akm-cli 0.0.21 → 0.0.23

package/dist/stash-source-manage.js

@@ -0,0 +1,82 @@
+import path from "node:path";
+import { loadConfig, saveConfig } from "./config";
+import { UsageError } from "./errors";
+import { resolveStashSources } from "./stash-source";
+// ── Operations ──────────────────────────────────────────────────────────────
+/**
+ * Add a stash source (filesystem path or remote provider URL) to config.
+ *
+ * Filesystem paths are auto-detected when `target` does not start with
+ * `http://` or `https://`. URL sources require a `providerType` option
+ * (e.g. "openviking").
+ */
+export function addStashSource(opts) {
+    const { target, name, providerType, options: providerOptions } = opts;
+    const config = loadConfig();
+    const stashes = [...(config.stashes ?? [])];
+    const isUrl = target.startsWith("http://") || target.startsWith("https://");
+    let entry;
+    if (isUrl) {
+        if (!providerType) {
+            throw new UsageError("--provider is required for URL sources (e.g. --provider openviking)");
+        }
+        // Deduplicate by URL
+        if (stashes.some((s) => s.url === target)) {
+            return { stashes, added: false, message: "Source URL already configured" };
+        }
+        entry = { type: providerType, url: target };
+        if (name)
+            entry.name = name;
+        if (providerOptions)
+            entry.options = providerOptions;
+    }
+    else {
+        // Filesystem path
+        const resolvedPath = path.resolve(target);
+        if (stashes.some((s) => s.path && path.resolve(s.path) === resolvedPath)) {
+            return { stashes, added: false, message: "Source path already configured" };
+        }
+        entry = { type: "filesystem", path: resolvedPath };
+        if (name)
+            entry.name = name;
+    }
+    stashes.push(entry);
+    saveConfig({ ...config, stashes });
+    return { stashes, added: true, entry };
+}
+/**
+ * Remove a stash source by URL, path, or name.
+ * Match priority: URL > path > name (most specific first).
+ */
+export function removeStashSource(target) {
+    const config = loadConfig();
+    const stashes = [...(config.stashes ?? [])];
+    const isUrl = target.startsWith("http://") || target.startsWith("https://");
+    const resolvedPath = !isUrl ? path.resolve(target) : undefined;
+    // Try URL match first, then path, then name (most specific → least specific)
+    let idx = -1;
+    if (isUrl) {
+        idx = stashes.findIndex((s) => s.url === target);
+    }
+    if (idx === -1 && resolvedPath) {
+        idx = stashes.findIndex((s) => s.path && path.resolve(s.path) === resolvedPath);
+    }
+    if (idx === -1) {
+        idx = stashes.findIndex((s) => s.name === target);
+    }
+    if (idx === -1) {
+        return { stashes, removed: false, message: "No matching source found" };
+    }
+    const removed = stashes.splice(idx, 1)[0];
+    saveConfig({ ...config, stashes });
+    return { stashes, removed: true, entry: removed };
+}
+/**
+ * List all stash sources (local filesystem + configured stashes).
+ */
+export function listStashSources() {
+    const config = loadConfig();
+    const localSources = resolveStashSources();
+    const stashes = config.stashes ?? [];
+    return { localSources, stashes };
+}

package/dist/stash-source.js

@@ -17,25 +17,33 @@ export function resolveStashSources(overrideStashDir, existingConfig) {
     const stashDir = overrideStashDir ?? resolveStashDir();
     const config = existingConfig ?? loadConfig();
     const sources = [{ path: stashDir }];
-    for (const dir of config.searchPaths) {
+    const seen = new Set([path.resolve(stashDir)]);
+    const addSource = (dir, registryId) => {
+        const resolved = path.resolve(dir);
+        if (seen.has(resolved))
+            return;
+        seen.add(resolved);
         if (isSuspiciousStashRoot(dir)) {
             warn(`Warning: stash root "${dir}" appears to be a system directory. This may be unintentional.`);
         }
         if (isValidDirectory(dir)) {
-            sources.push({ path: dir });
+            sources.push({ path: resolved, ...(registryId ? { registryId } : {}) });
         }
+    };
+    // Legacy: searchPaths[]
+    for (const dir of config.searchPaths) {
+        addSource(dir);
     }
-    for (const entry of config.installed ?? []) {
-        if (isSuspiciousStashRoot(entry.stashRoot)) {
-            warn(`Warning: stash root "${entry.stashRoot}" appears to be a system directory. This may be unintentional.`);
-        }
-        if (isValidDirectory(entry.stashRoot)) {
-            sources.push({
-                path: entry.stashRoot,
-                registryId: entry.id,
-            });
+    // Filesystem entries from stashes[]
+    for (const entry of config.stashes ?? []) {
+        if (entry.type === "filesystem" && entry.path && entry.enabled !== false) {
+            addSource(entry.path, entry.name);
         }
     }
+    // Installed kits (registry and local)
+    for (const entry of config.installed ?? []) {
+        addSource(entry.stashRoot, entry.id);
+    }
     return sources;
 }
 /**

package/dist/walker.js

@@ -5,7 +5,6 @@
  * (stash.ts) and the indexer (indexer.ts) to walk type-specific asset
  * directories and group files by parent directory.
  */
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { isRelevantAssetFile } from "./asset-spec";
@@ -77,17 +76,16 @@ function walkStashGit(stashRoot) {
     if (!isInsideGitRepo(stashRoot))
         return null;
     // Get tracked + untracked (non-ignored) files
-    const result = spawnSync("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z", "--", "."], {
+    const result = Bun.spawnSync(["git", "ls-files", "--cached", "--others", "--exclude-standard", "-z", "--", "."], {
         cwd: stashRoot,
-        encoding: "utf8",
-        timeout: 30_000,
-        maxBuffer: 10 * 1024 * 1024, // 10MB
     });
-    if (result.status !== 0)
+    // result.success is false if the process exited non-zero OR git was not found
+    if (!result.success)
         return null;
     const SKIP_DIRS = new Set([".git", "node_modules", "bin", ".cache"]);
     const SKIP_FILES = new Set([".stash.json", ".gitignore", ".gitattributes"]);
-    const files = result.stdout
+    const stdout = Buffer.isBuffer(result.stdout) ? result.stdout.toString("utf8") : String(result.stdout ?? "");
+    const files = stdout
         .split("\0")
         .filter((f) => f.length > 0)
         .filter((f) => !f.startsWith("..") && !path.isAbsolute(f))
@@ -98,8 +96,7 @@ function walkStashGit(stashRoot) {
             .filter(Boolean);
         return !dirParts.some((part) => SKIP_DIRS.has(part) || part.startsWith("."));
     })
-        .filter((f) => !SKIP_FILES.has(path.basename(f)))
-        .filter((f) => !f.includes("/.") && !f.startsWith(".")); // skip dot-dirs/files
+        .filter((f) => !SKIP_FILES.has(path.basename(f)));
     const results = [];
     for (const relFile of files) {
         const absPath = path.join(stashRoot, relFile);
@@ -114,7 +111,11 @@ function walkStashGit(stashRoot) {
     }
     return results;
 }
-/** Check if a directory is inside a git repository by walking up to find .git. */
+/**
+ * Check if a directory is inside a git repository by walking up to find .git.
+ * Intentionally walks above stashRoot so that parent repo .gitignore rules
+ * apply when the stash is nested inside a larger git repository.
+ */
 function isInsideGitRepo(dir) {
     let current = path.resolve(dir);
     const root = path.parse(current).root;
@@ -149,6 +150,10 @@ function walkStashManual(stashRoot) {
             if (entry.name === ".stash.json")
                 continue;
             const fullPath = path.join(current, entry.name);
+            if (entry.isSymbolicLink()) {
+                // Skip symlinks entirely to prevent potential path traversal outside stashRoot
+                continue;
+            }
             if (entry.isDirectory()) {
                 if (SKIP_DIRS.has(entry.name) || entry.name.startsWith("."))
                     continue;

package/dist/warn.js

@@ -6,6 +6,13 @@ let quiet = false;
 export function setQuiet(value) {
     quiet = value;
 }
+/**
+ * Reset the quiet flag to false.
+ * Intended for test teardown to prevent quiet state from leaking between tests.
+ */
+export function resetQuiet() {
+    quiet = false;
+}
 export function isQuiet() {
     return quiet;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.0.21",
+  "version": "0.0.23",
   "type": "module",
   "description": "CLI tool to search, open, and run extension assets from an akm stash directory.",
   "keywords": [

package/dist/provider-registry.js

@@ -1,8 +0,0 @@
-// ── Factory map ─────────────────────────────────────────────────────────────
-const providers = new Map();
-export function registerProvider(type, factory) {
-    providers.set(type, factory);
-}
-export function resolveProviderFactory(type) {
-    return providers.get(type) ?? null;
-}