arcane-cli 1.1.0 → 1.1.1

package/dist/index.js

@@ -19,13 +19,37 @@ import {
   access,
   readdir,
   readFile,
+  rm,
   writeFile
 } from "fs/promises";
 import { createHash } from "crypto";
 import path from "path";
+function normalizeLineEndings(content) {
+  if (!content.includes(13)) return content;
+  const out = Buffer.allocUnsafe(content.length);
+  let o = 0;
+  for (let i = 0; i < content.length; i++) {
+    const byte = content[i];
+    if (byte === 13) {
+      out[o++] = 10;
+      if (content[i + 1] === 10) i++;
+      continue;
+    }
+    out[o++] = byte;
+  }
+  return out.subarray(0, o);
+}
+function hashContent(content) {
+  const bytes = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
+  return createHash("sha256").update(normalizeLineEndings(bytes)).digest("hex");
+}
 async function hashFile(filePath) {
+  return hashContent(await readFile(filePath));
+}
+async function fileMatchesHash(filePath, recordedHash) {
   const content = await readFile(filePath);
-  return createHash("sha256").update(content).digest("hex");
+  if (hashContent(content) === recordedHash) return true;
+  return createHash("sha256").update(content).digest("hex") === recordedHash;
 }
 function validateTargetPath(targetDir, relativePath) {
   const resolvedBase = path.resolve(targetDir);
@@ -57,10 +81,14 @@ async function copyFile(srcPath, targetDir, relativePath, opts = {}) {
     );
   }
   const content = await readFile(srcPath);
-  const hash = createHash("sha256").update(content).digest("hex");
+  const hash = hashContent(content);
   await writeFile(destPath, content);
   return hash;
 }
+async function removeWithin(targetDir, relativePath) {
+  validateTargetPath(targetDir, relativePath);
+  await rm(path.resolve(targetDir, relativePath), { force: true });
+}
 async function copyDirectory(srcDir, targetDir, relativeDir, opts = {}) {
   validateTargetPath(targetDir, relativeDir);
   const copiedFiles = [];
@@ -838,8 +866,7 @@ function listProfiles() {
 }
 
 // src/modules/user-tier.ts
-import { createHash as createHash2 } from "crypto";
-import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rm, rmdir, writeFile as writeFile3 } from "fs/promises";
+import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rm as rm2, rmdir, writeFile as writeFile3 } from "fs/promises";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 
@@ -902,6 +929,7 @@ function renderClaudeCommandStub(id, frontmatter, canonicalRef = canonicalSpellP
   const title = deriveStubTitle(frontmatter.name);
   const description = frontmatter.claudeDescription ?? frontmatter.description;
   const promptPath = canonicalRef;
+  const includeRef = /\s/.test(promptPath) ? `"${promptPath}"` : promptPath;
   return `---
 description: ${description}
 ---
@@ -914,7 +942,7 @@ See the full prompt at \`${promptPath}\` for the complete workflow definition.
 
 ---
 
-@${promptPath}
+@${includeRef}
 `;
 }
 var SKILL_NAME_PATTERN = /^[a-z0-9-]+$/;
@@ -1041,9 +1069,6 @@ async function classifyTarget(path4) {
     throw err;
   }
 }
-function sha256(content) {
-  return createHash2("sha256").update(content, "utf-8").digest("hex");
-}
 function perSpellDirectory(homeDir, relativePath) {
   if (clientOfFanoutPath(relativePath) !== "codex") return void 0;
   return dirname(join(homeDir, relativePath));
@@ -1072,9 +1097,10 @@ async function syncUserTierFanout(options) {
     }
   }
   for (const file of desired) {
+    validateTargetPath(options.homeDir, file.relativePath);
     const target = join(options.homeDir, file.relativePath);
     const recorded = previous[file.relativePath];
-    const newHash = sha256(file.content);
+    const newHash = hashContent(file.content);
     const state = await classifyTarget(target);
     if (state === "absent") {
       if (!dryRun) {
@@ -1089,12 +1115,12 @@ async function syncUserTierFanout(options) {
       outcomes.push({ relativePath: file.relativePath, status: "collision" });
       continue;
     }
-    const currentHash = await hashFile(target);
-    if (currentHash !== recorded) {
+    if (!await fileMatchesHash(target, recorded)) {
       record[file.relativePath] = recorded;
       outcomes.push({ relativePath: file.relativePath, status: "customized" });
       continue;
     }
+    const currentHash = await hashFile(target);
     if (currentHash === newHash) {
       record[file.relativePath] = newHash;
       outcomes.push({ relativePath: file.relativePath, status: "unchanged" });
@@ -1106,19 +1132,20 @@ async function syncUserTierFanout(options) {
   }
   for (const [relativePath, recorded] of Object.entries(previous)) {
     if (desiredPaths.has(relativePath)) continue;
+    validateTargetPath(options.homeDir, relativePath);
     const target = join(options.homeDir, relativePath);
     const state = await classifyTarget(target);
     if (state === "absent") {
       outcomes.push({ relativePath, status: "gone" });
       continue;
     }
-    if (state === "other" || await hashFile(target) !== recorded) {
+    if (state === "other" || !await fileMatchesHash(target, recorded)) {
       record[relativePath] = recorded;
       outcomes.push({ relativePath, status: "kept-edited" });
       continue;
     }
     if (!dryRun) {
-      await rm(target, { force: true });
+      await rm2(target, { force: true });
       const spellDir = perSpellDirectory(options.homeDir, relativePath);
       if (spellDir !== void 0) await removeDirectoryIfEmpty(spellDir);
     }
@@ -1209,7 +1236,7 @@ async function inspectUserTierFanout(homeDir, record) {
       health.missing.push(relativePath);
       continue;
     }
-    if (state === "other" || await hashFile(target) !== recorded) health.customized.push(relativePath);
+    if (state === "other" || !await fileMatchesHash(target, recorded)) health.customized.push(relativePath);
   }
   return health;
 }
@@ -1834,7 +1861,7 @@ import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/modules/merger.ts
-import { readFile as readFile5, writeFile as writeFile4, rm as rm2 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile4, rm as rm3 } from "fs/promises";
 import path3 from "path";
 var MARKER_START = "<!-- arcane:start -->";
 var MARKER_END = "<!-- arcane:end -->";
@@ -1920,7 +1947,7 @@ async function stripMarkerSection(targetDir, relativePath, opts = {}) {
   const stripped = (before + after).replace(/\n{3,}/g, "\n\n").trim();
   if (!opts.dryRun) {
     if (stripped.length === 0) {
-      await rm2(destPath, { force: true });
+      await rm3(destPath, { force: true });
     } else {
       await writeFile4(destPath, stripped + "\n", "utf8");
     }
@@ -2426,7 +2453,7 @@ async function runAgentsList(targetDir) {
 }
 
 // src/modules/push-safety.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7, chmod, access as access3, rm as rm3, readdir as readdir4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7, chmod, access as access3, rm as rm4, readdir as readdir4 } from "fs/promises";
 import { constants } from "fs";
 import { join as join5, resolve as resolve2, dirname as dirname2, basename } from "path";
 
@@ -2843,7 +2870,7 @@ async function removeHook(cwd, hookName) {
   if (!isArcaneHooksPath(root, existing.value)) return;
   if (existing.scope !== "local" && existing.scope !== "worktree") return;
   try {
-    await rm3(await hookFilePath(cwd, hookName), { force: true });
+    await rm4(await hookFilePath(cwd, hookName), { force: true });
   } catch {
   }
   const hooksDir = join5(root, ARCANE_HOOKS_DIR);
@@ -3757,7 +3784,7 @@ async function runAdd(name, options, targetDir, assetsDir, packageVersion) {
 
 // src/commands/update.ts
 import { dirname as dirname4, join as join9 } from "path";
-import { readFile as readFile7, writeFile as writeFile9, rm as rm4 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile9 } from "fs/promises";
 
 // src/modules/hub.ts
 import { confirm as confirm2, select as select3, input as input3 } from "@inquirer/prompts";
@@ -4110,6 +4137,12 @@ function migrateLegacyComponents(components) {
   return out;
 }
 async function resolveOrphan(targetDir, file, recordedHash, prune) {
+  try {
+    validateTargetPath(targetDir, file);
+  } catch {
+    console.log(`  ! Refused (path escapes the target directory): ${file}`);
+    return "reported";
+  }
   const filePath = join9(targetDir, file);
   if (!await fileExists(filePath)) return "not-found";
   if (!prune) return "reported";
@@ -4117,12 +4150,11 @@ async function resolveOrphan(targetDir, file, recordedHash, prune) {
     console.log(`  ! Orphaned, not pruned (no recorded hash to verify it's untouched): ${file}`);
     return "reported";
   }
-  const currentHash = await hashFile(filePath);
-  if (currentHash !== recordedHash) {
+  if (!await fileMatchesHash(filePath, recordedHash)) {
     console.log(`  ! Orphaned but edited since install \u2014 not pruning: ${file}`);
     return "reported";
   }
-  await rm4(filePath, { force: true });
+  await removeWithin(targetDir, file);
   console.log(`  Pruned orphaned file: ${file}`);
   return "pruned";
 }
@@ -4279,7 +4311,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           continue;
         }
       }
-      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && await hashFile(join9(targetDir, file)) !== recordedHash;
+      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join9(targetDir, file), recordedHash);
       if (preserveExisting) {
         console.log(`  ${options.dryRun ? "[dry-run] Would preserve" : "Preserved"}: ${file}`);
       } else if (editedByOperator && isClientShimPath(file)) {
@@ -4755,11 +4787,13 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
   let removed = 0;
   for (const component of manifest.components) {
     for (const file of component.files) {
-      const filePath = join11(targetDir, file);
       try {
-        await rm5(filePath, { force: true });
+        await removeWithin(targetDir, file);
         removed++;
-      } catch {
+      } catch (err) {
+        console.log(
+          `  ! Skipped ${file}: ${err instanceof Error ? err.message : String(err)}`
+        );
       }
     }
   }
@@ -4827,8 +4861,12 @@ async function uninstallUserTier(options, storeRoot, manifest) {
   });
   let removed = 0;
   for (const file of storeFiles) {
-    await rm5(join11(storeRoot, file), { force: true });
-    removed++;
+    try {
+      await removeWithin(storeRoot, file);
+      removed++;
+    } catch (err) {
+      console.log(`  ! Skipped ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   await rm5(join11(storeRoot, ".arcane.json"), { force: true });
   await removeDirectoryIfEmpty(join11(storeRoot, USER_TIER_SPELLS_DIR));
@@ -6199,9 +6237,10 @@ async function getVersionAtRef(cwd, ref) {
     return null;
   }
 }
-async function getCloseCommit(cwd, completedDate) {
+async function getCloseCommit(cwd, completedDate, generatedOutputs = []) {
   if (!completedDate) {
-    const head = await runGitTextOrNull(cwd, ["rev-parse", "HEAD"]);
+    const args = generatedOutputs.length === 0 ? ["rev-parse", "HEAD"] : ["log", "-1", "--format=%H", "HEAD", "--", ".", ...generatedOutputs.map((p) => `:(exclude)${p}`)];
+    const head = await runGitTextOrNull(cwd, args);
     return head === null || head === "" ? null : head;
   }
   const log = await runGitTextOrNull(cwd, ["log", "--format=%H%x09%cs", "HEAD"]);
@@ -6212,13 +6251,14 @@ async function getCloseCommit(cwd, completedDate) {
   }
   return null;
 }
-async function getCast(cwd, fromRef, toRef) {
+async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
   const ETX = "";
   const log = await runGitTextOrNull(cwd, [
     "log",
     "--no-merges",
     `--format=%B${ETX}`,
-    `${fromRef}..${toRef}`
+    `${fromRef}..${toRef}`,
+    ...generatedOutputs.length > 0 ? ["--", ".", ...generatedOutputs.map((p) => `:(exclude)${p}`)] : []
   ]);
   const cast = /* @__PURE__ */ new Map();
   if (log === null || log === "") return cast;
@@ -6357,12 +6397,18 @@ async function buildShowReportModel(options) {
   const cast = /* @__PURE__ */ new Map();
   if (frontmatter.baseline) {
     const baselineSha = extractSha(frontmatter.baseline);
-    const closeSha = await getCloseCommit(options.rootDir, frontmatter.completed);
+    const reportDir = options.planRelPath.split("/").slice(0, -1).join("/");
+    const generatedOutputs = ["show-report.json", "show-report.html"].map(
+      (f) => reportDir ? `${reportDir}/${f}` : f
+    );
+    const closeSha = await getCloseCommit(options.rootDir, frontmatter.completed, generatedOutputs);
     if (closeSha) {
       const [from, to, castMap] = await Promise.all([
         getVersionAtRef(options.rootDir, baselineSha),
         getVersionAtRef(options.rootDir, closeSha),
-        getCast(options.rootDir, baselineSha, closeSha)
+        // Regeneration-only commits are never part of the cast, for a closed
+        // program as much as an active one.
+        getCast(options.rootDir, baselineSha, closeSha, generatedOutputs)
       ]);
       if (from && to) versionSpan = { from, to };
       for (const [name, count] of castMap) cast.set(name, count);
@@ -6540,7 +6586,7 @@ async function programFromPlanPath(rootDir, planPath) {
   const planRelPath = toPosix(relative3(rootDir, planAbs));
   return programFromPlan(rootDir, basename3(dirname9(planAbs)), planRelPath);
 }
-function normalizeLineEndings(content) {
+function normalizeLineEndings2(content) {
   return content.replace(/\r\n?/g, "\n");
 }
 async function readOptionalFile(path4) {
@@ -6586,7 +6632,7 @@ async function runReportGeneration(options) {
     ];
     for (const [relPath, expected] of outputs) {
       const actual = await readOptionalFile(join16(options.rootDir, relPath));
-      if (actual === null || normalizeLineEndings(actual) !== normalizeLineEndings(expected)) {
+      if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });