@metrio-ai/cli 1.1.0 → 1.2.0

package/dist/sync/workspace.js

@@ -0,0 +1,419 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KIND_FILES = exports.KIND_DIR = void 0;
+exports.findRoot = findRoot;
+exports.readProject = readProject;
+exports.initRoot = initRoot;
+exports.readState = readState;
+exports.writeState = writeState;
+exports.acquireLock = acquireLock;
+exports.hashFiles = hashFiles;
+exports.slugify = slugify;
+exports.readLocal = readLocal;
+exports.writeLocal = writeLocal;
+exports.removeLocal = removeLocal;
+exports.listLocal = listLocal;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml_1 = require("yaml");
+const errors_1 = require("../errors");
+exports.KIND_DIR = { prompt: 'prompts', skill: 'skills', workflow: 'workflows' };
+exports.KIND_FILES = {
+    prompt: ['prompt.yaml', 'system.md'],
+    skill: ['skill.md'],
+    workflow: ['workflow.yaml', 'definition.json'],
+};
+const CONFIG = 'metrio.yaml';
+/** Check a file path for symlinks; ENOENT is fine (file doesn't exist yet). */
+function assertNotSymlink(fullPath, relativePath) {
+    try {
+        const stat = fs.lstatSync(fullPath);
+        if (stat.isSymbolicLink()) {
+            throw new errors_1.CliError(`Refusing to follow symlink at ${relativePath}`);
+        }
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return;
+        if (err instanceof errors_1.CliError)
+            throw err;
+        throw new errors_1.CliError(`Cannot inspect ${relativePath}: ${err.message}`);
+    }
+}
+/** Nearest directory at or above cwd that holds metrio.yaml. */
+function findRoot(cwd = process.cwd()) {
+    let dir = path.resolve(cwd);
+    for (;;) {
+        if (fs.existsSync(path.join(dir, CONFIG)))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+function readProject(root) {
+    const file = path.join(root, CONFIG);
+    assertNotSymlink(file, CONFIG);
+    let doc;
+    try {
+        doc = (0, yaml_1.parse)(fs.readFileSync(file, 'utf8'));
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Cannot read ${file}: ${err.message}`);
+    }
+    const project = doc?.project;
+    if (typeof project !== 'string' || !project)
+        throw new errors_1.CliError(`${file} has no "project:" entry`);
+    return project;
+}
+/**
+ * Creates metrio.yaml in dir if missing; an existing one must name the same project.
+ * A new workspace also gets a .gitattributes that stops git from converting line endings in
+ * the synced files (they must stay byte-identical to the console); an existing one is left alone.
+ */
+function initRoot(dir, project) {
+    const root = path.resolve(dir);
+    const file = path.join(root, CONFIG);
+    if (fs.existsSync(file)) {
+        assertNotSymlink(file, CONFIG);
+        const existing = readProject(root);
+        if (existing !== project)
+            throw new errors_1.CliError(`${file} is already set up for project "${existing}"`);
+        return root;
+    }
+    fs.mkdirSync(root, { recursive: true });
+    assertNotSymlink(file, CONFIG);
+    fs.writeFileSync(file, (0, yaml_1.stringify)({ project }));
+    const attributes = path.join(root, '.gitattributes');
+    assertNotSymlink(attributes, '.gitattributes');
+    if (!fs.existsSync(attributes)) {
+        fs.writeFileSync(attributes, ['prompts/** -text', 'skills/** -text', 'workflows/** -text', '.metrio/** -text', ''].join('\n'));
+    }
+    return root;
+}
+const statePath = (root) => path.join(root, '.metrio', 'state.json');
+/** Creates .metrio/ (refusing a symlink) with a .gitignore so the lock and temp files are never committed. */
+function ensureMetrioDir(root) {
+    const dir = path.join(root, '.metrio');
+    fs.mkdirSync(dir, { recursive: true });
+    assertNotSymlink(dir, '.metrio');
+    const ignore = path.join(dir, '.gitignore');
+    assertNotSymlink(ignore, '.metrio/.gitignore');
+    if (!fs.existsSync(ignore))
+        fs.writeFileSync(ignore, 'lock\n*.tmp\n');
+    return dir;
+}
+function readState(root, project) {
+    const file = statePath(root);
+    assertNotSymlink(path.dirname(file), '.metrio');
+    if (!fs.existsSync(file))
+        return { version: 1, project, resources: {} };
+    assertNotSymlink(file, `.metrio/state.json`);
+    let state;
+    try {
+        state = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (err) {
+        throw new errors_1.CliError(`${file} is not valid JSON: ${err.message}`);
+    }
+    // Validate state shape
+    if (!state ||
+        typeof state !== 'object' ||
+        state.version !== 1 ||
+        typeof state.project !== 'string' ||
+        !state.resources ||
+        typeof state.resources !== 'object' ||
+        Array.isArray(state.resources)) {
+        throw new errors_1.CliError(`${file} is not a metrio state file`);
+    }
+    const typedState = state;
+    if (typedState.project !== project) {
+        throw new errors_1.CliError(`${file} belongs to project "${typedState.project}", not "${project}"`);
+    }
+    // Validate all resource keys
+    for (const key of Object.keys(typedState.resources)) {
+        validateKey(key);
+        // An older push stored a NaN version, which JSON wrote as null: treat it as never pushed.
+        const entry = typedState.resources[key];
+        if (entry && entry.pushed_workflow_version === null)
+            delete entry.pushed_workflow_version;
+    }
+    return typedState;
+}
+/** Atomic write with resources sorted by path, so the file diffs cleanly in git. */
+function writeState(root, state) {
+    const file = statePath(root);
+    ensureMetrioDir(root);
+    assertNotSymlink(file, `.metrio/state.json`);
+    const sorted = {
+        version: 1,
+        project: state.project,
+        resources: Object.fromEntries(Object.keys(state.resources).sort().map((k) => [k, state.resources[k]])),
+    };
+    const data = `${JSON.stringify(sorted, null, 2)}\n`;
+    const tmp = `${file}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(tmp, data, { flag: 'wx' });
+    }
+    catch (err) {
+        if (err.code === 'EEXIST') {
+            fs.rmSync(tmp, { force: true });
+            fs.writeFileSync(tmp, data, { flag: 'wx' });
+        }
+        else {
+            throw err;
+        }
+    }
+    try {
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        fs.rmSync(tmp, { force: true });
+        throw err;
+    }
+}
+/**
+ * Takes the workspace lock (.metrio/lock, created exclusively) so two pulls/pushes can't
+ * interleave their reads and state writes. Returns the release function; call it in finally.
+ */
+function acquireLock(root) {
+    const file = path.join(ensureMetrioDir(root), 'lock');
+    assertNotSymlink(file, '.metrio/lock');
+    try {
+        fs.writeFileSync(file, `${process.pid} ${new Date().toISOString()}\n`, { flag: 'wx' });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw new errors_1.CliError(`Cannot create .metrio/lock: ${err.message}`);
+        let holder = '';
+        try {
+            holder = fs.readFileSync(file, 'utf8').trim();
+        }
+        catch {
+            // released meanwhile, or unreadable: report what we know
+        }
+        const [pid = '?', since = '?'] = holder.split(/\s+/);
+        throw new errors_1.CliError(`another metrio pull/push is running in this workspace (pid ${pid} since ${since}); delete .metrio/lock if it is stale`);
+    }
+    return () => fs.rmSync(file, { force: true });
+}
+/**
+ * sha256 over sorted (name, length, content) triples — unambiguous for any file contents.
+ * Only used for change detection, so CRLF counts as LF: a checkout that converted line
+ * endings is not a local edit. File contents themselves are never rewritten.
+ */
+function hashFiles(files) {
+    const hash = (0, crypto_1.createHash)('sha256');
+    for (const name of Object.keys(files).sort()) {
+        const content = files[name].replace(/\r\n/g, '\n');
+        hash.update(`${name}\n${Buffer.byteLength(content)}\n`);
+        hash.update(content);
+    }
+    return hash.digest('hex');
+}
+function slugify(name, fallback) {
+    const slug = name
+        .normalize('NFKC')
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}]+/gu, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug || fallback;
+}
+/** Validates a resource key format (kind/name). */
+function validateKey(key) {
+    if (!key)
+        throw new errors_1.CliError(`Unsafe resource path "${key}" in .metrio/state.json or console data`);
+    const segments = key.split('/');
+    // Keys must be exactly 2 segments: kind/name
+    if (segments.length !== 2)
+        throw new errors_1.CliError(`Unsafe resource path "${key}" in .metrio/state.json or console data`);
+    // First segment must be a resource kind directory
+    if (!['prompts', 'skills', 'workflows'].includes(segments[0])) {
+        throw new errors_1.CliError(`Unsafe resource path "${key}" in .metrio/state.json or console data`);
+    }
+    // Check each segment
+    for (const seg of segments) {
+        if (seg === '' || seg === '.' || seg === '..') {
+            throw new errors_1.CliError(`Unsafe resource path "${key}" in .metrio/state.json or console data`);
+        }
+        if (seg.includes('\\') || seg.includes(':') || seg.includes('\0')) {
+            throw new errors_1.CliError(`Unsafe resource path "${key}" in .metrio/state.json or console data`);
+        }
+    }
+}
+/** Resolves a resource key to an absolute path, validating and checking for symlinks. */
+function resolveKey(root, key) {
+    validateKey(key);
+    const segments = key.split('/');
+    let currentPath = root;
+    // Walk from root down to the target, checking for symlinks
+    for (let i = 0; i < segments.length; i++) {
+        const segment = segments[i];
+        currentPath = path.join(currentPath, segment);
+        // Only check existing path components; ignore ENOENT for not-yet-created parts
+        try {
+            const stat = fs.lstatSync(currentPath);
+            if (stat.isSymbolicLink()) {
+                const relativePath = segments.slice(0, i + 1).join('/');
+                throw new errors_1.CliError(`Refusing to follow symlink at ${relativePath}`);
+            }
+        }
+        catch (err) {
+            if (err instanceof errors_1.CliError)
+                throw err;
+            if (err.code !== 'ENOENT') {
+                const relativePath = segments.slice(0, i + 1).join('/');
+                throw new errors_1.CliError(`Cannot inspect ${relativePath}: ${err.message}`);
+            }
+            // Path doesn't exist yet, which is fine
+        }
+    }
+    return currentPath;
+}
+function readLocal(root, key, kind) {
+    const targetPath = resolveKey(root, key);
+    if (kind === 'skill') {
+        if (!fs.existsSync(targetPath))
+            return undefined;
+        assertNotSymlink(targetPath, key);
+        return { 'skill.md': fs.readFileSync(targetPath, 'utf8') };
+    }
+    const files = {};
+    for (const name of exports.KIND_FILES[kind]) {
+        const file = path.join(targetPath, name);
+        if (fs.existsSync(file)) {
+            assertNotSymlink(file, `${key}/${name}`);
+            files[name] = fs.readFileSync(file, 'utf8');
+        }
+    }
+    return Object.keys(files).length ? files : undefined;
+}
+function writeLocal(root, key, kind, files) {
+    const targetPath = resolveKey(root, key);
+    if (kind === 'skill') {
+        fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+        assertNotSymlink(targetPath, key);
+        fs.writeFileSync(targetPath, files['skill.md']);
+        return;
+    }
+    fs.mkdirSync(targetPath, { recursive: true });
+    for (const name of exports.KIND_FILES[kind]) {
+        if (files[name] !== undefined) {
+            const file = path.join(targetPath, name);
+            assertNotSymlink(file, `${key}/${name}`);
+            fs.writeFileSync(file, files[name]);
+        }
+    }
+}
+function removeLocal(root, key, kind) {
+    const targetPath = resolveKey(root, key);
+    if (kind === 'skill') {
+        assertNotSymlink(targetPath, key);
+        fs.rmSync(targetPath, { force: true });
+        return;
+    }
+    for (const name of exports.KIND_FILES[kind]) {
+        const file = path.join(targetPath, name);
+        assertNotSymlink(file, `${key}/${name}`);
+        fs.rmSync(file, { force: true });
+    }
+    try {
+        fs.rmdirSync(targetPath);
+    }
+    catch {
+        // directory still holds other files the user put there; leave it
+    }
+}
+function listLocal(root, kinds) {
+    const out = [];
+    for (const kind of kinds) {
+        const dir = path.join(root, exports.KIND_DIR[kind]);
+        if (!fs.existsSync(dir))
+            continue;
+        // Check the kind directory itself for symlinks
+        try {
+            const stat = fs.lstatSync(dir);
+            if (stat.isSymbolicLink()) {
+                console.error(`metrio: skipping ${exports.KIND_DIR[kind]}: symlink`);
+                continue;
+            }
+        }
+        catch (err) {
+            console.error(`metrio: skipping ${exports.KIND_DIR[kind]}: ${err.message}`);
+            continue;
+        }
+        for (const name of fs.readdirSync(dir).sort()) {
+            const key = `${exports.KIND_DIR[kind]}/${name}`;
+            // Validate key format
+            try {
+                validateKey(key);
+            }
+            catch (err) {
+                console.error(`metrio: skipping ${key}: ${err.message}`);
+                continue;
+            }
+            const fullPath = path.join(dir, name);
+            let stat;
+            try {
+                stat = fs.lstatSync(fullPath);
+            }
+            catch (err) {
+                console.error(`metrio: skipping ${key}: ${err.message}`);
+                continue;
+            }
+            if (stat.isSymbolicLink()) {
+                console.error(`metrio: skipping ${key}: symlink`);
+                continue;
+            }
+            if (kind === 'skill') {
+                if (name.endsWith('.md') && stat.isFile())
+                    out.push({ key, kind });
+            }
+            else if (stat.isDirectory()) {
+                try {
+                    if (readLocal(root, key, kind))
+                        out.push({ key, kind });
+                }
+                catch (err) {
+                    console.error(`metrio: skipping ${key}: ${err.message}`);
+                }
+            }
+        }
+    }
+    return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metrio-ai/cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "packageManager": "yarn@4.14.1",
   "description": "Metrio AI command-line interface: run prompts and workflows, manage Metrio resources",
   "bin": {
@@ -31,9 +31,11 @@
   "dependencies": {
     "@metrio-ai/client": "^1.5.2",
     "ajv": "^8.17.1",
+    "diff": "^5.2.0",
     "yaml": "^2.8.3"
   },
   "devDependencies": {
+    "@types/diff": "^5.2.3",
     "@types/jest": "^29.5.14",
     "@types/node": "^20.10.0",
     "jest": "^29.7.0",