@simplysm/sd-cli 13.0.66 → 13.0.68

package/src/sd-cli.ts

@@ -7,7 +7,7 @@
  * .js 실행 (배포): replaceDeps 실행 후 새 프로세스로 sd-cli-entry spawn
  */
 
-import { exec, spawn } from "child_process";
+import { execa } from "execa";
 import os from "os";
 import path from "path";
 import { fileURLToPath } from "url";
@@ -40,7 +40,7 @@ if (isDev) {
 
   // Phase 2: 새 프로세스로 실제 CLI 실행 (모듈 캐시 초기화)
   const cliEntryFilePath = path.join(__dirname, "sd-cli-entry.js");
-  const child = spawn(
+  const subprocess = execa(
     "node",
     [
       "--max-old-space-size=8192",
@@ -48,14 +48,11 @@ if (isDev) {
       cliEntryFilePath,
       ...process.argv.slice(2),
     ],
-    { stdio: "inherit" },
+    { stdio: "inherit", reject: false },
   );
-  child.on("spawn", () => {
-    if (child.pid != null) configureAffinityAndPriority(child.pid);
-  });
-  child.on("exit", (code) => {
-    process.exitCode = code ?? 0;
-  });
+  if (subprocess.pid != null) configureAffinityAndPriority(subprocess.pid);
+  const result = await subprocess;
+  process.exitCode = result.exitCode ?? 0;
 }
 
 /**
@@ -97,10 +94,8 @@ function configureAffinityAndPriority(pid: number): void {
     command = `taskset -p ${mask} ${pid} && renice +10 -p ${pid}`;
   }
 
-  exec(command, (err) => {
-    if (err) {
-      // eslint-disable-next-line no-console
-      console.warn("CPU affinity/priority 설정 실패:", err.message);
-    }
+  execa({ shell: true })`${command}`.catch((err: Error) => {
+    // eslint-disable-next-line no-console
+    console.warn("CPU affinity/priority 설정 실패:", err.message);
   });
 }

package/src/utils/output-utils.ts

@@ -1,28 +1,32 @@
 import { consola } from "consola";
 import type { BuildResult } from "../infra/ResultCollector";
-import type { PackageResult } from "./package-utils";
 
 /**
- * printErrors에서 사용되는 결과 타입
- * PackageResult와 BuildResult 모두 지원
+ * 빌드 경고/에러 메시지를 포맷팅한다.
  */
-type ErrorResult = PackageResult | BuildResult;
+export function formatBuildMessages(name: string, label: string, messages: string[]): string {
+  const lines: string[] = [`${name} (${label})`];
+  for (const msg of messages) {
+    for (const line of msg.split("\n")) {
+      lines.push(`  → ${line}`);
+    }
+  }
+  return lines.join("\n");
+}
 
 /**
  * 에러만 출력한다.
  * @param results 패키지별 빌드 결과 상태
  */
-export function printErrors(results: Map<string, ErrorResult>): void {
+export function printErrors(results: Map<string, BuildResult>): void {
   for (const result of results.values()) {
     if (result.status === "error") {
       const typeLabel = result.type === "dts" ? "dts" : result.target;
-      const errorLines: string[] = [`${result.name} (${typeLabel})`];
       if (result.message != null && result.message !== "") {
-        for (const line of result.message.split("\n")) {
-          errorLines.push(`  → ${line}`);
-        }
+        consola.error(formatBuildMessages(result.name, typeLabel, [result.message]));
+      } else {
+        consola.error(`${result.name} (${typeLabel})`);
       }
-      consola.error(errorLines.join("\n"));
     }
   }
 }
@@ -33,7 +37,7 @@ export function printErrors(results: Map<string, ErrorResult>): void {
  * @param serverClientsMap 서버별 연결된 클라이언트 목록
  */
 export function printServers(
-  results: Map<string, PackageResult>,
+  results: Map<string, BuildResult>,
   serverClientsMap?: Map<string, string[]>,
 ): void {
   // 서버 정보 수집

package/src/utils/package-utils.ts

@@ -83,18 +83,6 @@ export function collectDeps(
   return { workspaceDeps, replaceDeps };
 }
 
-/**
- * 패키지 결과 상태
- */
-export interface PackageResult {
-  name: string;
-  target: string;
-  type: "build" | "dts" | "server" | "capacitor";
-  status: "success" | "error" | "running";
-  message?: string;
-  port?: number;
-}
-
 /**
  * 패키지 설정에서 targets 필터링 (scripts 타겟 제외)
  * @param packages 패키지 설정 맵

package/src/utils/replace-deps.ts

@@ -148,28 +148,26 @@ async function collectSearchRoots(projectRoot: string): Promise<string[]> {
 }
 
 /**
- * replaceDeps 설정에 따라 node_modules 내 패키지를 소스 디렉토리로 복사 교체한다.
+ * replaceDeps 설정에서 모든 교체 대상 항목을 해석한다.
  *
  * 1. pnpm-workspace.yaml 파싱 → workspace 패키지 경로 목록
  * 2. [루트, ...workspace 패키지]의 node_modules에서 매칭되는 패키지 찾기
- * 3. 기존 symlink/디렉토리 제거 → 소스 경로를 복사 (node_modules, package.json, .cache, tests 제외)
+ * 3. 패턴 매칭 + 소스 경로 존재 확인 + symlink 해석
  *
  * @param projectRoot - 프로젝트 루트 경로
  * @param replaceDeps - sd.config.ts의 replaceDeps 설정
+ * @param logger - consola 로거
+ * @returns 해석된 교체 대상 항목 배열
  */
-export async function setupReplaceDeps(
+async function resolveAllReplaceDepEntries(
   projectRoot: string,
   replaceDeps: Record<string, string>,
-): Promise<void> {
-  const logger = consola.withTag("sd:cli:replace-deps");
-  let setupCount = 0;
-
-  logger.start("Setting up replace-deps");
+  logger: ReturnType<typeof consola.withTag>,
+): Promise<ReplaceDepEntry[]> {
+  const entries: ReplaceDepEntry[] = [];
 
-  // 1. Workspace 패키지 경로 목록 수집
   const searchRoots = await collectSearchRoots(projectRoot);
 
-  // 2. 각 searchRoot의 node_modules에서 매칭되는 패키지 찾기
   for (const searchRoot of searchRoots) {
     const nodeModulesDir = path.join(searchRoot, "node_modules");
 
@@ -189,10 +187,9 @@ export async function setupReplaceDeps(
     if (targetNames.length === 0) continue;
 
     // 패턴 매칭 및 경로 해석
-    const entries = resolveReplaceDepEntries(replaceDeps, targetNames);
+    const matchedEntries = resolveReplaceDepEntries(replaceDeps, targetNames);
 
-    // 3. 복사 교체
-    for (const { targetName, sourcePath } of entries) {
+    for (const { targetName, sourcePath } of matchedEntries) {
       const targetPath = path.join(nodeModulesDir, targetName);
       const resolvedSourcePath = path.resolve(projectRoot, sourcePath);
 
@@ -204,25 +201,59 @@ export async function setupReplaceDeps(
         continue;
       }
 
+      // targetPath가 symlink면 realpath로 해석하여 실제 .pnpm 스토어 경로 얻기
+      let actualTargetPath = targetPath;
       try {
-        // targetPath가 symlink면 realpath로 해석하여 실제 .pnpm 스토어 경로 얻기
-        let actualTargetPath = targetPath;
-        try {
-          const stat = await fs.promises.lstat(targetPath);
-          if (stat.isSymbolicLink()) {
-            actualTargetPath = await fs.promises.realpath(targetPath);
-          }
-        } catch {
-          // targetPath가 존재하지 않으면 그대로 사용
+        const stat = await fs.promises.lstat(targetPath);
+        if (stat.isSymbolicLink()) {
+          actualTargetPath = await fs.promises.realpath(targetPath);
         }
+      } catch {
+        // targetPath가 존재하지 않으면 그대로 사용
+      }
 
-        // 소스 파일을 actualTargetPath에 덮어쓰기 복사 (기존 디렉토리 유지, symlink 보존)
-        await fsCopy(resolvedSourcePath, actualTargetPath, replaceDepsCopyFilter);
+      entries.push({
+        targetName,
+        sourcePath,
+        targetPath,
+        resolvedSourcePath,
+        actualTargetPath,
+      });
+    }
+  }
 
-        setupCount += 1;
-      } catch (err) {
-        logger.error(`복사 교체 실패 (${targetName}): ${err instanceof Error ? err.message : err}`);
-      }
+  return entries;
+}
+
+/**
+ * replaceDeps 설정에 따라 node_modules 내 패키지를 소스 디렉토리로 복사 교체한다.
+ *
+ * 1. pnpm-workspace.yaml 파싱 → workspace 패키지 경로 목록
+ * 2. [루트, ...workspace 패키지]의 node_modules에서 매칭되는 패키지 찾기
+ * 3. 기존 symlink/디렉토리 제거 → 소스 경로를 복사 (node_modules, package.json, .cache, tests 제외)
+ *
+ * @param projectRoot - 프로젝트 루트 경로
+ * @param replaceDeps - sd.config.ts의 replaceDeps 설정
+ */
+export async function setupReplaceDeps(
+  projectRoot: string,
+  replaceDeps: Record<string, string>,
+): Promise<void> {
+  const logger = consola.withTag("sd:cli:replace-deps");
+  let setupCount = 0;
+
+  logger.start("Setting up replace-deps");
+
+  const entries = await resolveAllReplaceDepEntries(projectRoot, replaceDeps, logger);
+
+  for (const { targetName, resolvedSourcePath, actualTargetPath } of entries) {
+    try {
+      // 소스 파일을 actualTargetPath에 덮어쓰기 복사 (기존 디렉토리 유지, symlink 보존)
+      await fsCopy(resolvedSourcePath, actualTargetPath, replaceDepsCopyFilter);
+
+      setupCount += 1;
+    } catch (err) {
+      logger.error(`복사 교체 실패 (${targetName}): ${err instanceof Error ? err.message : err}`);
     }
   }
 
@@ -246,68 +277,10 @@ export async function watchReplaceDeps(
   replaceDeps: Record<string, string>,
 ): Promise<WatchReplaceDepResult> {
   const logger = consola.withTag("sd:cli:replace-deps:watch");
-  const entries: ReplaceDepEntry[] = [];
 
-  // 1. Workspace 패키지 경로 목록 수집
-  const searchRoots = await collectSearchRoots(projectRoot);
-
-  // 2. 각 searchRoot의 node_modules에서 매칭되는 패키지 찾기
-  for (const searchRoot of searchRoots) {
-    const nodeModulesDir = path.join(searchRoot, "node_modules");
-
-    try {
-      await fs.promises.access(nodeModulesDir);
-    } catch {
-      continue; // node_modules 없으면 스킵
-    }
-
-    // replaceDeps의 각 glob 패턴으로 node_modules 내 디렉토리 탐색
-    const targetNames: string[] = [];
-    for (const pattern of Object.keys(replaceDeps)) {
-      const matches = await glob(pattern, { cwd: nodeModulesDir });
-      targetNames.push(...matches);
-    }
-
-    if (targetNames.length === 0) continue;
-
-    // 패턴 매칭 및 경로 해석
-    const matchedEntries = resolveReplaceDepEntries(replaceDeps, targetNames);
-
-    // 3. entry 정보 수집 (symlink 해석 포함)
-    for (const { targetName, sourcePath } of matchedEntries) {
-      const targetPath = path.join(nodeModulesDir, targetName);
-      const resolvedSourcePath = path.resolve(projectRoot, sourcePath);
-
-      // 소스 경로 존재 확인
-      try {
-        await fs.promises.access(resolvedSourcePath);
-      } catch {
-        logger.warn(`소스 경로가 존재하지 않아 스킵합니다: ${resolvedSourcePath}`);
-        continue;
-      }
-
-      // targetPath가 symlink면 realpath로 해석하여 실제 .pnpm 스토어 경로 얻기
-      let actualTargetPath = targetPath;
-      try {
-        const stat = await fs.promises.lstat(targetPath);
-        if (stat.isSymbolicLink()) {
-          actualTargetPath = await fs.promises.realpath(targetPath);
-        }
-      } catch {
-        // targetPath가 존재하지 않으면 그대로 사용
-      }
-
-      entries.push({
-        targetName,
-        sourcePath,
-        targetPath,
-        resolvedSourcePath,
-        actualTargetPath,
-      });
-    }
-  }
+  const entries = await resolveAllReplaceDepEntries(projectRoot, replaceDeps, logger);
 
-  // 4. 소스 디렉토리 watch 설정
+  // 소스 디렉토리 watch 설정
   const watchers: FsWatcher[] = [];
   const watchedSources = new Set<string>();
 

package/src/utils/sd-config.ts

@@ -2,18 +2,14 @@ import path from "path";
 import { createJiti } from "jiti";
 import { SdError } from "@simplysm/core-common";
 import { fsExists } from "@simplysm/core-node";
-import type { SdConfig } from "../sd-config.types";
+import type { SdConfig, SdConfigParams } from "../sd-config.types";
 
 /**
  * sd.config.ts 로드
  * @returns SdConfig 객체
  * @throws sd.config.ts가 없거나 형식이 잘못된 경우
  */
-export async function loadSdConfig(params: {
-  cwd: string;
-  dev: boolean;
-  opt: string[];
-}): Promise<SdConfig> {
+export async function loadSdConfig(params: SdConfigParams): Promise<SdConfig> {
   const sdConfigPath = path.resolve(params.cwd, "sd.config.ts");
 
   if (!(await fsExists(sdConfigPath))) {

package/src/utils/vite-config.ts

@@ -111,7 +111,15 @@ function sdPublicDevPlugin(pkgDir: string): Plugin {
           urlPath = urlPath.slice(1);
         }
 
-        const filePath = path.join(publicDevDir, urlPath);
+        // path traversal 방어: publicDevDir 범위 밖의 파일 접근 차단
+        const decodedPath = decodeURIComponent(urlPath);
+        const filePath = path.resolve(publicDevDir, decodedPath);
+        const normalizedRoot = path.resolve(publicDevDir);
+        if (!filePath.startsWith(normalizedRoot + path.sep) && filePath !== normalizedRoot) {
+          next();
+          return;
+        }
+
         if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
           // sirv 대신 간단히 파일 스트림으로 응답
           const stream = fs.createReadStream(filePath);

package/src/utils/worker-events.ts

@@ -1,7 +1,8 @@
 import { consola } from "consola";
-import type { PackageResult } from "./package-utils";
+import type { BuildResult } from "../infra/ResultCollector";
 import type { SdPackageConfig } from "../sd-config.types";
 import type { RebuildManager } from "./rebuild-manager";
+import { formatBuildMessages } from "./output-utils";
 
 const workerEventsLogger = consola.withTag("sd:cli:worker-events");
 
@@ -33,12 +34,12 @@ export interface ServerBuildEventData {
 /**
  * 기본 Worker 정보 타입
  */
-export interface BaseWorkerInfo<TEvents extends Record<string, any[]> = Record<string, any[]>> {
+export interface BaseWorkerInfo<TEvents extends Record<string, unknown> = Record<string, unknown>> {
   name: string;
   config: SdPackageConfig;
   worker: {
-    on<K extends keyof TEvents>(event: K, handler: (data: TEvents[K][0]) => void): void;
-    send<K extends keyof TEvents>(event: K, data: TEvents[K][0]): void;
+    on<K extends keyof TEvents>(event: K, handler: (data: TEvents[K]) => void): void;
+    send<K extends keyof TEvents>(event: K, data: TEvents[K]): void;
   };
   isInitialBuild: boolean;
   buildResolver: (() => void) | undefined;
@@ -63,15 +64,15 @@ export interface WorkerEventHandlerOptions {
  * @returns completeTask 함수 (결과를 저장하고 빌드 완료를 알림)
  */
 export function registerWorkerEventHandlers<
-  TEvents extends Record<string, any[]>,
+  TEvents extends Record<string, unknown>,
   T extends BaseWorkerInfo<TEvents>,
 >(
   workerInfo: T,
   opts: WorkerEventHandlerOptions,
-  results: Map<string, PackageResult>,
+  results: Map<string, BuildResult>,
   rebuildManager: RebuildManager,
-): (result: PackageResult) => void {
-  const completeTask = (result: PackageResult): void => {
+): (result: BuildResult) => void {
+  const completeTask = (result: BuildResult): void => {
     results.set(opts.resultKey, result);
     workerInfo.buildResolver?.();
     workerInfo.buildResolver = undefined;
@@ -86,40 +87,36 @@ export function registerWorkerEventHandlers<
   });
 
   // 빌드 완료
-  workerInfo.worker.on("build", (data) => {
-    const event = data as BuildEventData;
-    workerEventsLogger.debug(`[${workerInfo.name}] build: success=${String(event.success)}`);
+  workerInfo.worker.on("build", (_data) => {
+    const data = _data as BuildEventData;
+    workerEventsLogger.debug(`[${workerInfo.name}] build: success=${String(data.success)}`);
 
     // warnings 출력
-    if (event.warnings != null && event.warnings.length > 0) {
-      const warnLines: string[] = [`${workerInfo.name} (${workerInfo.config.target})`];
-      for (const warning of event.warnings) {
-        for (const line of warning.split("\n")) {
-          warnLines.push(`  → ${line}`);
-        }
-      }
-      workerEventsLogger.warn(warnLines.join("\n"));
+    if (data.warnings != null && data.warnings.length > 0) {
+      workerEventsLogger.warn(
+        formatBuildMessages(workerInfo.name, workerInfo.config.target, data.warnings),
+      );
     }
 
     completeTask({
       name: workerInfo.name,
       target: workerInfo.config.target,
       type: opts.resultType,
-      status: event.success ? "success" : "error",
-      message: event.errors?.join("\n"),
+      status: data.success ? "success" : "error",
+      message: data.errors?.join("\n"),
     });
   });
 
   // 에러
-  workerInfo.worker.on("error", (data) => {
-    const event = data as ErrorEventData;
-    workerEventsLogger.debug(`[${workerInfo.name}] error: ${event.message}`);
+  workerInfo.worker.on("error", (_data) => {
+    const data = _data as ErrorEventData;
+    workerEventsLogger.debug(`[${workerInfo.name}] error: ${data.message}`);
     completeTask({
       name: workerInfo.name,
       target: workerInfo.config.target,
       type: opts.resultType,
       status: "error",
-      message: event.message,
+      message: data.message,
     });
   });
 

package/src/utils/worker-utils.ts

@@ -27,3 +27,19 @@ export function registerCleanupHandlers(
   process.on("SIGTERM", handleSignal);
   process.on("SIGINT", handleSignal);
 }
+
+/**
+ * Worker 함수의 중복 호출을 방지하는 가드를 생성한다.
+ *
+ * @param label - 에러 메시지에 사용할 함수명
+ * @returns 호출 시 중복이면 에러를 throw하는 가드 함수
+ */
+export function createOnceGuard(label: string): () => void {
+  let called = false;
+  return () => {
+    if (called) {
+      throw new Error(`${label}는 Worker당 한 번만 호출할 수 있습니다.`);
+    }
+    called = true;
+  };
+}

package/src/workers/client.worker.ts

@@ -2,12 +2,13 @@ import path from "path";
 import fs from "fs";
 import { build as viteBuild, createServer, type ViteDevServer } from "vite";
 import { createWorker } from "@simplysm/core-node";
+import { errorMessage } from "@simplysm/core-common";
 import { consola } from "consola";
 import type { SdClientPackageConfig } from "../sd-config.types";
 import { parseRootTsconfig, getCompilerOptionsForPackage } from "../utils/tsconfig";
 import { createViteConfig } from "../utils/vite-config";
 import { collectDeps } from "../utils/package-utils";
-import { registerCleanupHandlers } from "../utils/worker-utils";
+import { registerCleanupHandlers, createOnceGuard } from "../utils/worker-utils";
 
 //#region Types
 
@@ -142,13 +143,12 @@ async function build(info: ClientBuildInfo): Promise<ClientBuildResult> {
   } catch (err) {
     return {
       success: false,
-      errors: [err instanceof Error ? err.message : String(err)],
+      errors: [errorMessage(err)],
     };
   }
 }
 
-/** startWatch 호출 여부 플래그 */
-let isWatchStarted = false;
+const guardStartWatch = createOnceGuard("startWatch");
 
 /**
  * watch 시작 (Vite dev server)
@@ -156,10 +156,7 @@ let isWatchStarted = false;
  * @throws 이미 watch가 시작된 경우
  */
 async function startWatch(info: ClientWatchInfo): Promise<void> {
-  if (isWatchStarted) {
-    throw new Error("startWatch는 Worker당 한 번만 호출할 수 있습니다.");
-  }
-  isWatchStarted = true;
+  guardStartWatch();
 
   try {
     // tsconfig 파싱
@@ -204,13 +201,17 @@ async function startWatch(info: ClientWatchInfo): Promise<void> {
 
     // 실제 할당된 포트 반환 (config.server.port는 설정값이므로 httpServer에서 실제 포트를 가져옴)
     const address = viteServer.httpServer?.address();
-    const actualPort =
-      typeof address === "object" && address != null ? address.port : viteServer.config.server.port;
+    const actualPort = typeof address === "object" && address != null ? address.port : undefined;
+
+    if (actualPort == null) {
+      sender.send("error", { message: "Vite dev server port를 확인할 수 없습니다." });
+      return;
+    }
 
     sender.send("serverReady", { port: actualPort });
   } catch (err) {
     sender.send("error", {
-      message: err instanceof Error ? err.message : String(err),
+      message: errorMessage(err),
     });
   }
 }

package/src/workers/dts.worker.ts

@@ -1,6 +1,7 @@
 import path from "path";
 import ts from "typescript";
 import { createWorker, pathIsChildPath, pathNorm } from "@simplysm/core-node";
+import { errorMessage } from "@simplysm/core-common";
 import { consola } from "consola";
 import {
   getCompilerOptionsForPackage,
@@ -10,6 +11,7 @@ import {
   type TypecheckEnv,
 } from "../utils/tsconfig";
 import { serializeDiagnostic, type SerializedDiagnostic } from "../utils/typecheck-serialization";
+import { createOnceGuard } from "../utils/worker-utils";
 
 //#region Types
 
@@ -181,12 +183,12 @@ function createDtsPathRewriter(
 
 //#endregion
 
-//#region buildDts (일회성 빌드)
+//#region build (일회성 빌드)
 
 /**
  * DTS 일회성 빌드 (타입체크 + dts 생성)
  */
-async function buildDts(info: DtsBuildInfo): Promise<DtsBuildResult> {
+async function build(info: DtsBuildInfo): Promise<DtsBuildResult> {
   try {
     const parsedConfig = parseRootTsconfig(info.cwd);
 
@@ -327,7 +329,7 @@ async function buildDts(info: DtsBuildInfo): Promise<DtsBuildResult> {
   } catch (err) {
     return {
       success: false,
-      errors: [err instanceof Error ? err.message : String(err)],
+      errors: [errorMessage(err)],
       diagnostics: [],
       errorCount: 1,
       warningCount: 0,
@@ -337,21 +339,17 @@ async function buildDts(info: DtsBuildInfo): Promise<DtsBuildResult> {
 
 //#endregion
 
-//#region startDtsWatch (watch 모드)
+//#region startWatch (watch 모드)
 
-/** startDtsWatch 호출 여부 플래그 */
-let isWatchStarted = false;
+const guardStartWatch = createOnceGuard("startWatch");
 
 /**
  * DTS watch 시작
  * @remarks 이 함수는 Worker당 한 번만 호출되어야 합니다.
  * @throws 이미 watch가 시작된 경우
  */
-async function startDtsWatch(info: DtsWatchInfo): Promise<void> {
-  if (isWatchStarted) {
-    throw new Error("startDtsWatch는 Worker당 한 번만 호출할 수 있습니다.");
-  }
-  isWatchStarted = true;
+async function startWatch(info: DtsWatchInfo): Promise<void> {
+  guardStartWatch();
 
   try {
     const parsedConfig = parseRootTsconfig(info.cwd);
@@ -451,17 +449,17 @@ async function startDtsWatch(info: DtsWatchInfo): Promise<void> {
     tscWatchProgram = ts.createWatchProgram(host);
   } catch (err) {
     sender.send("error", {
-      message: err instanceof Error ? err.message : String(err),
+      message: errorMessage(err),
     });
   }
 }
 
 const sender = createWorker<
-  { startDtsWatch: typeof startDtsWatch; buildDts: typeof buildDts },
+  { startWatch: typeof startWatch; build: typeof build },
   DtsWorkerEvents
 >({
-  startDtsWatch,
-  buildDts,
+  startWatch,
+  build,
 });
 
 export default sender;