claudekit-cli 1.2.2 → 1.3.0

package/dist/index.js

@@ -5800,11 +5800,6 @@ var require_ignore = __commonJS((exports, module) => {
   }
 });
 
-// src/index.ts
-import { readFileSync } from "fs";
-import { join as join6 } from "path";
-import { fileURLToPath } from "url";
-
 // node_modules/cac/dist/index.mjs
 import { EventEmitter } from "events";
 function toArr(any) {
@@ -6408,7 +6403,7 @@ var cac = (name = "") => new CAC(name);
 
 // src/commands/new.ts
 var import_fs_extra2 = __toESM(require_lib(), 1);
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 
 // src/lib/auth.ts
 import { execSync } from "node:child_process";
@@ -10930,7 +10925,8 @@ var KitType = exports_external.enum(["engineer", "marketing"]);
 var NewCommandOptionsSchema = exports_external.object({
   dir: exports_external.string().default("."),
   kit: KitType.optional(),
-  version: exports_external.string().optional()
+  version: exports_external.string().optional(),
+  force: exports_external.boolean().default(false)
 });
 var UpdateCommandOptionsSchema = exports_external.object({
   dir: exports_external.string().default("."),
@@ -11328,7 +11324,7 @@ var import_ignore = __toESM(require_ignore(), 1);
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir3 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join3, relative, resolve } from "node:path";
 
 // node_modules/@isaacs/fs-minipass/dist/esm/index.js
 import EE from "events";
@@ -21204,6 +21200,7 @@ function createSpinner(options) {
 
 // src/lib/download.ts
 class DownloadManager {
+  static MAX_EXTRACTION_SIZE = 500 * 1024 * 1024;
   static EXCLUDE_PATTERNS = [
     ".git",
     ".git/**",
@@ -21215,10 +21212,26 @@ class DownloadManager {
     "Thumbs.db",
     "*.log"
   ];
+  totalExtractedSize = 0;
   shouldExclude(filePath) {
     const ig = import_ignore.default().add(DownloadManager.EXCLUDE_PATTERNS);
     return ig.ignores(filePath);
   }
+  isPathSafe(basePath, targetPath) {
+    const resolvedBase = resolve(basePath);
+    const resolvedTarget = resolve(targetPath);
+    const relativePath = relative(resolvedBase, resolvedTarget);
+    return !relativePath.startsWith("..") && !relativePath.startsWith("/") && resolvedTarget.startsWith(resolvedBase);
+  }
+  checkExtractionSize(fileSize) {
+    this.totalExtractedSize += fileSize;
+    if (this.totalExtractedSize > DownloadManager.MAX_EXTRACTION_SIZE) {
+      throw new ExtractionError(`Archive exceeds maximum extraction size of ${this.formatBytes(DownloadManager.MAX_EXTRACTION_SIZE)}. Possible archive bomb detected.`);
+    }
+  }
+  resetExtractionSize() {
+    this.totalExtractedSize = 0;
+  }
   async downloadAsset(asset, destDir) {
     try {
       const destPath = join3(destDir, asset.name);
@@ -21328,6 +21341,7 @@ class DownloadManager {
   async extractArchive(archivePath, destDir, archiveType) {
     const spinner = createSpinner("Extracting files...").start();
     try {
+      this.resetExtractionSize();
       const detectedType = archiveType || this.detectArchiveType(archivePath);
       await mkdir3(destDir, { recursive: true });
       if (detectedType === "tar.gz") {
@@ -21398,8 +21412,8 @@ class DownloadManager {
     }
   }
   isWrapperDirectory(dirName) {
-    const versionPattern = /^[\w-]+-v?\d+\.\d+\.\d+/;
-    const hashPattern = /^[\w-]+-[a-f0-9]{7,}$/;
+    const versionPattern = /^[\w-]+-v?\d+\.\d+\.\d+(-[\w.]+)?$/;
+    const hashPattern = /^[\w-]+-[a-f0-9]{7,40}$/;
     return versionPattern.test(dirName) || hashPattern.test(dirName);
   }
   async extractZip(archivePath, destDir) {
@@ -21447,13 +21461,17 @@ class DownloadManager {
   }
   async moveDirectoryContents(sourceDir, destDir) {
     const { readdir, stat, mkdir: mkdirPromise, copyFile } = await import("node:fs/promises");
-    const { join: pathJoin, relative } = await import("node:path");
+    const { join: pathJoin, relative: relative2 } = await import("node:path");
     await mkdirPromise(destDir, { recursive: true });
     const entries = await readdir(sourceDir);
     for (const entry of entries) {
       const sourcePath = pathJoin(sourceDir, entry);
       const destPath = pathJoin(destDir, entry);
-      const relativePath = relative(sourceDir, sourcePath);
+      const relativePath = relative2(sourceDir, sourcePath);
+      if (!this.isPathSafe(destDir, destPath)) {
+        logger.warning(`Skipping unsafe path: ${relativePath}`);
+        throw new ExtractionError(`Path traversal attempt detected: ${relativePath}`);
+      }
       if (this.shouldExclude(relativePath)) {
         logger.debug(`Excluding: ${relativePath}`);
         continue;
@@ -21462,19 +21480,24 @@ class DownloadManager {
       if (entryStat.isDirectory()) {
         await this.copyDirectory(sourcePath, destPath);
       } else {
+        this.checkExtractionSize(entryStat.size);
         await copyFile(sourcePath, destPath);
       }
     }
   }
   async copyDirectory(sourceDir, destDir) {
     const { readdir, stat, mkdir: mkdirPromise, copyFile } = await import("node:fs/promises");
-    const { join: pathJoin, relative } = await import("node:path");
+    const { join: pathJoin, relative: relative2 } = await import("node:path");
     await mkdirPromise(destDir, { recursive: true });
     const entries = await readdir(sourceDir);
     for (const entry of entries) {
       const sourcePath = pathJoin(sourceDir, entry);
       const destPath = pathJoin(destDir, entry);
-      const relativePath = relative(sourceDir, sourcePath);
+      const relativePath = relative2(sourceDir, sourcePath);
+      if (!this.isPathSafe(destDir, destPath)) {
+        logger.warning(`Skipping unsafe path: ${relativePath}`);
+        throw new ExtractionError(`Path traversal attempt detected: ${relativePath}`);
+      }
       if (this.shouldExclude(relativePath)) {
         logger.debug(`Excluding: ${relativePath}`);
         continue;
@@ -21483,6 +21506,7 @@ class DownloadManager {
       if (entryStat.isDirectory()) {
         await this.copyDirectory(sourcePath, destPath);
       } else {
+        this.checkExtractionSize(entryStat.size);
         await copyFile(sourcePath, destPath);
       }
     }
@@ -21504,22 +21528,28 @@ class DownloadManager {
       const entries = await readdir(extractDir);
       logger.debug(`Extracted files: ${entries.join(", ")}`);
       if (entries.length === 0) {
-        logger.warning("Extraction resulted in no files");
-        return false;
+        throw new ExtractionError("Extraction resulted in no files");
       }
       const criticalPaths = [".claude", "CLAUDE.md"];
+      const missingPaths = [];
       for (const path8 of criticalPaths) {
         try {
           await access(pathJoin(extractDir, path8), constants2.F_OK);
           logger.debug(`✓ Found: ${path8}`);
         } catch {
           logger.warning(`Expected path not found: ${path8}`);
+          missingPaths.push(path8);
         }
       }
-      return true;
+      if (missingPaths.length > 0) {
+        logger.warning(`Some expected paths are missing: ${missingPaths.join(", ")}. This may not be a ClaudeKit project.`);
+      }
+      logger.debug("Extraction validation passed");
     } catch (error2) {
-      logger.error(`Validation failed: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
-      return false;
+      if (error2 instanceof ExtractionError) {
+        throw error2;
+      }
+      throw new ExtractionError(`Validation failed: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     }
   }
   async createTempDir() {
@@ -21679,7 +21709,7 @@ class GitHubClient {
 }
 
 // src/lib/merge.ts
-import { join as join4, relative } from "node:path";
+import { join as join4, relative as relative2 } from "node:path";
 var import_fs_extra = __toESM(require_lib(), 1);
 var import_ignore2 = __toESM(require_ignore(), 1);
 class FileMerger {
@@ -21705,7 +21735,7 @@ class FileMerger {
     const conflicts = [];
     const files = await this.getFiles(sourceDir);
     for (const file of files) {
-      const relativePath = relative(sourceDir, file);
+      const relativePath = relative2(sourceDir, file);
       if (this.ig.ignores(relativePath)) {
         continue;
       }
@@ -21721,7 +21751,7 @@ class FileMerger {
     let copiedCount = 0;
     let skippedCount = 0;
     for (const file of files) {
-      const relativePath = relative(sourceDir, file);
+      const relativePath = relative2(sourceDir, file);
       if (this.ig.ignores(relativePath)) {
         logger.debug(`Skipping protected file: ${relativePath}`);
         skippedCount++;
@@ -21859,27 +21889,42 @@ async function newCommand(options) {
   prompts.intro("\uD83D\uDE80 ClaudeKit - Create New Project");
   try {
     const validOptions = NewCommandOptionsSchema.parse(options);
+    const isNonInteractive = !process.stdin.isTTY || process.env.CI === "true" || process.env.NON_INTERACTIVE === "true";
     const config = await ConfigManager.get();
     let kit = validOptions.kit || config.defaults?.kit;
     if (!kit) {
+      if (isNonInteractive) {
+        throw new Error("Kit must be specified via --kit flag in non-interactive mode");
+      }
       kit = await prompts.selectKit();
     }
     const kitConfig = AVAILABLE_KITS[kit];
     logger.info(`Selected kit: ${kitConfig.name}`);
     let targetDir = validOptions.dir || config.defaults?.dir || ".";
     if (!validOptions.dir && !config.defaults?.dir) {
-      targetDir = await prompts.getDirectory(targetDir);
+      if (isNonInteractive) {
+        targetDir = ".";
+      } else {
+        targetDir = await prompts.getDirectory(targetDir);
+      }
     }
-    const resolvedDir = resolve(targetDir);
+    const resolvedDir = resolve2(targetDir);
     logger.info(`Target directory: ${resolvedDir}`);
     if (await import_fs_extra2.pathExists(resolvedDir)) {
       const files = await import_fs_extra2.readdir(resolvedDir);
       const isEmpty = files.length === 0;
       if (!isEmpty) {
-        const continueAnyway = await prompts.confirm("Directory is not empty. Files may be overwritten. Continue?");
-        if (!continueAnyway) {
-          logger.warning("Operation cancelled");
-          return;
+        if (isNonInteractive) {
+          if (!validOptions.force) {
+            throw new Error("Directory is not empty. Use --force flag to overwrite in non-interactive mode");
+          }
+          logger.info("Directory is not empty. Proceeding with --force flag");
+        } else {
+          const continueAnyway = await prompts.confirm("Directory is not empty. Files may be overwritten. Continue?");
+          if (!continueAnyway) {
+            logger.warning("Operation cancelled");
+            return;
+          }
         }
       }
     }
@@ -21953,11 +21998,11 @@ bun run dev`, "Next steps");
 
 // src/commands/update.ts
 var import_fs_extra4 = __toESM(require_lib(), 1);
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 
 // src/utils/file-scanner.ts
 var import_fs_extra3 = __toESM(require_lib(), 1);
-import { join as join5, relative as relative2, resolve as resolve2 } from "node:path";
+import { join as join5, relative as relative3, resolve as resolve3 } from "node:path";
 class FileScanner {
   static async getFiles(dirPath, relativeTo) {
     const basePath = relativeTo || dirPath;
@@ -21982,7 +22027,7 @@ class FileScanner {
           const subFiles = await FileScanner.getFiles(fullPath, basePath);
           files.push(...subFiles);
         } else if (stats.isFile()) {
-          const relativePath = relative2(basePath, fullPath);
+          const relativePath = relative3(basePath, fullPath);
           files.push(relativePath);
         }
       }
@@ -22010,8 +22055,8 @@ class FileScanner {
     return customFiles;
   }
   static isSafePath(basePath, targetPath) {
-    const resolvedBase = resolve2(basePath);
-    const resolvedTarget = resolve2(targetPath);
+    const resolvedBase = resolve3(basePath);
+    const resolvedTarget = resolve3(targetPath);
     return resolvedTarget.startsWith(resolvedBase);
   }
 }
@@ -22033,7 +22078,7 @@ async function updateCommand(options) {
     if (!validOptions.dir && !config.defaults?.dir) {
       targetDir = await prompts.getDirectory(targetDir);
     }
-    const resolvedDir = resolve3(targetDir);
+    const resolvedDir = resolve4(targetDir);
     logger.info(`Target directory: ${resolvedDir}`);
     if (!await import_fs_extra4.pathExists(resolvedDir)) {
       logger.error(`Directory does not exist: ${resolvedDir}`);
@@ -22309,6 +22354,10 @@ class Logger2 {
   }
 }
 var logger2 = new Logger2;
+// src/version.json
+var version_default = {
+  version: "1.2.1"
+};
 
 // src/index.ts
 if (process.stdout.setEncoding) {
@@ -22317,12 +22366,11 @@ if (process.stdout.setEncoding) {
 if (process.stderr.setEncoding) {
   process.stderr.setEncoding("utf8");
 }
-var __dirname2 = fileURLToPath(new URL(".", import.meta.url));
-var packageJson = JSON.parse(readFileSync(join6(__dirname2, "../package.json"), "utf-8"));
+var packageVersion = version_default.version;
 var cli = cac("ck");
 cli.option("--verbose, -v", "Enable verbose logging for debugging");
 cli.option("--log-file <path>", "Write logs to file");
-cli.command("new", "Bootstrap a new ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").action(async (options) => {
+cli.command("new", "Bootstrap a new ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").option("--force", "Overwrite existing files without confirmation").action(async (options) => {
   await newCommand(options);
 });
 cli.command("update", "Update existing ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").action(async (options) => {
@@ -22331,7 +22379,7 @@ cli.command("update", "Update existing ClaudeKit project").option("--dir <dir>",
 cli.command("versions", "List available versions of ClaudeKit repositories").option("--kit <kit>", "Filter by specific kit (engineer, marketing)").option("--limit <limit>", "Number of releases to show (default: 30)").option("--all", "Show all releases including prereleases").action(async (options) => {
   await versionCommand(options);
 });
-cli.version(packageJson.version);
+cli.version(packageVersion);
 cli.help();
 var parsed = cli.parse(process.argv, { run: false });
 var envVerbose = process.env.CLAUDEKIT_VERBOSE === "1" || process.env.CLAUDEKIT_VERBOSE === "true";
@@ -22343,7 +22391,7 @@ if (parsed.options.logFile) {
   logger2.setLogFile(parsed.options.logFile);
 }
 logger2.verbose("ClaudeKit CLI starting", {
-  version: packageJson.version,
+  version: packageVersion,
   command: parsed.args[0] || "none",
   options: parsed.options,
   cwd: process.cwd(),

package/package.json

@@ -1,20 +1,20 @@
 {
 	"name": "claudekit-cli",
-	"version": "1.2.2",
+	"version": "1.3.0",
 	"description": "CLI tool for bootstrapping and updating ClaudeKit projects",
 	"type": "module",
 	"bin": {
 		"ck": "./dist/index.js"
 	},
 	"scripts": {
-		"dev": "bun run src/index.ts",
-		"build": "bun build src/index.ts --outdir dist --target node --external unzipper --external keytar --external @octokit/rest",
-		"compile": "bun build src/index.ts --compile --outfile ck",
-		"test": "bun test",
-		"test:watch": "bun test --watch",
-		"lint": "biome check .",
-		"format": "biome format --write .",
-		"typecheck": "tsc --noEmit"
+		"dev": "bun run src/index.ts >> logs.txt 2>&1",
+		"build": "bun build src/index.ts --outdir dist --target node --external keytar --external @octokit/rest >> logs.txt 2>&1",
+		"compile": "bun build src/index.ts --compile --outfile ck >> logs.txt 2>&1",
+		"test": "bun test >> logs.txt 2>&1",
+		"test:watch": "bun test --watch >> logs.txt 2>&1",
+		"lint": "biome check . >> logs.txt 2>&1",
+		"format": "biome format --write . >> logs.txt 2>&1",
+		"typecheck": "tsc --noEmit >> logs.txt 2>&1"
 	},
 	"keywords": [
 		"cli",
@@ -53,7 +53,6 @@
 		"@types/node": "^22.10.1",
 		"@types/tar": "^6.1.13",
 		"@types/tmp": "^0.2.6",
-		"@types/unzipper": "^0.10.10",
 		"semantic-release": "^24.2.0",
 		"typescript": "^5.7.2"
 	}

package/src/commands/new.ts

@@ -19,12 +19,19 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 		// Validate and parse options
 		const validOptions = NewCommandOptionsSchema.parse(options);
 
+		// Detect non-interactive mode
+		const isNonInteractive =
+			!process.stdin.isTTY || process.env.CI === "true" || process.env.NON_INTERACTIVE === "true";
+
 		// Load config for defaults
 		const config = await ConfigManager.get();
 
 		// Get kit selection
 		let kit = validOptions.kit || config.defaults?.kit;
 		if (!kit) {
+			if (isNonInteractive) {
+				throw new Error("Kit must be specified via --kit flag in non-interactive mode");
+			}
 			kit = await prompts.selectKit();
 		}
 
@@ -34,7 +41,11 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 		// Get target directory
 		let targetDir = validOptions.dir || config.defaults?.dir || ".";
 		if (!validOptions.dir && !config.defaults?.dir) {
-			targetDir = await prompts.getDirectory(targetDir);
+			if (isNonInteractive) {
+				targetDir = ".";
+			} else {
+				targetDir = await prompts.getDirectory(targetDir);
+			}
 		}
 
 		const resolvedDir = resolve(targetDir);
@@ -45,12 +56,21 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 			const files = await readdir(resolvedDir);
 			const isEmpty = files.length === 0;
 			if (!isEmpty) {
-				const continueAnyway = await prompts.confirm(
-					"Directory is not empty. Files may be overwritten. Continue?",
-				);
-				if (!continueAnyway) {
-					logger.warning("Operation cancelled");
-					return;
+				if (isNonInteractive) {
+					if (!validOptions.force) {
+						throw new Error(
+							"Directory is not empty. Use --force flag to overwrite in non-interactive mode",
+						);
+					}
+					logger.info("Directory is not empty. Proceeding with --force flag");
+				} else {
+					const continueAnyway = await prompts.confirm(
+						"Directory is not empty. Files may be overwritten. Continue?",
+					);
+					if (!continueAnyway) {
+						logger.warning("Operation cancelled");
+						return;
+					}
 				}
 			}
 		}

package/src/index.ts

@@ -1,13 +1,11 @@
 #!/usr/bin/env bun
 
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { cac } from "cac";
 import { newCommand } from "./commands/new.js";
 import { updateCommand } from "./commands/update.js";
 import { versionCommand } from "./commands/version.js";
 import { logger } from "./utils/logger.js";
+import versionInfo from "./version.json" assert { type: "json" };
 
 // Set proper output encoding to prevent unicode rendering issues
 if (process.stdout.setEncoding) {
@@ -17,10 +15,7 @@ if (process.stderr.setEncoding) {
 	process.stderr.setEncoding("utf8");
 }
 
-const __dirname = fileURLToPath(new URL(".", import.meta.url));
-
-// Read package.json for version
-const packageJson = JSON.parse(readFileSync(join(__dirname, "../package.json"), "utf-8"));
+const packageVersion = versionInfo.version;
 
 const cli = cac("ck");
 
@@ -34,6 +29,7 @@ cli
 	.option("--dir <dir>", "Target directory (default: .)")
 	.option("--kit <kit>", "Kit to use (engineer, marketing)")
 	.option("--version <version>", "Specific version to download (default: latest)")
+	.option("--force", "Overwrite existing files without confirmation")
 	.action(async (options) => {
 		await newCommand(options);
 	});
@@ -59,7 +55,7 @@ cli
 	});
 
 // Version
-cli.version(packageJson.version);
+cli.version(packageVersion);
 
 // Help
 cli.help();
@@ -85,7 +81,7 @@ if (parsed.options.logFile) {
 
 // Log startup info in verbose mode
 logger.verbose("ClaudeKit CLI starting", {
-	version: packageJson.version,
+	version: packageVersion,
 	command: parsed.args[0] || "none",
 	options: parsed.options,
 	cwd: process.cwd(),