@runa-ai/runa-cli 0.5.72 → 0.7.0

package/dist/chunk-II7VYQEM.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);
+
+// src/commands/ci/utils/env-security.ts
+init_esm_shims();
+var SENSITIVE_ENV_PATTERNS = [
+  // Database credentials
+  /^DATABASE_URL$/i,
+  /^DRIZZLE_.*URL$/i,
+  /^.*_DATABASE_URL$/i,
+  /^PGPASSWORD$/i,
+  // Supabase
+  /^SUPABASE_.*KEY$/i,
+  /^SUPABASE_.*TOKEN$/i,
+  /^SUPABASE_.*SECRET$/i,
+  /^SUPABASE_ACCESS_TOKEN$/i,
+  // GitHub
+  /^GITHUB_TOKEN$/i,
+  /^GH_TOKEN$/i,
+  /^GITHUB_PAT$/i,
+  // Generic secrets
+  /^.*_SECRET$/i,
+  /^.*_PASSWORD$/i,
+  /^.*_TOKEN$/i,
+  /^.*_API_KEY$/i,
+  /^.*_PRIVATE_KEY$/i,
+  /^.*_CREDENTIALS$/i,
+  // Encryption keys
+  /^DOTENV_PRIVATE_KEY.*$/i,
+  /^ENCRYPTION_KEY$/i,
+  // Cloud providers
+  /^AWS_SECRET_ACCESS_KEY$/i,
+  /^AZURE_.*_KEY$/i,
+  /^GCP_.*_KEY$/i,
+  // CI-specific secrets
+  /^RUNA_APP_API_TOKEN$/i,
+  /^VERCEL_TOKEN$/i
+];
+var SAFE_ENV_PASSTHROUGH = [
+  // Standard shell environment
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  // Node.js
+  "NODE_ENV",
+  "NODE_PATH",
+  "NODE_OPTIONS",
+  "npm_config_registry",
+  // CI environment (non-sensitive)
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITHUB_WORKFLOW",
+  "GITHUB_RUN_ID",
+  "GITHUB_RUN_NUMBER",
+  "GITHUB_JOB",
+  "GITHUB_ACTION",
+  "GITHUB_EVENT_NAME",
+  "GITHUB_EVENT_PATH",
+  "GITHUB_WORKSPACE",
+  "GITHUB_SHA",
+  "GITHUB_REF",
+  "GITHUB_REF_NAME",
+  "GITHUB_HEAD_REF",
+  "GITHUB_BASE_REF",
+  "GITHUB_ACTOR",
+  "GITHUB_REPOSITORY",
+  "GITHUB_REPOSITORY_OWNER",
+  "GITHUB_OUTPUT",
+  "GITHUB_STEP_SUMMARY",
+  "GITHUB_ENV",
+  "RUNNER_OS",
+  "RUNNER_ARCH",
+  "RUNNER_NAME",
+  "RUNNER_TOOL_CACHE",
+  "RUNNER_TEMP",
+  // Vercel (non-sensitive)
+  "VERCEL",
+  "VERCEL_ENV",
+  "VERCEL_URL",
+  "VERCEL_GIT_COMMIT_SHA",
+  "VERCEL_GIT_COMMIT_REF",
+  // Supabase (non-sensitive)
+  "NEXT_PUBLIC_SUPABASE_URL",
+  // runa debug/config (non-sensitive)
+  "RUNA_DEBUG",
+  "RUNA_SKIP_SCHEMA_RISK",
+  // dotenvx (non-sensitive)
+  "DOTENVX_QUIET"
+];
+function isSensitiveEnvVar(name) {
+  return SENSITIVE_ENV_PATTERNS.some((pattern) => pattern.test(name));
+}
+function getSafeEnv(additionalSafe = [], requiredSecrets = []) {
+  const result = {};
+  const allowedNames = /* @__PURE__ */ new Set([...SAFE_ENV_PASSTHROUGH, ...additionalSafe]);
+  for (const name of allowedNames) {
+    if (process.env[name] !== void 0) {
+      result[name] = process.env[name];
+    }
+  }
+  for (const name of requiredSecrets) {
+    if (process.env[name] !== void 0) {
+      result[name] = process.env[name];
+    }
+  }
+  return result;
+}
+function getFilteredEnv() {
+  const result = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (!isSensitiveEnvVar(name)) {
+      result[name] = value;
+    }
+  }
+  return result;
+}
+var SECRET_VALUE_PATTERNS = [
+  // PostgreSQL URLs with passwords
+  {
+    pattern: /postgresql:\/\/([^/:@]+):([^@]+)@/gi,
+    replacement: "postgresql://$1:***@"
+  },
+  {
+    pattern: /postgres:\/\/([^/:@]+):([^@]+)@/gi,
+    replacement: "postgres://$1:***@"
+  },
+  // Generic URL with credentials
+  {
+    pattern: /https?:\/\/([^/:@]+):([^@]+)@/gi,
+    replacement: "https://$1:***@"
+  },
+  // Supabase keys (long base64-like strings)
+  {
+    pattern: /eyJ[A-Za-z0-9_-]{100,}/g,
+    replacement: "[SUPABASE_KEY_REDACTED]"
+  },
+  // GitHub tokens
+  {
+    pattern: /gh[ps]_[A-Za-z0-9_]{36,}/g,
+    replacement: "[GITHUB_TOKEN_REDACTED]"
+  },
+  {
+    pattern: /github_pat_[A-Za-z0-9_]{36,}/g,
+    replacement: "[GITHUB_PAT_REDACTED]"
+  },
+  // Generic API keys (32+ char alphanumeric)
+  {
+    pattern: /[A-Za-z0-9_-]{40,}/g,
+    replacement: (match) => {
+      if (/[a-z]/.test(match) && /[A-Z0-9_]/.test(match)) {
+        return `[KEY_REDACTED:${match.length}chars]`;
+      }
+      return match;
+    }
+  }
+];
+function redactSecrets(input) {
+  let result = input;
+  for (const { pattern, replacement } of SECRET_VALUE_PATTERNS) {
+    if (typeof replacement === "function") {
+      result = result.replace(pattern, replacement);
+    } else {
+      result = result.replace(pattern, replacement);
+    }
+  }
+  return result;
+}
+
+export { getFilteredEnv, getSafeEnv, redactSecrets };

package/dist/chunk-JMJP4A47.js

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { existsSync, readFileSync, realpathSync } from 'fs';
+import { join, isAbsolute, normalize, resolve, relative } from 'path';
+import { findWorkspaceRoot as findWorkspaceRoot$1 } from '@runa-ai/runa';
+
+createRequire(import.meta.url);
+
+// src/utils/workspace-detector.ts
+init_esm_shims();
+function isValidPackageName(packageName) {
+  if (!packageName || !packageName.trim()) {
+    return false;
+  }
+  if (packageName.includes("\0")) {
+    return false;
+  }
+  if (packageName.includes("..") || packageName.includes("./")) {
+    return false;
+  }
+  if (packageName.includes("\\")) {
+    return false;
+  }
+  if (isAbsolute(packageName)) {
+    return false;
+  }
+  const validPackageNameRegex = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
+  return validPackageNameRegex.test(packageName);
+}
+function isWithinBoundary(resolvedPath, boundaryPath) {
+  try {
+    const normalizedResolved = normalize(resolve(resolvedPath));
+    const normalizedBoundary = normalize(resolve(boundaryPath));
+    let realResolved;
+    let realBoundary;
+    try {
+      realResolved = existsSync(resolvedPath) ? realpathSync(resolvedPath) : normalizedResolved;
+      realBoundary = existsSync(boundaryPath) ? realpathSync(boundaryPath) : normalizedBoundary;
+    } catch {
+      realResolved = normalizedResolved;
+      realBoundary = normalizedBoundary;
+    }
+    const relativePath = relative(realBoundary, realResolved);
+    if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isValidWorkspacePattern(pattern) {
+  if (pattern.includes("..")) {
+    return false;
+  }
+  if (isAbsolute(pattern)) {
+    return false;
+  }
+  if (pattern.includes("\0")) {
+    return false;
+  }
+  return true;
+}
+function findWorkspaceRoot(from = process.cwd()) {
+  return findWorkspaceRoot$1(from, { stopAtGitRoot: true });
+}
+function isValidPackage(dir) {
+  return existsSync(dir) && existsSync(join(dir, "package.json"));
+}
+function searchConventionalLocations(workspaceRoot, packageName) {
+  const conventionalLocations = [
+    join(workspaceRoot, "packages", packageName),
+    join(workspaceRoot, "apps", packageName),
+    join(workspaceRoot, packageName)
+  ];
+  for (const location of conventionalLocations) {
+    if (!isWithinBoundary(location, workspaceRoot)) {
+      continue;
+    }
+    if (isValidPackage(location)) {
+      return location;
+    }
+  }
+  return null;
+}
+function parseWorkspacePatterns(yamlContent) {
+  const packagesMatch = yamlContent.match(/packages:\s*\n((?:\s+-\s+.+\n?)+)/);
+  if (!packagesMatch) {
+    return [];
+  }
+  return packagesMatch[1].split("\n").map((line) => line.trim().replace(/^-\s+/, "").replace(/["']/g, "")).filter(Boolean);
+}
+function searchWorkspaceYaml(workspaceRoot, packageName) {
+  const workspaceYamlPath = join(workspaceRoot, "pnpm-workspace.yaml");
+  if (!existsSync(workspaceYamlPath)) {
+    return null;
+  }
+  try {
+    const yaml = readFileSync(workspaceYamlPath, "utf-8");
+    const patterns = parseWorkspacePatterns(yaml);
+    for (const pattern of patterns) {
+      if (!isValidWorkspacePattern(pattern)) {
+        continue;
+      }
+      const dir = pattern.replace(/\/\*+$/, "");
+      const candidate = join(workspaceRoot, dir, packageName);
+      if (!isWithinBoundary(candidate, workspaceRoot)) {
+        continue;
+      }
+      if (isValidPackage(candidate)) {
+        return candidate;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function searchInWorkspace(workspaceRoot, packageName) {
+  return searchConventionalLocations(workspaceRoot, packageName) || searchWorkspaceYaml(workspaceRoot, packageName);
+}
+function searchInNodeModules(from, packageName) {
+  const nodeModulesRoot = join(from, "node_modules");
+  const packageMappings = {
+    sdk: ["@runa-ai/runa", "@runa-ai/runa"],
+    cli: ["@runa-ai/runa-cli", "@runa-ai/runa-cli"]
+  };
+  const mappedNames = packageMappings[packageName];
+  if (mappedNames) {
+    for (const pkgName of mappedNames) {
+      const pkgPath = join(from, "node_modules", ...pkgName.split("/"));
+      if (!isWithinBoundary(pkgPath, nodeModulesRoot)) {
+        continue;
+      }
+      if (isValidPackage(pkgPath)) {
+        return pkgPath;
+      }
+    }
+  }
+  const scopes = ["@runa-ai", "@runa"];
+  for (const scope of scopes) {
+    const nodeModulesPath = join(from, "node_modules", scope, packageName);
+    if (!isWithinBoundary(nodeModulesPath, nodeModulesRoot)) {
+      continue;
+    }
+    if (isValidPackage(nodeModulesPath)) {
+      return nodeModulesPath;
+    }
+  }
+  return null;
+}
+function checkCurrentDirectory(from, packageName) {
+  const currentPackageJson = join(from, "package.json");
+  if (!existsSync(currentPackageJson)) {
+    return null;
+  }
+  try {
+    const packageJson = JSON.parse(readFileSync(currentPackageJson, "utf-8"));
+    const name = packageJson.name;
+    if (!name) return null;
+    const validNames = [
+      packageName,
+      `@runa-ai/runa-${packageName}`,
+      // Special mappings
+      ...packageName === "sdk" ? ["@runa-ai/runa"] : [],
+      ...packageName === "cli" ? ["@runa-ai/runa-cli"] : []
+    ];
+    if (validNames.includes(name)) {
+      return from;
+    }
+  } catch {
+  }
+  return null;
+}
+function findPackage(packageName, from = process.cwd()) {
+  if (!isValidPackageName(packageName)) {
+    return null;
+  }
+  const workspaceRoot = findWorkspaceRoot(from);
+  if (workspaceRoot) {
+    const workspacePackage = searchInWorkspace(workspaceRoot, packageName);
+    if (workspacePackage) {
+      return workspacePackage;
+    }
+  }
+  return searchInNodeModules(from, packageName) || checkCurrentDirectory(from, packageName);
+}
+function detectEnvironment(from = process.cwd()) {
+  const workspaceRoot = findWorkspaceRoot(from);
+  if (workspaceRoot) {
+    const cliPackage = findPackage("cli", workspaceRoot);
+    const sdkPackage = findPackage("sdk", workspaceRoot);
+    if (cliPackage && sdkPackage) {
+      return "runa-repo";
+    }
+  }
+  const sdkPath = join(from, "node_modules", "@runa-ai", "runa");
+  if (existsSync(sdkPath)) {
+    return "pj-repo";
+  }
+  return "unknown";
+}
+
+export { detectEnvironment, findPackage, findWorkspaceRoot };