@nemus-cli/nemus 0.2.1

package/dist/utils/bug-report.js

@@ -0,0 +1,355 @@
+"use strict";
+/**
+ * Bug reporting — capture runtime errors and file them as GitHub issues
+ * against the project repo.
+ *
+ * Design goals (see PR discussion):
+ *  - Sanitize: never leak home dir, usernames, emails, or token-like strings.
+ *  - Deduplicate: one issue per distinct error signature (search before create).
+ *  - Safe: only file genuine tool errors; skip clearly-environmental ones unless
+ *    forced. Auto-filing is opt-in via config (autoReportBugs).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUG_LABEL = exports.LAST_ERROR_FILE = exports.BUG_REPORT_REPO = void 0;
+exports.sanitize = sanitize;
+exports.errorSignature = errorSignature;
+exports.gatherEnv = gatherEnv;
+exports.captureLastError = captureLastError;
+exports.readLastError = readLastError;
+exports.looksEnvironmental = looksEnvironmental;
+exports.buildIssueTitle = buildIssueTitle;
+exports.buildIssueBody = buildIssueBody;
+exports.buildIssueListArgs = buildIssueListArgs;
+exports.findExistingIssue = findExistingIssue;
+exports.buildIssueCreateArgs = buildIssueCreateArgs;
+exports.createIssue = createIssue;
+exports.reportBug = reportBug;
+const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const config_1 = require("./config");
+/**
+ * Repo that bug issues are filed against. Overridable via NEMUS_BUG_REPORT_REPO
+ * so forks/downstreams route reports to their own tracker.
+ */
+exports.BUG_REPORT_REPO = process.env.NEMUS_BUG_REPORT_REPO || 'me-public/nemus';
+/** Where the most recent error is captured for `w report-bug`. */
+exports.LAST_ERROR_FILE = path.join(config_1.CACHE_DIR, 'last-error.json');
+/** Label applied to auto-filed bug issues (used for dedup search too). */
+exports.BUG_LABEL = 'auto-reported';
+/**
+ * Redact personally-identifiable / sensitive substrings from text:
+ *  - absolute home dir   -> ~
+ *  - emails              -> <email>
+ *  - token-ish strings   -> <redacted>
+ */
+function sanitize(text) {
+    if (typeof text !== 'string' || !text)
+        return text || '';
+    let out = text;
+    const home = os.homedir();
+    if (home) {
+        // Replace the literal home path everywhere it appears.
+        out = out.split(home).join('~');
+    }
+    // /Users/<name>/ and /home/<name>/ (in case home didn't match, e.g. other users)
+    out = out.replace(/\/(Users|home)\/[^/\s"']+/g, '/$1/<user>');
+    // Emails
+    out = out.replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, '<email>');
+    // Bearer / token-like long alnum sequences (>= 24 chars with mixed case/digits)
+    out = out.replace(/\b(?=[A-Za-z0-9_-]*[A-Za-z])(?=[A-Za-z0-9_-]*[0-9])[A-Za-z0-9_-]{24,}\b/g, '<redacted>');
+    // GitHub tokens
+    out = out.replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, '<redacted>');
+    // Defense-in-depth: neutralize shell metacharacters so that even if the
+    // text is ever interpolated into a shell (it shouldn't be — we use argv),
+    // command substitution can't fire. Also keeps issue bodies clean.
+    out = out.replace(/\$\(/g, '$​(').replace(/`/g, 'ˋ').replace(/\$\{/g, '$​{');
+    return out;
+}
+/**
+ * Compute a stable signature for an error so duplicates collapse to one issue.
+ * Uses the normalized message (numbers/paths stripped) + top stack frame.
+ */
+function errorSignature(message, stack) {
+    const normMsg = sanitize(message || '')
+        .replace(/\d+/g, 'N') // collapse line numbers, counts, ports
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, 200);
+    // First stack frame that points into our own code (most stable identifier).
+    let frame = '';
+    if (stack) {
+        const m = sanitize(stack).match(/at\s+([^\s(]+)\s*\(?([^\s)]+):\d+:\d+\)?/);
+        if (m)
+            frame = `${m[1]} ${m[2].replace(/\d+/g, 'N')}`;
+    }
+    return (0, crypto_1.createHash)('sha1').update(`${normMsg}||${frame}`).digest('hex').slice(0, 12);
+}
+/** Gather non-sensitive environment info for the report. */
+function gatherEnv(version) {
+    return {
+        version,
+        node: process.version,
+        os: `${os.type()} ${os.release()}`,
+        arch: os.arch(),
+    };
+}
+/** Persist the most recent error so `w report-bug` can pick it up later. */
+function captureLastError(err) {
+    try {
+        fs.mkdirSync(config_1.CACHE_DIR, { recursive: true });
+        // Sanitize before persisting so secrets/paths/emails never sit on disk
+        // (the issue body re-sanitizes too — sanitize is idempotent enough here).
+        const safe = {
+            ...err,
+            command: sanitize(err.command),
+            message: sanitize(err.message),
+            stack: err.stack ? sanitize(err.stack) : undefined,
+        };
+        fs.writeFileSync(exports.LAST_ERROR_FILE, JSON.stringify(safe, null, 2), 'utf-8');
+    }
+    catch {
+        /* non-critical */
+    }
+}
+/** Read the most recent captured error, if any. */
+function readLastError() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(exports.LAST_ERROR_FILE, 'utf-8'));
+        // Validate required fields so a malformed/old file can't crash the reporter.
+        if (!raw || typeof raw !== 'object' || typeof raw.message !== 'string' || !raw.message) {
+            return null;
+        }
+        return {
+            command: typeof raw.command === 'string' ? raw.command : 'unknown',
+            message: raw.message,
+            stack: typeof raw.stack === 'string' ? raw.stack : undefined,
+            timestamp: typeof raw.timestamp === 'string' ? raw.timestamp : new Date().toISOString(),
+            version: typeof raw.version === 'string' ? raw.version : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Heuristic: is this error clearly environmental (not a code bug)? */
+function looksEnvironmental(message) {
+    return /ETIMEDOUT|ENOTFOUND|ECONNREFUSED|ECONNRESET|EACCES|EPERM|ENOSPC|network|rate.?limit|not authenticated|gh auth|sso|credential|token expired|command not found|No such file or directory/i
+        .test(message);
+}
+/** Build the GitHub issue title for a captured error. */
+function buildIssueTitle(err) {
+    const sig = errorSignature(err.message, err.stack);
+    const shortMsg = sanitize(err.message).split('\n')[0].slice(0, 80);
+    return `[auto] ${shortMsg} (${sig})`;
+}
+/** Build the GitHub issue body (fully sanitized). */
+function buildIssueBody(err, env) {
+    const sig = errorSignature(err.message, err.stack);
+    const stack = err.stack ? sanitize(err.stack).slice(0, 4000) : '(no stack captured)';
+    return [
+        `**Auto-reported by workspace-manager.**`,
+        ``,
+        `**Signature:** \`${sig}\``,
+        `**Command:** \`${sanitize(err.command)}\``,
+        `**When:** ${err.timestamp}`,
+        ``,
+        `### Error`,
+        '```',
+        sanitize(err.message).slice(0, 1000),
+        '```',
+        ``,
+        `### Stack`,
+        '```',
+        stack,
+        '```',
+        ``,
+        `### Environment`,
+        `| | |`,
+        `|---|---|`,
+        `| workspace-manager | ${env.version} |`,
+        `| node | ${env.node} |`,
+        `| os | ${env.os} |`,
+        `| arch | ${env.arch} |`,
+        ``,
+        `<sub>Paths, usernames, emails, and token-like strings are redacted automatically.</sub>`,
+    ].join('\n');
+}
+/**
+ * Build the argv for listing candidate duplicate issues. Exported for testing
+ * so we can assert no shell metacharacters / values are passed inertly.
+ */
+function buildIssueListArgs() {
+    return [
+        'issue', 'list',
+        '--repo', exports.BUG_REPORT_REPO,
+        '--state', 'open',
+        '--label', exports.BUG_LABEL,
+        '--json', 'url,title',
+        '--limit', '200',
+    ];
+}
+/**
+ * Find an existing open auto-reported issue with the same signature.
+ *
+ * Lists recent auto-reported issues and filters client-side on the
+ * parenthesized signature in the title. We do NOT rely on GitHub's
+ * free-text --search matching a hex substring, which is unreliable.
+ *
+ * Returns { ok:true, url } on a successful lookup (url=null = no duplicate),
+ * or { ok:false } if the lookup could not be performed.
+ */
+function findExistingIssue(signature) {
+    try {
+        const out = (0, child_process_1.execFileSync)('gh', buildIssueListArgs(), {
+            encoding: 'utf-8',
+            timeout: 20000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const issues = JSON.parse(out);
+        // Match the signature only where we put it: parenthesized at the end of
+        // the title ("[auto] … (<sig>)"). Avoids matching an unrelated issue whose
+        // free text happens to contain the same 12-hex substring.
+        const match = issues.find((i) => i.title.includes(`(${signature})`));
+        return { ok: true, url: match ? match.url : null };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/**
+ * Ensure the auto-report label exists (read-or-create, best-effort).
+ * Avoids re-writing the label on every issue by checking existence first.
+ */
+function ensureLabel() {
+    try {
+        const out = (0, child_process_1.execFileSync)('gh', ['label', 'list', '--repo', exports.BUG_REPORT_REPO, '--json', 'name'], {
+            encoding: 'utf-8', timeout: 15000, stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const labels = JSON.parse(out);
+        if (labels.some((l) => l.name === exports.BUG_LABEL))
+            return; // already exists
+    }
+    catch {
+        // couldn't list — fall through and try to create
+    }
+    try {
+        (0, child_process_1.execFileSync)('gh', [
+            'label', 'create', exports.BUG_LABEL,
+            '--repo', exports.BUG_REPORT_REPO,
+            '--color', 'B60205',
+            '--description', 'Auto-reported by workspace-manager',
+        ], { encoding: 'utf-8', timeout: 15000, stdio: 'ignore' });
+    }
+    catch {
+        /* may already exist or no perms — ignore */
+    }
+}
+/**
+ * Build the argv for creating an issue. Exported for testing: a title/body
+ * containing shell metacharacters ($(…), backticks) must be passed as inert
+ * argv elements, never interpolated into a shell.
+ */
+function buildIssueCreateArgs(title, body) {
+    return [
+        'issue', 'create',
+        '--repo', exports.BUG_REPORT_REPO,
+        '--title', title,
+        '--body', body,
+        '--label', exports.BUG_LABEL,
+    ];
+}
+/**
+ * Create a bug issue. Returns the created issue URL, or null on failure.
+ *
+ * Uses execFileSync with an argv array — NO shell — so title/body (derived
+ * from arbitrary error text) can never trigger command substitution.
+ */
+function createIssue(title, body) {
+    try {
+        ensureLabel();
+        const url = (0, child_process_1.execFileSync)('gh', buildIssueCreateArgs(title, body), {
+            encoding: 'utf-8',
+            timeout: 30000,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        const m = url.match(/https?:\/\/\S+/);
+        return m ? m[0] : url || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * File (or dedupe) a bug report for a captured error.
+ *
+ * @param err     The captured error.
+ * @param version Tool version string.
+ * @param opts.force  Report even if the error looks environmental.
+ */
+function reportBug(err, version, opts = {}) {
+    if (!opts.force && looksEnvironmental(err.message)) {
+        return {
+            status: 'skipped',
+            reason: 'Error looks environmental (network/auth/credentials), not a code bug. Use --force to report anyway.',
+        };
+    }
+    // gh must be available + authenticated.
+    try {
+        (0, child_process_1.execFileSync)('gh', ['auth', 'status'], { timeout: 15000, stdio: 'ignore' });
+    }
+    catch {
+        return { status: 'failed', reason: 'GitHub CLI (gh) not available or not authenticated.' };
+    }
+    const sig = errorSignature(err.message, err.stack);
+    const dedup = findExistingIssue(sig);
+    if (!dedup.ok) {
+        return {
+            status: 'failed',
+            reason: 'Could not check for existing reports (gh issue list failed). Not filing, to avoid creating a duplicate. Please retry.',
+        };
+    }
+    if (dedup.url) {
+        return { status: 'duplicate', url: dedup.url };
+    }
+    const env = gatherEnv(version);
+    const url = createIssue(buildIssueTitle(err), buildIssueBody(err, env));
+    if (!url)
+        return { status: 'failed', reason: 'Failed to create the GitHub issue.' };
+    return { status: 'created', url };
+}

package/dist/utils/cache.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedRepos = getCachedRepos;
+exports.setCachedRepos = setCachedRepos;
+exports.clearCache = clearCache;
+exports.getCacheStats = getCacheStats;
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const config_1 = require("./config");
+const logger_1 = require("./logger");
+const colors_1 = require("./colors");
+const REPOS_CACHE_FILE = path.join(config_1.CACHE_DIR, 'repos-cache.json');
+const DEFAULT_TTL = 86400000; // 24 hours in milliseconds
+/**
+ * Ensure cache directory exists
+ */
+async function ensureCacheDir() {
+    try {
+        await fs.mkdir(config_1.CACHE_DIR, { recursive: true });
+    }
+    catch (error) {
+        (0, logger_1.logWarning)('Failed to create cache directory');
+    }
+}
+/**
+ * Check if cache is valid (not expired)
+ */
+function isCacheValid(entry) {
+    const now = Date.now();
+    const age = now - entry.timestamp;
+    return age < entry.ttl;
+}
+/**
+ * Get cache age in human-readable format
+ */
+function getCacheAge(timestamp) {
+    const ageMs = Date.now() - timestamp;
+    const ageMinutes = Math.floor(ageMs / 60000);
+    const ageHours = Math.floor(ageMinutes / 60);
+    const ageDays = Math.floor(ageHours / 24);
+    if (ageDays > 0) {
+        return `${ageDays} day${ageDays > 1 ? 's' : ''} ago`;
+    }
+    else if (ageHours > 0) {
+        return `${ageHours} hour${ageHours > 1 ? 's' : ''} ago`;
+    }
+    else if (ageMinutes > 0) {
+        return `${ageMinutes} minute${ageMinutes > 1 ? 's' : ''} ago`;
+    }
+    else {
+        return 'just now';
+    }
+}
+/**
+ * Read cached repositories
+ */
+async function getCachedRepos(options = {}) {
+    const { force = false, org } = options;
+    if (force) {
+        (0, logger_1.logInfo)('Skipping cache (forced refresh)');
+        return null;
+    }
+    try {
+        const content = await fs.readFile(REPOS_CACHE_FILE, 'utf-8');
+        const entry = JSON.parse(content);
+        if (org && entry.org !== org) {
+            (0, logger_1.logInfo)(`Cache is for org "${entry.org || 'unknown'}", but current org is "${org}". Refreshing...`);
+            return null;
+        }
+        if (isCacheValid(entry)) {
+            const age = getCacheAge(entry.timestamp);
+            (0, logger_1.logInfo)(`Using cached repositories (${(0, colors_1.colorize)(String(entry.data.length), 'cyan')} repos, cached ${age})`);
+            return entry.data;
+        }
+        else {
+            (0, logger_1.logInfo)('Cache expired, fetching fresh data...');
+            return null;
+        }
+    }
+    catch (error) {
+        // Cache file doesn't exist or is invalid
+        return null;
+    }
+}
+/**
+ * Write repositories to cache
+ */
+async function setCachedRepos(repos, ttl = DEFAULT_TTL, org) {
+    try {
+        await ensureCacheDir();
+        const entry = {
+            data: repos,
+            timestamp: Date.now(),
+            ttl,
+            org,
+        };
+        await fs.writeFile(REPOS_CACHE_FILE, JSON.stringify(entry, null, 2), 'utf-8');
+        (0, logger_1.logInfo)(`Cached ${(0, colors_1.colorize)(String(repos.length), 'cyan')} repositories (TTL: ${Math.floor(ttl / 60000)} minutes)`);
+    }
+    catch (error) {
+        (0, logger_1.logWarning)('Failed to cache repositories');
+    }
+}
+/**
+ * Clear the cache
+ */
+async function clearCache() {
+    try {
+        await fs.unlink(REPOS_CACHE_FILE);
+        (0, logger_1.logInfo)('Cache cleared successfully');
+    }
+    catch (error) {
+        // Cache file doesn't exist, nothing to clear
+        (0, logger_1.logInfo)('No cache to clear');
+    }
+}
+/**
+ * Get cache statistics
+ */
+async function getCacheStats() {
+    try {
+        const content = await fs.readFile(REPOS_CACHE_FILE, 'utf-8');
+        const entry = JSON.parse(content);
+        const stats = await fs.stat(REPOS_CACHE_FILE);
+        return {
+            exists: true,
+            age: getCacheAge(entry.timestamp),
+            repoCount: entry.data.length,
+            size: stats.size,
+        };
+    }
+    catch {
+        return { exists: false };
+    }
+}