@oh-my-pi/cli 0.1.0 → 0.3.0

package/src/runtime.ts

@@ -0,0 +1,116 @@
+import type { OmpVariable, PluginPackageJson, PluginsJson } from "@omp/manifest";
+import { loadPluginsJson, readPluginPackageJson } from "@omp/manifest";
+
+/**
+ * Collect all variables from a plugin (top-level + enabled features)
+ */
+function collectVariables(
+	pkgJson: PluginPackageJson,
+	enabledFeatures: string[],
+): Record<string, OmpVariable> {
+	const vars: Record<string, OmpVariable> = {};
+
+	// Top-level variables
+	if (pkgJson.omp?.variables) {
+		Object.assign(vars, pkgJson.omp.variables);
+	}
+
+	// Variables from enabled features
+	if (pkgJson.omp?.features) {
+		for (const fname of enabledFeatures) {
+			const feature = pkgJson.omp.features[fname];
+			if (feature?.variables) {
+				Object.assign(vars, feature.variables);
+			}
+		}
+	}
+
+	return vars;
+}
+
+/**
+ * Resolve which features are currently enabled
+ *
+ * - null/undefined: use plugin defaults (features with default !== false)
+ * - ["*"]: explicitly all features
+ * - []: no optional features
+ * - ["f1", "f2"]: specific features
+ */
+function resolveEnabledFeatures(
+	allFeatureNames: string[],
+	storedFeatures: string[] | null | undefined,
+	pluginFeatures: Record<string, { default?: boolean }>,
+): string[] {
+	// Explicit "all features" request
+	if (Array.isArray(storedFeatures) && storedFeatures.includes("*")) return allFeatureNames;
+	// Explicit feature list (including empty array = no features)
+	if (Array.isArray(storedFeatures)) return storedFeatures;
+	// null/undefined = use defaults
+	return Object.entries(pluginFeatures)
+		.filter(([_, f]) => f.default !== false)
+		.map(([name]) => name);
+}
+
+/**
+ * Get all environment variables for enabled plugins
+ */
+export async function getPluginEnvVars(global = true): Promise<Record<string, string>> {
+	const pluginsJson = await loadPluginsJson(global);
+	const env: Record<string, string> = {};
+
+	for (const pluginName of Object.keys(pluginsJson.plugins)) {
+		// Skip disabled plugins
+		if (pluginsJson.disabled?.includes(pluginName)) continue;
+
+		const pkgJson = await readPluginPackageJson(pluginName, global);
+		if (!pkgJson?.omp) continue;
+
+		const config = pluginsJson.config?.[pluginName];
+		const allFeatureNames = Object.keys(pkgJson.omp.features || {});
+		const enabledFeatures = resolveEnabledFeatures(
+			allFeatureNames,
+			config?.features,
+			pkgJson.omp.features || {},
+		);
+
+		// Collect variables from top-level and enabled features
+		const variables = collectVariables(pkgJson, enabledFeatures);
+
+		for (const [key, varDef] of Object.entries(variables)) {
+			if (varDef.env) {
+				const value = config?.variables?.[key] ?? varDef.default;
+				if (value !== undefined) {
+					env[varDef.env] = String(value);
+				}
+			}
+		}
+	}
+
+	return env;
+}
+
+/**
+ * Generate shell export statements
+ * omp env > ~/.pi/env.sh && source ~/.pi/env.sh
+ */
+export async function generateEnvScript(global = true, shell: "sh" | "fish" = "sh"): Promise<string> {
+	const vars = await getPluginEnvVars(global);
+
+	if (shell === "fish") {
+		return Object.entries(vars)
+			.map(([k, v]) => `set -gx ${k} ${JSON.stringify(v)}`)
+			.join("\n");
+	}
+
+	// POSIX sh/bash/zsh
+	return Object.entries(vars)
+		.map(([k, v]) => `export ${k}=${JSON.stringify(v)}`)
+		.join("\n");
+}
+
+/**
+ * Get environment variables as a JSON object for programmatic use
+ */
+export async function getEnvJson(global = true): Promise<Record<string, string>> {
+	return getPluginEnvVars(global);
+}

package/src/symlinks.ts

@@ -1,39 +1,135 @@
-import { existsSync, lstatSync } from "node:fs";
-import { mkdir, readlink, rm, symlink } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { existsSync, lstatSync, readFileSync, writeFileSync } from "node:fs";
+import { copyFile, mkdir, readlink, rm, symlink } from "node:fs/promises";
+import { platform } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import type { OmpFeature, OmpInstallEntry, PluginPackageJson, PluginRuntimeConfig } from "@omp/manifest";
+import { getPluginSourceDir } from "@omp/manifest";
+import { PI_CONFIG_DIR, PROJECT_PI_DIR } from "@omp/paths";
 import chalk from "chalk";
-import type { OmpInstallEntry, PluginPackageJson } from "./manifest.js";
-import { getPluginSourceDir } from "./manifest.js";
-import { PI_CONFIG_DIR } from "./paths.js";
+
+/**
+ * Get all install entries from package.json.
+ * Features no longer have install entries - all files are always installed.
+ */
+export function getInstallEntries(pkgJson: PluginPackageJson): OmpInstallEntry[] {
+	return pkgJson.omp?.install ?? [];
+}
+
+/**
+ * @deprecated Use getInstallEntries instead. Features no longer have install arrays.
+ */
+export function getEnabledInstallEntries(
+	pkgJson: PluginPackageJson,
+	_enabledFeatures?: string[],
+): OmpInstallEntry[] {
+	return getInstallEntries(pkgJson);
+}
+
+/**
+ * Get all available feature names from a plugin
+ */
+export function getAllFeatureNames(pkgJson: PluginPackageJson): string[] {
+	return Object.keys(pkgJson.omp?.features || {});
+}
+
+/**
+ * Get features that are enabled by default (default !== false)
+ */
+export function getDefaultFeatures(features: Record<string, OmpFeature>): string[] {
+	return Object.entries(features)
+		.filter(([_, f]) => f.default !== false)
+		.map(([name]) => name);
+}
+
+const isWindows = platform() === "win32";
+
+/**
+ * Format permission-related errors with actionable guidance
+ */
+function formatPermissionError(err: NodeJS.ErrnoException, path: string): string {
+	if (err.code === "EACCES" || err.code === "EPERM") {
+		return `Permission denied: Cannot write to ${path}. Check directory permissions or run with appropriate privileges.`;
+	}
+	return err.message;
+}
+
+/**
+ * Validates that a target path stays within the base directory.
+ * Prevents path traversal attacks via malicious dest entries like '../../../etc/passwd'.
+ */
+function isPathWithinBase(basePath: string, targetPath: string): boolean {
+	const normalizedBase = resolve(basePath);
+	const resolvedTarget = resolve(basePath, targetPath);
+	// Must start with base path followed by separator (or be exactly the base)
+	return resolvedTarget === normalizedBase || resolvedTarget.startsWith(`${normalizedBase}/`);
+}
+
+/**
+ * Get the base directory for symlink destinations based on scope
+ */
+function getBaseDir(global: boolean): string {
+	return global ? PI_CONFIG_DIR : PROJECT_PI_DIR;
+}
 
 export interface SymlinkResult {
 	created: string[];
 	errors: string[];
 }
 
+export interface SymlinkRemovalResult {
+	removed: string[];
+	errors: string[];
+	skippedNonSymlinks: string[]; // Files that exist but aren't symlinks
+}
+
 /**
- * Create symlinks for a plugin's omp.install entries
+ * Create symlinks (or copy files with copy:true) for a plugin's omp.install entries
+ * @param skipDestinations - Set of destination paths to skip (e.g., due to conflict resolution)
+ * @param enabledFeatures - Features to write into runtime.json (if plugin has one)
  */
 export async function createPluginSymlinks(
 	pluginName: string,
 	pkgJson: PluginPackageJson,
 	global = true,
 	verbose = true,
+	skipDestinations?: Set<string>,
+	enabledFeatures?: string[],
 ): Promise<SymlinkResult> {
 	const result: SymlinkResult = { created: [], errors: [] };
 	const sourceDir = getPluginSourceDir(pluginName, global);
 
-	if (!pkgJson.omp?.install?.length) {
+	const installEntries = getInstallEntries(pkgJson);
+	if (installEntries.length === 0) {
 		if (verbose) {
 			console.log(chalk.dim("  No omp.install entries found"));
 		}
 		return result;
 	}
 
-	for (const entry of pkgJson.omp.install) {
+	const baseDir = getBaseDir(global);
+
+	for (const entry of installEntries) {
+		// Skip destinations that the user chose to keep from existing plugins
+		if (skipDestinations?.has(entry.dest)) {
+			if (verbose) {
+				console.log(chalk.dim(`  Skipped: ${entry.dest} (conflict resolved to existing plugin)`));
+			}
+			continue;
+		}
+
+		// Validate dest path stays within base directory (prevents path traversal attacks)
+		if (!isPathWithinBase(baseDir, entry.dest)) {
+			const msg = `Path traversal blocked: ${entry.dest} escapes base directory`;
+			result.errors.push(msg);
+			if (verbose) {
+				console.log(chalk.red(`  ✗ ${msg}`));
+			}
+			continue;
+		}
+
 		try {
 			const src = join(sourceDir, entry.src);
-			const dest = join(PI_CONFIG_DIR, entry.dest);
+			const dest = join(baseDir, entry.dest);
 
 			// Check if source exists
 			if (!existsSync(src)) {
@@ -47,60 +143,198 @@ export async function createPluginSymlinks(
 			// Create parent directory
 			await mkdir(dirname(dest), { recursive: true });
 
-			// Remove existing symlink/file if it exists
-			try {
-				await rm(dest, { force: true, recursive: true });
-			} catch {}
+			// Handle copy vs symlink
+			if (entry.copy) {
+				// For copy entries (like runtime.json), copy the file
+				// But DON'T overwrite if it already exists (preserves user edits)
+				if (!existsSync(dest)) {
+					await copyFile(src, dest);
+					result.created.push(entry.dest);
+					if (verbose) {
+						console.log(chalk.dim(`  Copied: ${entry.dest} (from ${entry.src})`));
+					}
+				} else {
+					if (verbose) {
+						console.log(chalk.dim(`  Exists: ${entry.dest} (preserved)`));
+					}
+				}
+			} else {
+				// Remove existing symlink/file if it exists
+				try {
+					await rm(dest, { force: true, recursive: true });
+				} catch {}
 
-			// Create symlink
-			await symlink(src, dest);
-			result.created.push(entry.dest);
+				// Create symlink (use junctions on Windows for directories to avoid admin requirement)
+				try {
+					if (isWindows) {
+						const stats = lstatSync(src);
+						if (stats.isDirectory()) {
+							await symlink(src, dest, "junction");
+						} else {
+							await symlink(src, dest, "file");
+						}
+					} else {
+						await symlink(src, dest);
+					}
+				} catch (symlinkErr) {
+					const error = symlinkErr as NodeJS.ErrnoException;
+					if (isWindows && error.code === "EPERM") {
+						console.log(chalk.red(`  Permission denied creating symlink.`));
+						console.log(chalk.dim("  On Windows, enable Developer Mode or run as Administrator."));
+						console.log(chalk.dim("  Settings > Update & Security > For developers > Developer Mode"));
+					}
+					throw symlinkErr;
+				}
+				result.created.push(entry.dest);
 
-			if (verbose) {
-				console.log(chalk.dim(`  Linked: ${entry.dest} → ${entry.src}`));
+				if (verbose) {
+					console.log(chalk.dim(`  Linked: ${entry.dest} → ${entry.src}`));
+				}
 			}
 		} catch (err) {
-			const msg = `Failed to link ${entry.dest}: ${(err as Error).message}`;
+			const error = err as NodeJS.ErrnoException;
+			const msg = `Failed to install ${entry.dest}: ${formatPermissionError(error, join(baseDir, entry.dest))}`;
 			result.errors.push(msg);
 			if (verbose) {
 				console.log(chalk.red(`  ✗ ${msg}`));
+				if (error.code === "EACCES" || error.code === "EPERM") {
+					console.log(chalk.dim("  Check directory permissions or run with appropriate privileges."));
+				}
 			}
 		}
 	}
 
+	// If enabledFeatures provided and plugin has a runtime.json entry, update it
+	if (enabledFeatures !== undefined) {
+		const runtimeEntry = installEntries.find((e) => e.copy && e.dest.endsWith("runtime.json"));
+		if (runtimeEntry) {
+			const runtimePath = join(baseDir, runtimeEntry.dest);
+			await writeRuntimeConfig(runtimePath, { features: enabledFeatures }, verbose);
+		}
+	}
+
 	return result;
 }
 
 /**
- * Remove symlinks for a plugin's omp.install entries
+ * Read runtime.json config from a plugin's installed location
+ * Returns {} on failure so callers can detect missing/corrupt config and fall back to defaults
+ */
+export function readRuntimeConfig(runtimePath: string): PluginRuntimeConfig {
+	try {
+		const content = readFileSync(runtimePath, "utf-8");
+		return JSON.parse(content) as PluginRuntimeConfig;
+	} catch {
+		// Return empty object (not {features: []}) so callers detect missing config
+		// and can fall back to plugin defaults instead of treating as "all disabled"
+		return {};
+	}
+}
+
+/**
+ * Write runtime.json config to a plugin's installed location
+ */
+export async function writeRuntimeConfig(
+	runtimePath: string,
+	config: PluginRuntimeConfig,
+	verbose = false,
+): Promise<void> {
+	try {
+		const existing = readRuntimeConfig(runtimePath);
+		const merged: PluginRuntimeConfig = {
+			features: config.features ?? existing.features ?? [],
+			options: { ...existing.options, ...config.options },
+		};
+		writeFileSync(runtimePath, JSON.stringify(merged, null, 2) + "\n");
+		if (verbose) {
+			console.log(chalk.dim(`  Updated: ${runtimePath}`));
+		}
+	} catch (err) {
+		if (verbose) {
+			console.log(chalk.yellow(`  ⚠ Failed to update runtime config: ${err}`));
+		}
+	}
+}
+
+/**
+ * Get the path to a plugin's runtime.json in the installed location
+ */
+export function getRuntimeConfigPath(pkgJson: PluginPackageJson, global = true): string | null {
+	const entries = getInstallEntries(pkgJson);
+	const runtimeEntry = entries.find((e) => e.copy && e.dest.endsWith("runtime.json"));
+	if (!runtimeEntry) return null;
+	return join(getBaseDir(global), runtimeEntry.dest);
+}
+
+/**
+ * Remove symlinks and copied files for a plugin's omp.install entries
  */
 export async function removePluginSymlinks(
 	_pluginName: string,
 	pkgJson: PluginPackageJson,
+	global = true,
 	verbose = true,
-): Promise<SymlinkResult> {
-	const result: SymlinkResult = { created: [], errors: [] };
+): Promise<SymlinkRemovalResult> {
+	const result: SymlinkRemovalResult = { removed: [], errors: [], skippedNonSymlinks: [] };
 
-	if (!pkgJson.omp?.install?.length) {
+	const installEntries = getInstallEntries(pkgJson);
+	if (installEntries.length === 0) {
 		return result;
 	}
 
-	for (const entry of pkgJson.omp.install) {
-		const dest = join(PI_CONFIG_DIR, entry.dest);
+	const baseDir = getBaseDir(global);
+
+	for (const entry of installEntries) {
+		// Validate dest path stays within base directory (prevents path traversal attacks)
+		if (!isPathWithinBase(baseDir, entry.dest)) {
+			const msg = `Path traversal blocked: ${entry.dest} escapes base directory`;
+			result.errors.push(msg);
+			if (verbose) {
+				console.log(chalk.red(`  ✗ ${msg}`));
+			}
+			continue;
+		}
+
+		const dest = join(baseDir, entry.dest);
 
 		try {
 			if (existsSync(dest)) {
+				const stats = lstatSync(dest);
+
+				// For copy entries (like runtime.json), we can safely remove them
+				if (entry.copy) {
+					await rm(dest, { force: true });
+					result.removed.push(entry.dest);
+					if (verbose) {
+						console.log(chalk.dim(`  Removed: ${entry.dest}`));
+					}
+					continue;
+				}
+
+				// For symlinks, check they're actually symlinks
+				if (!stats.isSymbolicLink()) {
+					result.skippedNonSymlinks.push(dest);
+					if (verbose) {
+						console.log(chalk.yellow(`  ⚠ Skipping ${entry.dest}: not a symlink (may contain user data)`));
+					}
+					continue;
+				}
+
 				await rm(dest, { force: true, recursive: true });
-				result.created.push(entry.dest);
+				result.removed.push(entry.dest);
 				if (verbose) {
 					console.log(chalk.dim(`  Removed: ${entry.dest}`));
 				}
 			}
 		} catch (err) {
-			const msg = `Failed to remove ${entry.dest}: ${(err as Error).message}`;
+			const error = err as NodeJS.ErrnoException;
+			const msg = `Failed to remove ${entry.dest}: ${formatPermissionError(error, dest)}`;
 			result.errors.push(msg);
 			if (verbose) {
 				console.log(chalk.yellow(`  ⚠ ${msg}`));
+				if (error.code === "EACCES" || error.code === "EPERM") {
+					console.log(chalk.dim("  Check directory permissions or run with appropriate privileges."));
+				}
 			}
 		}
 	}
@@ -109,7 +343,7 @@ export async function removePluginSymlinks(
 }
 
 /**
- * Check symlink health for a plugin
+ * Check symlink/file health for a plugin
  */
 export async function checkPluginSymlinks(
 	pluginName: string,
@@ -118,14 +352,22 @@ export async function checkPluginSymlinks(
 ): Promise<{ valid: string[]; broken: string[]; missing: string[] }> {
 	const result = { valid: [] as string[], broken: [] as string[], missing: [] as string[] };
 	const sourceDir = getPluginSourceDir(pluginName, global);
+	const baseDir = getBaseDir(global);
 
-	if (!pkgJson.omp?.install?.length) {
+	const installEntries = getInstallEntries(pkgJson);
+	if (installEntries.length === 0) {
 		return result;
 	}
 
-	for (const entry of pkgJson.omp.install) {
+	for (const entry of installEntries) {
+		// Skip entries with path traversal (treat as broken)
+		if (!isPathWithinBase(baseDir, entry.dest)) {
+			result.broken.push(entry.dest);
+			continue;
+		}
+
 		const src = join(sourceDir, entry.src);
-		const dest = join(PI_CONFIG_DIR, entry.dest);
+		const dest = join(baseDir, entry.dest);
 
 		if (!existsSync(dest)) {
 			result.missing.push(entry.dest);
@@ -134,6 +376,18 @@ export async function checkPluginSymlinks(
 
 		try {
 			const stats = lstatSync(dest);
+
+			// For copy entries, just check the file exists
+			if (entry.copy) {
+				if (stats.isFile()) {
+					result.valid.push(entry.dest);
+				} else {
+					result.broken.push(entry.dest);
+				}
+				continue;
+			}
+
+			// For symlinks, verify they point to valid sources
 			if (stats.isSymbolicLink()) {
 				const _target = await readlink(dest);
 				if (existsSync(src)) {
@@ -178,11 +432,13 @@ export async function getPluginForSymlink(
 export async function traceInstalledFile(
 	filePath: string,
 	installedPlugins: Map<string, PluginPackageJson>,
+	global = true,
 ): Promise<{ plugin: string; entry: OmpInstallEntry } | null> {
-	// Normalize the path relative to PI_CONFIG_DIR
+	// Normalize the path relative to the base directory
+	const baseDir = getBaseDir(global);
 	let relativePath = filePath;
-	if (filePath.startsWith(PI_CONFIG_DIR)) {
-		relativePath = filePath.slice(PI_CONFIG_DIR.length + 1);
+	if (filePath.startsWith(baseDir)) {
+		relativePath = filePath.slice(baseDir.length + 1);
 	}
 
 	for (const [name, pkgJson] of installedPlugins) {

package/tsconfig.json

@@ -1,7 +1,7 @@
 {
 	"compilerOptions": {
 		"target": "ES2022",
-		"module": "Node16",
+		"module": "ESNext",
 		"lib": ["ES2022"],
 		"strict": true,
 		"esModuleInterop": true,
@@ -12,12 +12,16 @@
 		"sourceMap": true,
 		"inlineSources": true,
 		"inlineSourceMap": false,
-		"moduleResolution": "Node16",
+		"moduleResolution": "bundler",
 		"resolveJsonModule": true,
 		"allowImportingTsExtensions": false,
 		"outDir": "./dist",
 		"rootDir": "./src",
-		"types": ["node", "bun-types"]
+		"types": ["node", "bun-types"],
+		"baseUrl": ".",
+		"paths": {
+			"@omp/*": ["src/*"]
+		}
 	},
 	"include": ["src/**/*"],
 	"exclude": ["node_modules", "dist"]