@wundr.io/cli 1.0.0 → 1.0.2-dev.20260530174250.ef0ec927

package/src/commands/batch.ts

@@ -1,14 +1,17 @@
-import { Command } from 'commander';
-import fs from 'fs-extra';
 import path from 'path';
+
 import chalk from 'chalk';
-import YAML from 'yaml';
+import fs from 'fs-extra';
 import { Listr } from 'listr2';
-import { ConfigManager } from '../utils/config-manager';
-import { PluginManager } from '../plugins/plugin-manager';
-import { logger } from '../utils/logger';
+import YAML from 'yaml';
+
 import { errorHandler } from '../utils/error-handler';
-import { BatchJob, BatchCommand } from '../types';
+import { logger } from '../utils/logger';
+
+import type { PluginManager } from '../plugins/plugin-manager';
+import type { BatchJob, BatchCommand } from '../types';
+import type { ConfigManager } from '../utils/config-manager';
+import type { Command } from 'commander';
 
 /**
  * Batch commands for YAML automation and batch processing
@@ -560,6 +563,11 @@ export class BatchCommands {
     return { valid: errors.length === 0, errors };
   }
 
+  /**
+   * Regex for valid variable names in batch templates.
+   */
+  private static readonly VALID_VARIABLE_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
   private async processJobVariables(
     job: BatchJob,
     vars?: string
@@ -573,25 +581,58 @@ export class BatchCommands {
       } catch {
         // Parse as key=value pairs
         vars.split(',').forEach(pair => {
-          const [key, value] = pair.split('=');
-          if (key && value) {
-            variables[key.trim()] = value.trim();
+          const eqIndex = pair.indexOf('=');
+          if (eqIndex > 0) {
+            const key = pair.slice(0, eqIndex).trim();
+            const value = pair.slice(eqIndex + 1).trim();
+            if (key) {
+              variables[key] = value;
+            }
           }
         });
       }
     }
 
-    // Replace variables in job
-    const processedJob = JSON.parse(JSON.stringify(job));
-    const jobString = JSON.stringify(processedJob);
-    let processedString = jobString;
+    // Validate variable names to prevent regex injection
+    for (const key of Object.keys(variables)) {
+      if (!BatchCommands.VALID_VARIABLE_NAME.test(key)) {
+        throw new Error(
+          `Invalid variable name "${key}": must match [a-zA-Z_][a-zA-Z0-9_]*`
+        );
+      }
+    }
 
-    Object.entries(variables).forEach(([key, value]) => {
-      const placeholder = new RegExp(`\\{\\{${key}\\}\\}`, 'g');
-      processedString = processedString.replace(placeholder, String(value));
-    });
+    // SECURITY: Instead of replacing {{var}} in a JSON-stringified string
+    // (which allows JSON structure breakout via quotes in values), we walk
+    // the job structure and only replace in string leaf values. Values are
+    // JSON-escaped to prevent structure injection.
+    const processedJob: BatchJob = JSON.parse(JSON.stringify(job));
+
+    const replaceVarsInString = (str: string): string => {
+      let result = str;
+      for (const [key, value] of Object.entries(variables)) {
+        const placeholder = `{{${key}}}`;
+        // Only replace exact placeholder matches, not regex patterns
+        while (result.includes(placeholder)) {
+          result = result.replace(placeholder, String(value));
+        }
+      }
+      return result;
+    };
+
+    // Walk commands and replace variables in string fields only
+    processedJob.commands = processedJob.commands.map(cmd => ({
+      ...cmd,
+      command: replaceVarsInString(cmd.command),
+      args: cmd.args?.map(arg => replaceVarsInString(arg)),
+      condition: cmd.condition ? replaceVarsInString(cmd.condition) : undefined,
+    }));
+
+    if (processedJob.description) {
+      processedJob.description = replaceVarsInString(processedJob.description);
+    }
 
-    return JSON.parse(processedString);
+    return processedJob;
   }
 
   private async showDryRun(job: BatchJob): Promise<void> {
@@ -646,6 +687,91 @@ export class BatchCommands {
     await listr.run();
   }
 
+  /**
+   * Shell metacharacters that indicate injection attempts.
+   * These characters have special meaning in sh/bash and must not
+   * appear in arguments passed to spawn().
+   */
+  private static readonly SHELL_METACHARACTERS = /[;&|`$(){}[\]<>!#~*?\n\r\\]/;
+
+  /**
+   * Tokenize a command string into [binary, ...args] without shell
+   * interpretation. Supports simple single/double quoting.
+   */
+  private tokenizeCommand(command: string): string[] {
+    const tokens: string[] = [];
+    let current = '';
+    let inSingle = false;
+    let inDouble = false;
+
+    for (let i = 0; i < command.length; i++) {
+      const ch = command[i];
+
+      if (inSingle) {
+        if (ch === "'") {
+          inSingle = false;
+        } else {
+          current += ch;
+        }
+        continue;
+      }
+
+      if (inDouble) {
+        if (ch === '"') {
+          inDouble = false;
+        } else {
+          current += ch;
+        }
+        continue;
+      }
+
+      if (ch === "'") {
+        inSingle = true;
+        continue;
+      }
+      if (ch === '"') {
+        inDouble = true;
+        continue;
+      }
+
+      if (ch === ' ' || ch === '\t') {
+        if (current.length > 0) {
+          tokens.push(current);
+          current = '';
+        }
+        continue;
+      }
+
+      current += ch;
+    }
+
+    if (current.length > 0) {
+      tokens.push(current);
+    }
+
+    if (inSingle || inDouble) {
+      throw new Error(`Unterminated quote in command: ${command}`);
+    }
+
+    return tokens;
+  }
+
+  /**
+   * Validate that no argument contains shell metacharacters.
+   * This is a defense-in-depth measure: since we never use shell: true,
+   * metacharacters would be treated literally, but their presence strongly
+   * suggests a command injection attempt.
+   */
+  private validateArgs(args: string[]): void {
+    for (const arg of args) {
+      if (BatchCommands.SHELL_METACHARACTERS.test(arg)) {
+        throw new Error(
+          `Argument contains shell metacharacters (possible injection): "${arg}"`
+        );
+      }
+    }
+  }
+
   private async executeCommand(
     cmd: BatchCommand,
     _options: any
@@ -657,13 +783,27 @@ export class BatchCommands {
     }
 
     const { spawn } = await import('child_process');
-    const [command, ...args] = cmd.command.split(' ');
-    const finalArgs = cmd.args ? [...args, ...cmd.args] : args;
+
+    // Tokenize the command string into binary + args without shell
+    // interpretation. This prevents command injection via shell metacharacters
+    // like ; | & ` $() etc.
+    const tokens = this.tokenizeCommand(cmd.command);
+    if (tokens.length === 0) {
+      throw new Error('Empty command');
+    }
+
+    const [command, ...parsedArgs] = tokens;
+    const finalArgs = cmd.args ? [...parsedArgs, ...cmd.args] : parsedArgs;
+
+    // Validate arguments for shell metacharacters as defense-in-depth
+    this.validateArgs(finalArgs);
 
     return new Promise((resolve, reject) => {
+      // SECURITY: No shell: true. The command is executed directly via
+      // execvp(), so shell metacharacters in arguments are treated as
+      // literal characters rather than being interpreted by a shell.
       const child = spawn(command ?? 'echo', finalArgs, {
         stdio: ['ignore', 'pipe', 'pipe'],
-        shell: true,
       });
 
       let output = '';
@@ -834,14 +974,14 @@ export class BatchCommands {
 
   private convertToDockerfile(job: BatchJob): string {
     let dockerfile = `# Generated from batch job: ${job.name}\n`;
-    dockerfile += `FROM node:18-alpine\n\n`;
+    dockerfile += 'FROM node:18-alpine\n\n';
 
     if (job.description) {
       dockerfile += `# ${job.description}\n`;
     }
 
-    dockerfile += `WORKDIR /app\n`;
-    dockerfile += `COPY . .\n\n`;
+    dockerfile += 'WORKDIR /app\n';
+    dockerfile += 'COPY . .\n\n';
 
     job.commands.forEach(cmd => {
       dockerfile += `RUN ${cmd.command}\n`;
@@ -887,7 +1027,7 @@ export class BatchCommands {
 
     return {
       name: name || 'package-scripts',
-      description: `Imported from package.json scripts`,
+      description: 'Imported from package.json scripts',
       commands,
     };
   }

package/src/commands/chat.ts

@@ -1,25 +1,31 @@
-import { Command } from 'commander';
-import inquirer from 'inquirer';
-import fs from 'fs-extra';
 import path from 'path';
+
 import chalk from 'chalk';
-import { ConfigManager } from '../utils/config-manager';
-import { PluginManager } from '../plugins/plugin-manager';
-import { logger } from '../utils/logger';
+import fs from 'fs-extra';
+import inquirer from 'inquirer';
+
+import { AIService } from '../ai/ai-service';
 import { errorHandler } from '../utils/error-handler';
-import { ChatSession, ChatMessage } from '../types';
+import { logger } from '../utils/logger';
+
+import type { PluginManager } from '../plugins/plugin-manager';
+import type { ChatSession, ChatMessage } from '../types';
+import type { ConfigManager } from '../utils/config-manager';
+import type { Command } from 'commander';
 
 /**
  * Chat commands for natural language interface
  */
 export class ChatCommands {
   private activeSessions: Map<string, ChatSession> = new Map();
+  private aiService: AIService;
 
   constructor(
     private program: Command,
     private configManager: ConfigManager,
     private pluginManager: PluginManager
   ) {
+    this.aiService = new AIService(configManager);
     this.registerCommands();
   }
 
@@ -622,9 +628,13 @@ export class ChatCommands {
   }
 
   private async callAI(session: ChatSession, message: string): Promise<string> {
-    // Mock AI service call
-    // In a real implementation, this would call Claude, GPT, etc.
-    return `This is a mock response to: "${message}". The AI would provide a helpful response here based on the context and conversation history.`;
+    if (!this.aiService.isReady()) {
+      throw new Error(
+        'AI service not configured. Set ANTHROPIC_API_KEY environment variable to enable chat.'
+      );
+    }
+
+    return this.aiService.sendMessage(session.id, message);
   }
 
   private showChatHelp(): void {

package/src/commands/claude-init.ts

@@ -1,10 +1,12 @@
-import { Command } from 'commander';
-import * as fs from 'fs-extra';
-import * as path from 'path';
 import { execSync } from 'child_process';
+import * as path from 'path';
+
 import chalk from 'chalk';
-import ora from 'ora';
+import * as fs from 'fs-extra';
 import inquirer from 'inquirer';
+import ora from 'ora';
+
+import type { Command } from 'commander';
 
 interface ProjectInfo {
   name: string;
@@ -29,9 +31,7 @@ export class ClaudeInitCommand {
     this.program
       .command('claude-init')
       .alias('ci')
-      .description(
-        'Initialize Claude Code and Claude Flow in current repository'
-      )
+      .description('Initialize Claude Code and Ruflo in current repository')
       .option('-i, --interactive', 'Interactive mode with prompts')
       .option('-a, --audit', 'Run repository audit first')
       .option('-f, --force', 'Force overwrite existing CLAUDE.md')
@@ -79,8 +79,8 @@ export class ClaudeInitCommand {
     // Generate CLAUDE.md
     await this.generateClaudeMd(projectInfo, options);
 
-    // Setup Claude Flow
-    await this.setupClaudeFlow(projectInfo, options);
+    // Setup Ruflo
+    await this.setupRuflo(projectInfo, options);
 
     // Setup MCP tools
     await this.setupMcpTools(options.mcpTools);
@@ -183,10 +183,12 @@ export class ClaudeInitCommand {
     };
 
     // Structure checks
-    if (await fs.pathExists('src'))
+    if (await fs.pathExists('src')) {
       auditResults.categories.structure.score += 10;
-    if (await fs.pathExists('.gitignore'))
+    }
+    if (await fs.pathExists('.gitignore')) {
       auditResults.categories.structure.score += 5;
+    }
     if (projectInfo.isMonorepo && (await fs.pathExists('packages'))) {
       auditResults.categories.structure.score += 5;
     }
@@ -291,8 +293,8 @@ export class ClaudeInitCommand {
     const answers = await inquirer.prompt([
       {
         type: 'confirm',
-        name: 'setupClaudeFlow',
-        message: 'Setup Claude Flow orchestration?',
+        name: 'setupRuflo',
+        message: 'Setup Ruflo orchestration?',
         default: true,
       },
       {
@@ -560,17 +562,19 @@ By: Wundr Claude Init
     return patterns.join('\n\n');
   }
 
-  private async setupClaudeFlow(
+  private async setupRuflo(
     projectInfo: ProjectInfo,
     options: any
   ): Promise<void> {
-    if (!options.setupClaudeFlow) return;
+    if (!options.setupRuflo) {
+      return;
+    }
 
-    this.spinner.start('Setting up Claude Flow...');
+    this.spinner.start('Setting up Ruflo...');
 
     try {
-      // Initialize Claude Flow
-      execSync('npx claude-flow@alpha init', { stdio: 'ignore' });
+      // Initialize Ruflo
+      execSync('npx ruflo@latest init', { stdio: 'ignore' });
 
       // Configure for project
       const config = {
@@ -581,24 +585,26 @@ By: Wundr Claude Init
           : this.getDefaultAgents(projectInfo),
         memory: {
           backend: 'sqlite',
-          path: '.claude-flow/memory.db',
+          path: '.ruflo/memory.db',
         },
         neural: {
           enabled: true,
-          modelPath: '.claude-flow/models',
+          modelPath: '.ruflo/models',
         },
       };
 
-      await fs.writeJson('.claude-flow/config.json', config, { spaces: 2 });
-      this.spinner.succeed('Claude Flow configured');
+      await fs.writeJson('.ruflo/config.json', config, { spaces: 2 });
+      this.spinner.succeed('Ruflo configured');
     } catch (error) {
-      this.spinner.fail('Failed to setup Claude Flow');
+      this.spinner.fail('Failed to setup Ruflo');
       console.error(chalk.red(error));
     }
   }
 
   private async setupMcpTools(mcpTools: string | string[]): Promise<void> {
-    if (!mcpTools) return;
+    if (!mcpTools) {
+      return;
+    }
 
     const tools = Array.isArray(mcpTools) ? mcpTools : mcpTools.split(',');
 
@@ -702,9 +708,7 @@ echo "✅ All quality checks passed!"
       chalk.white('3. Restart Claude Desktop to load new configurations')
     );
     console.log(
-      chalk.white(
-        '4. Run: npx claude-flow@alpha sparc tdd "your first feature"'
-      )
+      chalk.white('4. Run: npx ruflo@latest sparc tdd "your first feature"')
     );
     console.log(chalk.cyan('\n🚀 Happy coding with Claude!\n'));
   }