@runa-ai/runa-cli 0.5.71 → 0.6.0

package/dist/chunk-QDF7QXBL.js

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { CLIError } from '@runa-ai/runa';
+import { createActor } from 'xstate';
+
+createRequire(import.meta.url);
+
+// src/internal/machines/machine-runner.ts
+init_esm_shims();
+function getOutputOrThrow(snapshot) {
+  const s = snapshot;
+  if (s.output === void 0) {
+    throw new CLIError("Machine completed without output", "MACHINE_NO_OUTPUT", [
+      "Ensure the machine defines an `output:` function."
+    ]);
+  }
+  return s.output;
+}
+async function runMachine(params) {
+  const timeoutMs = params.timeoutMs ?? 10 * 60 * 1e3;
+  return new Promise((resolve, reject) => {
+    const actor = createActor(params.machine, { input: params.input });
+    const timer = setTimeout(() => {
+      try {
+        actor.stop?.();
+      } catch {
+      }
+      reject(
+        new CLIError("Machine execution timed out", "MACHINE_TIMEOUT", [
+          `Timeout: ${timeoutMs}ms`,
+          "Consider increasing timeoutMs for long-running operations."
+        ])
+      );
+    }, timeoutMs);
+    const sub = actor.subscribe((snapshot) => {
+      try {
+        params.onSnapshot?.(snapshot);
+        const stateName = params.helpers.getStateName(snapshot);
+        params.onTransition?.(stateName);
+        if (params.helpers.isComplete(snapshot)) {
+          clearTimeout(timer);
+          sub.unsubscribe();
+          const out = getOutputOrThrow(snapshot);
+          resolve(out);
+        }
+      } catch (err) {
+        clearTimeout(timer);
+        sub.unsubscribe();
+        reject(err);
+      }
+    });
+    try {
+      actor.start();
+      actor.send({ type: "START" });
+    } catch (err) {
+      clearTimeout(timer);
+      sub.unsubscribe();
+      reject(err);
+    }
+  });
+}
+
+// src/internal/machines/index.ts
+init_esm_shims();
+
+export { runMachine };

package/dist/chunk-RRGQCUKT.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION } from './chunk-JT5SUTWE.js';
+import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { z } from 'zod';
+
+createRequire(import.meta.url);
+
+// src/cli/contract-output.ts
+init_esm_shims();
+function getCommandPath(cmd) {
+  const parts = [];
+  let cur = cmd;
+  while (cur) {
+    const name = cur.name?.();
+    if (name && name !== "runa") {
+      parts.unshift(name);
+    }
+    cur = cur.parent ?? null;
+  }
+  return parts.length > 0 ? `runa ${parts.join(" ")}` : "runa";
+}
+function markJsonEmitted() {
+  process.env.RUNA_JSON_EMITTED = "true";
+}
+function emitDefaultSuccessIfNeeded(cmd) {
+  if (getOutputFormatFromEnv() !== "json") return;
+  if (process.env.RUNA_JSON_EMITTED === "true") return;
+  const payload = {
+    version: CLI_CONTRACT_VERSION,
+    ok: true,
+    command: getCommandPath(cmd),
+    data: {}
+  };
+  process.env.RUNA_JSON_EMITTING = "true";
+  try {
+    const schema = createSuccessEnvelopeSchema(z.object({}).strict());
+    const parsed = schema.parse(payload);
+    process.stdout.write(`${JSON.stringify(parsed)}
+`);
+  } finally {
+    process.env.RUNA_JSON_EMITTING = "false";
+  }
+  markJsonEmitted();
+}
+
+export { emitDefaultSuccessIfNeeded, markJsonEmitted };

package/dist/chunk-RZLYEO4U.js

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { lstatSync, realpathSync, statSync, accessSync, constants } from 'fs';
+import { dirname, isAbsolute, normalize, join } from 'path';
+import { execa } from 'execa';
+
+createRequire(import.meta.url);
+
+// src/utils/secure-exec.ts
+init_esm_shims();
+var TRUSTED_BINARIES = [
+  "node",
+  "pnpm",
+  "npm",
+  "npx",
+  "git",
+  "gh",
+  "vercel",
+  "supabase",
+  "docker",
+  "psql",
+  "turbo",
+  "biome",
+  "lsof",
+  "runa"
+];
+var TRUSTED_DIRECTORIES_UNIX = [
+  "/usr/bin",
+  "/usr/local/bin",
+  "/bin",
+  "/usr/sbin",
+  "/sbin",
+  // Homebrew on macOS
+  "/opt/homebrew/bin",
+  "/opt/homebrew/sbin",
+  // Node.js version managers and corepack symlink targets
+  "/usr/local/lib/node_modules/.bin",
+  "/usr/local/lib/node_modules",
+  // Common package manager locations
+  "/usr/local/share/npm/bin"
+];
+var TRUSTED_DIRECTORY_PATTERNS_WINDOWS = [
+  /^[A-Z]:\\Windows\\System32\\?$/i,
+  /^[A-Z]:\\Windows\\?$/i,
+  /^[A-Z]:\\Program Files\\.*\\bin\\?$/i,
+  /^[A-Z]:\\Program Files \(x86\)\\.*\\bin\\?$/i,
+  // Node.js and npm
+  /^[A-Z]:\\Program Files\\nodejs\\?$/i,
+  /^[A-Z]:\\Users\\[^\\]+\\AppData\\Roaming\\npm\\?$/i
+];
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var binaryPathCache = /* @__PURE__ */ new Map();
+function getPathFingerprint() {
+  const pathEnv = process.env.PATH || "";
+  return `${pathEnv.length}:${pathEnv.slice(0, 100)}:${pathEnv.slice(-100)}`;
+}
+function isExecutable(filePath) {
+  try {
+    accessSync(filePath, constants.X_OK);
+    const stats = statSync(filePath);
+    return stats.isFile();
+  } catch {
+    return false;
+  }
+}
+function resolveAndValidateSymlink(filePath) {
+  try {
+    const lstats = lstatSync(filePath);
+    if (lstats.isSymbolicLink()) {
+      const realPath = realpathSync(filePath);
+      const realDir = dirname(realPath);
+      if (!isTrustedDirectory(realDir)) {
+        return null;
+      }
+      const realStats = statSync(realPath);
+      if (!realStats.isFile()) {
+        return null;
+      }
+      return realPath;
+    }
+    return filePath;
+  } catch {
+    return null;
+  }
+}
+var TRUSTED_VERSION_MANAGER_PATTERNS_UNIX = [
+  // Homebrew Cellar (macOS)
+  /^\/opt\/homebrew\/Cellar\/[^/]+\/[^/]+\/bin$/,
+  // nvm
+  /^\/Users\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/,
+  // fnm
+  /^\/Users\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/,
+  /^\/home\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/,
+  // pnpm global
+  /^\/Users\/[^/]+\/Library\/pnpm$/,
+  /^\/home\/[^/]+\/\.local\/share\/pnpm$/,
+  // mise
+  /^\/Users\/[^/]+\/\.local\/share\/mise\/installs\/[^/]+\/[^/]+\/bin$/,
+  /^\/Users\/[^/]+\/\.local\/share\/mise\/shims$/,
+  /^\/home\/[^/]+\/\.local\/share\/mise\/installs\/[^/]+\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.local\/share\/mise\/shims$/,
+  // volta
+  /^\/Users\/[^/]+\/\.volta\/bin$/,
+  /^\/home\/[^/]+\/\.volta\/bin$/,
+  // asdf
+  /^\/Users\/[^/]+\/\.asdf\/shims$/,
+  /^\/Users\/[^/]+\/\.asdf\/installs\/[^/]+\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.asdf\/shims$/,
+  /^\/home\/[^/]+\/\.asdf\/installs\/[^/]+\/[^/]+\/bin$/,
+  // proto
+  /^\/Users\/[^/]+\/\.proto\/shims$/,
+  /^\/Users\/[^/]+\/\.proto\/tools\/[^/]+\/[^/]+\/bin$/,
+  /^\/home\/[^/]+\/\.proto\/shims$/,
+  /^\/home\/[^/]+\/\.proto\/tools\/[^/]+\/[^/]+\/bin$/
+];
+function isTrustedDirectory(dir) {
+  const normalizedDir = normalize(dir).replace(/[/\\]$/, "");
+  if (process.platform === "win32") {
+    return TRUSTED_DIRECTORY_PATTERNS_WINDOWS.some((pattern) => pattern.test(normalizedDir));
+  }
+  for (const trusted of TRUSTED_DIRECTORIES_UNIX) {
+    const normalizedTrusted = normalize(trusted).replace(/[/\\]$/, "");
+    if (normalizedDir === normalizedTrusted || normalizedDir.startsWith(`${normalizedTrusted}/`)) {
+      return true;
+    }
+  }
+  return TRUSTED_VERSION_MANAGER_PATTERNS_UNIX.some((pattern) => pattern.test(normalizedDir));
+}
+function searchPathForBinary(binaryName) {
+  const pathEnv = process.env.PATH ?? "";
+  const pathDirs = pathEnv.split(process.platform === "win32" ? ";" : ":");
+  const extensions = process.platform === "win32" ? ["", ".exe", ".cmd", ".bat"] : [""];
+  for (const dir of pathDirs) {
+    if (!dir || !isAbsolute(dir) || !isTrustedDirectory(dir)) continue;
+    const matchedBinary = findValidatedBinaryInDirectory(dir, binaryName, extensions);
+    if (matchedBinary) {
+      return matchedBinary;
+    }
+  }
+  return null;
+}
+function findValidatedBinaryInDirectory(dir, binaryName, extensions) {
+  for (const ext of extensions) {
+    const fullPath = join(dir, binaryName + ext);
+    if (!isExecutable(fullPath)) {
+      continue;
+    }
+    const validatedPath = resolveAndValidateSymlink(fullPath);
+    if (validatedPath) {
+      return { originalPath: fullPath, validatedPath };
+    }
+  }
+  return null;
+}
+function resolveBinaryPath(binaryName) {
+  if (!TRUSTED_BINARIES.includes(binaryName)) {
+    throw new Error(
+      `Security: Binary '${binaryName}' is not in the trusted binaries list. Allowed: ${TRUSTED_BINARIES.join(", ")}`
+    );
+  }
+  const now = Date.now();
+  const currentPathFingerprint = getPathFingerprint();
+  const cached = binaryPathCache.get(binaryName);
+  if (cached) {
+    const isExpired = now - cached.resolvedAt >= CACHE_TTL_MS;
+    const pathChanged = cached.pathFingerprint !== currentPathFingerprint;
+    if (!isExpired && !pathChanged) {
+      const validatedPath2 = resolveAndValidateSymlink(cached.path);
+      if (validatedPath2 && isExecutable(validatedPath2)) {
+        return validatedPath2;
+      }
+      binaryPathCache.delete(binaryName);
+    } else {
+      binaryPathCache.delete(binaryName);
+    }
+  }
+  const result = searchPathForBinary(binaryName);
+  if (!result) {
+    throw new Error(
+      `Binary '${binaryName}' not found in trusted PATH directories. Ensure ${binaryName} is installed in a system directory.`
+    );
+  }
+  const { validatedPath } = result;
+  if (!isExecutable(validatedPath)) {
+    throw new Error(`Binary '${binaryName}' at '${validatedPath}' is not executable.`);
+  }
+  binaryPathCache.set(binaryName, {
+    path: validatedPath,
+    resolvedAt: now,
+    pathFingerprint: currentPathFingerprint
+  });
+  return validatedPath;
+}
+function secureExeca(binaryName, args = [], options) {
+  const resolvedPath = resolveBinaryPath(binaryName);
+  const finalPath = resolveAndValidateSymlink(resolvedPath);
+  if (!finalPath || !isExecutable(finalPath)) {
+    throw new Error(
+      `Security: Binary '${binaryName}' validation failed just before execution. The file may have been modified.`
+    );
+  }
+  return execa(finalPath, args, { ...options, shell: false });
+}
+function securePnpm(args = [], options) {
+  return secureExeca("pnpm", args, options);
+}
+function secureGh(args = [], options) {
+  return secureExeca("gh", args, options);
+}
+function secureSupabase(args = [], options) {
+  return secureExeca("supabase", args, options);
+}
+function secureDocker(args = [], options) {
+  return secureExeca("docker", args, options);
+}
+
+export { secureDocker, secureExeca, secureGh, securePnpm, secureSupabase };

package/dist/chunk-TYIAD6SB.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);
+
+// src/cli/signal-handler.ts
+init_esm_shims();
+var state = {
+  cleanupFns: [],
+  sigintCount: 0,
+  isShuttingDown: false
+};
+function registerCleanup(fn) {
+  state.cleanupFns.push(fn);
+}
+function unregisterCleanup(fn) {
+  const index = state.cleanupFns.indexOf(fn);
+  if (index !== -1) {
+    state.cleanupFns.splice(index, 1);
+  }
+}
+async function runCleanup() {
+  for (const fn of state.cleanupFns) {
+    try {
+      await fn();
+    } catch (error) {
+      logSignal(
+        "debug",
+        `Cleanup error: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  state.cleanupFns = [];
+}
+function shouldLogDebug() {
+  return process.env.DEBUG === "true" || process.env.LOG_LEVEL === "debug";
+}
+function logSignal(level, message) {
+  if (process.env.RUNA_OUTPUT_FORMAT === "json") return;
+  if (level === "debug" && !shouldLogDebug()) return;
+  const stream = level === "warn" ? process.stderr : process.stdout;
+  const label = level.toUpperCase();
+  stream.write(`[${label}] [signal] ${message}
+`);
+}
+async function handleShutdown(signal, exitCode) {
+  if (state.isShuttingDown) {
+    logSignal("warn", "Force exit");
+    process.exit(exitCode);
+  }
+  state.isShuttingDown = true;
+  logSignal("info", `Received ${signal}, shutting down...`);
+  await runCleanup();
+  process.exit(exitCode);
+}
+function setupSignalHandlers() {
+  process.on("SIGINT", async () => {
+    state.sigintCount++;
+    if (state.sigintCount >= 2) {
+      logSignal("warn", "Force exit (double Ctrl+C)");
+      process.exit(130);
+    }
+    await handleShutdown("SIGINT", 130);
+  });
+  process.on("SIGTERM", async () => {
+    await handleShutdown("SIGTERM", 143);
+  });
+}
+function isShuttingDown() {
+  return state.isShuttingDown;
+}
+
+export { isShuttingDown, registerCleanup, setupSignalHandlers, unregisterCleanup };

package/dist/chunk-UU55OH7P.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { markJsonEmitted } from './chunk-RRGQCUKT.js';
+import { createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION } from './chunk-JT5SUTWE.js';
+import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);
+
+// src/cli/json-output.ts
+init_esm_shims();
+function getCommandPath(cmd) {
+  const parts = [];
+  let cur = cmd;
+  while (cur) {
+    const name = cur.name?.();
+    if (name && name !== "runa") parts.unshift(name);
+    cur = cur.parent ?? null;
+  }
+  return parts.length > 0 ? `runa ${parts.join(" ")}` : "runa";
+}
+function emitJsonSuccess(cmd, dataSchema, data) {
+  if (getOutputFormatFromEnv() !== "json") return;
+  const payload = {
+    version: CLI_CONTRACT_VERSION,
+    ok: true,
+    command: getCommandPath(cmd),
+    data
+  };
+  const schema = createSuccessEnvelopeSchema(dataSchema);
+  const parsed = schema.parse(payload);
+  process.env.RUNA_JSON_EMITTING = "true";
+  try {
+    process.stdout.write(`${JSON.stringify(parsed)}
+`);
+  } finally {
+    process.env.RUNA_JSON_EMITTING = "false";
+  }
+  markJsonEmitted();
+}
+
+export { emitJsonSuccess };

package/dist/chunk-UWWSAPDR.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);
+
+// src/cli/requested-command.ts
+init_esm_shims();
+function getRequestedCommandNameFromArgv(argv) {
+  let skipNextToken = false;
+  for (const token of argv) {
+    if (skipNextToken) {
+      skipNextToken = false;
+      continue;
+    }
+    if (token === "--") break;
+    if (token === "--format") {
+      skipNextToken = true;
+      continue;
+    }
+    if (token.startsWith("--format=")) {
+      continue;
+    }
+    if (!token.startsWith("-")) {
+      return token;
+    }
+  }
+  return null;
+}
+
+export { getRequestedCommandNameFromArgv };