bmad-plus 0.12.1 → 0.13.0

package/tools/cli/lib/npm-runner.js

@@ -0,0 +1,177 @@
+/** Run npm through Node with bounded output and no shell interpolation. */
+const fs = require('node:fs');
+const path = require('node:path');
+const childProcess = require('node:child_process');
+
+function resolveNpmCli({
+  env = process.env,
+  execPath = process.execPath,
+  platform = process.platform,
+  realpath = fs.realpathSync,
+  isFile = (file) => fs.statSync(file).isFile(),
+} = {}) {
+  const paths = platform === 'win32' ? path.win32 : path.posix;
+  const searchPath = Object.entries(env).find(([key]) => key.toLowerCase() === 'path')?.[1] || '';
+  const directories = searchPath.split(platform === 'win32' ? ';' : ':').filter(Boolean);
+  const nodeDir = paths.dirname(execPath);
+  const candidates = [
+    env.npm_execpath,
+    paths.join(nodeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    paths.resolve(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    ...directories.flatMap((dir) => [
+      paths.join(dir, 'npm'),
+      paths.join(dir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    ]),
+  ];
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    try {
+      const resolved = realpath(candidate);
+      if (paths.basename(resolved).toLowerCase() === 'npm-cli.js' && isFile(resolved))
+        return resolved;
+    } catch {
+      /* Try the next standard npm installation location. */
+    }
+  }
+  throw new Error('npm-cli.js was not found. Install Node.js with npm or repair its PATH.');
+}
+
+/** Injectable process boundary; tests never need to fetch a package. */
+function createNpmRunner({
+  spawn = childProcess.spawn,
+  resolveCli = resolveNpmCli,
+  platform = process.platform,
+  execPath = process.execPath,
+  kill = process.kill.bind(process),
+} = {}) {
+  return async function runNpm(
+    args,
+    { cwd, timeout = 6000, env = process.env, maxBuffer = 1024 * 1024, signal } = {}
+  ) {
+    if (!Array.isArray(args) || args.some((arg) => typeof arg !== 'string' || arg.includes('\0'))) {
+      throw new Error('npm arguments must be an array of strings without NUL bytes.');
+    }
+    if (
+      !Number.isSafeInteger(timeout) ||
+      timeout <= 0 ||
+      !Number.isSafeInteger(maxBuffer) ||
+      maxBuffer <= 0
+    ) {
+      throw new Error('npm timeout and maxBuffer must be positive integers.');
+    }
+    if (signal?.aborted)
+      throw Object.assign(new Error('npm operation was cancelled.'), { code: 'ABORT_ERR' });
+    const cli = resolveCli({ env, execPath, platform });
+
+    return new Promise((resolve, reject) => {
+      let child;
+      try {
+        child = spawn(execPath, [cli, ...args], {
+          cwd,
+          env,
+          shell: false,
+          windowsHide: true,
+          detached: platform !== 'win32',
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+      } catch (error) {
+        reject(new Error('Could not start npm.', { cause: error }));
+        return;
+      }
+      let settled = false;
+      let bytes = 0;
+      const stdout = [];
+      const stderr = [];
+      let timer;
+      const finish = (error, output) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+        if (error) {
+          error.stdout = Buffer.concat(stdout).toString('utf8');
+          error.stderr = Buffer.concat(stderr).toString('utf8');
+          const diagnostic = [error.stdout.trim(), error.stderr.trim()].filter(Boolean).join('\n');
+          if (diagnostic) error.message += '\n' + diagnostic;
+          reject(error);
+        } else resolve(output);
+      };
+      const killChild = () => {
+        try {
+          child.kill('SIGKILL');
+        } catch {
+          /* The process may already have exited. */
+        }
+      };
+      const stop = () => {
+        if (!Number.isInteger(child.pid) || child.pid <= 0) return killChild();
+        if (platform !== 'win32') {
+          // A detached npm owns this process group, including its updater child.
+          try {
+            kill(-child.pid, 'SIGKILL');
+          } catch {
+            killChild();
+          }
+          return;
+        }
+        try {
+          const terminator = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], {
+            shell: false,
+            windowsHide: true,
+            stdio: 'ignore',
+            env,
+          });
+          terminator.once('error', killChild);
+          terminator.once('close', (code) => {
+            if (code !== 0) killChild();
+          });
+        } catch {
+          killChild();
+        }
+      };
+      const cancel = (message, code) => {
+        if (settled) return;
+        stop();
+        finish(Object.assign(new Error(message), { code }));
+      };
+      const abort = () =>
+        cancel('npm operation was cancelled; child termination requested.', 'ABORT_ERR');
+      const collect = (chunk, save) => {
+        if (settled) return;
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > maxBuffer)
+          return cancel('npm output exceeded the configured buffer limit.', 'ENOBUFS');
+        (save ? stdout : stderr).push(buffer);
+      };
+      child.stdout.on('data', (chunk) => collect(chunk, true));
+      child.stderr.on('data', (chunk) => collect(chunk, false));
+      child.once('error', (error) => finish(new Error('Could not run npm.', { cause: error })));
+      child.once('close', (code, exitSignal) => {
+        if (code !== 0 || exitSignal) {
+          finish(
+            Object.assign(new Error(`npm exited unsuccessfully (${exitSignal || code}).`), {
+              code: 'NPM_EXIT',
+              exitCode: code,
+              signal: exitSignal,
+            })
+          );
+        } else finish(null, Buffer.concat(stdout).toString('utf8'));
+      });
+      timer = setTimeout(
+        () =>
+          cancel(
+            `npm exceeded its ${timeout} ms deadline; child termination requested.`,
+            'ETIMEDOUT'
+          ),
+        timeout
+      );
+      timer.unref?.();
+      signal?.addEventListener('abort', abort, { once: true });
+      if (signal?.aborted) abort();
+    });
+  };
+}
+
+const runNpm = createNpmRunner();
+module.exports = { runNpm, resolveNpmCli, createNpmRunner };

package/tools/cli/lib/pack-copy.js

@@ -1,84 +1,80 @@
 /**
- * BMAD+ Shared Pack-Copy Module
- * Extracted duplicate file-copy loops from install.js and update.js.
- *
+ * Shared deterministic pack enumeration and conservative installation copying.
  * Author: Laurent Rochetta
  */
-
 const path = require('node:path');
 const fs = require('node:fs');
-const fsExtra = require('fs-extra');
-
-/**
- * Copy files for a single pack definition into the target directories.
- *
- * @param {object} opts
- * @param {string} opts.bmadSrc      - Path to src/bmad-plus/
- * @param {string} opts.targetAgentsDir - Destination for agents / skills
- * @param {string} opts.targetDataDir   - Destination for data files
- * @param {string} opts.projectRoot    - Project root (for external package resolution)
- * @param {object} opts.pack           - Pack definition from PACKS
- * @returns {{ copiedAgents: number, copiedSkills: number, copiedFiles: number }}
- */
-function copyPackFiles({ bmadSrc, targetAgentsDir, targetDataDir, projectRoot, pack }) {
-  let copiedAgents = 0;
-  let copiedSkills = 0;
-  let copiedFiles = 0;
+const crypto = require('node:crypto');
+const { safeTarget } = require('../../build/generate-adapters');
 
-  if (!pack) return { copiedAgents, copiedSkills, copiedFiles };
+const fileHash = content => crypto.createHash('sha256').update(content).digest('hex');
 
-  // Copy agents
-  for (const agent of (pack.agents || [])) {
-    const src = path.join(bmadSrc, 'agents', agent);
-    const dest = path.join(targetAgentsDir, agent);
-    if (fs.existsSync(src)) {
-      fsExtra.copySync(src, dest, { overwrite: true });
-      copiedAgents++;
+function listPackFiles({ bmadSrc, targetAgentsDir, targetDataDir, projectRoot, pack }) {
+  const result = { copiedAgents: 0, copiedSkills: 0, copiedFiles: 0, files: [] };
+  if (!pack) return result;
+  function walk(source, target) {
+    let stat;
+    try { stat = fs.lstatSync(source); } catch (error) {
+      if (error.code === 'ENOENT') return false;
+      throw error;
     }
+    if (stat.isSymbolicLink()) throw new Error('Pack source is a symbolic link: ' + source);
+    if (stat.isDirectory()) {
+      for (const name of fs.readdirSync(source).sort()) walk(path.join(source, name), path.join(target, name));
+    } else if (stat.isFile()) {
+      result.files.push({ source, target });
+    } else throw new Error('Pack source is not a regular file: ' + source);
+    return true;
   }
-
-  // Copy skills
-  for (const skill of (pack.skills || [])) {
-    const src = path.join(bmadSrc, 'skills', skill);
-    const dest = path.join(targetAgentsDir, skill);
-    if (fs.existsSync(src)) {
-      fsExtra.copySync(src, dest, { overwrite: true });
-      copiedSkills++;
-    }
+  for (const name of pack.agents || []) {
+    if (walk(path.join(bmadSrc, 'agents', name), path.join(targetAgentsDir, name))) result.copiedAgents++;
   }
-
-  // Copy data files
-  for (const dataFile of (pack.data || [])) {
-    const src = path.join(bmadSrc, 'data', dataFile);
-    const dest = path.join(targetDataDir, dataFile);
-    if (fs.existsSync(src)) {
-      fsExtra.copySync(src, dest, { overwrite: true });
-      copiedFiles++;
-    }
+  for (const name of pack.skills || []) {
+    if (walk(path.join(bmadSrc, 'skills', name), path.join(targetAgentsDir, name))) result.copiedSkills++;
   }
-
-  // Copy external package (e.g. OSINT)
-  if (pack.externalPackage) {
-    const extSrc = path.join(projectRoot, pack.externalPackage, 'skills');
-    if (fs.existsSync(extSrc)) {
-      fsExtra.copySync(extSrc, targetAgentsDir, { overwrite: true });
-      copiedSkills++;
-    }
+  for (const name of pack.data || []) {
+    if (walk(path.join(bmadSrc, 'data', name), path.join(targetDataDir, name))) result.copiedFiles++;
+  }
+  if (pack.externalPackage && walk(path.join(projectRoot, pack.externalPackage, 'skills'), targetAgentsDir)) result.copiedSkills++;
+  if (pack.packDir && walk(path.join(bmadSrc, pack.packSrcDir || 'agents', pack.packDir), path.join(targetAgentsDir, pack.packDir))) {
+    result.copiedAgents++;
+    result.copiedFiles++;
   }
+  return result;
+}
 
-  // Copy pack directory (SEO, Backup, Animated, Shield, etc.)
-  if (pack.packDir) {
-    const srcParent = pack.packSrcDir || 'agents';
-    const packSrc = path.join(bmadSrc, srcParent, pack.packDir);
-    const packDest = path.join(targetAgentsDir, pack.packDir);
-    if (fs.existsSync(packSrc)) {
-      fsExtra.copySync(packSrc, packDest, { overwrite: true });
-      copiedAgents++;
-      copiedFiles++;
+function copyManagedFile({ source, target, projectDir, inventory, previousInventory = {}, onConflict = () => {} }) {
+  const file = path.relative(projectDir, target).split(path.sep).join('/');
+  safeTarget(projectDir, file);
+  const sourceStat = fs.lstatSync(source);
+  if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) throw new Error('Pack source is not a regular file: ' + source);
+  const content = fs.readFileSync(source);
+  const hash = fileHash(content);
+  if (fs.existsSync(target)) {
+    const existingHash = fileHash(fs.readFileSync(target));
+    if (existingHash === hash) {
+      if (inventory) inventory[file] = hash;
+      return false;
+    }
+    if (previousInventory[file] !== existingHash) {
+      if (inventory && previousInventory[file]) inventory[file] = previousInventory[file];
+      onConflict(file);
+      return false;
     }
   }
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  safeTarget(projectDir, file);
+  fs.writeFileSync(target, content, { mode: sourceStat.mode });
+  if (inventory) inventory[file] = hash;
+  return true;
+}
 
-  return { copiedAgents, copiedSkills, copiedFiles };
+function copyPackFiles(options) {
+  const { files, ...counts } = listPackFiles(options);
+  const projectDir = options.projectDir || path.dirname(options.targetAgentsDir);
+  for (const { target } of files) safeTarget(projectDir, path.relative(projectDir, target).split(path.sep).join('/'));
+  for (const entry of files) copyManagedFile({ ...options, ...entry, projectDir });
+  return counts;
 }
 
-module.exports = { copyPackFiles };
+module.exports = { copyPackFiles, listPackFiles, copyManagedFile, fileHash };