@runa-ai/runa-cli 0.5.71 → 0.6.0

package/dist/chunk-XJBQINSA.js

@@ -0,0 +1,351 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { secureGh, securePnpm } from './chunk-RZLYEO4U.js';
+import { isPathContained } from './chunk-DRSUEMAK.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import fs from 'fs';
+import { rm, mkdir, writeFile, cp, readdir, lstat } from 'fs/promises';
+import os from 'os';
+import path from 'path';
+import { CLIError } from '@runa-ai/runa';
+
+createRequire(import.meta.url);
+
+// src/utils/template-fetcher.ts
+init_esm_shims();
+
+// src/constants/versions.ts
+init_esm_shims();
+var COMPATIBLE_TEMPLATES_VERSION = "0.5.71";
+var TEMPLATES_PACKAGE_NAME = "@r06-dev/runa-templates";
+var GITHUB_PACKAGES_REGISTRY = "https://npm.pkg.github.com";
+
+// src/utils/template-fetcher.ts
+var SAFE_VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/;
+function validateVersion(version) {
+  if (!version || version.trim() === "") {
+    throw new CLIError("Invalid version: version cannot be empty.", "INVALID_VERSION", [
+      "Provide a valid semantic version (e.g., 0.1.0)"
+    ]);
+  }
+  if (version.includes("..") || version.includes("/") || version.includes("\\")) {
+    throw new CLIError(
+      "Invalid version: path traversal sequences detected.",
+      "INVALID_VERSION_PATH_TRAVERSAL",
+      [
+        'Version cannot contain "..", "/", or "\\"',
+        "Provide a valid semantic version (e.g., 0.1.0)"
+      ]
+    );
+  }
+  if (!SAFE_VERSION_PATTERN.test(version)) {
+    throw new CLIError(
+      "Invalid version: contains prohibited characters.",
+      "INVALID_VERSION_CHARS",
+      [
+        'Version can only contain: a-z, A-Z, 0-9, ".", "-", "_"',
+        "Provide a valid semantic version (e.g., 0.1.0)"
+      ]
+    );
+  }
+}
+function getCacheBase() {
+  return path.join(os.homedir(), ".cache", "runa", "templates");
+}
+function getCacheDir(version) {
+  validateVersion(version);
+  const cacheBase = getCacheBase();
+  const cacheDir = path.join(cacheBase, version);
+  const resolvedCacheDir = path.resolve(cacheDir);
+  if (!isPathContained(cacheBase, resolvedCacheDir)) {
+    throw new CLIError(
+      "Security: cache directory would escape allowed location.",
+      "CACHE_PATH_ESCAPE",
+      ["This is likely a bug. Please report this issue."]
+    );
+  }
+  return resolvedCacheDir;
+}
+function isCached(version) {
+  const cacheDir = getCacheDir(version);
+  const templatesDir = path.join(cacheDir, "templates");
+  return fs.existsSync(templatesDir);
+}
+var scopedAuthToken = null;
+var tokenWasAutoDetected = false;
+async function getAuthToken() {
+  if (process.env.NODE_AUTH_TOKEN) {
+    return process.env.NODE_AUTH_TOKEN;
+  }
+  if (scopedAuthToken) {
+    return scopedAuthToken;
+  }
+  try {
+    const result = await secureGh(["auth", "token"], {
+      reject: false,
+      timeout: 5e3
+    });
+    const stdout = typeof result.stdout === "string" ? result.stdout : "";
+    if (result.exitCode === 0 && stdout.trim()) {
+      scopedAuthToken = stdout.trim();
+      tokenWasAutoDetected = true;
+      return scopedAuthToken;
+    }
+  } catch {
+  }
+  throw new CLIError("GitHub authentication required for template fetch.", "GITHUB_AUTH_REQUIRED", [
+    "Option 1: Use GitHub CLI (recommended)",
+    "  gh auth login",
+    "  # Token will be auto-detected on next run",
+    "",
+    "Option 2: Set NODE_AUTH_TOKEN manually",
+    "  export NODE_AUTH_TOKEN=$(gh auth token)",
+    "",
+    "Option 3: Create Personal Access Token",
+    "  https://github.com/settings/tokens (packages:read scope)"
+  ]);
+}
+function cleanupAuthToken() {
+  if (tokenWasAutoDetected) {
+    scopedAuthToken = null;
+    tokenWasAutoDetected = false;
+  }
+}
+async function createTempPackageJson(tempDir, version) {
+  const packageJson = {
+    name: "runa-templates-installer",
+    private: true,
+    dependencies: {
+      [TEMPLATES_PACKAGE_NAME]: version
+    }
+  };
+  await writeFile(path.join(tempDir, "package.json"), JSON.stringify(packageJson, null, 2));
+}
+async function createTempNpmrc(tempDir) {
+  const npmrc = `@r06-dev:registry=${GITHUB_PACKAGES_REGISTRY}
+//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}
+`;
+  await writeFile(path.join(tempDir, ".npmrc"), npmrc);
+}
+async function installTemplates(tempDir, authToken, verbose) {
+  try {
+    const childEnv = {
+      ...process.env,
+      // SECURITY: Pass token only to this specific child process
+      NODE_AUTH_TOKEN: authToken
+    };
+    await securePnpm(["install", "--no-frozen-lockfile"], {
+      cwd: tempDir,
+      stdio: verbose ? "inherit" : "pipe",
+      env: childEnv
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("401") || message.includes("403")) {
+      throw new CLIError("GitHub Packages authentication failed.", "GITHUB_AUTH_FAILED", [
+        "Ensure your GitHub authentication is valid:",
+        "  gh auth status",
+        "",
+        "Re-authenticate if needed:",
+        "  gh auth login",
+        "",
+        "Or generate a new token with `packages:read` scope:",
+        "  https://github.com/settings/tokens"
+      ]);
+    }
+    if (message.includes("404")) {
+      throw new CLIError("Templates package not found.", "TEMPLATES_NOT_FOUND", [
+        `Package: ${TEMPLATES_PACKAGE_NAME}@${COMPATIBLE_TEMPLATES_VERSION}`,
+        "",
+        "Possible causes:",
+        "  1. This version is not published yet",
+        "  2. The package registry is unavailable",
+        "",
+        "Workarounds:",
+        "  - Try a specific version: runa init --templates-version 0.5.30",
+        "  - Check available versions: npm view @r06-dev/runa-templates versions"
+      ]);
+    }
+    const errorDetail = message.length > 200 ? `${message.slice(0, 200)}...` : message;
+    throw new CLIError("Failed to install templates.", "TEMPLATES_INSTALL_FAILED", [
+      `Error: ${errorDetail}`,
+      "",
+      "Troubleshooting:",
+      "  1. Check your network connection",
+      "  2. Verify GitHub authentication: gh auth status",
+      "  3. Run with DEBUG=true for verbose output",
+      "  4. Clear cache and retry: runa init --fresh",
+      "",
+      `Requested version: ${COMPATIBLE_TEMPLATES_VERSION}`
+    ]);
+  }
+}
+async function verifyNoSymlinks(dir, baseDir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    const stats = await lstat(fullPath);
+    if (stats.isSymbolicLink()) {
+      const relativePath = path.relative(baseDir, fullPath);
+      throw new CLIError(
+        "Security: Symlink detected in template package.",
+        "SYMLINK_ATTACK_DETECTED",
+        [
+          `Symlink found: ${relativePath}`,
+          "This could be an attempt to access files outside the template directory.",
+          "The template package may be malicious or corrupted.",
+          "Please report this issue if you believe this is a false positive."
+        ]
+      );
+    }
+    if (stats.isDirectory()) {
+      await verifyNoSymlinks(fullPath, baseDir);
+    }
+  }
+}
+async function copyToCache(tempDir, cacheDir) {
+  const sourceTemplates = path.join(tempDir, "node_modules", TEMPLATES_PACKAGE_NAME, "templates");
+  if (!fs.existsSync(sourceTemplates)) {
+    throw new CLIError("Templates directory not found in package.", "TEMPLATES_DIR_NOT_FOUND", [
+      `Expected: ${sourceTemplates}`,
+      "The templates package may be corrupted.",
+      "Try running with --fresh to re-download."
+    ]);
+  }
+  await verifyNoSymlinks(sourceTemplates, sourceTemplates);
+  await mkdir(cacheDir, { recursive: true });
+  const targetTemplates = path.join(cacheDir, "templates");
+  await cp(sourceTemplates, targetTemplates, {
+    recursive: true,
+    dereference: false
+  });
+}
+function logVerboseMessage(verbose, message) {
+  if (verbose) {
+    console.log(message);
+  }
+}
+function getWorkspaceTemplatesResult(workspaceTemplatesDir, verbose) {
+  if (!workspaceTemplatesDir) return null;
+  logVerboseMessage(verbose, `Using workspace templates: ${workspaceTemplatesDir}`);
+  return {
+    templatesDir: workspaceTemplatesDir,
+    version: "workspace",
+    cached: true
+  };
+}
+function getCachedTemplatesResult(version, fresh, templatesDir, verbose) {
+  if (fresh || !isCached(version)) {
+    return null;
+  }
+  logVerboseMessage(verbose, `Using cached templates v${version}: ${templatesDir}`);
+  return {
+    templatesDir,
+    version,
+    cached: true
+  };
+}
+async function fetchAndCacheTemplates(options) {
+  const { authToken, cacheDir, fresh, templatesDir, version, verbose } = options;
+  if (fresh && fs.existsSync(cacheDir)) {
+    await rm(cacheDir, { recursive: true, force: true });
+  }
+  const tempDir = path.join(os.tmpdir(), `runa-templates-${Date.now()}`);
+  await mkdir(tempDir, { recursive: true });
+  try {
+    logVerboseMessage(verbose, `Fetching templates v${version}...`);
+    await createTempPackageJson(tempDir, version);
+    await createTempNpmrc(tempDir);
+    await installTemplates(tempDir, authToken, verbose);
+    await copyToCache(tempDir, cacheDir);
+    logVerboseMessage(verbose, `Templates cached at: ${templatesDir}`);
+    return {
+      templatesDir,
+      version,
+      cached: false
+    };
+  } finally {
+    await rm(tempDir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function fetchTemplates(options = {}) {
+  const version = options.version ?? COMPATIBLE_TEMPLATES_VERSION;
+  const fresh = options.fresh ?? false;
+  const verbose = options.verbose ?? false;
+  const workspaceResult = getWorkspaceTemplatesResult(resolveWorkspaceTemplates(), verbose);
+  if (workspaceResult) {
+    return workspaceResult;
+  }
+  const cacheDir = getCacheDir(version);
+  const templatesDir = path.join(cacheDir, "templates");
+  const cachedResult = getCachedTemplatesResult(version, fresh, templatesDir, verbose);
+  if (cachedResult) {
+    return cachedResult;
+  }
+  const authToken = await getAuthToken();
+  try {
+    return fetchAndCacheTemplates({ authToken, cacheDir, fresh, templatesDir, version, verbose });
+  } finally {
+    cleanupAuthToken();
+  }
+}
+var MAX_WORKSPACE_TRAVERSAL_DEPTH = 10;
+function isLegitimateWorkspaceRoot(workspaceRoot) {
+  const pnpmWorkspaceFile = path.join(workspaceRoot, "pnpm-workspace.yaml");
+  if (!fs.existsSync(pnpmWorkspaceFile)) {
+    return false;
+  }
+  const rootPackageFile = path.join(workspaceRoot, "package.json");
+  if (!fs.existsSync(rootPackageFile)) {
+    return false;
+  }
+  try {
+    const rootPkg = JSON.parse(fs.readFileSync(rootPackageFile, "utf-8"));
+    const hasWorkspaces = Array.isArray(rootPkg.workspaces) && rootPkg.workspaces.length > 0;
+    const hasExpectedName = rootPkg.name === "runa" || rootPkg.name === "@r06-dev/runa";
+    return hasWorkspaces || hasExpectedName;
+  } catch {
+    return false;
+  }
+}
+function hasValidTemplatesPackageMarker(workspaceRoot) {
+  const markerFile = path.join(workspaceRoot, "packages", "runa-templates", "package.json");
+  if (!fs.existsSync(markerFile)) {
+    return false;
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(markerFile, "utf-8"));
+    return pkg.name === "@r06-dev/runa-templates";
+  } catch {
+    return false;
+  }
+}
+function resolveWorkspaceTemplatesFromRoot(workspaceRoot) {
+  if (!isLegitimateWorkspaceRoot(workspaceRoot)) {
+    return void 0;
+  }
+  const templatesPath = path.join(workspaceRoot, "packages", "runa-templates", "templates");
+  const normalizedTemplatesPath = path.resolve(templatesPath);
+  if (!isPathContained(workspaceRoot, normalizedTemplatesPath)) {
+    return void 0;
+  }
+  if (!fs.existsSync(normalizedTemplatesPath)) {
+    return void 0;
+  }
+  return hasValidTemplatesPackageMarker(workspaceRoot) ? normalizedTemplatesPath : void 0;
+}
+function resolveWorkspaceTemplates() {
+  let current = path.resolve(process.cwd());
+  const root = path.parse(current).root;
+  for (let depth = 0; current !== root && depth < MAX_WORKSPACE_TRAVERSAL_DEPTH; depth += 1) {
+    const resolved = resolveWorkspaceTemplatesFromRoot(current);
+    if (resolved) {
+      return resolved;
+    }
+    current = path.dirname(current);
+  }
+  return void 0;
+}
+
+export { fetchTemplates };

package/dist/chunk-ZZOXM6Q4.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);
+
+// src/errors/index.ts
+init_esm_shims();