',
-      opencli: '>=0.9.0',
-      description: 'My plugin collection',
-      plugins: {
-        polymarket: {
-          path: 'packages/polymarket',
-          description: 'Prediction market',
-          version: '1.2.0',
-        },
-        defi: {
-          path: 'packages/defi',
-          description: 'DeFi data',
-          version: '0.8.0',
-          disabled: true,
-        },
-      },
-    };
-    fs.writeFileSync(path.join(tmpDir, MANIFEST_FILENAME), JSON.stringify(manifest));
-    const result = readPluginManifest(tmpDir);
-    expect(result).toEqual(manifest);
-    expect(result!.plugins!.polymarket.path).toBe('packages/polymarket');
-    expect(result!.plugins!.defi.disabled).toBe(true);
-  });
-});
-
-// ── isMonorepo ──────────────────────────────────────────────────────────────
-
-describe('isMonorepo', () => {
-  it('returns false for single-plugin manifest', () => {
-    expect(isMonorepo({ name: 'test', version: '1.0.0' })).toBe(false);
-  });
-
-  it('returns false for empty plugins object', () => {
-    expect(isMonorepo({ plugins: {} })).toBe(false);
-  });
-
-  it('returns true for manifest with plugins', () => {
-    expect(
-      isMonorepo({
-        plugins: {
-          foo: { path: 'packages/foo' },
-        },
-      }),
-    ).toBe(true);
-  });
-});
-
-// ── getEnabledPlugins ───────────────────────────────────────────────────────
-
-describe('getEnabledPlugins', () => {
-  it('returns empty array for no plugins', () => {
-    expect(getEnabledPlugins({ name: 'test' })).toEqual([]);
-  });
-
-  it('filters out disabled plugins', () => {
-    const manifest: PluginManifest = {
-      plugins: {
-        foo: { path: 'packages/foo' },
-        bar: { path: 'packages/bar', disabled: true },
-        baz: { path: 'packages/baz' },
-      },
-    };
-    const result = getEnabledPlugins(manifest);
-    expect(result).toHaveLength(2);
-    expect(result.map((r) => r.name)).toEqual(['baz', 'foo']); // sorted
-  });
-
-  it('returns all when none disabled', () => {
-    const manifest: PluginManifest = {
-      plugins: {
-        charlie: { path: 'packages/charlie' },
-        alpha: { path: 'packages/alpha' },
-      },
-    };
-    const result = getEnabledPlugins(manifest);
-    expect(result).toHaveLength(2);
-    expect(result[0].name).toBe('alpha');
-    expect(result[1].name).toBe('charlie');
-  });
-});
-
-// ── parseVersion ────────────────────────────────────────────────────────────
-
-describe('parseVersion', () => {
-  it('parses standard versions', () => {
-    expect(parseVersion('1.2.3')).toEqual([1, 2, 3]);
-    expect(parseVersion('0.0.0')).toEqual([0, 0, 0]);
-    expect(parseVersion('10.20.30')).toEqual([10, 20, 30]);
-  });
-
-  it('parses versions with prerelease suffix', () => {
-    expect(parseVersion('1.2.3-beta.1')).toEqual([1, 2, 3]);
-  });
-
-  it('returns null for invalid versions', () => {
-    expect(parseVersion('abc')).toBeNull();
-    expect(parseVersion('')).toBeNull();
-    expect(parseVersion('1.2')).toBeNull();
-  });
-});
-
-// ── satisfiesRange ──────────────────────────────────────────────────────────
-
-describe('satisfiesRange', () => {
-  it('handles >= constraint', () => {
-    expect(satisfiesRange('1.4.1', '>=1.0.0')).toBe(true);
-    expect(satisfiesRange('1.0.0', '>=1.0.0')).toBe(true);
-    expect(satisfiesRange('0.9.9', '>=1.0.0')).toBe(false);
-  });
-
-  it('handles <= constraint', () => {
-    expect(satisfiesRange('1.0.0', '<=1.0.0')).toBe(true);
-    expect(satisfiesRange('0.9.0', '<=1.0.0')).toBe(true);
-    expect(satisfiesRange('1.0.1', '<=1.0.0')).toBe(false);
-  });
-
-  it('handles > constraint', () => {
-    expect(satisfiesRange('1.0.1', '>1.0.0')).toBe(true);
-    expect(satisfiesRange('1.0.0', '>1.0.0')).toBe(false);
-  });
-
-  it('handles < constraint', () => {
-    expect(satisfiesRange('0.9.9', '<1.0.0')).toBe(true);
-    expect(satisfiesRange('1.0.0', '<1.0.0')).toBe(false);
-  });
-
-  it('handles ^ (caret) constraint', () => {
-    expect(satisfiesRange('1.2.0', '^1.2.0')).toBe(true);
-    expect(satisfiesRange('1.9.9', '^1.2.0')).toBe(true);
-    expect(satisfiesRange('2.0.0', '^1.2.0')).toBe(false);
-    expect(satisfiesRange('1.1.0', '^1.2.0')).toBe(false);
-  });
-
-  it('handles ~ (tilde) constraint', () => {
-    expect(satisfiesRange('1.2.0', '~1.2.0')).toBe(true);
-    expect(satisfiesRange('1.2.9', '~1.2.0')).toBe(true);
-    expect(satisfiesRange('1.3.0', '~1.2.0')).toBe(false);
-  });
-
-  it('handles exact match', () => {
-    expect(satisfiesRange('1.2.3', '1.2.3')).toBe(true);
-    expect(satisfiesRange('1.2.4', '1.2.3')).toBe(false);
-  });
-
-  it('handles compound range (AND)', () => {
-    expect(satisfiesRange('1.5.0', '>=1.0.0 <2.0.0')).toBe(true);
-    expect(satisfiesRange('2.0.0', '>=1.0.0 <2.0.0')).toBe(false);
-    expect(satisfiesRange('0.9.0', '>=1.0.0 <2.0.0')).toBe(false);
-  });
-
-  it('returns true for empty range', () => {
-    expect(satisfiesRange('1.0.0', '')).toBe(true);
-    expect(satisfiesRange('1.0.0', '  ')).toBe(true);
-  });
-
-  it('returns true for unparseable version', () => {
-    expect(satisfiesRange('dev', '>=1.0.0')).toBe(true);
-  });
-});