@runa-ai/runa-cli 0.5.47 → 0.5.49

package/dist/commands/ci/machine/machine.d.ts

@@ -240,7 +240,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
     summaryPath?: string | undefined;
     error?: string | undefined;
 }, import("xstate").EventObject, import("xstate").MetaObject, {
-    id: "ciMachine";
+    id: "ci";
     states: {
         readonly idle: {};
         readonly setup: {

package/dist/index.js

@@ -929,7 +929,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.47";
+    CLI_VERSION = "0.5.49";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -5422,8 +5422,9 @@ var TRUSTED_DIRECTORIES_UNIX = [
   // Homebrew on macOS
   "/opt/homebrew/bin",
   "/opt/homebrew/sbin",
-  // Node.js version managers
+  // Node.js version managers and corepack symlink targets
   "/usr/local/lib/node_modules/.bin",
+  "/usr/local/lib/node_modules",
   // Common package manager locations
   "/usr/local/share/npm/bin"
 ];
@@ -5471,6 +5472,37 @@ function resolveAndValidateSymlink(filePath) {
     return null;
   }
 }
+var TRUSTED_VERSION_MANAGER_PATTERNS_UNIX = [
+  // Homebrew Cellar (macOS)
+  /^\/opt\/homebrew\/Cellar\/[^/]+\/[^/]+\/bin$/,
+  // nvm
+  /^\/Users\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/,
+  // fnm
+  /^\/Users\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/,
+  /^\/home\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/,
+  // pnpm global
+  /^\/Users\/[^/]+\/Library\/pnpm$/,
+  /^\/home\/[^/]+\/\.local\/share\/pnpm$/,
+  // mise
+  /^\/Users\/[^/]+\/\.local\/share\/mise\/installs\/[^/]+\/[^/]+\/bin$/,
+  /^\/Users\/[^/]+\/\.local\/share\/mise\/shims$/,
+  /^\/home\/[^/]+\/\.local\/share\/mise\/installs\/[^/]+\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.local\/share\/mise\/shims$/,
+  // volta
+  /^\/Users\/[^/]+\/\.volta\/bin$/,
+  /^\/home\/[^/]+\/\.volta\/bin$/,
+  // asdf
+  /^\/Users\/[^/]+\/\.asdf\/shims$/,
+  /^\/Users\/[^/]+\/\.asdf\/installs\/[^/]+\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.asdf\/shims$/,
+  /^\/home\/[^/]+\/\.asdf\/installs\/[^/]+\/[^/]+\/bin$/,
+  // proto
+  /^\/Users\/[^/]+\/\.proto\/shims$/,
+  /^\/Users\/[^/]+\/\.proto\/tools\/[^/]+\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.proto\/shims$/,
+  /^\/home\/[^/]+\/\.proto\/tools\/[^/]+\/[^/]+\/bin$/
+];
 function isTrustedDirectory(dir) {
   const normalizedDir = normalize(dir).replace(/[/\\]$/, "");
   if (process.platform === "win32") {
@@ -5482,16 +5514,7 @@ function isTrustedDirectory(dir) {
       return true;
     }
   }
-  if (normalizedDir.match(/^\/opt\/homebrew\/Cellar\/[^/]+\/[^/]+\/bin$/)) {
-    return true;
-  }
-  if (normalizedDir.match(/^\/Users\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/) || normalizedDir.match(/^\/Users\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/) || normalizedDir.match(/^\/home\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/) || normalizedDir.match(/^\/home\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/)) {
-    return true;
-  }
-  if (normalizedDir.match(/^\/Users\/[^/]+\/Library\/pnpm$/) || normalizedDir.match(/^\/home\/[^/]+\/\.local\/share\/pnpm$/)) {
-    return true;
-  }
-  return false;
+  return TRUSTED_VERSION_MANAGER_PATTERNS_UNIX.some((pattern) => pattern.test(normalizedDir));
 }
 function searchPathForBinary(binaryName) {
   const pathEnv = process.env.PATH || "";
@@ -5505,7 +5528,10 @@ function searchPathForBinary(binaryName) {
     for (const ext of extensions) {
       const fullPath = join(dir, binaryName + ext);
       if (isExecutable(fullPath)) {
-        return fullPath;
+        const validatedPath = resolveAndValidateSymlink(fullPath);
+        if (validatedPath) {
+          return { originalPath: fullPath, validatedPath };
+        }
       }
     }
   }
@@ -5524,36 +5550,31 @@ function resolveBinaryPath(binaryName) {
     const isExpired = now - cached.resolvedAt >= CACHE_TTL_MS;
     const pathChanged = cached.pathFingerprint !== currentPathFingerprint;
     if (!isExpired && !pathChanged) {
-      const validatedPath = resolveAndValidateSymlink(cached.path);
-      if (validatedPath && isExecutable(validatedPath)) {
-        return validatedPath;
+      const validatedPath2 = resolveAndValidateSymlink(cached.path);
+      if (validatedPath2 && isExecutable(validatedPath2)) {
+        return validatedPath2;
       }
       binaryPathCache.delete(binaryName);
     } else {
       binaryPathCache.delete(binaryName);
     }
   }
-  const resolvedPath = searchPathForBinary(binaryName);
-  if (!resolvedPath) {
+  const result = searchPathForBinary(binaryName);
+  if (!result) {
     throw new Error(
       `Binary '${binaryName}' not found in trusted PATH directories. Ensure ${binaryName} is installed in a system directory.`
     );
   }
-  const realPath = resolveAndValidateSymlink(resolvedPath);
-  if (!realPath) {
-    throw new Error(
-      `Security: Binary '${binaryName}' at '${resolvedPath}' is a symlink pointing outside trusted directories. This is not allowed for security reasons.`
-    );
-  }
-  if (!isExecutable(realPath)) {
-    throw new Error(`Binary '${binaryName}' at '${realPath}' is not executable.`);
+  const { validatedPath } = result;
+  if (!isExecutable(validatedPath)) {
+    throw new Error(`Binary '${binaryName}' at '${validatedPath}' is not executable.`);
   }
   binaryPathCache.set(binaryName, {
-    path: realPath,
+    path: validatedPath,
     resolvedAt: now,
     pathFingerprint: currentPathFingerprint
   });
-  return realPath;
+  return validatedPath;
 }
 function secureExeca(binaryName, args = [], options) {
   const resolvedPath = resolveBinaryPath(binaryName);
@@ -14936,7 +14957,7 @@ var ciMachine = setup({
     allTestsPassed: ({ context }) => allTestsPassed(context)
   }
 }).createMachine({
-  id: "ciMachine",
+  id: "ci",
   initial: "idle",
   context: ({ input: input3 }) => createInitialContext(input3),
   states: {
@@ -15000,7 +15021,7 @@ var ciMachine = setup({
               })
             },
             onError: {
-              target: "#ciMachine.failed",
+              target: "#ci.failed",
               actions: assign({
                 error: ({ event }) => extractErrorMessage2(event, "Local setup failed")
               })
@@ -15044,7 +15065,7 @@ var ciMachine = setup({
               })
             },
             onError: {
-              target: "#ciMachine.failed",
+              target: "#ci.failed",
               actions: assign({
                 error: ({ event }) => extractErrorMessage2(event, "PR local setup failed")
               })

package/dist/utils/secure-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-exec.d.ts","sourceRoot":"","sources":["../../src/utils/secure-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAE,KAAK,OAAO,IAAI,YAAY,EAAE,KAAK,aAAa,EAAS,MAAM,OAAO,CAAC;AAMhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,gIAenB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA8D9D;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAsJD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoE5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAO7D;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,aAAa,EACzB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAef;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,aAAa,CAwDf;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE7F;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE5F;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAEf;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F"}
+{"version":3,"file":"secure-exec.d.ts","sourceRoot":"","sources":["../../src/utils/secure-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAE,KAAK,OAAO,IAAI,YAAY,EAAE,KAAK,aAAa,EAAS,MAAM,OAAO,CAAC;AAMhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,gIAenB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA+D9D;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AA2KD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA6D5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAO7D;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,aAAa,EACzB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAef;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,aAAa,CAwDf;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE7F;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE5F;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAEf;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.47",
+  "version": "0.5.49",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",