@lenne.tech/cli 1.46.0 → 1.47.0

package/build/lib/heal-oxlintrc.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDangerousFixFlagUsage = findDangerousFixFlagUsage;
+exports.healDangerousOxlintFixFlags = healDangerousOxlintFixFlags;
+exports.healOxlintrcFilename = healOxlintrcFilename;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const LEGACY = 'oxlint.json';
+const TARGET = '.oxlintrc.json';
+/** A `-c`/`--config` flag pointing at the legacy file, e.g. `-c oxlint.json`, `--config=./oxlint.json`. */
+const CONFIG_FLAG = /(-c|--config)(\s+|=)(\.\/)?oxlint\.json(?![\w.-])/g;
+/**
+ * oxlint flags that apply behaviour-changing fixes: `--fix-suggestions` (e.g. deletes
+ * console calls for no-console) and `--fix-dangerously`. Matches a USE of the flag —
+ * preceded by whitespace or a quote — not a mention in backticks such as the comment
+ * "Never `--fix-suggestions`" the current templates carry.
+ */
+const DANGEROUS_FIX_FLAG_USE = /(?:^|[\s'"])--fix-(?:suggestions|dangerously)(?![\w-])/m;
+/** The removable form: the flag as a further argument after whitespace. `--fix` itself stays. */
+const DANGEROUS_FIX_FLAG_ARG = /[ \t]+--fix-(?:suggestions|dangerously)(?![\w-])/g;
+const LINT_STAGED_FILES = [
+    '.lintstagedrc',
+    '.lintstagedrc.json',
+    '.lintstagedrc.yaml',
+    '.lintstagedrc.yml',
+    '.lintstagedrc.js',
+    '.lintstagedrc.cjs',
+    '.lintstagedrc.mjs',
+    'lint-staged.config.js',
+    'lint-staged.config.cjs',
+    'lint-staged.config.mjs',
+];
+/**
+ * Files in which a dangerous fix flag is still USED. The root `scripts/check.mjs` counts
+ * for the gate but is not stripped here — `healCheckWrapper` owns that file.
+ * Paths are relative to `workspaceRoot` (or `appDir` for a standalone app).
+ */
+function findDangerousFixFlagUsage(appDir, workspaceRoot) {
+    const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
+    const files = [...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []), ...fixFlagFiles(appDir, workspaceRoot)];
+    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => (0, path_1.relative)(base, file) || file);
+}
+/**
+ * Remove `--fix-suggestions` and `--fix-dangerously` from the project's lint commands
+ * — root and app `package.json` (scripts and inline lint-staged), lint-staged configs
+ * and the app's own `scripts/check.mjs` — so the oxlint config can be loaded safely.
+ *
+ * Textual, so formatting stays exactly as it was. Only tracked files without
+ * uncommitted changes are edited (git can restore them); an untracked, dirty or
+ * symlinked file is reported in `skipped` and keeps blocking the rename.
+ */
+function healDangerousOxlintFixFlags(appDir, workspaceRoot) {
+    const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
+    const result = { changed: [], skipped: [] };
+    for (const file of fixFlagFiles(appDir, workspaceRoot)) {
+        if (!usesDangerousFixFlag(file)) {
+            continue;
+        }
+        const rel = (0, path_1.relative)(base, file) || file;
+        const dir = (0, path_1.join)(file, '..');
+        const name = (0, path_1.relative)(dir, file);
+        if (isSymlink(file)) {
+            result.skipped.push(`${rel} (symlink)`);
+        }
+        else if (!isTracked(dir, name)) {
+            result.skipped.push(`${rel} (not tracked by git — remove the flag by hand)`);
+        }
+        else if (hasUncommittedChanges(dir, name)) {
+            result.skipped.push(`${rel} (uncommitted changes — commit or discard them, then re-run)`);
+        }
+        else {
+            const content = (0, fs_1.readFileSync)(file, 'utf8');
+            const stripped = content.replace(DANGEROUS_FIX_FLAG_ARG, '');
+            if (stripped !== content) {
+                (0, fs_1.writeFileSync)(file, stripped);
+                result.changed.push(rel);
+            }
+            if (DANGEROUS_FIX_FLAG_USE.test(stripped)) {
+                result.skipped.push(`${rel} (a flag use that is not a plain argument remains — remove it by hand)`);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Heal the oxlint config filename of an app project: `oxlint.json` → `.oxlintrc.json`.
+ *
+ * oxlint only auto-discovers `.oxlintrc.json`. nuxt-base-template and
+ * nuxt-extensions shipped the config as `oxlint.json`, so every rule in it was
+ * silently ignored — projects linted with oxlint's defaults only. The templates
+ * renamed the file; existing projects keep the old name until this runs.
+ *
+ * Loading the config is not neutral. It turns on rules such as `no-console`, and
+ * an auto-fix run with `--fix-suggestions` applies that rule's suggestion, which
+ * deletes console calls. So the rename is GATED: it only happens once no check
+ * wrapper, script or lint-staged entry of the project still passes
+ * `--fix-suggestions`. Run it after `healCheckWrapper`, which removes the flag
+ * from the root wrapper in the same update.
+ *
+ * Same recoverability rules as the other heals: never through a symlink, never
+ * over uncommitted changes to the file, `git mv` for a tracked file so history
+ * follows the rename.
+ *
+ * @param appDir        The app project (e.g. `<workspace>/projects/app`).
+ * @param workspaceRoot The monorepo root, whose `scripts/check.mjs` and
+ *                      `package.json` also gate the rename. Omit for a standalone app.
+ */
+function healOxlintrcFilename(appDir, workspaceRoot) {
+    const legacy = (0, path_1.join)(appDir, LEGACY);
+    const target = (0, path_1.join)(appDir, TARGET);
+    if (!(0, fs_1.existsSync)(legacy) && !isSymlink(legacy)) {
+        return { action: 'none', changed: [] };
+    }
+    if ((0, fs_1.existsSync)(target) || isSymlink(target)) {
+        return {
+            action: 'both-present',
+            changed: [],
+            detail: `both ${LEGACY} and ${TARGET} exist — oxlint only loads ${TARGET}; merge the rules from ${LEGACY} by hand, then delete it`,
+        };
+    }
+    if (isSymlink(legacy)) {
+        return { action: 'skipped', changed: [], detail: `${LEGACY} is a symlink — rename it by hand` };
+    }
+    const withFlag = findDangerousFixFlagUsage(appDir, workspaceRoot);
+    if (withFlag.length > 0) {
+        return {
+            action: 'skipped',
+            changed: [],
+            detail: `--fix-suggestions/--fix-dangerously is still used in ${withFlag.join(', ')}; loading the config would let it delete console calls — remove the flag, then re-run`,
+        };
+    }
+    const tracked = isTracked(appDir, LEGACY);
+    if (tracked && hasUncommittedChanges(appDir, LEGACY)) {
+        return {
+            action: 'skipped',
+            changed: [],
+            detail: `${LEGACY} has uncommitted changes — commit or discard them, then re-run`,
+        };
+    }
+    if (tracked) {
+        (0, child_process_1.execFileSync)('git', ['-C', appDir, 'mv', '--', LEGACY, TARGET], { stdio: 'ignore' });
+    }
+    else {
+        // Nothing is overwritten (the target does not exist), so an untracked file
+        // keeps its content under the new name — no backup needed.
+        (0, fs_1.renameSync)(legacy, target);
+    }
+    const changed = [`${LEGACY} → ${TARGET}`];
+    const pkgPath = (0, path_1.join)(appDir, 'package.json');
+    if ((0, fs_1.existsSync)(pkgPath) && !isSymlink(pkgPath)) {
+        const pkg = (0, fs_1.readFileSync)(pkgPath, 'utf8');
+        // Textual, not JSON round-trip: only the flag value changes, the file keeps its formatting.
+        const updated = pkg.replace(CONFIG_FLAG, (_match, flag, sep, dot = '') => `${flag}${sep}${dot}${TARGET}`);
+        if (updated !== pkg) {
+            (0, fs_1.writeFileSync)(pkgPath, updated);
+            changed.push('package.json');
+        }
+    }
+    return { action: 'renamed', changed };
+}
+/**
+ * Files that may pass a dangerous fix flag and are ours to strip: both package.json
+ * files (scripts and inline lint-staged), lint-staged configs, and the app's own
+ * check wrapper.
+ */
+function fixFlagFiles(appDir, workspaceRoot) {
+    const roots = [...new Set([workspaceRoot, appDir].filter((dir) => Boolean(dir)))];
+    return [
+        ...roots.flatMap((dir) => ['package.json', ...LINT_STAGED_FILES].map((name) => (0, path_1.join)(dir, name))),
+        (0, path_1.join)(appDir, 'scripts', 'check.mjs'),
+    ];
+}
+/** True when the TRACKED `relPath` has uncommitted modifications. */
+function hasUncommittedChanges(dir, relPath) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['-C', dir, 'status', '--porcelain', '--', relPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return out.trim().length > 0;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True when `path` is a symlink (checked without following it). */
+function isSymlink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True when git tracks `relPath`; false outside a repository as well. */
+function isTracked(dir, relPath) {
+    try {
+        (0, child_process_1.execFileSync)('git', ['-C', dir, 'ls-files', '--error-unmatch', '--', relPath], { stdio: 'ignore' });
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function usesDangerousFixFlag(file) {
+    try {
+        // Follows a symlink on purpose: a linked config still feeds the lint run, so it
+        // must block the rename, even though the strip refuses to write through it.
+        return DANGEROUS_FIX_FLAG_USE.test((0, fs_1.readFileSync)(file, 'utf8'));
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/build/lib/platform.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findExecutable = findExecutable;
+exports.isWindows = isWindows;
+exports.spawnCmdSync = spawnCmdSync;
+exports.windowsAppData = windowsAppData;
+const cross_spawn_1 = require("cross-spawn");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+/**
+ * Resolve a binary the way a shell would, without spawning `which`/`where.exe`.
+ *
+ * `candidates` win over PATH, in order. On Windows each PATH directory is
+ * probed with every PATHEXT extension; an extensionless file is never matched
+ * there, because Node cannot spawn it (it is typically a Git Bash script).
+ *
+ * @returns Absolute path of the first match, or null
+ */
+function findExecutable(name, options = {}) {
+    const { candidates = [], env = process.env, isExecutableFile = isExecutableFileOnDisk } = options;
+    const windows = isWindows(options.platform);
+    const pathApi = windows ? path_1.win32 : path_1.posix;
+    for (const candidate of candidates) {
+        if (isExecutableFile(candidate)) {
+            return candidate;
+        }
+    }
+    const dirs = (readEnv(env, 'PATH', windows) || '')
+        .split(pathApi.delimiter)
+        .map((dir) => dir.trim().replace(/^"(.*)"$/, '$1'))
+        .filter(Boolean);
+    const names = windows ? windowsNameVariants(name, readEnv(env, 'PATHEXT', windows)) : [name];
+    for (const dir of dirs) {
+        for (const variant of names) {
+            const full = pathApi.join(dir, variant);
+            if (isExecutableFile(full)) {
+                return full;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * True for native Windows (PowerShell, cmd.exe and Git Bash alike — Node
+ * reports `win32` in all three).
+ */
+function isWindows(platform = process.platform) {
+    return platform === 'win32';
+}
+/**
+ * `spawnSync` that also runs `.cmd`/`.bat` shims on Windows.
+ *
+ * Delegates to cross-spawn, which is a plain `child_process.spawnSync` on
+ * macOS/Linux. On Windows it resolves the shim and runs it through cmd.exe with
+ * escaped arguments.
+ *
+ * Limit on Windows: cross-spawn escapes cmd.exe metacharacters (`& | % ^ …`) twice
+ * only for shims under `node_modules\.bin`. A global npm shim such as
+ * `%APPDATA%\npm\claude.cmd` re-parses its `%*`, so there a metacharacter can
+ * still take effect. Pass plain arguments (names, slugs, paths), never
+ * untrusted free text.
+ */
+function spawnCmdSync(command, args = [], options = {}) {
+    return (0, cross_spawn_1.sync)(command, [...args], Object.assign({ encoding: 'utf-8' }, options));
+}
+/**
+ * `%APPDATA%` (roaming profile), home of npm's global `.cmd` shims on Windows.
+ */
+function windowsAppData(env, home) {
+    return readEnv(env, 'APPDATA', true) || path_1.win32.join(home, 'AppData', 'Roaming');
+}
+function isExecutableFileOnDisk(path) {
+    try {
+        if (!(0, fs_1.statSync)(path).isFile()) {
+            return false;
+        }
+        // Windows has no execute bit; X_OK degrades to an existence check there
+        (0, fs_1.accessSync)(path, fs_1.constants.X_OK);
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Windows environment keys are case-insensitive (`Path` is the usual spelling).
+ * `process.env` hides that, a plain object passed in a test does not.
+ */
+function readEnv(env, key, windows) {
+    if (!windows) {
+        return env[key];
+    }
+    const match = Object.keys(env).find((k) => k.toUpperCase() === key);
+    return match ? env[match] : undefined;
+}
+function windowsNameVariants(name, pathExt) {
+    const extensions = (pathExt || DEFAULT_PATHEXT)
+        .split(';')
+        .map((ext) => ext.trim().toLowerCase())
+        .filter(Boolean);
+    const ownExtension = path_1.win32.extname(name).toLowerCase();
+    if (ownExtension && extensions.includes(ownExtension)) {
+        return [name];
+    }
+    return extensions.map((ext) => `${name}${ext}`);
+}

package/build/lib/plugin-utils.js

@@ -21,12 +21,12 @@ exports.setupPermissions = setupPermissions;
  * Plugin utilities for Claude Code plugin management
  * Handles reading plugin contents, permissions, and post-installation setup
  */
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const claude_cli_1 = require("./claude-cli");
 const json_utils_1 = require("./json-utils");
+const platform_1 = require("./platform");
 const shell_config_1 = require("./shell-config");
 /**
  * Empty plugin contents constant (used for failed installations)
@@ -62,8 +62,8 @@ exports.PLUGIN_POST_INSTALL = {
         ],
         requirements: [
             {
-                checkCommand: 'which typescript-language-server',
                 description: 'TypeScript language server',
+                executable: 'typescript-language-server',
                 installCommand: 'npm install -g typescript-language-server typescript',
             },
         ],
@@ -245,10 +245,11 @@ function processPostInstall(pluginName, toolbox) {
     // Check and install requirements
     if (postInstall.requirements) {
         for (const req of postInstall.requirements) {
-            // If checkCommand is provided, verify if requirement is already met
-            if (req.checkCommand) {
+            // If executable or checkCommand is provided, verify if requirement is already met
+            if (req.executable || req.checkCommand) {
+                const isMet = () => req.executable ? (0, platform_1.findExecutable)(req.executable) !== null : (0, claude_cli_1.checkCommandExists)(req.checkCommand);
                 const checkSpinner = spin(`Checking ${req.description}`);
-                if ((0, claude_cli_1.checkCommandExists)(req.checkCommand)) {
+                if (isMet()) {
                     checkSpinner.succeed(`${req.description} already installed`);
                     continue;
                 }
@@ -257,7 +258,7 @@ function processPostInstall(pluginName, toolbox) {
                 try {
                     safeExecCommand(req.installCommand);
                     // Verify installation
-                    if ((0, claude_cli_1.checkCommandExists)(req.checkCommand)) {
+                    if (isMet()) {
                         checkSpinner.succeed(`${req.description} installed`);
                         result.requirementsInstalled.push(req.description);
                     }
@@ -377,7 +378,7 @@ function readPluginContents(marketplaceName, pluginName) {
     return result;
 }
 /**
- * Execute a shell command safely using spawnSync (no shell interpretation)
+ * Execute a shell command safely using spawnCmdSync (no shell interpretation, `.cmd` shims such as npm work on Windows)
  * Splits the command string into executable and arguments to prevent command injection
  * @param command - Command string to execute (e.g., 'npm install -g typescript')
  * @throws Error if command fails (non-zero exit code or signal)
@@ -385,7 +386,7 @@ function readPluginContents(marketplaceName, pluginName) {
 function safeExecCommand(command) {
     var _a;
     const [cmd, ...args] = command.trim().split(/\s+/);
-    const result = (0, child_process_1.spawnSync)(cmd, args, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+    const result = (0, platform_1.spawnCmdSync)(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'] });
     if (result.status !== 0 || result.error) {
         throw new Error(result.stderr || ((_a = result.error) === null || _a === void 0 ? void 0 : _a.message) || `Command failed: ${command}`);
     }