@portel/photon 1.18.0 → 1.20.0

package/dist/marketplace-manager.js

@@ -11,6 +11,7 @@ import { createLogger } from './shared/logger.js';
 import { getErrorMessage } from './shared/error-handler.js';
 import { verifyContentHash, validateAssetPath, isPathWithin } from './shared/security.js';
 import { getDefaultContext } from './context.js';
+import { getMetadataPath, resolvePath } from '@portel/photon-core';
 import { SchemaExtractor } from '@portel/photon-core';
 // Timeout for marketplace fetch requests
 const FETCH_TIMEOUT_MS = 10 * 1000;
@@ -32,8 +33,12 @@ function getGitHubToken() {
     _ghToken = process.env.GITHUB_TOKEN || null;
     if (!_ghToken) {
         try {
-            const { execSync } = require('child_process');
-            _ghToken = execSync('gh auth token 2>/dev/null', { encoding: 'utf-8' }).trim() || null;
+            const { execFileSync } = require('child_process');
+            _ghToken =
+                execFileSync('gh', ['auth', 'token'], {
+                    encoding: 'utf-8',
+                    stdio: ['pipe', 'pipe', 'ignore'],
+                }).trim() || null;
         }
         catch {
             _ghToken = null;
@@ -56,7 +61,7 @@ function ghFetch(url, options = {}) {
     return fetch(url, { ...options, headers });
 }
 const CONFIG_DIR = getDefaultContext().baseDir;
-const METADATA_FILE = path.join(CONFIG_DIR, '.metadata.json');
+const METADATA_FILE = getMetadataPath();
 // Cache is considered stale after 24 hours
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 // Built-in marketplaces that ship with the runtime
@@ -126,6 +131,11 @@ export async function readLocalMetadata() {
     }
     return { photons: {} };
 }
+function validateSafeName(name, label) {
+    if (/[;&|$`(){}\\\<>!#~\n\r]/.test(name)) {
+        throw new Error(`Invalid ${label}: contains unsafe characters`);
+    }
+}
 export class MarketplaceManager {
     config = { marketplaces: [] };
     logger;
@@ -138,8 +148,8 @@ export class MarketplaceManager {
         const dir = baseDir || CONFIG_DIR;
         this.configDir = dir;
         this.configFile = path.join(dir, 'marketplaces.json');
-        this.cacheDir = path.join(dir, '.cache', 'marketplaces');
-        this.metadataFile = path.join(dir, '.metadata.json');
+        this.cacheDir = path.join(getDefaultContext().cacheDir, 'marketplaces');
+        this.metadataFile = getMetadataPath(dir);
     }
     async initialize() {
         await fs.mkdir(this.configDir, { recursive: true });
@@ -731,7 +741,7 @@ export class MarketplaceManager {
      * Safe to call on every startup — only fetches when assets are actually missing.
      */
     async repairMissingAssets(workingDir) {
-        const localMetadata = await readLocalMetadata();
+        const localMetadata = await this.readMetadata();
         let repaired = 0;
         for (const [fileName, installInfo] of Object.entries(localMetadata.photons)) {
             const photonName = fileName.replace(/\.photon\.ts$/, '');
@@ -965,6 +975,11 @@ export class MarketplaceManager {
                 }
             }
         }
+        // Install @photon transitive dependencies from the same marketplace
+        const transitiveDeps = await this.installTransitiveDeps(content, result.marketplace, workingDir);
+        if (transitiveDeps.length > 0) {
+            assetsInstalled.push(...transitiveDeps.map((d) => `@photon ${d}`));
+        }
         return { photonPath, assetsInstalled };
     }
     /**
@@ -1004,10 +1019,21 @@ export class MarketplaceManager {
         const deps = extractor.extractPhotonDependencies(content);
         const installed = [];
         for (const dep of deps) {
+            // Resolve dependency name from source
+            let depName;
             if (dep.sourceType === 'local' &&
                 (dep.source.startsWith('./') || dep.source.startsWith('../'))) {
-                const depFileName = path.basename(dep.source);
-                const depName = depFileName.replace(/\.photon\.(ts|js)$/, '');
+                // Relative path: ./chat.photon.ts → chat
+                depName = path.basename(dep.source).replace(/\.photon\.(ts|js)$/, '');
+            }
+            else if (dep.sourceType === 'marketplace' || !dep.source.startsWith('/')) {
+                // Marketplace name: whatsapp, agent-router, courier
+                depName = dep.source;
+            }
+            else {
+                continue; // Absolute paths — skip
+            }
+            {
                 if (visited.has(depName))
                     continue;
                 visited.add(depName);
@@ -1016,6 +1042,9 @@ export class MarketplaceManager {
                 const installDir = namespace ? path.join(workingDir, namespace) : workingDir;
                 if (existsSync(path.join(installDir, `${depName}.photon.ts`)))
                     continue;
+                // Also check flat in workingDir
+                if (existsSync(path.join(workingDir, `${depName}.photon.ts`)))
+                    continue;
                 // Fetch from the same marketplace
                 this.logger.info(`Fetching @photon dependency: ${depName}`);
                 const depResult = await this.fetchMCPFromMarketplace(depName, marketplace);
@@ -1123,7 +1152,7 @@ export class MarketplaceManager {
         return { photons: {} };
     }
     async writeMetadata(metadata) {
-        await fs.mkdir(this.configDir, { recursive: true });
+        await fs.mkdir(path.dirname(this.metadataFile), { recursive: true });
         await writeJSON(this.metadataFile, metadata);
     }
     /**
@@ -1307,30 +1336,82 @@ export class MarketplaceManager {
      * Shared logic used by both CLI and Beam.
      */
     async forkPhoton(name, workingDir, options) {
-        const fileName = `${name}.photon.ts`;
-        const filePath = path.join(workingDir, fileName);
-        // Check file exists
-        if (!existsSync(filePath)) {
+        validateSafeName(name, 'photon name');
+        if (options?.targetRepo)
+            validateSafeName(options.targetRepo, 'target repo');
+        if (options?.createRepo)
+            validateSafeName(options.createRepo, 'repo name');
+        if (options?.newName)
+            validateSafeName(options.newName, 'new photon name');
+        const sourcePath = await resolvePath(name, workingDir);
+        if (!sourcePath) {
             return { success: false, message: `Photon not found: ${name}` };
         }
-        // Read install metadata
-        const localMetadata = await readLocalMetadata();
-        const installMeta = localMetadata.photons[fileName];
-        if (!installMeta) {
+        const sourceName = path.basename(sourcePath).replace(/\.photon\.(ts|js)$/, '');
+        const normalizedSourceKey = this.toMetadataKey(sourcePath, workingDir);
+        const requestedNewName = options?.newName?.trim();
+        const localMetadata = await this.readMetadata();
+        const installMeta = localMetadata.photons[normalizedSourceKey];
+        const isLocalSource = !installMeta;
+        const targetName = requestedNewName || sourceName;
+        const suggestedName = `${sourceName}-copy`;
+        if (isLocalSource && !requestedNewName) {
             return {
-                success: true,
-                message: `${name} is already a local photon (no marketplace tracking)`,
+                success: false,
+                message: `${sourceName} is already local. Choose a new local name to fork it.`,
+                requiresName: true,
+                suggestedName,
             };
         }
+        if (isLocalSource && requestedNewName === sourceName) {
+            return {
+                success: false,
+                message: 'Forking a local photon requires a different new name.',
+                requiresName: true,
+                suggestedName,
+            };
+        }
+        const targetPath = path.join(workingDir, `${targetName}.photon.ts`);
+        const sourceRealPath = await fs.realpath(sourcePath).catch(() => sourcePath);
+        const targetExists = existsSync(targetPath);
+        const targetRealPath = targetExists
+            ? await fs.realpath(targetPath).catch(() => targetPath)
+            : null;
+        if (targetExists && targetRealPath !== sourceRealPath) {
+            return {
+                success: false,
+                message: `A local photon named ${targetName} already exists. Choose a different local name.`,
+                requiresName: true,
+                suggestedName,
+            };
+        }
+        const fileName = `${targetName}.photon.ts`;
+        const filePath = targetPath;
         // Check @forkedFrom tag
-        const content = await readText(filePath);
+        const content = await readText(sourcePath);
         const hasForkedFrom = content.includes('@forkedFrom');
+        const sourceAssetDir = path.join(path.dirname(sourcePath), sourceName);
+        const targetAssetDir = path.join(workingDir, targetName);
+        if (targetRealPath !== sourceRealPath && !isLocalSource) {
+            await fs.mkdir(workingDir, { recursive: true });
+            await fs.rename(sourcePath, targetPath);
+            await this.movePhotonAssetDir(sourceAssetDir, targetAssetDir);
+        }
+        else if (targetRealPath !== sourceRealPath) {
+            await fs.copyFile(sourcePath, targetPath);
+            await this.copyPhotonAssetDir(sourceAssetDir, targetAssetDir);
+        }
+        else if (path.dirname(sourcePath) !== workingDir || targetName !== sourceName) {
+            await fs.mkdir(workingDir, { recursive: true });
+            await fs.rename(sourcePath, targetPath);
+            await this.movePhotonAssetDir(sourceAssetDir, targetAssetDir);
+        }
         // Handle target repo push if specified
         if (options?.targetRepo || options?.createRepo) {
-            const { execSync } = await import('child_process');
+            const { execFileSync } = await import('child_process');
             // Check gh CLI
             try {
-                execSync('gh --version', { stdio: 'pipe' });
+                execFileSync('gh', ['--version'], { stdio: 'pipe' });
             }
             catch {
                 return {
@@ -1341,7 +1422,9 @@ export class MarketplaceManager {
             if (options.createRepo) {
                 // Create new repo and push
                 try {
-                    execSync(`gh repo create ${options.createRepo} --public --confirm`, { stdio: 'pipe' });
+                    execFileSync('gh', ['repo', 'create', options.createRepo, '--public', '--confirm'], {
+                        stdio: 'pipe',
+                    });
                 }
                 catch {
                     // Repo may already exist
@@ -1349,23 +1432,17 @@ export class MarketplaceManager {
                 const targetRepo = options.createRepo;
                 const tmpDir = path.join(os.tmpdir(), `photon-fork-${Date.now()}`);
                 try {
-                    execSync(`gh repo clone ${targetRepo} "${tmpDir}" -- --depth=1`, {
+                    execFileSync('gh', ['repo', 'clone', targetRepo, tmpDir, '--', '--depth=1'], {
                         stdio: 'pipe',
                     });
                     await fs.copyFile(filePath, path.join(tmpDir, fileName));
-                    // Copy assets
-                    const photonMeta = await this.getPhotonMetadata(name);
-                    if (photonMeta?.metadata.assets) {
-                        for (const asset of photonMeta.metadata.assets) {
-                            const srcAsset = path.join(workingDir, asset);
-                            if (existsSync(srcAsset)) {
-                                const dstAsset = path.join(tmpDir, asset);
-                                await fs.mkdir(path.dirname(dstAsset), { recursive: true });
-                                await fs.copyFile(srcAsset, dstAsset);
-                            }
-                        }
-                    }
-                    execSync(`cd "${tmpDir}" && git add -A && git commit -m "fork: ${name} photon" && git push origin`, { stdio: 'pipe' });
+                    await this.copyPhotonAssetDir(targetAssetDir, path.join(tmpDir, targetName));
+                    execFileSync('git', ['add', '-A'], { cwd: tmpDir, stdio: 'pipe' });
+                    execFileSync('git', ['commit', '-m', `fork: ${name} photon`], {
+                        cwd: tmpDir,
+                        stdio: 'pipe',
+                    });
+                    execFileSync('git', ['push', 'origin'], { cwd: tmpDir, stdio: 'pipe' });
                     await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
                 }
                 catch (e) {
@@ -1380,23 +1457,17 @@ export class MarketplaceManager {
                 // Push to existing repo
                 const tmpDir = path.join(os.tmpdir(), `photon-fork-${Date.now()}`);
                 try {
-                    execSync(`gh repo clone ${options.targetRepo} "${tmpDir}" -- --depth=1`, {
+                    execFileSync('gh', ['repo', 'clone', options.targetRepo, tmpDir, '--', '--depth=1'], {
                         stdio: 'pipe',
                     });
                     await fs.copyFile(filePath, path.join(tmpDir, fileName));
-                    // Copy assets
-                    const photonMeta = await this.getPhotonMetadata(name);
-                    if (photonMeta?.metadata.assets) {
-                        for (const asset of photonMeta.metadata.assets) {
-                            const srcAsset = path.join(workingDir, asset);
-                            if (existsSync(srcAsset)) {
-                                const dstAsset = path.join(tmpDir, asset);
-                                await fs.mkdir(path.dirname(dstAsset), { recursive: true });
-                                await fs.copyFile(srcAsset, dstAsset);
-                            }
-                        }
-                    }
-                    execSync(`cd "${tmpDir}" && git add -A && git commit -m "fork: ${name} photon" && git push origin`, { stdio: 'pipe' });
+                    await this.copyPhotonAssetDir(targetAssetDir, path.join(tmpDir, targetName));
+                    execFileSync('git', ['add', '-A'], { cwd: tmpDir, stdio: 'pipe' });
+                    execFileSync('git', ['commit', '-m', `fork: ${name} photon`], {
+                        cwd: tmpDir,
+                        stdio: 'pipe',
+                    });
+                    execFileSync('git', ['push', 'origin'], { cwd: tmpDir, stdio: 'pipe' });
                     await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
                 }
                 catch (e) {
@@ -1409,22 +1480,59 @@ export class MarketplaceManager {
             }
         }
         // Remove marketplace tracking
-        delete localMetadata.photons[fileName];
+        if (installMeta) {
+            delete localMetadata.photons[normalizedSourceKey];
+        }
         await this.writeMetadata(localMetadata);
         const parts = [];
-        parts.push(`${name} is now your own`);
+        if (targetName !== sourceName) {
+            parts.push(`Created local fork ${targetName} from ${sourceName}`);
+        }
+        else {
+            parts.push(`${sourceName} is now your own`);
+        }
         if (hasForkedFrom) {
             parts.push('Origin preserved as @forkedFrom tag');
         }
-        parts.push('Marketplace update tracking removed');
+        if (installMeta) {
+            parts.push('Marketplace update tracking removed');
+        }
         return { success: true, message: parts.join('. ') };
     }
+    toMetadataKey(filePath, workingDir) {
+        return path.relative(workingDir, filePath).split(path.sep).join('/');
+    }
+    async copyPhotonAssetDir(sourceDir, targetDir) {
+        const stat = await fs.lstat(sourceDir).catch(() => null);
+        if (!stat)
+            return;
+        if (stat.isSymbolicLink()) {
+            const linkTarget = await fs.readlink(sourceDir);
+            await fs.symlink(linkTarget, targetDir).catch(() => { });
+            return;
+        }
+        if (!stat.isDirectory())
+            return;
+        await fs.cp(sourceDir, targetDir, { recursive: true, force: true });
+    }
+    async movePhotonAssetDir(sourceDir, targetDir) {
+        const stat = await fs.lstat(sourceDir).catch(() => null);
+        if (!stat)
+            return;
+        if (existsSync(targetDir))
+            return;
+        await fs.mkdir(path.dirname(targetDir), { recursive: true });
+        await fs.rename(sourceDir, targetDir);
+    }
     /**
      * Contribute a photon back upstream via PR.
      * Shared logic used by both CLI and Beam.
      */
     async contributePhoton(name, workingDir, options) {
-        const { execSync } = await import('child_process');
+        validateSafeName(name, 'photon name');
+        if (options?.branch)
+            validateSafeName(options.branch, 'branch name');
+        const { execFileSync } = await import('child_process');
         const fileName = `${name}.photon.ts`;
         const filePath = path.join(workingDir, fileName);
         // Check file exists
@@ -1433,7 +1541,7 @@ export class MarketplaceManager {
         }
         // Check gh CLI
         try {
-            execSync('gh --version', { stdio: 'pipe' });
+            execFileSync('gh', ['--version'], { stdio: 'pipe' });
         }
         catch {
             return {
@@ -1443,7 +1551,7 @@ export class MarketplaceManager {
         }
         // Check gh auth
         try {
-            execSync('gh auth status', { stdio: 'pipe' });
+            execFileSync('gh', ['auth', 'status'], { stdio: 'pipe' });
         }
         catch {
             return {
@@ -1492,20 +1600,20 @@ export class MarketplaceManager {
         }
         // Fork the repo
         try {
-            execSync(`gh repo fork ${repo} --clone=false`, { stdio: 'pipe' });
+            execFileSync('gh', ['repo', 'fork', repo, '--clone=false'], { stdio: 'pipe' });
         }
         catch {
             // Fork may already exist
         }
         // Get fork name
-        const forkJson = execSync('gh api user', { encoding: 'utf-8' });
+        const forkJson = execFileSync('gh', ['api', 'user'], { encoding: 'utf-8' });
         const ghUser = JSON.parse(forkJson).login;
         const repoName = repo.split('/')[1];
         const forkRepo = `${ghUser}/${repoName}`;
         // Clone to temp dir
         const tmpDir = path.join(os.tmpdir(), `photon-contribute-${Date.now()}`);
         try {
-            execSync(`gh repo clone ${forkRepo} "${tmpDir}" -- --depth=1`, {
+            execFileSync('gh', ['repo', 'clone', forkRepo, tmpDir, '--', '--depth=1'], {
                 stdio: 'pipe',
             });
             // Copy modified photon file
@@ -1523,9 +1631,24 @@ export class MarketplaceManager {
                 }
             }
             // Create branch, commit, push
-            execSync(`cd "${tmpDir}" && git checkout -b "${branchName}" && git add -A && git commit -m "improve: update ${name} photon" && git push origin "${branchName}"`, { stdio: 'pipe' });
+            execFileSync('git', ['checkout', '-b', branchName], { cwd: tmpDir, stdio: 'pipe' });
+            execFileSync('git', ['add', '-A'], { cwd: tmpDir, stdio: 'pipe' });
+            execFileSync('git', ['commit', '-m', `improve: update ${name} photon`], {
+                cwd: tmpDir,
+                stdio: 'pipe',
+            });
+            execFileSync('git', ['push', 'origin', branchName], { cwd: tmpDir, stdio: 'pipe' });
             // Create PR
-            const prOutput = execSync(`cd "${tmpDir}" && gh pr create --repo "${repo}" --title "Improve ${name} photon" --body "Contributed improvements to ${name} photon via Photon marketplace."`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+            const prOutput = execFileSync('gh', [
+                'pr',
+                'create',
+                '--repo',
+                repo,
+                '--title',
+                `Improve ${name} photon`,
+                '--body',
+                `Contributed improvements to ${name} photon via Photon marketplace.`,
+            ], { cwd: tmpDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
             // Cleanup temp dir
             await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
             const prUrl = prOutput.trim();