@runa-ai/runa-cli 0.5.53 → 0.5.58

package/dist/utils/path-security.d.ts

@@ -97,4 +97,22 @@ export declare function buildSafeEnvFilePath(projectRoot: string, envName: strin
  * @returns true if targetPath is within basePath
  */
 export declare function isPathContained(basePath: string, targetPath: string): boolean;
+/**
+ * SECURITY (Issue #651): Validate a user-provided file path (absolute or relative).
+ * Resolves the path and validates that it stays within the allowed base directory.
+ *
+ * Unlike validateSafePath(), this accepts absolute paths that are within baseDir.
+ * Use this for CLI arguments like --file, --config, --output where users may
+ * provide either relative or absolute paths.
+ *
+ * Security checks:
+ * 1. Path doesn't contain dangerous characters (shell metacharacters, control chars)
+ * 2. Resolved path (including symlink targets) is within baseDir
+ *
+ * @param filePath - User-provided file path (can be relative or absolute)
+ * @param baseDir - The directory the file must be contained within
+ * @returns The validated absolute path
+ * @throws Error if validation fails
+ */
+export declare function validateUserFilePath(filePath: string, baseDir: string): string;
 //# sourceMappingURL=path-security.d.ts.map

package/dist/utils/path-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyCH;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAc7D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAW/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmC3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACvC,MAAM,EAAE,CAQV;AAMD;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAQhD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,MAAM,CAehG;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS7E"}
+{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyCH;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAc7D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAW/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmC3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACvC,MAAM,EAAE,CAQV;AAMD;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAQhD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,MAAM,CAehG;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS7E;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAqB9E"}

package/dist/utils/port-allocator.d.ts

@@ -1,50 +1,47 @@
 /**
- * AI HINT: Dynamic port allocation for Supabase local development
+ * AI HINT: CLI wrapper for Supabase port allocation
  *
- * Purpose: Prevent port conflicts when running multiple pj-repos simultaneously.
- * Since pj-repos cannot share state, we use a deterministic hash-based approach
- * where the project path determines the port offset.
+ * Purpose: Thin wrapper around SDK's port-offset module.
+ * The algorithm lives in @runa-ai/runa (SDK) as the single source of truth.
+ * This module provides CLI-specific functions (config.toml update, summary).
  *
- * Port ranges (10 ports per slot, 100 slots):
- *   Slot 0:  54321-54330
- *   Slot 1:  54331-54340
- *   ...
- *   Slot 99: 55311-55320
- *
- * Port assignments within a slot:
- *   +0: API (Kong gateway)
- *   +1: DB (PostgreSQL)
- *   +2: Studio
- *   +3: Inbucket (email testing)
- *   +4: JWT verification
- *   +5: Auth
- *   +6: REST (PostgREST)
- *   +7: Realtime
- *   +8: Storage
- *   +9: Reserved
- */
-export interface SupabasePorts {
-    api: number;
-    db: number;
-    studio: number;
-    inbucket: number;
-    auth: number;
-    rest: number;
-    realtime: number;
-    storage: number;
-    shadow: number;
-}
-/**
- * Calculate port offset from project path using MD5 hash.
- * Same path always produces same offset (deterministic).
+ * IMPORTANT: Do NOT add port calculation logic here.
+ * All calculation is delegated to SDK's port-offset.ts.
  */
-export declare function calculatePortOffset(projectPath: string): number;
+import { type SupabasePorts } from '@runa-ai/runa';
+export type { SupabasePorts };
 /**
  * Get Supabase ports for a project based on its path.
+ * Deterministic (hash-based), no runtime check.
  */
 export declare function getSupabasePorts(projectPath: string): SupabasePorts;
+/**
+ * Get available Supabase ports with runtime conflict detection.
+ *
+ * 1. Calculate hash-based ports (deterministic)
+ * 2. Check if ports are actually free (TCP bind test)
+ * 3. If occupied, try adjacent slots as fallback
+ *
+ * @returns Ports and metadata, or null if no slots available
+ */
+export declare function getAvailableSupabasePorts(projectPath: string): Promise<{
+    ports: SupabasePorts;
+    offset: number;
+    slot: number;
+    retried: boolean;
+} | null>;
 /**
  * Update supabase/config.toml with allocated ports.
+ * Uses runtime-safe port resolution (checks availability, falls back on conflict).
+ */
+export declare function updateSupabaseConfigPortsSafe(projectPath: string): Promise<{
+    updated: boolean;
+    ports: SupabasePorts;
+    configPath: string;
+    retried: boolean;
+}>;
+/**
+ * Update supabase/config.toml with allocated ports (deterministic, no runtime check).
  * Preserves other settings and comments.
  */
 export declare function updateSupabaseConfigPorts(projectPath: string): {

package/dist/utils/port-allocator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"port-allocator.d.ts","sourceRoot":"","sources":["../../src/utils/port-allocator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAUH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CAenE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAwCA;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAYpE"}
+{"version":3,"file":"port-allocator.d.ts","sourceRoot":"","sources":["../../src/utils/port-allocator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CAGnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5E,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,IAAI,CAAC,CAER;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAgBD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAUA;AAsCD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAYpE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.53",
+  "version": "0.5.58",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -26,7 +26,7 @@
     }
   },
   "dependencies": {
-    "@dotenvx/dotenvx": "1.51.4",
+    "@dotenvx/dotenvx": "1.52.0",
     "@types/node": "22.19.3",
     "boxen": "7.1.1",
     "chalk": "5.6.2",
@@ -46,15 +46,15 @@
     "ora": "8.2.0",
     "p-queue": "8.1.1",
     "postgres": "3.4.8",
-    "react": "19.2.3",
+    "react": "19.2.4",
     "systeminformation": "5.30.2",
     "ts-morph": "25.0.1",
     "tsup": "8.5.1",
     "typescript": "5.9.3",
-    "xstate": "5.25.0",
-    "zod": "4.3.5",
-    "@runa-ai/runa-xstate-test-plugin": "0.5.35",
-    "@runa-ai/runa": "0.5.44"
+    "xstate": "5.28.0",
+    "zod": "4.3.6",
+    "@runa-ai/runa": "0.5.58",
+    "@runa-ai/runa-xstate-test-plugin": "0.5.58"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -62,7 +62,7 @@
   "devDependencies": {
     "@types/js-yaml": "4.0.9",
     "@types/node-notifier": "8.0.5",
-    "@types/react": "19.2.7"
+    "@types/react": "19.2.14"
   },
   "scripts": {
     "build:esm": "tsup",