@launchfile/macos-dev 0.3.0 → 0.4.0

package/dist/shell.d.ts

@@ -1,5 +1,16 @@
 /**
- * Shell execution helper with timeout, logging, and structured results.
+ * Command execution helpers with timeout, logging, and structured results.
+ *
+ * Two entry points, and the difference between them is a security boundary:
+ *
+ * - `shell(cmd, args, opts)` passes arguments straight to the OS via
+ *   `execFile`. No shell is involved, so metacharacters in an argument are
+ *   inert. Every command this provider builds itself uses this form — a value
+ *   spliced into a command string would be CWE-78.
+ * - `shellScript(command, opts)` runs a command string through `/bin/sh -c`.
+ *   It exists only for command strings the Launchfile author wrote for their
+ *   own app (`commands:`, `health:`, `release:`), where shell syntax is the
+ *   documented contract. Never build one of these by interpolation.
  */
 export interface ShellResult {
     exitCode: number;
@@ -14,12 +25,23 @@ export interface ShellOpts {
     silent?: boolean;
 }
 /**
- * Run a shell command and return structured output.
- * Throws on non-zero exit code unless `allowFailure` is set.
+ * Run a command with an argument array. Arguments reach the OS directly, so
+ * they are never parsed as shell syntax.
  */
-export declare function shell(command: string, opts?: ShellOpts & {
+export declare function shell(cmd: string, args: string[], opts?: ShellOpts & {
+    allowFailure?: boolean;
+}): Promise<ShellResult>;
+/** Run a command with an argument array, return true if exit code is 0. */
+export declare function shellOk(cmd: string, args: string[], opts?: ShellOpts): Promise<boolean>;
+/**
+ * Run an author-written command string through `/bin/sh -c`.
+ *
+ * The shell is the point here: `commands:`, `health:` and `release:` values are
+ * documented as shell commands, and app authors rely on pipes, `&&` and
+ * variable expansion in them. The string must come from the Launchfile
+ * verbatim — building one by interpolating a value makes it injectable.
+ */
+export declare function shellScript(command: string, opts?: ShellOpts & {
     allowFailure?: boolean;
 }): Promise<ShellResult>;
-/** Run a command, return true if exit code is 0 */
-export declare function shellOk(command: string, opts?: ShellOpts): Promise<boolean>;
 //# sourceMappingURL=shell.d.ts.map

package/dist/shell.js

@@ -1,46 +1,101 @@
 /**
- * Shell execution helper with timeout, logging, and structured results.
+ * Command execution helpers with timeout, logging, and structured results.
+ *
+ * Two entry points, and the difference between them is a security boundary:
+ *
+ * - `shell(cmd, args, opts)` passes arguments straight to the OS via
+ *   `execFile`. No shell is involved, so metacharacters in an argument are
+ *   inert. Every command this provider builds itself uses this form — a value
+ *   spliced into a command string would be CWE-78.
+ * - `shellScript(command, opts)` runs a command string through `/bin/sh -c`.
+ *   It exists only for command strings the Launchfile author wrote for their
+ *   own app (`commands:`, `health:`, `release:`), where shell syntax is the
+ *   documented contract. Never build one of these by interpolation.
  */
-import { exec as cpExec } from "node:child_process";
+import { exec as cpExec, execFile as cpExecFile, } from "node:child_process";
+import { redactSecrets } from "./redact.js";
+const DEFAULT_TIMEOUT_MS = 120_000;
+const MAX_BUFFER = 10 * 1024 * 1024;
+function toResult(error, stdout, stderr) {
+    const result = {
+        exitCode: typeof error?.code === "number" ? error.code : 0,
+        stdout: typeof stdout === "string" ? stdout : "",
+        stderr: typeof stderr === "string" ? stderr : "",
+    };
+    // Node sets error.code to the exit code on non-zero; a signal or a spawn
+    // failure leaves it non-numeric, so surface those as a generic failure.
+    if (error && result.exitCode === 0)
+        result.exitCode = 1;
+    return result;
+}
+function failure(display, result) {
+    // The message reaches the user and may be logged by a caller; both the
+    // command and the child's stderr can echo a secret back, so neither goes
+    // in unscrubbed (D-18, CWE-532).
+    return Object.assign(new Error(`Command failed: ${redactSecrets(display)}\n${redactSecrets(result.stderr)}`), { result });
+}
 /**
- * Run a shell command and return structured output.
- * Throws on non-zero exit code unless `allowFailure` is set.
+ * Run a command with an argument array. Arguments reach the OS directly, so
+ * they are never parsed as shell syntax.
  */
-export async function shell(command, opts = {}) {
+export async function shell(cmd, args, opts = {}) {
+    const display = [cmd, ...args].join(" ");
     if (!opts.silent) {
-        console.log(`  $ ${command}`);
+        // An argument can carry a resolved secret (a generated DB password, a
+        // credential-bearing URL). Scrub before echo.
+        console.log(`  $ ${redactSecrets(display)}`);
     }
     const execOpts = {
         cwd: opts.cwd,
         env: opts.env ? { ...process.env, ...opts.env } : undefined,
-        timeout: opts.timeout ?? 120_000,
-        maxBuffer: 10 * 1024 * 1024,
+        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
     };
     return new Promise((resolve, reject) => {
-        cpExec(command, execOpts, (error, stdout, stderr) => {
-            const result = {
-                exitCode: typeof error?.code === "number" ? error.code : 0,
-                stdout: typeof stdout === "string" ? stdout : "",
-                stderr: typeof stderr === "string" ? stderr : "",
-            };
-            // Node's exec sets error.code to the exit code on non-zero
-            if (error && result.exitCode === 0) {
-                result.exitCode = 1;
-            }
-            if (error && !opts.allowFailure) {
-                reject(Object.assign(new Error(`Command failed: ${command}\n${result.stderr}`), {
-                    result,
-                }));
-            }
-            else {
+        cpExecFile(cmd, args, execOpts, (error, stdout, stderr) => {
+            const result = toResult(error, stdout, stderr);
+            if (error && !opts.allowFailure)
+                reject(failure(display, result));
+            else
                 resolve(result);
-            }
         });
     });
 }
-/** Run a command, return true if exit code is 0 */
-export async function shellOk(command, opts) {
-    const result = await shell(command, { ...opts, allowFailure: true, silent: true });
+/** Run a command with an argument array, return true if exit code is 0. */
+export async function shellOk(cmd, args, opts) {
+    const result = await shell(cmd, args, {
+        ...opts,
+        allowFailure: true,
+        silent: true,
+    });
     return result.exitCode === 0;
 }
+/**
+ * Run an author-written command string through `/bin/sh -c`.
+ *
+ * The shell is the point here: `commands:`, `health:` and `release:` values are
+ * documented as shell commands, and app authors rely on pipes, `&&` and
+ * variable expansion in them. The string must come from the Launchfile
+ * verbatim — building one by interpolating a value makes it injectable.
+ */
+export async function shellScript(command, opts = {}) {
+    if (!opts.silent) {
+        console.log(`  $ ${redactSecrets(command)}`);
+    }
+    const execOpts = {
+        cwd: opts.cwd,
+        env: opts.env ? { ...process.env, ...opts.env } : undefined,
+        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+    };
+    return new Promise((resolve, reject) => {
+        cpExec(command, execOpts, (error, stdout, stderr) => {
+            const result = toResult(error, stdout, stderr);
+            if (error && !opts.allowFailure)
+                reject(failure(command, result));
+            else
+                resolve(result);
+        });
+    });
+}
 //# sourceMappingURL=shell.js.map

package/dist/state.d.ts

@@ -50,6 +50,16 @@ export interface LaunchState {
      * persistence existed simply omit this, and `down` tolerates its absence.
      */
     processes?: Record<string, ProcessState>;
+    /**
+     * Minted `env:`-level generator values (D-49: generate once, then
+     * preserve), keyed `<component>.<ENV_NAME>` — one entry per declaration
+     * (D-25), so same-named variables on different components hold independent
+     * values. `generator: port` values are never stored here (ports are
+     * re-allocated each run). Disjoint from `secrets` on purpose: these names
+     * must not become resolvable as `$secrets.<name>`. Optional for backward
+     * compatibility: older state files omit it and load as a first run.
+     */
+    generatedEnv?: Record<string, string>;
 }
 export declare function hashLaunchfile(content: string): string;
 /** Load state from disk, or return null if none exists */

package/dist/state.js

@@ -7,6 +7,7 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
+import { registerSecrets } from "./redact.js";
 const STATE_DIR = ".launchfile";
 const STATE_FILE = "state.json";
 function stateDir(projectDir) {
@@ -22,7 +23,17 @@ export function hashLaunchfile(content) {
 export async function loadState(projectDir) {
     try {
         const raw = await readFile(statePath(projectDir), "utf8");
-        return JSON.parse(raw);
+        const state = JSON.parse(raw);
+        // Persisted credentials are reused verbatim in provisioning commands and
+        // in `$secrets.*` / `$<resource>.*` expressions, so they must be known to
+        // the redactor before anything can echo them.
+        registerSecrets(Object.values(state.secrets ?? {}));
+        registerSecrets(Object.values(state.resources ?? {}).map((r) => r.password));
+        // A value minted in an earlier run and merely reused in this one never
+        // passes through generateValue()'s registration, so the loader is the
+        // only place it can become scrubbable (D-18).
+        registerSecrets(Object.values(state.generatedEnv ?? {}));
+        return state;
     }
     catch {
         return null;

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@launchfile/macos-dev",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "macOS dev provider for Launchfile — run apps locally via brew services and native runtimes",
+  "os": [
+    "darwin"
+  ],
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -33,14 +36,14 @@
     "directory": "providers/macos-dev"
   },
   "dependencies": {
-    "@launchfile/sdk": "^0.3.0",
+    "@launchfile/sdk": "^0.4.0",
     "semver": "^7.7.4"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.10",
     "@types/bun": "^1.3.11",
     "@types/semver": "^7.7.1",
-    "typescript": "^6.0.0",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.3"
   }
 }