@vention/vention-cli 0.24.2 → 0.24.3

package/cli.esm.js

@@ -6008,6 +6008,9 @@ const TokenResponseSchema = z.object({
 const openBrowser = url => {
   const platform = process.platform;
   const command = platform === "darwin" ? `open "${url}"` : platform === "win32" ? `start "${url}"` : `xdg-open "${url}"`;
+
+  // URL is constructed from trusted constants and internal params (not user input)
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
   exec$9(command, error => {
     if (error) {
       console.log("Please open this URL in your browser:", url);
@@ -6027,6 +6030,9 @@ const startCallbackServer = async expectedState => {
   const server = http.createServer();
   const waitForCode = (async () => {
     try {
+      // Keep listening until we get the expected /callback request
+      // This avoids external mutable resolve/reject handlers.
+      // eslint-disable-next-line no-constant-condition
       while (true) {
         const [req, res] = await once(server, "request");
         const url = new URL(req.url || "/", `http://127.0.0.1`);
@@ -6088,7 +6094,7 @@ const startCallbackServer = async expectedState => {
 const getSsoConfig = environment => {
   if (environment === "local") throw new Error("SSO is not supported for local environment. Use cookie-based login.");
   const ssoConfig = CONNECTED_APP_SSO_CONFIG[environment];
-  if (!(ssoConfig === null || ssoConfig === void 0 ? void 0 : ssoConfig.clientId)) throw new Error("Missing CONNECTED_APP clientId for selected environment in sso-constants.ts");
+  if (!(ssoConfig != null && ssoConfig.clientId)) throw new Error("Missing CONNECTED_APP clientId for selected environment in sso-constants.ts");
   if (!ssoConfig.tokenUrl) throw new Error("Missing tokenUrl for selected environment in sso-constants.ts");
   return {
     clientId: ssoConfig.clientId,
@@ -6124,7 +6130,7 @@ const exchangeAuthorizationCodeForTokens = async (config, code, codeVerifier, re
   };
 };
 const refreshAccessToken = async (config, refreshToken) => {
-  var _a;
+  var _parsed$refresh_token;
   const body = new URLSearchParams$2({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
@@ -6144,7 +6150,7 @@ const refreshAccessToken = async (config, refreshToken) => {
   const parsed = TokenResponseSchema.parse(json);
   return {
     accessToken: parsed.access_token,
-    refreshToken: (_a = parsed.refresh_token) !== null && _a !== void 0 ? _a : refreshToken,
+    refreshToken: (_parsed$refresh_token = parsed.refresh_token) != null ? _parsed$refresh_token : refreshToken,
     expiresInSeconds: parsed.expires_in
   };
 };
@@ -6158,6 +6164,7 @@ const loginWithSso = async environment => {
     verifier,
     challenge
   } = generatePkce();
+  // OAuth 2.0 state: per-request nonce used to prevent CSRF and bind the callback to this initiation
   const state = generateRandomBase64Url(16);
   const {
     port,
@@ -6341,7 +6348,7 @@ async function assertApiResponseOk(res, url) {
     try {
       text = await res.text();
       responseBody = text ? JSON.parse(text) : null;
-    } catch (_a) {
+    } catch (_unused) {
       responseBody = text || null;
     }
     throw new ApiError(`Request failed: ${res.status} ${res.statusText}`, res.status, res.statusText, responseBody, url);
@@ -6379,15 +6386,15 @@ const ERROR_SUGGESTIONS = {
 };
 const ENDPOINT_PATTERNS = [["allocations", "/allocations"], ["library", "/library"]];
 const getEndpointFromUrl = url => {
-  var _a;
-  return (_a = ENDPOINT_PATTERNS.find(([, pattern]) => url.includes(pattern))) === null || _a === void 0 ? void 0 : _a[0];
+  var _ENDPOINT_PATTERNS$fi;
+  return (_ENDPOINT_PATTERNS$fi = ENDPOINT_PATTERNS.find(([, pattern]) => url.includes(pattern))) == null ? void 0 : _ENDPOINT_PATTERNS$fi[0];
 };
 const getErrorSuggestions = (status, url) => {
-  var _a, _b, _c;
-  const entry = (_a = ERROR_SUGGESTIONS[status]) !== null && _a !== void 0 ? _a : status >= 500 ? ERROR_SUGGESTIONS[500] : undefined;
+  var _ERROR_SUGGESTIONS$st, _ref, _entry$byEndpoint;
+  const entry = (_ERROR_SUGGESTIONS$st = ERROR_SUGGESTIONS[status]) != null ? _ERROR_SUGGESTIONS$st : status >= 500 ? ERROR_SUGGESTIONS[500] : undefined;
   if (!entry) return [];
   const endpoint = getEndpointFromUrl(url);
-  return (_c = endpoint && ((_b = entry.byEndpoint) === null || _b === void 0 ? void 0 : _b[endpoint])) !== null && _c !== void 0 ? _c : entry.default;
+  return (_ref = endpoint && ((_entry$byEndpoint = entry.byEndpoint) == null ? void 0 : _entry$byEndpoint[endpoint])) != null ? _ref : entry.default;
 };
 const handleCommandError = (error, context) => {
   console.error(chalk.red(`${context}:`));
@@ -6430,6 +6437,7 @@ const fetchJson = async (url, options = {}) => {
 const getDigitalTwinUrl = (environment, sessionId) => {
   switch (environment) {
     case "local":
+      // This is where execution-engine-cad is served on vention-stack
       return `http://localhost:3101`;
     case "demo":
       return `https://digital-twin.vention.foo/digital-twin/machine-motion/passthrough/${sessionId}/80`;
@@ -6751,7 +6759,7 @@ const getUserAllocations = async session => {
   });
 };
 const getAuthHeaders = async session => {
-  var _a;
+  var _session$oauth;
   const baseUrl = getBaseRailsUrl(session.environment);
   const baseHeaders = {
     Accept: "application/json",
@@ -6762,11 +6770,11 @@ const getAuthHeaders = async session => {
     if (!session.ventionSession) {
       throw new Error("Local environment requires vention_session. Please run 'vention login' and provide the cookie value.");
     }
-    return Object.assign(Object.assign({}, baseHeaders), {
+    return Object.assign({}, baseHeaders, {
       Cookie: `vention_session=${session.ventionSession}`
     });
   }
-  if (!((_a = session.oauth) === null || _a === void 0 ? void 0 : _a.accessToken)) {
+  if (!((_session$oauth = session.oauth) != null && _session$oauth.accessToken)) {
     throw new Error("Not authenticated. Please run 'vention login' to authenticate via SSO.");
   }
   const bufferMs = 5 * 60 * 1000;
@@ -6779,7 +6787,7 @@ const getAuthHeaders = async session => {
     session.oauth.expiresAt = refreshed.expiresInSeconds ? Date.now() + refreshed.expiresInSeconds * 1000 : session.oauth.expiresAt;
     await saveSession(session);
   }
-  return Object.assign(Object.assign({}, baseHeaders), {
+  return Object.assign({}, baseHeaders, {
     Authorization: `Bearer ${session.oauth.accessToken}`
   });
 };
@@ -10113,6 +10121,11 @@ const shouldIgnoreFileSystemNode = (nodeName, ignoredNodes) => {
 const getSafeAppName = appName => {
   return appName.replace(/[^a-zA-Z0-9-_]/g, "_");
 };
+
+/**
+ * Serializes a file system directory into a JSON representation
+ * Based on the logic from mm-execution-engine's MachineCodeDirectoryUtils.ts
+ */
 const serializeFileSystem = (sourceDirectory, ignoredFileSystemNodes, shouldBase64Encoded) => {
   const fileSystemNode = {};
   const directoryContents = fs.readdirSync(sourceDirectory);
@@ -10131,11 +10144,18 @@ const serializeFileSystem = (sourceDirectory, ignoredFileSystemNodes, shouldBase
   });
   return fileSystemNode;
 };
+
+/**
+ * Creates a file system structure from a JSON representation.
+ * Based on the logic from mm-execution-engine's MachineCodeDirectoryUtils.ts
+ */
 const createFileSystemFromJson = async (fileSystemNode, targetDirectory) => {
   await ensureDirectoryExists(targetDirectory);
   const writeFiles = async (node, currentPath) => {
     for (const [entryName, contentOrNode] of Object.entries(node)) {
       const fullPath = path$2.join(currentPath, entryName);
+
+      // A node either represents the string contents of a file, or a subdirectory
       if (typeof contentOrNode === "string") {
         const decodedContent = Buffer.from(contentOrNode, "base64");
         const fileHandle = await fs.promises.open(fullPath, "w");
@@ -10152,6 +10172,9 @@ const createFileSystemFromJson = async (fileSystemNode, targetDirectory) => {
     }
   };
   await writeFiles(fileSystemNode, targetDirectory);
+
+  // fsync on directories is not supported on Windows, so we skip it there
+  // On Unix systems, this ensures directory metadata is persisted to disk
   if (process.platform !== "win32") {
     const dirHandle = await fs.promises.open(targetDirectory, "r");
     try {
@@ -10169,15 +10192,27 @@ const ensureDirectoryExists = async directory => {
     });
   }
 };
+
+/**
+ * Checks if a directory already exists at the given path
+ */
 const checkIfDirectoryExists = async directory => {
   const exists = await fs.promises.access(directory).then(() => true).catch(() => false);
   return exists;
 };
+
+/**
+ * Checks if an application directory with the given name already exists in the target directory
+ */
 const checkIfAppDirectoryExists = async (appName, targetDirectory) => {
   const safeAppName = appName.replace(/[^a-zA-Z0-9-_]/g, "_");
   const appDirectoryPath = path$2.join(targetDirectory, safeAppName);
   return await checkIfDirectoryExists(appDirectoryPath);
 };
+
+/**
+ * Writes application source code to disk in a new directory
+ */
 const writeApplicationToDisk = async (appName, sourceCode, targetDirectory, overwriteExisting = false) => {
   if (overwriteExisting) {
     await createFileSystemFromJson(sourceCode, targetDirectory);
@@ -10255,7 +10290,7 @@ const updateExistingAppDirectory = async (session, machineCodeAppDirectoryInfo,
   }
   const appWithSourceCode = await getAppFromDigitalTwin(session.environment, machineCodeAppDirectoryInfo, linkedAllocation.sessionId);
   await writeApplicationToDisk(appWithSourceCode.name, appWithSourceCode.sourceCode, currentDir, true);
-  await writeMachineCodeAppDirectoryInfo(currentDir, Object.assign(Object.assign({}, machineCodeAppDirectoryInfo), {
+  await writeMachineCodeAppDirectoryInfo(currentDir, Object.assign({}, machineCodeAppDirectoryInfo, {
     lastPulledAt: new Date().toISOString()
   }));
   console.log();
@@ -10303,7 +10338,7 @@ const require$1 = createRequire(import.meta.url);
 function loadPackageJson() {
   try {
     return require$1("./package.json");
-  } catch (_a) {
+  } catch (_unused) {
     return require$1("../package.json");
   }
 }
@@ -10475,7 +10510,7 @@ program.command("push").description("Push local changes from this directory to t
     };
     console.log(chalk.blue("Pushing to digital twin..."));
     await pushApplicationToDigitalTwin(session.environment, updatedMachineCodeAppDirectoryInfo.designId, linkedAllocation.sessionId, applicationToPush);
-    await writeMachineCodeAppDirectoryInfo(currentDir, Object.assign(Object.assign({}, updatedMachineCodeAppDirectoryInfo), {
+    await writeMachineCodeAppDirectoryInfo(currentDir, Object.assign({}, updatedMachineCodeAppDirectoryInfo, {
       lastPushedAt: new Date().toISOString()
     }));
     console.log();
@@ -10505,9 +10540,15 @@ program.command("pull").description("Pull an application from a design to this d
     handleCommandError(error, "Failed to pull application");
   }
 });
+
+// Only run the CLI if this is the main module (not imported for testing)
+// we need to resolve the real path, because in local development, the path is a symlink
 const resolvedArgv = realpathSync(process.argv[1]);
+// fileURLToPath correctly handles Windows paths (C:\...) vs Unix paths (/...)
+// Without this, Windows comparisons fail due to leading slash in pathname
 const resolvedUrlPath = realpathSync(fileURLToPath(import.meta.url));
 if (resolvedArgv === resolvedUrlPath) {
+  // Only show logo when no command is provided or help is requested
   const showLogoConditions = [process.argv.length <= 2, process.argv.includes("--help"), process.argv.includes("-h")];
   if (showLogoConditions.some(Boolean)) {
     console.log(chalk.cyan(ventionLogo));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vention/vention-cli",
-  "version": "0.24.2",
+  "version": "0.24.3",
   "description": "CLI tool for Vention applications",
   "type": "module",
   "engines": {