@nikala-ui/cli 0.11.0-nightly.b01fa01 → 0.11.0-nightly.b447b5b

package/dist/commands/add.js

@@ -61,9 +61,6 @@ export async function add(components = [], options = {}) {
     const componentsDir = path.resolve(cwd, config.alias.components);
     console.log(pc.cyan(`\n🎨 Adding items to project...\n`));
     const requiredNpmDeps = new Set();
-    if (isHookMode) {
-        requiredNpmDeps.add("@nikala-ui/hooks");
-    }
     for (const target of resolvedTargets) {
         const item = await getRegistryItem(target, config.registries);
         if (!item) {

package/dist/utils/pkg.js

@@ -1,8 +1,10 @@
 import fs from "fs-extra";
 import path from "node:path";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import pc from "picocolors";
 import stripJsonComments from "strip-json-comments";
+// Standard npm package name regex validator (supports scoped packages and version specifiers)
+const NPM_PACKAGE_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[a-zA-Z0-9^~.*><=-]+)?$/;
 /**
  * Detects the package manager used in the target project workspace by checking lockfiles.
  *
@@ -47,27 +49,16 @@ export async function installDependencies(dependencies, cwd = process.cwd()) {
             // Failed to parse original package.json
         }
     }
-    const depsString = dependencies.join(" ");
-    let command = "";
-    switch (pkgManager) {
-        case "bun":
-            command = `bun add ${depsString}`;
-            break;
-        case "pnpm":
-            command = `pnpm add ${depsString}`;
-            break;
-        case "yarn":
-            command = `yarn add ${depsString}`;
-            break;
-        case "npm":
-        default:
-            command = `npm install ${depsString}`;
-            break;
-    }
+    // Validate and sanitize dependency names to prevent any shell metacharacter injection
+    const validDeps = dependencies.filter((dep) => NPM_PACKAGE_REGEX.test(dep));
+    if (validDeps.length === 0)
+        return;
+    const subCommand = pkgManager === "npm" ? "install" : "add";
+    const args = [subCommand, ...validDeps];
     console.log(pc.yellow(`\n📦 Installing required component dependencies (${pkgManager})...`));
-    console.log(pc.white(`   ${command}\n`));
+    console.log(pc.white(`   ${pkgManager} ${args.join(" ")}\n`));
     try {
-        execSync(command, { cwd, stdio: "inherit" });
+        execFileSync(pkgManager, args, { cwd, stdio: "inherit" });
         // 2. Validate package.json integrity after installation and restore stripped fields if necessary
         if (originalPkgJson && (await fs.pathExists(pkgPath))) {
             try {
@@ -97,6 +88,6 @@ export async function installDependencies(dependencies, cwd = process.cwd()) {
     }
     catch (error) {
         console.log(pc.red(`❌ Failed to install dependencies automatically.`));
-        console.log(pc.yellow(`   Please run manually: ${command}`));
+        console.log(pc.yellow(`   Please run manually: ${pkgManager} ${args.join(" ")}`));
     }
 }

package/dist/utils/theme.js

@@ -171,16 +171,16 @@ export const PRIMARY_COLORS = {
         },
     },
     yellow: {
-        light: "oklch(0.75 0.18 90)",
-        dark: "oklch(0.82 0.16 90)",
+        light: "oklch(0.795 0.184 86.047)",
+        dark: "oklch(0.852 0.199 91.936)",
         lightFg: "oklch(0.1450 0 0)",
         darkFg: "oklch(0.1450 0 0)",
         charts: {
-            chart1: "oklch(0.82 0.18 90)",
-            chart2: "oklch(0.72 0.16 80)",
-            chart3: "oklch(0.62 0.14 100)",
-            chart4: "oklch(0.88 0.12 95)",
-            chart5: "oklch(0.52 0.15 85)",
+            chart1: "oklch(0.795 0.184 86.047)",
+            chart2: "oklch(0.65 0.16 50)",
+            chart3: "oklch(0.55 0.15 85)",
+            chart4: "oklch(0.85 0.12 60)",
+            chart5: "oklch(0.45 0.14 75)",
         },
     },
     lime: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nikala-ui/cli",
-  "version": "0.11.0-nightly.b01fa01",
+  "version": "0.11.0-nightly.b447b5b",
   "description": "Command line interface for Nikala UI",
   "type": "module",
   "main": "./dist/index.js",