@robot-resources/cli-core 0.1.0 → 0.1.2

package/auth.mjs

@@ -1,8 +1,13 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { createServer } from 'node:http';
 
-const SUPABASE_URL = 'https://tbnliojrqmcagojtvqpe.supabase.co';
+// Supabase anon key is a public client key (like Stripe's publishable key).
+// Security is enforced by Row Level Security policies, not key secrecy.
+// Override via env vars for alternative Supabase instances.
+const SUPABASE_URL =
+  process.env.SUPABASE_URL || 'https://tbnliojrqmcagojtvqpe.supabase.co';
 const SUPABASE_ANON_KEY =
+  process.env.SUPABASE_ANON_KEY ||
   'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InRibmxpb2pycW1jYWdvanR2cXBlIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMyNjIxNzAsImV4cCI6MjA4ODgzODE3MH0.GKlpbVFgBbcV0OwxFZuOb-LfqtOu95ZiR33KNOONPI0';
 
 const PREFERRED_PORT = 54321;
@@ -214,14 +219,15 @@ export async function authenticate() {
 
   console.log(`\n  Auth URL: ${authUrl}\n`);
 
-  // Open browser
-  const { exec } = await import('node:child_process');
-  const openCmd =
-    process.platform === 'darwin' ? 'open' :
-    process.platform === 'win32' ? 'start' :
-    'xdg-open';
-
-  exec(`${openCmd} "${authUrl}"`);
+  // Open browser (use execFile to avoid shell injection)
+  const { execFile } = await import('node:child_process');
+  if (process.platform === 'win32') {
+    // 'start' is a cmd.exe builtin, not an executable — must invoke via cmd.exe
+    execFile('cmd.exe', ['/c', 'start', '""', authUrl]);
+  } else {
+    const openCmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    execFile(openCmd, [authUrl]);
+  }
 
   console.log('  Waiting for GitHub authorization...\n');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robot-resources/cli-core",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Shared CLI utilities — auth, config, login (internal)",
   "type": "module",
   "main": "./index.mjs",
@@ -21,6 +21,17 @@
   "devDependencies": {
     "vitest": "^1.2.0"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/robot-resources/robot-resources.git",
+    "directory": "packages/cli-core"
+  },
+  "homepage": "https://robotresources.ai",
+  "bugs": {
+    "url": "https://github.com/robot-resources/robot-resources/issues"
+  },
+  "license": "MIT",
+  "author": "Robot Resources Team",
   "publishConfig": {
     "access": "public"
   },

package/python-bridge.mjs

@@ -69,6 +69,18 @@ export function ensureVenv(pythonBin) {
     }
   }
 
+  // Pre-check: verify the venv module is available (missing on some Debian/Ubuntu systems)
+  try {
+    execSync(`"${pythonBin}" -c "import ensurepip; import venv"`, { stdio: 'pipe' });
+  } catch {
+    const version = execSync(`"${pythonBin}" --version`, { encoding: 'utf-8' }).trim().match(/\d+\.\d+/)?.[0] || '3.x';
+    throw new Error(
+      `Python venv module is not installed.\n` +
+      `  Fix: sudo apt install python${version}-venv   (Debian/Ubuntu)\n` +
+      `  Then re-run: npx robot-resources`
+    );
+  }
+
   mkdirSync(join(homedir(), '.robot-resources'), { recursive: true });
   execSync(`"${pythonBin}" -m venv "${VENV_DIR}"`, { stdio: 'pipe' });
   return venvPython;