cli4ai 0.8.3 → 0.9.1

package/src/commands/init.ts

@@ -9,7 +9,7 @@ import { createManifest, MANIFEST_FILENAME, type Manifest } from '../core/manife
 
 interface InitOptions {
   template?: string;
-  runtime?: 'bun' | 'node';
+  runtime?: 'node' | 'bun';
   yes?: boolean;
 }
 
@@ -18,7 +18,7 @@ export async function initCommand(name: string | undefined, options: InitOptions
   const targetDir = name ? resolve(process.cwd(), name) : process.cwd();
   const manifestPath = resolve(targetDir, MANIFEST_FILENAME);
   const templateName = options.template || 'basic';
-  const runtime = options.runtime || 'bun';
+  const runtime = options.runtime || 'node';
 
   // Check if cli4ai.json already exists
   if (existsSync(manifestPath)) {
@@ -46,7 +46,7 @@ export async function initCommand(name: string | undefined, options: InitOptions
   // Create entry file if it doesn't exist
   const entryPath = resolve(targetDir, manifest.entry);
   if (!existsSync(entryPath)) {
-    const template = getTemplate(templateName, runtime, manifest);
+    const template = getTemplate(templateName, manifest);
     writeFileSync(entryPath, template);
     log(`Created ${manifest.entry}`);
   }
@@ -54,7 +54,7 @@ export async function initCommand(name: string | undefined, options: InitOptions
   // Create helpful extras (non-destructive)
   const readmePath = resolve(targetDir, 'README.md');
   if (!existsSync(readmePath)) {
-    writeFileSync(readmePath, getReadmeTemplate(templateName, runtime, manifest));
+    writeFileSync(readmePath, getReadmeTemplate(templateName, manifest));
     log('Created README.md');
   }
 
@@ -66,11 +66,32 @@ export async function initCommand(name: string | undefined, options: InitOptions
 
   const pkgJsonPath = resolve(targetDir, 'package.json');
   if (!existsSync(pkgJsonPath)) {
-    const pkgJson = getDevPackageJson(templateName, runtime, manifest);
+    const pkgJson = getDevPackageJson(templateName, manifest);
     writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\n');
     log('Created package.json');
   }
 
+  // Create test file
+  const testPath = resolve(targetDir, manifest.entry.replace(/\.ts$/, '.test.ts'));
+  if (!existsSync(testPath)) {
+    writeFileSync(testPath, getTestTemplate(templateName, manifest));
+    log(`Created ${basename(testPath)}`);
+  }
+
+  // Create tsconfig.json for TypeScript support
+  const tsconfigPath = resolve(targetDir, 'tsconfig.json');
+  if (!existsSync(tsconfigPath)) {
+    writeFileSync(tsconfigPath, getTsconfigTemplate());
+    log('Created tsconfig.json');
+  }
+
+  // Create vitest.config.ts
+  const vitestConfigPath = resolve(targetDir, 'vitest.config.ts');
+  if (!existsSync(vitestConfigPath)) {
+    writeFileSync(vitestConfigPath, getVitestConfigTemplate());
+    log('Created vitest.config.ts');
+  }
+
   // Template-specific extras
   if (templateName === 'api') {
     const envExamplePath = resolve(targetDir, '.env.example');
@@ -80,14 +101,17 @@ export async function initCommand(name: string | undefined, options: InitOptions
     }
   }
 
-  const nextSteps = getNextSteps(name, targetDir, templateName, runtime, manifest);
+  const nextSteps = getNextSteps(name, targetDir, templateName, manifest);
 
   output({
     created: {
       manifest: manifestPath,
       entry: entryPath,
+      test: testPath,
       readme: readmePath,
       gitignore: gitignorePath,
+      tsconfig: tsconfigPath,
+      vitestConfig: vitestConfigPath,
       packageJson: existsSync(resolve(targetDir, 'package.json')) ? resolve(targetDir, 'package.json') : undefined,
     },
     name: manifest.name,
@@ -109,7 +133,7 @@ function guessAuthor(): string | undefined {
   return candidates[0];
 }
 
-function getBaseManifest(templateName: string, runtime: 'bun' | 'node'): Partial<Manifest> {
+function getBaseManifest(templateName: string, runtime: 'node' | 'bun'): Partial<Manifest> {
   const author = guessAuthor();
   const keywords = Array.from(new Set([
     'cli4ai',
@@ -118,7 +142,7 @@ function getBaseManifest(templateName: string, runtime: 'bun' | 'node'): Partial
   ]));
 
   return {
-    entry: runtime === 'node' ? 'run.mjs' : 'run.ts',
+    entry: 'run.ts',
     runtime,
     description: `${templateName === 'basic' ? 'CLI' : templateName} tool`,
     author,
@@ -128,7 +152,7 @@ function getBaseManifest(templateName: string, runtime: 'bun' | 'node'): Partial
   };
 }
 
-function getTemplateManifest(templateName: string, runtime: 'bun' | 'node'): Partial<Manifest> {
+function getTemplateManifest(templateName: string, runtime: 'node' | 'bun'): Partial<Manifest> {
   switch (templateName) {
     case 'api':
       return {
@@ -144,7 +168,7 @@ function getTemplateManifest(templateName: string, runtime: 'bun' | 'node'): Par
             description: 'API key for the service you are calling (stored via `cli4ai secrets`)',
           }
         },
-        dependencies: getDefaultDependencies(templateName, runtime),
+        dependencies: getDefaultDependencies(templateName),
       };
     case 'browser':
       return {
@@ -160,7 +184,7 @@ function getTemplateManifest(templateName: string, runtime: 'bun' | 'node'): Par
             ]
           }
         },
-        dependencies: getDefaultDependencies(templateName, runtime),
+        dependencies: getDefaultDependencies(templateName),
       };
     default:
       return {
@@ -170,23 +194,16 @@ function getTemplateManifest(templateName: string, runtime: 'bun' | 'node'): Par
             args: [{ name: 'name', required: false }]
           }
         },
-        dependencies: getDefaultDependencies(templateName, runtime),
+        dependencies: getDefaultDependencies(templateName),
       };
   }
 }
 
-function getDefaultDependencies(
-  templateName: string,
-  runtime: 'bun' | 'node'
-): Record<string, string> | undefined {
-  const deps: Record<string, string> = {};
-
-  // Prefer shared SDK helpers when running on bun (or node with TS support, if that lands later).
-  if (runtime === 'bun') {
-    deps['@cli4ai/lib'] = '^1.0.0';
-  }
-
-  deps['commander'] = '^14.0.0';
+function getDefaultDependencies(templateName: string): Record<string, string> | undefined {
+  const deps: Record<string, string> = {
+    '@cli4ai/lib': '^1.0.0',
+    'commander': '^14.0.0',
+  };
 
   if (templateName === 'browser') {
     deps['puppeteer'] = '^24.0.0';
@@ -195,28 +212,24 @@ function getDefaultDependencies(
   return deps;
 }
 
-function getTemplate(templateName: string, runtime: 'bun' | 'node', manifest: Manifest): string {
-  if (runtime === 'node') {
-    return getNodeTemplate(templateName, manifest);
-  }
-
+function getTemplate(templateName: string, manifest: Manifest): string {
   switch (templateName) {
     case 'api':
-      return getBunApiTemplate(manifest);
+      return getApiTemplate(manifest);
     case 'browser':
-      return getBunBrowserTemplate(manifest);
+      return getBrowserTemplate(manifest);
     default:
-      return getBunBasicTemplate(manifest);
+      return getBasicTemplate(manifest);
   }
 }
 
-function getBunBasicTemplate(manifest: Manifest): string {
-  return `#!/usr/bin/env bun
+function getBasicTemplate(manifest: Manifest): string {
+  return `#!/usr/bin/env npx tsx
 /**
  * ${manifest.name} - ${manifest.description || 'A cli4ai tool'}
  */
 
-import { cli, output } from '@cli4ai/lib/cli.ts';
+import { cli, output } from '@cli4ai/lib';
 
 const program = cli('${manifest.name}', '${manifest.version}', '${manifest.description || manifest.name}');
 
@@ -232,13 +245,13 @@ program.parse();
 `;
 }
 
-function getBunApiTemplate(manifest: Manifest): string {
-  return `#!/usr/bin/env bun
+function getApiTemplate(manifest: Manifest): string {
+  return `#!/usr/bin/env npx tsx
 /**
  * ${manifest.name} - ${manifest.description || 'API wrapper tool'}
  */
 
-import { cli, env, output, outputError, withErrorHandling } from '@cli4ai/lib/cli.ts';
+import { cli, env, output, outputError, withErrorHandling } from '@cli4ai/lib';
 
 const program = cli('${manifest.name}', '${manifest.version}', '${manifest.description || manifest.name}');
 
@@ -249,33 +262,29 @@ program
     // Use \`cli4ai secrets set API_KEY\` to store this securely (cli4ai injects it at runtime).
     const apiKey = env('API_KEY');
 
-    try {
-      const res = await fetch(\`https://api.example.com/\${endpoint}\`, {
-        headers: { 'Authorization': \`Bearer \${apiKey}\` }
-      });
-
-      if (!res.ok) {
-        outputError('API_ERROR', \`HTTP \${res.status}: \${res.statusText}\`);
-      }
+    const res = await fetch(\`https://api.example.com/\${endpoint}\`, {
+      headers: { 'Authorization': \`Bearer \${apiKey}\` }
+    });
 
-      output(await res.json());
-    } catch (err) {
-      outputError('NETWORK_ERROR', err instanceof Error ? err.message : String(err));
+    if (!res.ok) {
+      outputError('API_ERROR', \`HTTP \${res.status}: \${res.statusText}\`);
     }
+
+    output(await res.json());
   }));
 
 program.parse();
 `;
 }
 
-function getBunBrowserTemplate(manifest: Manifest): string {
-  return `#!/usr/bin/env bun
+function getBrowserTemplate(manifest: Manifest): string {
+  return `#!/usr/bin/env npx tsx
 /**
  * ${manifest.name} - ${manifest.description || 'Browser automation tool'}
  */
 
 import puppeteer from 'puppeteer';
-import { cli, output, outputError, withErrorHandling } from '@cli4ai/lib/cli.ts';
+import { cli, output, outputError, withErrorHandling } from '@cli4ai/lib';
 
 const program = cli('${manifest.name}', '${manifest.version}', '${manifest.description || manifest.name}');
 
@@ -297,161 +306,6 @@ program
         screenshot: options.output,
         timestamp: new Date().toISOString()
       });
-    } catch (err) {
-      outputError('API_ERROR', err instanceof Error ? err.message : String(err));
-    } finally {
-      await browser.close();
-    }
-  }));
-
-program.parse();
-`;
-}
-
-function getNodeTemplate(templateName: string, manifest: Manifest): string {
-  switch (templateName) {
-    case 'api':
-      return getNodeApiTemplate(manifest);
-    case 'browser':
-      return getNodeBrowserTemplate(manifest);
-    default:
-      return getNodeBasicTemplate(manifest);
-  }
-}
-
-function getNodeBasicTemplate(manifest: Manifest): string {
-  return `#!/usr/bin/env node
-/**
- * ${manifest.name} - ${manifest.description || 'A cli4ai tool'}
- */
-
-import { Command } from 'commander';
-
-const output = (data) => console.log(JSON.stringify(data, null, 2));
-const outputError = (code, message, details) => {
-  console.error(JSON.stringify({ error: code, message, ...(details || {}) }));
-  process.exit(1);
-};
-
-const withErrorHandling = (fn) => async (...args) => {
-  try {
-    await fn(...args);
-  } catch (err) {
-    outputError('API_ERROR', err instanceof Error ? err.message : String(err));
-  }
-};
-
-const program = new Command()
-  .name('${manifest.name}')
-  .version('${manifest.version}', '-v, --version', 'Show version')
-  .description('${manifest.description || manifest.name}');
-
-program
-  .command('hello [name]')
-  .description('Say hello')
-  .action(withErrorHandling(async (name) => {
-    const who = (name || '').trim() || 'world';
-    output({ message: \`Hello, \${who}!\` });
-  }));
-
-program.parse();
-`;
-}
-
-function getNodeApiTemplate(manifest: Manifest): string {
-  return `#!/usr/bin/env node
-/**
- * ${manifest.name} - ${manifest.description || 'API wrapper tool'}
- */
-
-import { Command } from 'commander';
-
-const output = (data) => console.log(JSON.stringify(data, null, 2));
-const outputError = (code, message, details) => {
-  console.error(JSON.stringify({ error: code, message, ...(details || {}) }));
-  process.exit(1);
-};
-
-const withErrorHandling = (fn) => async (...args) => {
-  try {
-    await fn(...args);
-  } catch (err) {
-    outputError('API_ERROR', err instanceof Error ? err.message : String(err));
-  }
-};
-
-const env = (name) => {
-  const value = process.env[name];
-  if (!value) outputError('ENV_MISSING', \`Missing required environment variable: \${name}\`);
-  return value;
-};
-
-const program = new Command()
-  .name('${manifest.name}')
-  .version('${manifest.version}', '-v, --version', 'Show version')
-  .description('${manifest.description || manifest.name}');
-
-program
-  .command('fetch <endpoint>')
-  .description('Fetch JSON from an API endpoint')
-  .action(withErrorHandling(async (endpoint) => {
-    // Use \`cli4ai secrets set API_KEY\` to store this securely (cli4ai injects it at runtime).
-    const apiKey = env('API_KEY');
-    const res = await fetch(\`https://api.example.com/\${endpoint}\`, {
-      headers: { Authorization: \`Bearer \${apiKey}\` },
-    });
-
-    if (!res.ok) {
-      outputError('API_ERROR', \`HTTP \${res.status}: \${res.statusText}\`);
-    }
-
-    output(await res.json());
-  }));
-
-program.parse();
-`;
-}
-
-function getNodeBrowserTemplate(manifest: Manifest): string {
-  return `#!/usr/bin/env node
-/**
- * ${manifest.name} - ${manifest.description || 'Browser automation tool'}
- */
-
-import { Command } from 'commander';
-import puppeteer from 'puppeteer';
-
-const output = (data) => console.log(JSON.stringify(data, null, 2));
-const outputError = (code, message, details) => {
-  console.error(JSON.stringify({ error: code, message, ...(details || {}) }));
-  process.exit(1);
-};
-
-const withErrorHandling = (fn) => async (...args) => {
-  try {
-    await fn(...args);
-  } catch (err) {
-    outputError('API_ERROR', err instanceof Error ? err.message : String(err));
-  }
-};
-
-const program = new Command()
-  .name('${manifest.name}')
-  .version('${manifest.version}', '-v, --version', 'Show version')
-  .description('${manifest.description || manifest.name}');
-
-program
-  .command('screenshot <url>')
-  .description('Take a screenshot of a webpage')
-  .option('-o, --output <file>', 'Output file', 'screenshot.png')
-  .option('--full-page', 'Capture full page')
-  .action(withErrorHandling(async (url, options) => {
-    const browser = await puppeteer.launch({ headless: true });
-    try {
-      const page = await browser.newPage();
-      await page.goto(url, { waitUntil: 'networkidle2' });
-      await page.screenshot({ path: options.output, fullPage: options.fullPage });
-      output({ url, screenshot: options.output, timestamp: new Date().toISOString() });
     } finally {
       await browser.close();
     }
@@ -461,11 +315,7 @@ program.parse();
 `;
 }
 
-function getReadmeTemplate(templateName: string, runtime: 'bun' | 'node', manifest: Manifest): string {
-  const runCmd =
-    runtime === 'node' ? `node ${manifest.entry}` :
-    `bun run ${manifest.entry}`;
-
+function getReadmeTemplate(templateName: string, manifest: Manifest): string {
   const exampleCmd =
     templateName === 'api' ? 'fetch users' :
     templateName === 'browser' ? 'screenshot https://example.com' :
@@ -475,10 +325,16 @@ function getReadmeTemplate(templateName: string, runtime: 'bun' | 'node', manife
 
 ${manifest.description || ''}
 
+## Setup
+
+\`\`\`bash
+npm install
+\`\`\`
+
 ## Run directly
 
 \`\`\`bash
-${runCmd} ${exampleCmd}
+npx tsx run.ts ${exampleCmd}
 \`\`\`
 
 ## Install with cli4ai (project-scoped)
@@ -489,6 +345,12 @@ cli4ai add --local /path/to/${manifest.name} -y
 cli4ai run ${manifest.name} ${exampleCmd}
 \`\`\`
 
+## Testing
+
+\`\`\`bash
+npm test
+\`\`\`
+
 ## MCP
 
 \`\`\`bash
@@ -504,12 +366,93 @@ function getGitignoreTemplate(): string {
 .env.*
 dist
 .DS_Store
+*.log
+coverage
+`;
+}
+
+function getTsconfigTemplate(): string {
+  return `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": false,
+    "noEmit": true
+  },
+  "include": ["*.ts", "lib/**/*.ts"],
+  "exclude": ["node_modules"]
+}
+`;
+}
+
+function getVitestConfigTemplate(): string {
+  return `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+  },
+});
+`;
+}
+
+function getTestTemplate(templateName: string, manifest: Manifest): string {
+  const testCmd = templateName === 'api' ? 'fetch' : templateName === 'browser' ? 'screenshot' : 'hello';
+  const envSetup = templateName === 'api' ? `
+// Set required env vars before importing
+process.env.API_KEY = 'test-api-key';
+` : '';
+
+  return `import { describe, test, expect, vi, beforeEach, afterEach } from 'vitest';
+${envSetup}
+describe('${manifest.name}', () => {
+  let consoleSpy: ReturnType<typeof vi.spyOn>;
+  let logs: string[];
+
+  beforeEach(() => {
+    logs = [];
+    consoleSpy = vi.spyOn(console, 'log').mockImplementation((msg: string) => {
+      logs.push(msg);
+    });
+  });
+
+  afterEach(() => {
+    consoleSpy.mockRestore();
+  });
+
+  describe('${testCmd} command', () => {
+    test('should output valid JSON', async () => {
+      // TODO: Import and test your command handler
+      // Example:
+      // import { ${testCmd}Command } from './run';
+      // await ${testCmd}Command('test-arg');
+      // expect(logs.length).toBeGreaterThan(0);
+      // const result = JSON.parse(logs[0]);
+      // expect(result).toBeDefined();
+
+      expect(true).toBe(true); // Placeholder - replace with real test
+    });
+
+    test('should handle invalid input', async () => {
+      // TODO: Test error handling
+      // Example:
+      // expect(() => ${testCmd}Command('')).toThrow();
+
+      expect(true).toBe(true); // Placeholder - replace with real test
+    });
+  });
+});
 `;
 }
 
 function getDevPackageJson(
   templateName: string,
-  runtime: 'bun' | 'node',
   manifest: Manifest
 ): Record<string, unknown> {
   const deps = manifest.dependencies || {};
@@ -520,11 +463,19 @@ function getDevPackageJson(
     private: true,
     type: 'module',
     bin: {
-      [manifest.name]: `./${manifest.entry}`,
+      [manifest.name]: `./run.ts`,
     },
     dependencies: deps,
+    devDependencies: {
+      'typescript': '^5.0.0',
+      'tsx': '^4.0.0',
+      'vitest': '^2.0.0',
+      '@types/node': '^22.0.0',
+    },
     scripts: {
-      dev: runtime === 'node' ? `node ${manifest.entry}` : `bun run ${manifest.entry}`,
+      dev: 'tsx run.ts',
+      test: 'vitest run',
+      'test:watch': 'vitest',
     },
   };
 }
@@ -533,7 +484,6 @@ function getNextSteps(
   nameArg: string | undefined,
   targetDir: string,
   templateName: string,
-  runtime: 'bun' | 'node',
   manifest: Manifest
 ): Array<{ description: string; command: string }> {
   const exampleArgs =
@@ -541,16 +491,20 @@ function getNextSteps(
     templateName === 'browser' ? 'screenshot https://example.com' :
     'hello world';
 
-  const runDirect =
-    runtime === 'node' ? `node ${manifest.entry} ${exampleArgs}` :
-    `bun run ${manifest.entry} ${exampleArgs}`;
-
   const installPath = nameArg ? `./${basename(targetDir)}` : '.';
 
   return [
     {
-      description: 'Run the tool directly in this folder',
-      command: runDirect,
+      description: 'Install dependencies',
+      command: 'npm install',
+    },
+    {
+      description: 'Run the tool directly',
+      command: `npx tsx run.ts ${exampleArgs}`,
+    },
+    {
+      description: 'Run tests',
+      command: 'npm test',
     },
     {
       description: 'Install into a project and run via cli4ai',

package/src/commands/routines.ts

@@ -384,9 +384,24 @@ export async function routinesEditCommand(name: string, options: { global?: bool
     return;
   }
 
-  const result = spawnSync(editor, [routine.path], {
-    stdio: 'inherit',
-    shell: true
+  // SECURITY: Parse editor command to prevent shell injection
+  // Common editors may have arguments like "code --wait" or "vim -c 'set nu'"
+  // We split on spaces but this is a simple approach; complex cases should use exec wrapper
+  const editorParts = editor.trim().split(/\s+/);
+  const editorCmd = editorParts[0];
+  const editorArgs = [...editorParts.slice(1), routine.path];
+
+  // Validate editor command doesn't contain shell metacharacters in the base command
+  if (!/^[a-zA-Z0-9_.\-\/]+$/.test(editorCmd)) {
+    outputError('INVALID_INPUT', 'Invalid $EDITOR value - contains unsafe characters', {
+      editor: editorCmd,
+      hint: 'Set $EDITOR to a simple command like "vim", "nano", or "code --wait"'
+    });
+  }
+
+  const result = spawnSync(editorCmd, editorArgs, {
+    stdio: 'inherit'
+    // SECURITY: shell: false (default) prevents command injection
   });
 
   process.exit(result.status ?? 1);

package/src/commands/scheduler.ts

@@ -79,7 +79,7 @@ export async function schedulerStartCommand(options: SchedulerStartOptions): Pro
   const daemonScript = resolve(dirname(fileURLToPath(import.meta.url)), '../core/scheduler-daemon.ts');
 
   // Spawn with detached mode
-  const child = spawn('bun', [daemonScript, '--project-dir', process.cwd()], {
+  const child = spawn('npx', ['tsx', daemonScript, '--project-dir', process.cwd()], {
     detached: true,
     stdio: 'ignore',
     env: {

package/src/commands/update.ts

@@ -99,14 +99,30 @@ export async function checkForUpdates(): Promise<{ hasUpdate: boolean; current:
  */
 function getUpdateablePackages(): Array<{ name: string; npmName: string; version: string }> {
   const packages: Array<{ name: string; npmName: string; version: string }> = [];
+  const seen = new Set<string>();
+
+  // Get packages from ~/.cli4ai/packages/ (where cli4ai add -g installs)
+  for (const pkg of getGlobalPackages()) {
+    if (!seen.has(pkg.name)) {
+      seen.add(pkg.name);
+      packages.push({
+        name: pkg.name,
+        npmName: `@cli4ai/${pkg.name}`,
+        version: pkg.version
+      });
+    }
+  }
 
-  // Get npm global @cli4ai packages
+  // Also check npm global @cli4ai packages (for packages installed via npm directly)
   for (const pkg of getNpmGlobalPackages()) {
-    packages.push({
-      name: pkg.name,
-      npmName: `@cli4ai/${pkg.name}`,
-      version: pkg.version
-    });
+    if (!seen.has(pkg.name)) {
+      seen.add(pkg.name);
+      packages.push({
+        name: pkg.name,
+        npmName: `@cli4ai/${pkg.name}`,
+        version: pkg.version
+      });
+    }
   }
 
   return packages;