@tokiui/cli 0.1.1 → 0.2.0

package/dist/index.js

@@ -233,7 +233,7 @@ var initCommand = new import_commander.Command("init").description("Initialize t
   console.log(import_kleur.default.green("\n  \u2713 tokiui initialized\n"));
   console.log(`  ${import_kleur.default.bold("Add your first component:")}
 `);
-  console.log(`  ${import_kleur.default.cyan("npx tokiui add button")}
+  console.log(`  ${import_kleur.default.cyan("npx @tokiui/cli add button")}
 `);
   if (!isNext) {
     console.log(
@@ -254,21 +254,107 @@ var import_ora2 = __toESM(require("ora"));
 var import_execa2 = require("execa");
 
 // src/utils/registry.ts
-var REGISTRY_BASE = "https://raw.githubusercontent.com/TopherGacad/tokiui/main/packages/registry";
+var ALLOWED_FETCH_ORIGIN = "https://raw.githubusercontent.com/TopherGacad/tokiui/";
+var SAFE_REF_RE = /^[a-zA-Z0-9._/@-]+$/;
+function resolveRegistryRef() {
+  const envRef = process.env.TOKIUI_REGISTRY_REF;
+  if (envRef !== void 0) {
+    if (!SAFE_REF_RE.test(envRef) || envRef.includes("..")) {
+      throw new Error(
+        `TOKIUI_REGISTRY_REF contains invalid characters: "${envRef}". Only alphanumeric characters, hyphens, dots, slashes, and @ are allowed.`
+      );
+    }
+    return envRef;
+  }
+  return `cli-v${"0.2.0"}`;
+}
+var REGISTRY_REF = resolveRegistryRef();
+var REGISTRY_BASE = `${ALLOWED_FETCH_ORIGIN}${REGISTRY_REF}/packages/registry`;
+var SOURCE_BASE = `${ALLOWED_FETCH_ORIGIN}${REGISTRY_REF}/packages/ui/src`;
+async function safeFetch(url) {
+  if (!url.startsWith(ALLOWED_FETCH_ORIGIN)) {
+    throw new Error(
+      `Security: refusing to fetch from unexpected origin.
+  Expected: ${ALLOWED_FETCH_ORIGIN}...
+  Got:      ${url}`
+    );
+  }
+  return fetch(url);
+}
+var ALLOWED_SCOPES = /* @__PURE__ */ new Set(["@radix-ui"]);
+var ALLOWED_PACKAGES = /* @__PURE__ */ new Set([
+  "class-variance-authority",
+  "clsx",
+  "tailwind-merge",
+  "sonner",
+  "lucide-react"
+]);
+var PACKAGE_NAME_RE = /^(@[a-z0-9][a-z0-9-._]*\/[a-z0-9][a-z0-9-._]*)(@[^\s]+)?$|^([a-z0-9][a-z0-9-._]*)(@[^\s]+)?$/;
+function assertSafeDependency(dep) {
+  if (!PACKAGE_NAME_RE.test(dep)) {
+    throw new Error(
+      `Registry returned a malformed dependency name: "${dep}". Aborting install.`
+    );
+  }
+  if (dep.startsWith("@")) {
+    const scope = dep.slice(0, dep.indexOf("/"));
+    if (!ALLOWED_SCOPES.has(scope)) {
+      throw new Error(
+        `Dependency scope "${scope}" is not in the approved list. Refusing to install "${dep}". If this is legitimate, open an issue on GitHub.`
+      );
+    }
+  } else {
+    const name = dep.split("@")[0];
+    if (!ALLOWED_PACKAGES.has(name)) {
+      throw new Error(
+        `Package "${name}" is not in the approved dependency list. Refusing to install. If this is legitimate, open an issue on GitHub.`
+      );
+    }
+  }
+}
+function assertSafeFilePath(filePath) {
+  if (filePath.includes("..") || filePath.startsWith("/") || /^[A-Za-z]:/.test(filePath) || filePath.includes("\0") || filePath.includes("\r") || filePath.includes("\n")) {
+    throw new Error(`Registry returned an unsafe file path: "${filePath}". Aborting.`);
+  }
+}
+function assertSafeComponentName(name) {
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new Error(`Invalid component name in registry: "${name}". Aborting.`);
+  }
+}
+function assertRegistryIndex(data) {
+  if (typeof data !== "object" || data === null || !Array.isArray(data.components)) {
+    throw new Error("Received an invalid registry index from the server.");
+  }
+}
+function assertRegistryComponent(data) {
+  const obj = data;
+  const valid = typeof data === "object" && data !== null && typeof obj.name === "string" && Array.isArray(obj.files) && Array.isArray(obj.dependencies) && Array.isArray(obj.devDependencies) && Array.isArray(obj.registryDependencies) && obj.files.every((f) => typeof f === "string") && obj.dependencies.every((d) => typeof d === "string") && obj.registryDependencies.every((d) => typeof d === "string");
+  if (!valid) {
+    throw new Error(
+      `Received an invalid component definition for "${String(obj.name ?? "unknown")}" from the registry.`
+    );
+  }
+}
 async function fetchRegistryIndex() {
-  const res = await fetch(`${REGISTRY_BASE}/index.json`);
+  const res = await safeFetch(`${REGISTRY_BASE}/index.json`);
   if (!res.ok) throw new Error(`Failed to fetch registry index: ${res.statusText}`);
-  return res.json();
+  const data = await res.json();
+  assertRegistryIndex(data);
+  return data;
 }
 async function fetchComponent(name) {
-  const res = await fetch(`${REGISTRY_BASE}/components/${name}.json`);
+  assertSafeComponentName(name);
+  const res = await safeFetch(`${REGISTRY_BASE}/components/${name}.json`);
   if (!res.ok) throw new Error(`Component "${name}" not found in registry`);
-  return res.json();
+  const data = await res.json();
+  assertRegistryComponent(data);
+  return data;
 }
 async function fetchComponentSource(name, file) {
-  const res = await fetch(
-    `https://raw.githubusercontent.com/TopherGacad/tokiui/main/packages/ui/src/${file}`
-  );
+  assertSafeComponentName(name);
+  assertSafeFilePath(file);
+  const res = await safeFetch(`${SOURCE_BASE}/${file}`);
   if (!res.ok) throw new Error(`Failed to fetch source for ${name}/${file}`);
   return res.text();
 }
@@ -308,23 +394,33 @@ var addCommand = new import_commander2.Command("add").description("Add a compone
       console.log(import_kleur2.default.red("Aborted."));
       process.exit(0);
     }
+    const visited = /* @__PURE__ */ new Set();
     for (const name of answer.components) {
-      await installComponent(name, cwd, config.componentsDir, libAlias);
+      await installComponent(name, cwd, config.componentsDir, libAlias, visited);
     }
     return;
   }
-  await installComponent(componentName, cwd, config.componentsDir, libAlias);
+  await installComponent(componentName, cwd, config.componentsDir, libAlias, /* @__PURE__ */ new Set());
 });
-async function installComponent(name, cwd, componentsDir, libAlias) {
+async function installComponent(name, cwd, componentsDir, libAlias, visited) {
+  if (visited.has(name)) return;
+  visited.add(name);
+  assertSafeComponentName(name);
   const spinner = (0, import_ora2.default)(`Adding ${name}...`).start();
-  const meta = await fetchComponent(name).catch(() => {
-    spinner.fail(`Component "${name}" not found`);
+  const meta = await fetchComponent(name).catch((err) => {
+    spinner.fail(`${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   });
   for (const dep of meta.registryDependencies) {
-    await installComponent(dep, cwd, componentsDir, libAlias);
+    await installComponent(dep, cwd, componentsDir, libAlias, visited);
   }
   for (const file of meta.files) {
+    try {
+      assertSafeFilePath(file);
+    } catch (err) {
+      spinner.fail(`Security: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
     const source = await fetchComponentSource(name, file);
     const transformed = transformImports(source, libAlias);
     const destPath = import_path3.default.join(cwd, componentsDir, import_path3.default.basename(file));
@@ -346,6 +442,15 @@ async function installComponent(name, cwd, componentsDir, libAlias) {
     await import_fs_extra3.default.writeFile(destPath, transformed);
   }
   if (meta.dependencies.length > 0) {
+    for (const dep of meta.dependencies) {
+      try {
+        assertSafeDependency(dep);
+      } catch (err) {
+        spinner.fail(`Security: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+    }
+    console.log(import_kleur2.default.dim(`  Installing: ${meta.dependencies.join(", ")}`));
     const pm = detectPackageManager(cwd);
     const installCmd = pm === "npm" ? "install" : "add";
     await (0, import_execa2.execa)(pm, [installCmd, ...meta.dependencies], { cwd });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokiui/cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "CLI for adding tokiui components to your project",
   "license": "MIT",
   "author": "Topher Gacad",
@@ -21,14 +21,12 @@
   "bin": {
     "tokiui": "./dist/index.js"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "lint": "tsc --noEmit"
-  },
   "dependencies": {
     "commander": "^12.1.0",
     "execa": "^9.3.0",
@@ -43,5 +41,10 @@
     "@types/prompts": "^2.4.9",
     "tsup": "^8.2.4",
     "typescript": "^5.5.4"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "tsc --noEmit"
   }
-}
+}