cli4ai 0.8.0

package/src/core/execute.ts

@@ -0,0 +1,507 @@
+/**
+ * Tool execution helper used by `cli4ai run` and routines.
+ *
+ * This refactors the core execution logic so callers can either:
+ * - inherit stdio (interactive `cli4ai run`)
+ * - capture output (routines / orchestration)
+ */
+
+import { spawn, spawnSync } from 'child_process';
+import { resolve } from 'path';
+import { existsSync, readFileSync } from 'fs';
+import { createInterface } from 'readline';
+import { platform } from 'os';
+import { log } from '../lib/cli.js';
+import { findPackage } from './config.js';
+import { loadManifest, type Manifest } from './manifest.js';
+import { getSecret } from './secrets.js';
+import { checkPackageIntegrity } from './lockfile.js';
+
+export type ExecuteCaptureMode = 'inherit' | 'pipe';
+
+export interface ExecuteToolOptions {
+  packageName: string;
+  command?: string;
+  args: string[];
+  cwd: string;
+  env?: Record<string, string>;
+  stdin?: string;
+  capture: ExecuteCaptureMode;
+  timeoutMs?: number;
+  teeStderr?: boolean;
+}
+
+export interface ExecuteToolResult {
+  exitCode: number;
+  durationMs: number;
+  stdout?: string;
+  stderr?: string;
+  packagePath: string;
+  entryPath: string;
+  runtime: 'bun' | 'node';
+}
+
+export class ExecuteToolError extends Error {
+  constructor(
+    public code: string,
+    message: string,
+    public details?: Record<string, unknown>
+  ) {
+    super(message);
+    this.name = 'ExecuteToolError';
+  }
+}
+
+// Known system tools and how to install them
+const INSTALL_COMMANDS: Record<string, { check: string; install: Record<string, string>; description: string }> = {
+  'yt-dlp': {
+    check: 'yt-dlp --version',
+    install: {
+      darwin: 'brew install yt-dlp',
+      linux: 'pipx install yt-dlp || sudo apt install -y pipx && pipx install yt-dlp',
+      win32: 'pip install yt-dlp'
+    },
+    description: 'YouTube video/audio downloader'
+  },
+  'gh': {
+    check: 'gh --version',
+    install: {
+      darwin: 'brew install gh',
+      linux: 'sudo apt install gh -y',
+      win32: 'winget install GitHub.cli'
+    },
+    description: 'GitHub CLI'
+  },
+  'ffmpeg': {
+    check: 'ffmpeg -version',
+    install: {
+      darwin: 'brew install ffmpeg',
+      linux: 'sudo apt install ffmpeg -y',
+      win32: 'winget install FFmpeg.FFmpeg'
+    },
+    description: 'Media processing tool'
+  },
+  'bun': {
+    check: 'bun --version',
+    install: {
+      darwin: 'curl -fsSL https://bun.sh/install | bash',
+      linux: 'curl -fsSL https://bun.sh/install | bash',
+      win32: 'powershell -c "irm bun.sh/install.ps1 | iex"'
+    },
+    description: 'JavaScript runtime'
+  }
+};
+
+/**
+ * Check if a command exists on the system
+ */
+function commandExists(cmd: string): boolean {
+  // Use spawnSync with argument array to prevent command injection
+  const os = platform();
+  if (os === 'win32') {
+    const result = spawnSync('where', [cmd], { stdio: 'pipe' });
+    return result.status === 0;
+  }
+  const result = spawnSync('which', [cmd], { stdio: 'pipe' });
+  return result.status === 0;
+}
+
+/**
+ * Prompt user for confirmation
+ */
+async function confirm(message: string): Promise<boolean> {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stderr
+  });
+
+  return new Promise((resolve) => {
+    rl.question(`${message} [y/N] `, (answer) => {
+      rl.close();
+      resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+    });
+  });
+}
+
+/**
+ * Try to install a system dependency
+ */
+async function installDependency(name: string): Promise<boolean> {
+  const info = INSTALL_COMMANDS[name];
+  if (!info) {
+    log(`⚠️  Unknown dependency: ${name}`);
+    log(`   Please install it manually`);
+    return false;
+  }
+
+  const os = platform();
+  const installCmd = info.install[os];
+
+  if (!installCmd) {
+    log(`⚠️  No install command for ${name} on ${os}`);
+    return false;
+  }
+
+  log(`\n📦 ${name} - ${info.description}`);
+  log(`   Install command: ${installCmd}\n`);
+
+  const shouldInstall = await confirm(`Install ${name}?`);
+  if (!shouldInstall) return false;
+
+  log(`\nInstalling ${name}...`);
+
+  try {
+    // Use spawnSync with shell:true for complex install commands (from trusted INSTALL_COMMANDS list)
+    // This is safe because installCmd comes from hardcoded list, not user input
+    const result = spawnSync(installCmd, {
+      stdio: 'inherit',
+      shell: true
+    });
+    if (result.status === 0) {
+      log(`✓ ${name} installed successfully\n`);
+      return true;
+    }
+    log(`✗ Failed to install ${name}`);
+    log(`  Try running manually: ${installCmd}\n`);
+    return false;
+  } catch {
+    log(`✗ Failed to install ${name}`);
+    log(`  Try running manually: ${installCmd}\n`);
+    return false;
+  }
+}
+
+/**
+ * Check and install missing peer dependencies
+ */
+async function checkPeerDependencies(pkgPath: string): Promise<void> {
+  // Try to load cli4ai.json for peer dependencies
+  const cli4aiPath = resolve(pkgPath, 'cli4ai.json');
+  let peerDeps: Record<string, string> = {};
+
+  if (existsSync(cli4aiPath)) {
+    try {
+      const cli4ai = JSON.parse(readFileSync(cli4aiPath, 'utf-8'));
+      peerDeps = cli4ai.peerDependencies || {};
+    } catch {}
+  }
+
+  const missing: string[] = [];
+
+  for (const dep of Object.keys(peerDeps)) {
+    // Skip npm packages (they start with @ or contain /)
+    if (dep.startsWith('@') || dep.includes('/')) continue;
+
+    if (!commandExists(dep)) {
+      missing.push(dep);
+    }
+  }
+
+  if (missing.length === 0) return;
+
+  log(`\n⚠️  Missing system dependencies: ${missing.join(', ')}\n`);
+
+  for (const dep of missing) {
+    const installed = await installDependency(dep);
+    if (!installed) {
+      throw new ExecuteToolError('MISSING_DEPENDENCY', `Cannot run without ${dep}`, {
+        dependency: dep,
+        packagePath: pkgPath
+      });
+    }
+  }
+}
+
+/**
+ * Prompt for a secret value
+ */
+async function promptSecret(key: string, description?: string): Promise<string> {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stderr
+  });
+
+  if (description) {
+    log(`  ${description}`);
+  }
+
+  return new Promise((resolve) => {
+    if (process.stdin.isTTY) {
+      // Hide input
+      process.stderr.write(`  Enter ${key}: `);
+      let value = '';
+
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.setEncoding('utf8');
+
+      const onData = (char: string) => {
+        if (char === '\n' || char === '\r') {
+          process.stdin.setRawMode(false);
+          process.stdin.removeListener('data', onData);
+          process.stderr.write('\n');
+          rl.close();
+          resolve(value);
+        } else if (char === '\u0003') {
+          process.exit(1);
+        } else if (char === '\u007F') {
+          if (value.length > 0) value = value.slice(0, -1);
+        } else {
+          value += char;
+        }
+      };
+
+      process.stdin.on('data', onData);
+    } else {
+      rl.question(`  Enter ${key}: `, (answer) => {
+        rl.close();
+        resolve(answer);
+      });
+    }
+  });
+}
+
+/**
+ * Check required secrets and prompt for missing ones
+ */
+async function checkAndPromptSecrets(pkgPath: string, pkgName: string): Promise<Record<string, string>> {
+  const cli4aiPath = resolve(pkgPath, 'cli4ai.json');
+  const secretsEnv: Record<string, string> = {};
+
+  if (!existsSync(cli4aiPath)) return secretsEnv;
+
+  let envDefs: Record<string, { required?: boolean; description?: string }> = {};
+
+  try {
+    const cli4ai = JSON.parse(readFileSync(cli4aiPath, 'utf-8'));
+    envDefs = cli4ai.env || {};
+  } catch {
+    return secretsEnv;
+  }
+
+  const missingRequired: Array<{ key: string; description?: string }> = [];
+
+  for (const [key, def] of Object.entries(envDefs)) {
+    const value = getSecret(key);
+
+    if (value) {
+      secretsEnv[key] = value;
+    } else if (def.required) {
+      missingRequired.push({ key, description: def.description });
+    }
+  }
+
+  if (missingRequired.length === 0) return secretsEnv;
+
+  log(`\n⚠️  Missing required secrets for ${pkgName}:\n`);
+
+  // Import setSecret dynamically to avoid circular dependency issues
+  const { setSecret } = await import('./secrets.js');
+
+  for (const { key, description } of missingRequired) {
+    const value = await promptSecret(key, description);
+
+    if (!value) {
+      throw new ExecuteToolError('ENV_MISSING', `${key} is required to run ${pkgName}`, {
+        package: pkgName,
+        secret: key,
+        hint: `Set it with: cli4ai secrets set ${key}`
+      });
+    }
+
+    setSecret(key, value);
+    secretsEnv[key] = value;
+    log(`  ✓ ${key} saved to vault\n`);
+  }
+
+  log('');
+  return secretsEnv;
+}
+
+function buildRuntimeCommand(entryPath: string, manifest: Manifest, cmdArgs: string[]): { execCmd: string; execArgs: string[]; runtime: 'bun' | 'node' } {
+  const runtime = manifest.runtime || 'bun';
+  switch (runtime) {
+    case 'node':
+      return { execCmd: 'node', execArgs: [entryPath, ...cmdArgs], runtime: 'node' };
+    case 'bun':
+    default:
+      return { execCmd: 'bun', execArgs: ['run', entryPath, ...cmdArgs], runtime: 'bun' };
+  }
+}
+
+function collectStream(stream: NodeJS.ReadableStream): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    stream.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+    stream.on('error', reject);
+    stream.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+  });
+}
+
+/**
+ * Execute a tool command.
+ *
+ * - When capture === 'inherit', the child inherits stdio (interactive).
+ * - When capture === 'pipe', stdout/stderr can be captured and returned.
+ */
+export async function executeTool(options: ExecuteToolOptions): Promise<ExecuteToolResult> {
+  const startTime = Date.now();
+  const invocationDir = options.cwd;
+
+  const pkg = findPackage(options.packageName, invocationDir);
+  if (!pkg) {
+    throw new ExecuteToolError('NOT_FOUND', `Package not found: ${options.packageName}`, {
+      hint: 'Run "cli4ai list" to see installed packages, or "cli4ai add <package>" to install'
+    });
+  }
+
+  const manifest = loadManifest(pkg.path);
+
+  const integrityCheck = checkPackageIntegrity(invocationDir, options.packageName, pkg.path);
+  if (!integrityCheck.valid) {
+    log(`\n⚠️  SECURITY WARNING: Package integrity check failed for ${options.packageName}`);
+    if (integrityCheck.error) log(`   ${integrityCheck.error}`);
+    if (integrityCheck.expected && integrityCheck.actual) {
+      log(`   Expected: ${integrityCheck.expected.slice(0, 30)}...`);
+      log(`   Actual:   ${integrityCheck.actual.slice(0, 30)}...`);
+    }
+    log(`\n   The package may have been tampered with or modified since installation.`);
+    log(`   To fix: reinstall with "cli4ai remove ${options.packageName} && cli4ai add ${options.packageName}"\n`);
+
+    const shouldContinue = await confirm('Continue anyway? (NOT RECOMMENDED)');
+    if (!shouldContinue) {
+      throw new ExecuteToolError('INTEGRITY_ERROR', 'Package integrity verification failed', {
+        package: options.packageName,
+        hint: `Reinstall the package with: cli4ai remove ${options.packageName} && cli4ai add ${options.packageName}`
+      });
+    }
+    log('');
+  }
+
+  if (!commandExists('bun')) {
+    log('⚠️  bun is required to run cli4ai tools\n');
+    const installed = await installDependency('bun');
+    if (!installed) {
+      throw new ExecuteToolError('MISSING_DEPENDENCY', 'bun is required', {
+        hint: 'Install bun: curl -fsSL https://bun.sh/install | bash'
+      });
+    }
+  }
+
+  await checkPeerDependencies(pkg.path);
+
+  const secretsEnv = await checkAndPromptSecrets(pkg.path, options.packageName);
+
+  const entryPath = resolve(pkg.path, manifest.entry);
+  if (!existsSync(entryPath)) {
+    throw new ExecuteToolError('NOT_FOUND', `Entry point not found: ${entryPath}`, {
+      manifest: resolve(pkg.path, 'cli4ai.json')
+    });
+  }
+
+  const cmdArgs: string[] = [];
+  if (options.command) cmdArgs.push(options.command);
+  cmdArgs.push(...options.args);
+
+  const { execCmd, execArgs, runtime } = buildRuntimeCommand(entryPath, manifest, cmdArgs);
+
+  const teeStderr = options.teeStderr ?? true;
+
+  if (options.capture === 'inherit') {
+    const proc = spawn(execCmd, execArgs, {
+      stdio: 'inherit',
+      cwd: invocationDir,
+      env: {
+        ...process.env,
+        INIT_CWD: process.env.INIT_CWD ?? invocationDir,
+        CLI4AI_CWD: invocationDir,
+        C4AI_PACKAGE_DIR: pkg.path,
+        C4AI_PACKAGE_NAME: pkg.name,
+        C4AI_ENTRY: entryPath,
+        ...secretsEnv,
+        ...(options.env ?? {})
+      }
+    });
+
+    const exitCode = await new Promise<number>((resolve, reject) => {
+      proc.on('close', (code) => resolve(code ?? 0));
+      proc.on('error', (err) => {
+        reject(new ExecuteToolError('API_ERROR', `Failed to execute: ${err.message}`));
+      });
+    });
+
+    return {
+      exitCode,
+      durationMs: Date.now() - startTime,
+      packagePath: pkg.path,
+      entryPath,
+      runtime
+    };
+  }
+
+  // capture === 'pipe'
+  const proc = spawn(execCmd, execArgs, {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    cwd: invocationDir,
+    env: {
+      ...process.env,
+      INIT_CWD: process.env.INIT_CWD ?? invocationDir,
+      CLI4AI_CWD: invocationDir,
+      C4AI_PACKAGE_DIR: pkg.path,
+      C4AI_PACKAGE_NAME: pkg.name,
+      C4AI_ENTRY: entryPath,
+      ...secretsEnv,
+      ...(options.env ?? {})
+    }
+  });
+
+  if (options.stdin !== undefined) {
+    proc.stdin.write(options.stdin);
+    proc.stdin.end();
+  } else {
+    // Don’t block on stdin if nothing is provided
+    proc.stdin.end();
+  }
+
+  if (teeStderr && proc.stderr) {
+    proc.stderr.on('data', (chunk) => {
+      process.stderr.write(chunk);
+    });
+  }
+
+  const stdoutPromise = proc.stdout ? collectStream(proc.stdout) : Promise.resolve('');
+  const stderrPromise = proc.stderr ? collectStream(proc.stderr) : Promise.resolve('');
+
+  let timeout: NodeJS.Timeout | undefined;
+  if (options.timeoutMs && options.timeoutMs > 0) {
+    timeout = setTimeout(() => {
+      try {
+        proc.kill('SIGTERM');
+      } catch {}
+      setTimeout(() => {
+        try {
+          proc.kill('SIGKILL');
+        } catch {}
+      }, 250);
+    }, options.timeoutMs);
+  }
+
+  const exitCode = await new Promise<number>((resolve, reject) => {
+    proc.on('close', (code) => resolve(code ?? 0));
+    proc.on('error', (err) => reject(new ExecuteToolError('API_ERROR', `Failed to execute: ${err.message}`)));
+  }).finally(() => {
+    if (timeout) clearTimeout(timeout);
+  });
+
+  const [stdout, stderr] = await Promise.all([stdoutPromise, stderrPromise]);
+
+  return {
+    exitCode,
+    durationMs: Date.now() - startTime,
+    stdout,
+    stderr,
+    packagePath: pkg.path,
+    entryPath,
+    runtime
+  };
+}