@neetru/cli 2.12.1 → 2.12.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
* O `setup wizard` (em commands/auth.ts) usa essa detecção pra ofertar
|
|
17
17
|
* install + login per-provider.
|
|
18
18
|
*/
|
|
19
|
-
import { execSync } from 'node:child_process';
|
|
19
|
+
import { execSync, execFileSync } from 'node:child_process';
|
|
20
20
|
import { existsSync, readFileSync } from 'node:fs';
|
|
21
21
|
import { homedir, platform } from 'node:os';
|
|
22
22
|
import { join } from 'node:path';
|
|
@@ -26,12 +26,22 @@ const IS_WINDOWS = platform() === 'win32';
|
|
|
26
26
|
* e `command -v` (POSIX). Silencioso — captura erro e retorna false.
|
|
27
27
|
*/
|
|
28
28
|
function binaryExists(name) {
|
|
29
|
+
// Defesa em profundidade: hoje `name` vem de uma lista interna fixa
|
|
30
|
+
// (claude/codex/gemini), mas validamos o formato e evitamos o shell para que
|
|
31
|
+
// isto NUNCA permita injeção de comando, mesmo se a fonte do nome mudar.
|
|
32
|
+
if (!/^[A-Za-z0-9._-]+$/.test(name))
|
|
33
|
+
return false;
|
|
29
34
|
try {
|
|
30
35
|
if (IS_WINDOWS) {
|
|
31
|
-
|
|
36
|
+
// where.exe via execFile (sem shell) — `name` vai como argv isolado.
|
|
37
|
+
execFileSync('where', [name], { stdio: 'ignore' });
|
|
32
38
|
}
|
|
33
39
|
else {
|
|
34
|
-
|
|
40
|
+
// `command -v` é builtin do shell; passamos `name` como argumento
|
|
41
|
+
// posicional ($1), NUNCA interpolado no script-fonte — sem injeção.
|
|
42
|
+
execFileSync('/bin/sh', ['-c', 'command -v "$1"', 'sh', name], {
|
|
43
|
+
stdio: 'ignore',
|
|
44
|
+
});
|
|
35
45
|
}
|
|
36
46
|
return true;
|
|
37
47
|
}
|
|
@@ -267,6 +277,10 @@ export function discoveredKeys() {
|
|
|
267
277
|
* decide como apresentar.
|
|
268
278
|
*/
|
|
269
279
|
export function installGlobal(npmPackage) {
|
|
280
|
+
// Defesa em profundidade: valida o formato do nome npm (hoje vem de constante
|
|
281
|
+
// interna) antes de passar pro shell — bloqueia injeção se a fonte mudar.
|
|
282
|
+
if (!/^@?[a-z0-9._-]+(?:\/[a-z0-9._-]+)?$/i.test(npmPackage))
|
|
283
|
+
return false;
|
|
270
284
|
try {
|
|
271
285
|
execSync(`npm install -g ${npmPackage}`, { stdio: 'inherit' });
|
|
272
286
|
return true;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-discovery.js","sourceRoot":"","sources":["../../../src/lib/ai/auth-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"auth-discovery.js","sourceRoot":"","sources":["../../../src/lib/ai/auth-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,MAAM,UAAU,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAC;AAE1C;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,oEAAoE;IACpE,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,qEAAqE;YACrE,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,oEAAoE;YACpE,YAAY,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBAC7D,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEzC,qEAAqE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,2BAA2B;YACvC,SAAS;YACT,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sCAAsC;SAC7C,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,oFAAoF;QACpF,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YACpE,CAAC,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,2BAA2B;YACvC,SAAS;YACT,gBAAgB,EAAE,eAAe;YACjC,cAAc,EAAE,SAAS;YACzB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,QAAQ;gBACZ,CAAC,CAAC,uBAAuB,SAAS,EAAE;gBACpC,CAAC,CAAC,mJAAmJ;SACxJ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,2BAA2B;QACvC,SAAS;QACT,gBAAgB,EAAE,IAAI;QACtB,IAAI,EAAE,SAAS;YACb,CAAC,CAAC,qEAAqE;YACvE,CAAC,CAAC,8CAA8C;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,eAAe;YAC3B,SAAS;YACT,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mCAAmC;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC;YAC9E,CAAC,CAAC,IAAI,CAAC,cAAc;YACrB,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;gBAChE,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,eAAe;YAC3B,SAAS;YACT,gBAAgB,EAAE,eAAe;YACjC,cAAc,EAAE,QAAQ;YACxB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,QAAQ;gBACZ,CAAC,CAAC,+BAA+B,QAAQ,EAAE;gBAC3C,CAAC,CAAC,iHAAiH;SACtH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,eAAe;QAC3B,SAAS;QACT,gBAAgB,EAAE,IAAI;QACtB,IAAI,EAAE,SAAS;YACb,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,kCAAkC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACxE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,oBAAoB;YAChC,SAAS;YACT,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uDAAuD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC;YACE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC;YACpF,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC;SAC7C;QACH,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;gBACvC,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,oBAAoB;YAChC,SAAS;YACT,gBAAgB,EAAE,eAAe;YACjC,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,QAAQ;gBACZ,CAAC,CAAC,uBAAuB,IAAI,EAAE;gBAC/B,CAAC,CAAC,qGAAqG;SAC1G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,oBAAoB;QAChC,SAAS;QACT,gBAAgB,EAAE,IAAI;QACtB,IAAI,EAAE,SAAS;YACb,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,uCAAuC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED