@vizzly-testing/cli 0.19.1 → 0.19.2

package/dist/services/tdd-service.js

@@ -21,7 +21,7 @@
  */
 
 import crypto from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { compare } from '@vizzly-testing/honeydiff';
 import { NetworkError } from '../errors/vizzly-error.js';
@@ -184,11 +184,50 @@ export class TddService {
           throw new Error(`Build ${buildId} not found or API returned null`);
         }
 
+        // When downloading baselines, always start with a clean slate
+        // This handles signature property changes, build switches, and any stale state
+        output.info('Clearing local state before downloading baselines...');
+        try {
+          // Clear everything - baselines, current screenshots, diffs, and metadata
+          // This ensures we start fresh with the new baseline build
+          rmSync(this.baselinePath, {
+            recursive: true,
+            force: true
+          });
+          rmSync(this.currentPath, {
+            recursive: true,
+            force: true
+          });
+          rmSync(this.diffPath, {
+            recursive: true,
+            force: true
+          });
+          mkdirSync(this.baselinePath, {
+            recursive: true
+          });
+          mkdirSync(this.currentPath, {
+            recursive: true
+          });
+          mkdirSync(this.diffPath, {
+            recursive: true
+          });
+
+          // Clear baseline metadata file (will be regenerated with new baseline)
+          const baselineMetadataPath = safePath(this.workingDir, '.vizzly', 'baseline-metadata.json');
+          if (existsSync(baselineMetadataPath)) {
+            rmSync(baselineMetadataPath, {
+              force: true
+            });
+          }
+        } catch (error) {
+          output.error(`Failed to clear local state: ${error.message}`);
+        }
+
         // Extract signature properties from API response (for variant support)
         if (apiResponse.signatureProperties && Array.isArray(apiResponse.signatureProperties)) {
           this.signatureProperties = apiResponse.signatureProperties;
           if (this.signatureProperties.length > 0) {
-            output.info(`Using custom signature properties: ${this.signatureProperties.join(', ')}`);
+            output.info(`Using signature properties: ${this.signatureProperties.join(', ')}`);
           }
         }
         baselineBuild = apiResponse.build;

package/dist/utils/security.js

@@ -13,6 +13,62 @@ import * as output from './output.js';
  * @param {boolean} allowSlashes - Whether to allow forward slashes (for browser version strings)
  * @returns {string} Sanitized screenshot name
  */
+/**
+ * Validate screenshot name for security (no transformations, just validation)
+ * Throws if name contains path traversal or other dangerous patterns
+ *
+ * @param {string} name - Screenshot name to validate
+ * @param {number} maxLength - Maximum allowed length
+ * @returns {string} The original name (unchanged) if valid
+ * @throws {Error} If name contains dangerous patterns
+ */
+export function validateScreenshotName(name, maxLength = 255) {
+  if (typeof name !== 'string' || name.length === 0) {
+    throw new Error('Screenshot name must be a non-empty string');
+  }
+  if (name.length > maxLength) {
+    throw new Error(`Screenshot name exceeds maximum length of ${maxLength} characters`);
+  }
+
+  // Block directory traversal patterns
+  if (name.includes('..') || name.includes('\\')) {
+    throw new Error('Screenshot name contains invalid path characters');
+  }
+
+  // Block forward slashes (path separators)
+  if (name.includes('/')) {
+    throw new Error('Screenshot name cannot contain forward slashes');
+  }
+
+  // Block absolute paths
+  if (isAbsolute(name)) {
+    throw new Error('Screenshot name cannot be an absolute path');
+  }
+
+  // Return the original name unchanged - validation only!
+  return name;
+}
+
+/**
+ * Validate screenshot name for security (allows spaces, preserves original name)
+ *
+ * This function only validates for security - it does NOT transform spaces.
+ * Spaces are preserved so that:
+ * 1. generateScreenshotSignature() uses the original name with spaces (matches cloud)
+ * 2. generateBaselineFilename() handles space→hyphen conversion (matches cloud)
+ *
+ * Flow: "VBtn dark" → sanitize → "VBtn dark" → signature: "VBtn dark|1265||" → filename: "VBtn-dark_hash.png"
+ *
+ * @param {string} name - Screenshot name to validate
+ * @param {number} maxLength - Maximum allowed length (default: 255)
+ * @param {boolean} allowSlashes - Whether to allow forward slashes (for browser version strings)
+ * @returns {string} The validated name (unchanged if valid, spaces preserved)
+ * @throws {Error} If name contains dangerous patterns
+ *
+ * @example
+ * sanitizeScreenshotName("VBtn dark") // Returns "VBtn dark" (spaces preserved)
+ * sanitizeScreenshotName("My/Component") // Throws error (contains /)
+ */
 export function sanitizeScreenshotName(name, maxLength = 255, allowSlashes = false) {
   if (typeof name !== 'string' || name.length === 0) {
     throw new Error('Screenshot name must be a non-empty string');
@@ -36,9 +92,10 @@ export function sanitizeScreenshotName(name, maxLength = 255, allowSlashes = fal
     throw new Error('Screenshot name cannot be an absolute path');
   }
 
-  // Allow only safe characters: alphanumeric, hyphens, underscores, dots, and optionally slashes
+  // Allow only safe characters: alphanumeric, hyphens, underscores, dots, spaces, and optionally slashes
+  // Spaces are allowed here and will be converted to hyphens in generateBaselineFilename() to match cloud behavior
   // Replace other characters with underscores
-  const allowedChars = allowSlashes ? /[^a-zA-Z0-9._/-]/g : /[^a-zA-Z0-9._-]/g;
+  const allowedChars = allowSlashes ? /[^a-zA-Z0-9._ /-]/g : /[^a-zA-Z0-9._ -]/g;
   let sanitized = name.replace(allowedChars, '_');
 
   // Prevent names that start with dots (hidden files)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizzly-testing/cli",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Visual review platform for UI developers and designers",
   "keywords": [
     "visual-testing",