@solidactions/cli 1.16.0 → 1.17.1

package/README.md

@@ -61,6 +61,24 @@ If you run multiple AI coding agents in different project folders simultaneously
 - Run `solidactions login <key> --local` in each folder so each has its own config, or
 - Set `SOLIDACTIONS_API_KEY` / `SOLIDACTIONS_WORKSPACE_ID` in the environment each agent uses (no files to share or stomp).
 
+### Deploy bundle exclusions (`solidactions.yaml`)
+
+When you run `solidactions project deploy`, the CLI bundles your project directory and uploads it. You can control what goes into that bundle with an optional `deploy:` block in `solidactions.yaml`:
+
+```yaml
+deploy:
+  exclude:            # additive, gitignore-style patterns
+    - web/            # a large local-only sub-app you don't deploy
+    - "*.tmp"
+  gitignore: true     # opt-in: also honor this project's .gitignore
+```
+
+- **`deploy.exclude`** — a list of gitignore-style patterns (anchoring, `*.log`-at-any-depth, and `!` negation all work). Use it to keep large local-only directories (e.g. a `.venv` or a legacy `web/` app) out of the upload — this avoids `413 Request Entity Too Large` failures. Additive on top of the always-excluded defaults: `node_modules/`, `.git/`, `dist/`, `vendor/`.
+- **`deploy.gitignore`** — `false` by default. Set to `true` to also apply your project's root `.gitignore` to the bundle. This is opt-in so deploys don't silently change behavior.
+- **`.env` and `.env.*` are always excluded**, regardless of config, and no `!` negation can re-include them. Secrets must come from `solidactions env set` (they are injected at runtime), and must never be baked into the deploy bundle.
+
+The CLI prints a one-line summary of what it bundled, e.g. `Bundling 312 files (.env excluded; .gitignore applied; 2 exclude rules)`, and warns about any symlinks it skipped.
+
 ## Commands
 
 Use `solidactions <command> --help` for full flag details on any command.

package/dist/commands/deploy.js

@@ -13,6 +13,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const env_1 = require("../utils/env");
 const api_1 = require("../utils/api");
+const deploy_ignore_1 = require("../utils/deploy-ignore");
 /**
  * Validate project structure before deployment.
  * Checks for required files and SDK dependency.
@@ -282,6 +283,29 @@ async function deploy(projectName, sourcePath, options = {}) {
         return;
     }
     const archivePath = path_1.default.join(sourceDir, '.steps-deploy.tar.gz');
+    // Plan the file list BEFORE creating the archive write stream so a walk error
+    // (permission error, unreadable dir) aborts cleanly with no orphan tarball.
+    let plan;
+    try {
+        plan = (0, deploy_ignore_1.planDeployFiles)(sourceDir, yamlConfig);
+    }
+    catch (error) {
+        console.error(chalk_1.default.red('Deployment failed:'));
+        console.error(error.message);
+        process.exit(1);
+    }
+    // Summary line so silent truncation never reads as "shipped everything".
+    const parts = ['.env excluded'];
+    if (plan.summary.gitignoreApplied) {
+        parts.push('.gitignore applied');
+    }
+    if (plan.summary.excludeRuleCount > 0) {
+        parts.push(`${plan.summary.excludeRuleCount} exclude rule${plan.summary.excludeRuleCount === 1 ? '' : 's'}`);
+    }
+    console.log(chalk_1.default.gray(`Bundling ${plan.files.length} files (${parts.join('; ')})`));
+    if (plan.summary.symlinksSkipped.length > 0) {
+        console.log(chalk_1.default.yellow(`⚠ Skipped ${plan.summary.symlinksSkipped.length} symlink(s) (not followed): ${plan.summary.symlinksSkipped.join(', ')}`));
+    }
     const output = fs_1.default.createWriteStream(archivePath);
     const archive = (0, archiver_1.default)('tar', { gzip: true, gzipOptions: { level: 9 } });
     output.on('close', async () => {
@@ -386,16 +410,12 @@ async function deploy(projectName, sourcePath, options = {}) {
         throw err;
     });
     archive.pipe(output);
-    // Glob patterns to ignore
-    const ignore = ['node_modules/**', '.git/**', '.steps-deploy.tar.gz', '.steps-deploy.zip', 'dist/**', 'vendor/**', '**/node_modules/**'];
-    // User code goes under tenantcode/ so it never conflicts with our Dockerfile
-    archive.glob('**/*', {
-        cwd: sourceDir,
-        ignore: ignore,
-        dot: true
-    }, {
-        prefix: 'tenantcode'
-    });
+    // User code goes under tenantcode/ so it never conflicts with our Dockerfile.
+    // Add each planned file explicitly (per-file walk computed above).
+    for (const relPosixPath of plan.files) {
+        const absPath = path_1.default.join(sourceDir, relPosixPath);
+        archive.file(absPath, { name: 'tenantcode/' + relPosixPath });
+    }
     // Dockerfile always at archive root, referencing tenantcode/
     const universalDockerfile = [
         'FROM node:24-alpine',

package/dist/utils/deploy-ignore.js

@@ -0,0 +1,141 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HARD_DENY_BASENAMES = exports.DEFAULT_DEPLOY_IGNORES = void 0;
+exports.isHardDenied = isHardDenied;
+exports.buildDeployMatcher = buildDeployMatcher;
+exports.isIgnoredDirectory = isIgnoredDirectory;
+exports.planDeployFiles = planDeployFiles;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const ignore_1 = __importDefault(require("ignore"));
+/**
+ * Layer-2 matcher defaults (gitignore syntax). These are excluded unless a later
+ * pattern (deploy.exclude or .gitignore) re-includes them via a `!` negation.
+ *
+ * `dist/` and `vendor/` are anchored to the project root (`/dist/`, `/vendor/`)
+ * so they only strip the project's own build output. An unanchored `dist/` /
+ * `vendor/` matches at any depth and wrongly excludes a vendored dependency's
+ * own build output — e.g. a `"@solidactions/sdk": "file:./sdk"` dep whose code
+ * lives in `sdk/dist/`, which then fails to resolve at build time.
+ * `node_modules/` and `.git/` stay unanchored: those are never wanted at any depth.
+ */
+exports.DEFAULT_DEPLOY_IGNORES = [
+    'node_modules/',
+    '.git/',
+    '/dist/',
+    '/vendor/',
+];
+/**
+ * Layer-1 hard deny — matched against the *basename* of a path. Never
+ * re-includable by any matcher negation. Covers:
+ *   - `.env` and any `.env.*` (secret-leak fix). Anchored so `.envrc` and
+ *     `environment.ts` do NOT match.
+ *   - `.steps-deploy.tar.gz` / `.steps-deploy.zip` (our own deploy artifacts,
+ *     written into sourceDir while we walk).
+ */
+exports.HARD_DENY_BASENAMES = /^(?:\.env(?:$|\..*)|\.steps-deploy\.(?:tar\.gz|zip))$/;
+/**
+ * True if a path is hard-denied (Layer 1). Checked before the matcher so that
+ * no `!` negation in deploy.exclude or .gitignore can re-include it.
+ * Tests the basename of the (POSIX) path.
+ */
+function isHardDenied(relPosixPath) {
+    const base = relPosixPath.split('/').pop() ?? '';
+    return exports.HARD_DENY_BASENAMES.test(base);
+}
+/**
+ * Build the Layer-2 ignore matcher from defaults + deploy.exclude + optional
+ * .gitignore. Patterns are added in order; with negations, later patterns win
+ * (standard ordered gitignore semantics).
+ */
+function buildDeployMatcher(sourceDir, config) {
+    const matcher = (0, ignore_1.default)();
+    // 1. Defaults.
+    matcher.add(exports.DEFAULT_DEPLOY_IGNORES);
+    // 2. deploy.exclude entries.
+    const exclude = config?.deploy?.exclude ?? [];
+    const excludeRuleCount = exclude.length;
+    if (excludeRuleCount > 0) {
+        matcher.add(exclude);
+    }
+    // 3. .gitignore, only when opted in and the file exists.
+    let gitignoreApplied = false;
+    if (config?.deploy?.gitignore === true) {
+        const gitignorePath = path_1.default.join(sourceDir, '.gitignore');
+        if (fs_1.default.existsSync(gitignorePath)) {
+            matcher.add(fs_1.default.readFileSync(gitignorePath, 'utf8'));
+            gitignoreApplied = true;
+        }
+    }
+    return { matcher, summary: { gitignoreApplied, excludeRuleCount } };
+}
+/**
+ * True if a directory should be pruned (not descended into). The `ignore`
+ * package only matches trailing-slash dir patterns (e.g. `node_modules/`) when
+ * the tested path itself carries a trailing slash, so we normalize the dir path
+ * to exactly one trailing slash before testing. This also still matches plain
+ * (non-trailing-slash) patterns like a bare `foo`.
+ */
+function isIgnoredDirectory(relPosixDir, matcher) {
+    const stripped = relPosixDir.replace(/\/+$/, '');
+    if (stripped === '') {
+        return false;
+    }
+    return matcher.ignores(stripped + '/');
+}
+/**
+ * Walk sourceDir, returning { files, summary }. files = relative POSIX paths to
+ * include, with Layer-1 hard deny + Layer-2 matcher applied and ignored
+ * directories pruned (so we never read into a 400 MB .venv). Symlinks (file and
+ * directory) are skipped and collected in summary.symlinksSkipped.
+ */
+function planDeployFiles(sourceDir, config) {
+    const { matcher, summary } = buildDeployMatcher(sourceDir, config);
+    const files = [];
+    const symlinksSkipped = [];
+    const toPosix = (p) => p.split(path_1.default.sep).join('/');
+    const walk = (absDir, relDir) => {
+        const entries = fs_1.default.readdirSync(absDir, { withFileTypes: true });
+        for (const entry of entries) {
+            const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
+            const relPosix = toPosix(relPath);
+            const absPath = path_1.default.join(absDir, entry.name);
+            // Layer 1 — hard deny (files and dirs), independent of the matcher.
+            if (isHardDenied(relPosix)) {
+                continue;
+            }
+            if (entry.isSymbolicLink()) {
+                // Skip symlinks (both file and dir); never follow.
+                symlinksSkipped.push(relPosix);
+                continue;
+            }
+            if (entry.isDirectory()) {
+                // Layer 2 — prune ignored directories before descending.
+                if (isIgnoredDirectory(relPosix, matcher)) {
+                    continue;
+                }
+                walk(absPath, relPath);
+            }
+            else if (entry.isFile()) {
+                // Layer 2 — matcher for files.
+                if (matcher.ignores(relPosix)) {
+                    continue;
+                }
+                files.push(relPosix);
+            }
+            // Other entry types (sockets, fifos, etc.) are ignored.
+        }
+    };
+    walk(sourceDir, '');
+    return {
+        files,
+        summary: {
+            gitignoreApplied: summary.gitignoreApplied,
+            excludeRuleCount: summary.excludeRuleCount,
+            symlinksSkipped,
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidactions/cli",
-  "version": "1.16.0",
+  "version": "1.17.1",
   "description": "SolidActions CLI - Deploy and manage workflow automation",
   "main": "dist/index.js",
   "bin": {
@@ -45,6 +45,7 @@
     "dotenv": "^17.3.1",
     "form-data": "^4.0.0",
     "fs-extra": "^11.0.0",
+    "ignore": "^7.0.5",
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.5.12"