@portel/photon 1.19.0 → 1.20.1

package/dist/marketplace-manager.js

@@ -5,13 +5,14 @@ import * as fs from 'fs/promises';
 import * as path from 'path';
 import * as os from 'os';
 import { existsSync } from 'fs';
+import { execFileSync } from 'child_process';
 import { readText, readJSON, writeText, writeJSON } from './shared/io.js';
 import * as crypto from 'crypto';
 import { createLogger } from './shared/logger.js';
 import { getErrorMessage } from './shared/error-handler.js';
 import { verifyContentHash, validateAssetPath, isPathWithin } from './shared/security.js';
 import { getDefaultContext } from './context.js';
-import { getMetadataPath } from '@portel/photon-core';
+import { getMetadataPath, resolvePath } from '@portel/photon-core';
 import { SchemaExtractor } from '@portel/photon-core';
 // Timeout for marketplace fetch requests
 const FETCH_TIMEOUT_MS = 10 * 1000;
@@ -33,8 +34,11 @@ function getGitHubToken() {
     _ghToken = process.env.GITHUB_TOKEN || null;
     if (!_ghToken) {
         try {
-            const { execSync } = require('child_process');
-            _ghToken = execSync('gh auth token 2>/dev/null', { encoding: 'utf-8' }).trim() || null;
+            _ghToken =
+                execFileSync('gh', ['auth', 'token'], {
+                    encoding: 'utf-8',
+                    stdio: ['pipe', 'pipe', 'ignore'],
+                }).trim() || null;
         }
         catch {
             _ghToken = null;
@@ -115,10 +119,11 @@ export async function calculatePhotonHash(sourceFilePath, assets, baseDir) {
 /**
  * Read local installation metadata
  */
-export async function readLocalMetadata() {
+export async function readLocalMetadata(baseDir) {
+    const metaFile = baseDir ? getMetadataPath(baseDir) : METADATA_FILE;
     try {
-        if (existsSync(METADATA_FILE)) {
-            return await readJSON(METADATA_FILE);
+        if (existsSync(metaFile)) {
+            return await readJSON(metaFile);
         }
     }
     catch (error) {
@@ -127,6 +132,11 @@ export async function readLocalMetadata() {
     }
     return { photons: {} };
 }
+function validateSafeName(name, label) {
+    if (/[;&|$`(){}\\\<>!#~\n\r]/.test(name)) {
+        throw new Error(`Invalid ${label}: contains unsafe characters`);
+    }
+}
 export class MarketplaceManager {
     config = { marketplaces: [] };
     logger;
@@ -732,7 +742,7 @@ export class MarketplaceManager {
      * Safe to call on every startup — only fetches when assets are actually missing.
      */
     async repairMissingAssets(workingDir) {
-        const localMetadata = await readLocalMetadata();
+        const localMetadata = await this.readMetadata();
         let repaired = 0;
         for (const [fileName, installInfo] of Object.entries(localMetadata.photons)) {
             const photonName = fileName.replace(/\.photon\.ts$/, '');
@@ -1143,7 +1153,7 @@ export class MarketplaceManager {
         return { photons: {} };
     }
     async writeMetadata(metadata) {
-        await fs.mkdir(this.configDir, { recursive: true });
+        await fs.mkdir(path.dirname(this.metadataFile), { recursive: true });
         await writeJSON(this.metadataFile, metadata);
     }
     /**
@@ -1327,30 +1337,82 @@ export class MarketplaceManager {
      * Shared logic used by both CLI and Beam.
      */
     async forkPhoton(name, workingDir, options) {
-        const fileName = `${name}.photon.ts`;
-        const filePath = path.join(workingDir, fileName);
-        // Check file exists
-        if (!existsSync(filePath)) {
+        validateSafeName(name, 'photon name');
+        if (options?.targetRepo)
+            validateSafeName(options.targetRepo, 'target repo');
+        if (options?.createRepo)
+            validateSafeName(options.createRepo, 'repo name');
+        if (options?.newName)
+            validateSafeName(options.newName, 'new photon name');
+        const sourcePath = await resolvePath(name, workingDir);
+        if (!sourcePath) {
             return { success: false, message: `Photon not found: ${name}` };
         }
-        // Read install metadata
-        const localMetadata = await readLocalMetadata();
-        const installMeta = localMetadata.photons[fileName];
-        if (!installMeta) {
+        const sourceName = path.basename(sourcePath).replace(/\.photon\.(ts|js)$/, '');
+        const normalizedSourceKey = this.toMetadataKey(sourcePath, workingDir);
+        const requestedNewName = options?.newName?.trim();
+        const localMetadata = await this.readMetadata();
+        const installMeta = localMetadata.photons[normalizedSourceKey];
+        const isLocalSource = !installMeta;
+        const targetName = requestedNewName || sourceName;
+        const suggestedName = `${sourceName}-copy`;
+        if (isLocalSource && !requestedNewName) {
             return {
-                success: true,
-                message: `${name} is already a local photon (no marketplace tracking)`,
+                success: false,
+                message: `${sourceName} is already local. Choose a new local name to fork it.`,
+                requiresName: true,
+                suggestedName,
             };
         }
+        if (isLocalSource && requestedNewName === sourceName) {
+            return {
+                success: false,
+                message: 'Forking a local photon requires a different new name.',
+                requiresName: true,
+                suggestedName,
+            };
+        }
+        const targetPath = path.join(workingDir, `${targetName}.photon.ts`);
+        const sourceRealPath = await fs.realpath(sourcePath).catch(() => sourcePath);
+        const targetExists = existsSync(targetPath);
+        const targetRealPath = targetExists
+            ? await fs.realpath(targetPath).catch(() => targetPath)
+            : null;
+        if (targetExists && targetRealPath !== sourceRealPath) {
+            return {
+                success: false,
+                message: `A local photon named ${targetName} already exists. Choose a different local name.`,
+                requiresName: true,
+                suggestedName,
+            };
+        }
+        const fileName = `${targetName}.photon.ts`;
+        const filePath = targetPath;
         // Check @forkedFrom tag
-        const content = await readText(filePath);
+        const content = await readText(sourcePath);
         const hasForkedFrom = content.includes('@forkedFrom');
+        const sourceAssetDir = path.join(path.dirname(sourcePath), sourceName);
+        const targetAssetDir = path.join(workingDir, targetName);
+        if (targetRealPath !== sourceRealPath && !isLocalSource) {
+            await fs.mkdir(workingDir, { recursive: true });
+            await fs.rename(sourcePath, targetPath);
+            await this.movePhotonAssetDir(sourceAssetDir, targetAssetDir);
+        }
+        else if (targetRealPath !== sourceRealPath) {
+            await fs.copyFile(sourcePath, targetPath);
+            await this.copyPhotonAssetDir(sourceAssetDir, targetAssetDir);
+        }
+        else if (path.dirname(sourcePath) !== workingDir || targetName !== sourceName) {
+            await fs.mkdir(workingDir, { recursive: true });
+            await fs.rename(sourcePath, targetPath);
+            await this.movePhotonAssetDir(sourceAssetDir, targetAssetDir);
+        }
         // Handle target repo push if specified
         if (options?.targetRepo || options?.createRepo) {
-            const { execSync } = await import('child_process');
+            const { execFileSync } = await import('child_process');
             // Check gh CLI
             try {
-                execSync('gh --version', { stdio: 'pipe' });
+                execFileSync('gh', ['--version'], { stdio: 'pipe' });
             }
             catch {
                 return {
@@ -1361,7 +1423,9 @@ export class MarketplaceManager {
             if (options.createRepo) {
                 // Create new repo and push
                 try {
-                    execSync(`gh repo create ${options.createRepo} --public --confirm`, { stdio: 'pipe' });
+                    execFileSync('gh', ['repo', 'create', options.createRepo, '--public', '--confirm'], {
+                        stdio: 'pipe',
+                    });
                 }
                 catch {
                     // Repo may already exist
@@ -1369,23 +1433,17 @@ export class MarketplaceManager {
                 const targetRepo = options.createRepo;
                 const tmpDir = path.join(os.tmpdir(), `photon-fork-${Date.now()}`);
                 try {
-                    execSync(`gh repo clone ${targetRepo} "${tmpDir}" -- --depth=1`, {
+                    execFileSync('gh', ['repo', 'clone', targetRepo, tmpDir, '--', '--depth=1'], {
                         stdio: 'pipe',
                     });
                     await fs.copyFile(filePath, path.join(tmpDir, fileName));
-                    // Copy assets
-                    const photonMeta = await this.getPhotonMetadata(name);
-                    if (photonMeta?.metadata.assets) {
-                        for (const asset of photonMeta.metadata.assets) {
-                            const srcAsset = path.join(workingDir, asset);
-                            if (existsSync(srcAsset)) {
-                                const dstAsset = path.join(tmpDir, asset);
-                                await fs.mkdir(path.dirname(dstAsset), { recursive: true });
-                                await fs.copyFile(srcAsset, dstAsset);
-                            }
-                        }
-                    }
-                    execSync(`cd "${tmpDir}" && git add -A && git commit -m "fork: ${name} photon" && git push origin`, { stdio: 'pipe' });
+                    await this.copyPhotonAssetDir(targetAssetDir, path.join(tmpDir, targetName));
+                    execFileSync('git', ['add', '-A'], { cwd: tmpDir, stdio: 'pipe' });
+                    execFileSync('git', ['commit', '-m', `fork: ${name} photon`], {
+                        cwd: tmpDir,
+                        stdio: 'pipe',
+                    });
+                    execFileSync('git', ['push', 'origin'], { cwd: tmpDir, stdio: 'pipe' });
                     await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
                 }
                 catch (e) {
@@ -1400,23 +1458,17 @@ export class MarketplaceManager {
                 // Push to existing repo
                 const tmpDir = path.join(os.tmpdir(), `photon-fork-${Date.now()}`);
                 try {
-                    execSync(`gh repo clone ${options.targetRepo} "${tmpDir}" -- --depth=1`, {
+                    execFileSync('gh', ['repo', 'clone', options.targetRepo, tmpDir, '--', '--depth=1'], {
                         stdio: 'pipe',
                     });
                     await fs.copyFile(filePath, path.join(tmpDir, fileName));
-                    // Copy assets
-                    const photonMeta = await this.getPhotonMetadata(name);
-                    if (photonMeta?.metadata.assets) {
-                        for (const asset of photonMeta.metadata.assets) {
-                            const srcAsset = path.join(workingDir, asset);
-                            if (existsSync(srcAsset)) {
-                                const dstAsset = path.join(tmpDir, asset);
-                                await fs.mkdir(path.dirname(dstAsset), { recursive: true });
-                                await fs.copyFile(srcAsset, dstAsset);
-                            }
-                        }
-                    }
-                    execSync(`cd "${tmpDir}" && git add -A && git commit -m "fork: ${name} photon" && git push origin`, { stdio: 'pipe' });
+                    await this.copyPhotonAssetDir(targetAssetDir, path.join(tmpDir, targetName));
+                    execFileSync('git', ['add', '-A'], { cwd: tmpDir, stdio: 'pipe' });
+                    execFileSync('git', ['commit', '-m', `fork: ${name} photon`], {
+                        cwd: tmpDir,
+                        stdio: 'pipe',
+                    });
+                    execFileSync('git', ['push', 'origin'], { cwd: tmpDir, stdio: 'pipe' });
                     await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
                 }
                 catch (e) {
@@ -1429,22 +1481,59 @@ export class MarketplaceManager {
             }
         }
         // Remove marketplace tracking
-        delete localMetadata.photons[fileName];
+        if (installMeta) {
+            delete localMetadata.photons[normalizedSourceKey];
+        }
         await this.writeMetadata(localMetadata);
         const parts = [];
-        parts.push(`${name} is now your own`);
+        if (targetName !== sourceName) {
+            parts.push(`Created local fork ${targetName} from ${sourceName}`);
+        }
+        else {
+            parts.push(`${sourceName} is now your own`);
+        }
         if (hasForkedFrom) {
             parts.push('Origin preserved as @forkedFrom tag');
         }
-        parts.push('Marketplace update tracking removed');
+        if (installMeta) {
+            parts.push('Marketplace update tracking removed');
+        }
         return { success: true, message: parts.join('. ') };
     }
+    toMetadataKey(filePath, workingDir) {
+        return path.relative(workingDir, filePath).split(path.sep).join('/');
+    }
+    async copyPhotonAssetDir(sourceDir, targetDir) {
+        const stat = await fs.lstat(sourceDir).catch(() => null);
+        if (!stat)
+            return;
+        if (stat.isSymbolicLink()) {
+            const linkTarget = await fs.readlink(sourceDir);
+            await fs.symlink(linkTarget, targetDir).catch(() => { });
+            return;
+        }
+        if (!stat.isDirectory())
+            return;
+        await fs.cp(sourceDir, targetDir, { recursive: true, force: true });
+    }
+    async movePhotonAssetDir(sourceDir, targetDir) {
+        const stat = await fs.lstat(sourceDir).catch(() => null);
+        if (!stat)
+            return;
+        if (existsSync(targetDir))
+            return;
+        await fs.mkdir(path.dirname(targetDir), { recursive: true });
+        await fs.rename(sourceDir, targetDir);
+    }
     /**
      * Contribute a photon back upstream via PR.
      * Shared logic used by both CLI and Beam.
      */
     async contributePhoton(name, workingDir, options) {
-        const { execSync } = await import('child_process');
+        validateSafeName(name, 'photon name');
+        if (options?.branch)
+            validateSafeName(options.branch, 'branch name');
+        const { execFileSync } = await import('child_process');
         const fileName = `${name}.photon.ts`;
         const filePath = path.join(workingDir, fileName);
         // Check file exists
@@ -1453,7 +1542,7 @@ export class MarketplaceManager {
         }
         // Check gh CLI
         try {
-            execSync('gh --version', { stdio: 'pipe' });
+            execFileSync('gh', ['--version'], { stdio: 'pipe' });
         }
         catch {
             return {
@@ -1463,7 +1552,7 @@ export class MarketplaceManager {
         }
         // Check gh auth
         try {
-            execSync('gh auth status', { stdio: 'pipe' });
+            execFileSync('gh', ['auth', 'status'], { stdio: 'pipe' });
         }
         catch {
             return {
@@ -1512,20 +1601,20 @@ export class MarketplaceManager {
         }
         // Fork the repo
         try {
-            execSync(`gh repo fork ${repo} --clone=false`, { stdio: 'pipe' });
+            execFileSync('gh', ['repo', 'fork', repo, '--clone=false'], { stdio: 'pipe' });
         }
         catch {
             // Fork may already exist
         }
         // Get fork name
-        const forkJson = execSync('gh api user', { encoding: 'utf-8' });
+        const forkJson = execFileSync('gh', ['api', 'user'], { encoding: 'utf-8' });
         const ghUser = JSON.parse(forkJson).login;
         const repoName = repo.split('/')[1];
         const forkRepo = `${ghUser}/${repoName}`;
         // Clone to temp dir
         const tmpDir = path.join(os.tmpdir(), `photon-contribute-${Date.now()}`);
         try {
-            execSync(`gh repo clone ${forkRepo} "${tmpDir}" -- --depth=1`, {
+            execFileSync('gh', ['repo', 'clone', forkRepo, tmpDir, '--', '--depth=1'], {
                 stdio: 'pipe',
             });
             // Copy modified photon file
@@ -1543,9 +1632,24 @@ export class MarketplaceManager {
                 }
             }
             // Create branch, commit, push
-            execSync(`cd "${tmpDir}" && git checkout -b "${branchName}" && git add -A && git commit -m "improve: update ${name} photon" && git push origin "${branchName}"`, { stdio: 'pipe' });
+            execFileSync('git', ['checkout', '-b', branchName], { cwd: tmpDir, stdio: 'pipe' });
+            execFileSync('git', ['add', '-A'], { cwd: tmpDir, stdio: 'pipe' });
+            execFileSync('git', ['commit', '-m', `improve: update ${name} photon`], {
+                cwd: tmpDir,
+                stdio: 'pipe',
+            });
+            execFileSync('git', ['push', 'origin', branchName], { cwd: tmpDir, stdio: 'pipe' });
             // Create PR
-            const prOutput = execSync(`cd "${tmpDir}" && gh pr create --repo "${repo}" --title "Improve ${name} photon" --body "Contributed improvements to ${name} photon via Photon marketplace."`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+            const prOutput = execFileSync('gh', [
+                'pr',
+                'create',
+                '--repo',
+                repo,
+                '--title',
+                `Improve ${name} photon`,
+                '--body',
+                `Contributed improvements to ${name} photon via Photon marketplace.`,
+            ], { cwd: tmpDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
             // Cleanup temp dir
             await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
             const prUrl = prOutput.trim();