@opul/cli 0.1.2 → 0.1.3

package/dist/index.js

@@ -243,6 +243,10 @@ function overlayInitSource() {
     const POS_KEY = "__opul_cursor_pos";
     const INK2 = "#0E0E0E";
     const PAPER = "#F4F4F2";
+    const DEFAULT_COLOR = "#C8F24E";
+    if (typeof config.color !== "string" || !/^#[0-9a-fA-F]{3,8}$|^(?:rgb|rgba|hsl|hsla)\([0-9.,%\s]+\)$|^[a-zA-Z]{1,20}$/.test(config.color.trim())) {
+      config = { color: DEFAULT_COLOR };
+    }
     function ensureFont() {
       if (document.getElementById("__opul_font"))
         return;
@@ -977,6 +981,18 @@ var ACTIONS = [
 ];
 var StepsValidationError = class extends Error {
 };
+var SAFE_COLOR = /^#[0-9a-fA-F]{3,8}$|^(?:rgb|rgba|hsl|hsla)\(\s*[0-9.,%\s]+\)$|^[a-zA-Z]{1,20}$/;
+function isSafeColor(c2) {
+  return SAFE_COLOR.test(c2.trim());
+}
+function isSafeUrl(u) {
+  try {
+    const p = new URL(u);
+    return p.protocol === "http:" || p.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 function parseSteps(raw) {
   if (typeof raw !== "object" || raw === null) {
     throw new StepsValidationError("steps file must be a JSON object");
@@ -989,6 +1005,16 @@ function parseSteps(raw) {
     throw new StepsValidationError('"steps" must be a non-empty array');
   }
   const steps = obj.steps.map((s, i) => validateStep(s, i));
+  for (const key of ["url", "startUrl"]) {
+    const v = obj[key];
+    if (typeof v === "string" && v !== "" && !isSafeUrl(v)) {
+      throw new StepsValidationError(`"${key}" must be an http(s) URL`);
+    }
+  }
+  const cursorColor = obj.cursor?.color;
+  if (typeof cursorColor === "string" && !isSafeColor(cursorColor)) {
+    throw new StepsValidationError(`cursor.color "${cursorColor}" is not a valid CSS color`);
+  }
   const vp = obj.viewport;
   const viewport = vp && typeof vp.width === "number" && typeof vp.height === "number" ? { width: vp.width, height: vp.height } : { width: 1440, height: 900 };
   return {
@@ -1016,8 +1042,12 @@ function validateStep(s, i) {
       throw new StepsValidationError(`step ${i} (${a}): "${field}" is required`);
     }
   };
-  if (a === "goto")
+  if (a === "goto") {
     need("url");
+    if (typeof step.url === "string" && !isSafeUrl(step.url)) {
+      throw new StepsValidationError(`step ${i} (goto): "url" must be http(s)`);
+    }
+  }
   if (a === "click" || a === "hover" || a === "wait")
     need("selector");
   if (a === "type") {
@@ -1242,7 +1272,7 @@ import { createInterface as createInterface2 } from "readline/promises";
 import { stdin, stdout } from "process";
 
 // src/config.ts
-import { readFile as readFile2, writeFile as writeFile7, mkdir as mkdir3 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile7, mkdir as mkdir3, chmod } from "fs/promises";
 import { homedir } from "os";
 import { join as join6 } from "path";
 var dir = join6(homedir(), ".opul");
@@ -1256,8 +1286,12 @@ async function loadConfig() {
   }
 }
 async function saveConfig(cfg) {
-  await mkdir3(dir, { recursive: true });
+  await mkdir3(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448).catch(() => {
+  });
   await writeFile7(file, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  await chmod(file, 384).catch(() => {
+  });
 }
 async function requireToken() {
   const { token } = await loadConfig();
@@ -1321,15 +1355,15 @@ async function publishCommand(file2, opts) {
   }
   const videoPath = resolve3(process.cwd(), file2);
   const posterPath = opts.poster ? resolve3(process.cwd(), opts.poster) : join7(dirname(videoPath), "poster.jpg");
-  let video;
+  let size;
   try {
-    video = await readFile3(videoPath);
+    size = (await stat2(videoPath)).size;
   } catch {
     return fail3(`file not found: ${file2}`);
   }
-  const poster = await readFile3(posterPath).catch(() => null);
-  const size = (await stat2(videoPath)).size;
   if (size > 200 * 1024 * 1024) return fail3("file exceeds 200 MB upload cap.");
+  const video = await readFile3(videoPath);
+  const poster = await readFile3(posterPath).catch(() => null);
   const meta = await readFile3(join7(dirname(videoPath), "demo.json"), "utf8").then((s) => JSON.parse(s)).catch(() => ({}));
   const title = opts.title ?? meta.title ?? basename(videoPath).replace(/\.[^.]+$/, "");
   const auth = { authorization: `Bearer ${token}` };
@@ -1433,7 +1467,7 @@ function fail4(msg) {
 
 // src/index.ts
 var program = new Command();
-program.name("opul").description("Record a product demo from your running web app.").version("0.1.2");
+program.name("opul").description("Record a product demo from your running web app.").version("0.1.3");
 program.command("init").description("Create an opul.steps.json stub").option("--out <file>", "output path", "opul.steps.json").action(initCommand);
 program.command("doctor").description("Check that Chrome and ffmpeg are installed").action(doctorCommand);
 program.command("record").description("Click through your app to generate a steps file").option("--url <url>", "app URL to open").option("--out <file>", "steps file to write", "opul.steps.json").option("--name <name>", "product/demo name").option("--chrome <path>", "path to Chrome executable").action(recordCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opul/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Record a polished product-demo video from your running web app — from the terminal.",
   "type": "module",
   "bin": {