@technotalim-org/console-cli 1.3.0 → 1.3.1

package/dist/browser.js

@@ -0,0 +1,19 @@
+import open from 'open';
+/**
+ * Open a URL in the user's browser — but ONLY if it's a real http(s) URL.
+ * Some values handed to this (the device verification URL, a site's live URL)
+ * come from the server; a non-URL string could otherwise be interpreted by the
+ * OS opener as a local file or application. This guard makes that impossible.
+ */
+export async function safeOpen(target) {
+    let u;
+    try {
+        u = new URL(target);
+    }
+    catch {
+        return; // not a URL — refuse to open
+    }
+    if (u.protocol !== 'https:' && u.protocol !== 'http:')
+        return;
+    await open(u.toString());
+}

package/dist/commands/login.js

@@ -4,8 +4,8 @@
 // the PKCE verifier) for the long-lived cli_token.
 import http from 'http';
 import os from 'os';
-import open from 'open';
 import pc from 'picocolors';
+import { safeOpen } from '../browser.js';
 import { CONFIG } from '../config.js';
 import { genVerifier, challengeFor, genState } from '../pkce.js';
 import { saveCredentials, credentialsPath } from '../credentials.js';
@@ -84,7 +84,7 @@ export async function loginCommand(opts = {}) {
     log.info('\nOpening your browser to authorize…');
     log.dim(`If it doesn't open, visit:\n${authorizeUrl.toString()}\n`);
     try {
-        await open(authorizeUrl.toString());
+        await safeOpen(authorizeUrl.toString());
     }
     catch {
         /* the user can copy the URL above */
@@ -136,7 +136,7 @@ async function deviceLogin() {
     log.info(`and enter the code:  ${pc.bold(start.user_code)}\n`);
     try {
         if (start.verification_uri_complete)
-            await open(start.verification_uri_complete);
+            await safeOpen(start.verification_uri_complete);
     }
     catch {
         /* user can navigate manually */

package/dist/commands/open.js

@@ -1,5 +1,5 @@
 // `technotalim open` — open the linked site's live URL in the browser.
-import open from 'open';
+import { safeOpen } from '../browser.js';
 import { apiGet } from '../api.js';
 import { loadProject } from '../projectconfig.js';
 import { log, fail } from '../util.js';
@@ -16,5 +16,5 @@ export async function openCommand(opts) {
         return fail('Could not resolve a live URL for this site yet.');
     const url = `https://${site.domain}`;
     log.info(`Opening ${url}`);
-    await open(url);
+    await safeOpen(url);
 }

package/dist/config.js

@@ -7,5 +7,5 @@ export const CONFIG = {
     scope: 'hosting.deploy',
     // Env var used to pass a CI token in headless environments.
     ciTokenEnv: 'TECHNOTALIM_TOKEN',
-    version: '1.3.0',
+    version: '1.3.1',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technotalim-org/console-cli",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Deploy your TechnoTaLim-hosted websites from the command line.",
   "type": "module",
   "bin": {