cli4ai 1.1.5 → 1.2.1

package/src/commands/add.ts

@@ -1,562 +0,0 @@
-/**
- * cli4ai add - Install packages
- */
-
-import { existsSync, symlinkSync, mkdirSync, cpSync, rmSync, readdirSync, statSync, unlinkSync, lstatSync } from 'fs';
-import { resolve, dirname, join, basename, normalize } from 'path';
-import { createInterface } from 'readline';
-import { tmpdir } from 'os';
-import { spawnSync } from 'child_process';
-import { output, outputError, log } from '../lib/cli.js';
-import { loadManifest, tryLoadManifest, type Manifest } from '../core/manifest.js';
-import {
-  ensureCli4aiHome,
-  ensureLocalDir,
-  PACKAGES_DIR,
-  LOCAL_PACKAGES_DIR,
-  loadConfig
-} from '../core/config.js';
-import { lockPackage, type LockedPackage } from '../core/lockfile.js';
-import { linkPackageDirect, isBinInPath, getPathInstructions } from '../core/link.js';
-
-interface AddOptions {
-  local?: boolean;
-  global?: boolean;
-  saveDev?: boolean;
-  yes?: boolean;  // Skip confirmation
-}
-
-interface InstallResult {
-  name: string;
-  version: string;
-  path: string;
-  source: 'local' | 'registry';
-  binPath?: string;
-  dependencies?: Record<string, string>;
-  peerDependencies?: Record<string, string>;
-}
-
-interface InstallPlan {
-  package: string;
-  manifest: Manifest;
-  path: string;
-  npmDependencies: string[];
-  peerDependencies: Array<{ name: string; version: string; description?: string }>;
-  fromNpm?: boolean;
-}
-
-const PKG_NAME_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
-const CLI4AI_SCOPED_PKG_PATTERN = /^@cli4ai\/[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
-const URL_LIKE_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
-
-function validatePackageSpecifier(pkg: string): void {
-  if (URL_LIKE_PATTERN.test(pkg)) {
-    let parsed: URL;
-    try {
-      parsed = new URL(pkg);
-    } catch {
-      outputError('INVALID_INPUT', 'Invalid URL', { url: pkg });
-    }
-    if (parsed.protocol !== 'https:') {
-      outputError('INVALID_INPUT', 'Unsupported URL protocol', {
-        url: pkg,
-        protocol: parsed.protocol,
-        allowed: ['https:']
-      });
-    }
-    outputError('INVALID_INPUT', 'Installing from URLs is not supported', {
-      url: pkg,
-      hint: 'Use a local path (./path) or a package name (e.g. github, @cli4ai/github)'
-    });
-  }
-
-  if (pkg.includes('\\') || pkg.includes('..')) {
-    outputError('INVALID_INPUT', 'Invalid package specifier', { package: pkg });
-  }
-
-  if (pkg.startsWith('@cli4ai/')) {
-    if (!CLI4AI_SCOPED_PKG_PATTERN.test(pkg)) {
-      outputError('INVALID_INPUT', 'Invalid package name', { package: pkg });
-    }
-    return;
-  }
-
-  if (!PKG_NAME_PATTERN.test(pkg)) {
-    outputError('INVALID_INPUT', 'Invalid package name', { package: pkg });
-  }
-}
-
-/**
- * Prompt user for confirmation
- */
-async function confirm(message: string): Promise<boolean> {
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stderr
-  });
-
-  return new Promise((resolve) => {
-    rl.question(`${message} [y/N] `, (answer) => {
-      rl.close();
-      resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
-    });
-  });
-}
-
-/**
- * Validate extracted tarball paths to prevent path traversal attacks
- */
-function validateTarballPaths(extractedDir: string): boolean {
-  function checkPath(dir: string): boolean {
-    const entries = readdirSync(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
-      const normalizedPath = normalize(fullPath);
-
-      // Ensure path doesn't escape the extraction directory
-      if (!normalizedPath.startsWith(normalize(extractedDir))) {
-        return false;
-      }
-
-      // Check for suspicious names
-      if (entry.name.includes('..') || entry.name.startsWith('/')) {
-        return false;
-      }
-
-      if (entry.isDirectory()) {
-        if (!checkPath(fullPath)) return false;
-      }
-    }
-    return true;
-  }
-
-  return checkPath(extractedDir);
-}
-
-/**
- * Download and extract package from npm registry
- */
-async function downloadFromNpm(packageName: string, targetDir: string): Promise<string> {
-  const tmpDir = join(tmpdir(), `cli4ai-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  mkdirSync(tmpDir, { recursive: true });
-
-  try {
-    // Use npm pack to download the tarball - using spawnSync to prevent command injection
-    log(`Downloading ${packageName} from npm...`);
-    const packResult = spawnSync('npm', ['pack', packageName, `--pack-destination=${tmpDir}`], {
-      stdio: 'pipe',
-      cwd: tmpDir,
-      encoding: 'utf-8'
-    });
-
-    if (packResult.error) {
-      throw new Error(`npm not found or failed to execute: ${packResult.error.message}`);
-    }
-
-    if (packResult.status !== 0) {
-      throw new Error(`npm pack failed: ${packResult.stderr || packResult.stdout || 'unknown error'}`);
-    }
-
-    // Find the tarball (it will be named like cli4ai-slack-1.0.2.tgz)
-    const files = readdirSync(tmpDir);
-    const tarball = files.find(f => f.endsWith('.tgz'));
-
-    if (!tarball) {
-      throw new Error('Failed to download package tarball');
-    }
-
-    // Extract the tarball using spawnSync to prevent command injection
-    // Use --strip-components=1 equivalent by extracting to a subdir
-    const tarPath = join(tmpDir, tarball);
-    const extractResult = spawnSync('tar', ['-xzf', tarPath, '-C', tmpDir], {
-      stdio: 'pipe',
-      encoding: 'utf-8'
-    });
-
-    if (extractResult.status !== 0) {
-      throw new Error(`Failed to extract package: ${extractResult.stderr || 'tar extraction failed'}`);
-    }
-
-    // The extracted content is in a 'package' folder
-    const extractedPath = join(tmpDir, 'package');
-
-    if (!existsSync(extractedPath)) {
-      throw new Error('Failed to extract package');
-    }
-
-    // Validate extracted paths to prevent path traversal attacks
-    if (!validateTarballPaths(extractedPath)) {
-      throw new Error('Package contains suspicious paths - possible path traversal attack');
-    }
-
-    // Get package name without scope for target directory
-    const shortName = packageName.replace('@cli4ai/', '');
-    const pkgTargetDir = join(targetDir, shortName);
-
-    // Remove existing if present
-    if (existsSync(pkgTargetDir)) {
-      rmSync(pkgTargetDir, { recursive: true });
-    }
-
-    // Copy to target directory
-    mkdirSync(dirname(pkgTargetDir), { recursive: true });
-    cpSync(extractedPath, pkgTargetDir, { recursive: true });
-
-    // Clean up temp directory
-    rmSync(tmpDir, { recursive: true });
-
-    return pkgTargetDir;
-  } catch (err) {
-    // Clean up on error
-    if (existsSync(tmpDir)) {
-      rmSync(tmpDir, { recursive: true });
-    }
-    throw err;
-  }
-}
-
-/**
- * Check if a CLI tool is available
- */
-function checkCliTool(name: string): boolean {
-  try {
-    const result = spawnSync('which', [name], { stdio: 'pipe' });
-    return result.status === 0;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Install npm dependencies
- */
-async function installNpmDependencies(pkgPath: string, dependencies: Record<string, string>): Promise<void> {
-  const deps = Object.entries(dependencies).map(([name, version]) => `${name}@${version}`);
-
-  if (deps.length === 0) return;
-
-  log(`Installing npm dependencies: ${deps.join(', ')}`);
-
-  const result = spawnSync('npm', ['install', ...deps], {
-    cwd: pkgPath,
-    stdio: 'inherit'
-  });
-
-  if (result.status !== 0) {
-    throw new Error(`Failed to install dependencies (exit code: ${result.status})`);
-  }
-}
-
-/**
- * Display installation plan
- */
-function displayInstallPlan(plans: InstallPlan[]): void {
-  log('\n┌─────────────────────────────────────────────────────┐');
-  log('│              INSTALLATION PLAN                      │');
-  log('└─────────────────────────────────────────────────────┘\n');
-
-  for (const plan of plans) {
-    log(`📦 ${plan.manifest.name}@${plan.manifest.version}`);
-
-    if (plan.manifest.description) {
-      log(`   ${plan.manifest.description}`);
-    }
-
-    if (plan.npmDependencies.length > 0) {
-      log('\n   npm dependencies to install:');
-      for (const dep of plan.npmDependencies) {
-        log(`     • ${dep}`);
-      }
-    }
-
-    if (plan.peerDependencies.length > 0) {
-      log('\n   ⚠️  peer dependencies (you must install these yourself):');
-      for (const peer of plan.peerDependencies) {
-        log(`     • ${peer.name} ${peer.version}`);
-        if (peer.description) {
-          log(`       ${peer.description}`);
-        }
-      }
-    }
-
-    if (plan.manifest.env) {
-      const requiredEnvs = Object.entries(plan.manifest.env)
-        .filter(([_, def]) => def.required)
-        .map(([name, def]) => ({ name, ...def }));
-
-      if (requiredEnvs.length > 0) {
-        log('\n   🔐 required environment variables:');
-        for (const envVar of requiredEnvs) {
-          log(`     • ${envVar.name}`);
-          if (envVar.description) {
-            log(`       ${envVar.description}`);
-          }
-        }
-      }
-    }
-
-    log('');
-  }
-}
-
-export async function addCommand(packages: string[], options: AddOptions): Promise<void> {
-  const results: InstallResult[] = [];
-  const errors: { package: string; error: string }[] = [];
-
-  const targetDir = options.global ? PACKAGES_DIR : resolve(process.cwd(), LOCAL_PACKAGES_DIR);
-
-  // Ensure target directory exists
-  if (options.global) {
-    ensureCli4aiHome();
-  } else {
-    ensureLocalDir(process.cwd());
-  }
-
-  const projectDir = process.cwd();
-
-  // Build installation plans
-  const plans: InstallPlan[] = [];
-
-  for (const pkg of packages) {
-    try {
-      const { manifest, path: pkgPath, fromNpm } = await resolvePackage(pkg, options, targetDir);
-
-      // Build npm dependencies list
-      const npmDependencies: string[] = [];
-      if (manifest.dependencies) {
-        for (const [name, version] of Object.entries(manifest.dependencies)) {
-          npmDependencies.push(`${name}@${version}`);
-        }
-      }
-
-      // Build peer dependencies list
-      const peerDependencies: Array<{ name: string; version: string; description?: string }> = [];
-      if (manifest.peerDependencies) {
-        for (const [name, version] of Object.entries(manifest.peerDependencies)) {
-          peerDependencies.push({ name, version, description: String(version) });
-        }
-      }
-
-      plans.push({
-        package: pkg,
-        manifest,
-        path: pkgPath,
-        npmDependencies,
-        peerDependencies,
-        fromNpm
-      });
-    } catch (err) {
-      errors.push({
-        package: pkg,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-
-  if (plans.length === 0) {
-    if (errors.length > 0) {
-      outputError('INSTALL_ERROR', 'Failed to resolve packages', { errors });
-    }
-    return;
-  }
-
-  // Display installation plan
-  displayInstallPlan(plans);
-
-  // Check peer dependencies availability
-  const peerWarnings: string[] = [];
-  for (const plan of plans) {
-    for (const peer of plan.peerDependencies) {
-      // Check if it's a CLI tool (not a cli4ai package reference)
-      if (!peer.version.includes('cli4ai')) {
-        const available = checkCliTool(peer.name);
-        if (!available) {
-          peerWarnings.push(`${peer.name} is not installed on your system`);
-        }
-      }
-    }
-  }
-
-  if (peerWarnings.length > 0) {
-    log('⚠️  Warning: Some peer dependencies are missing:');
-    for (const warning of peerWarnings) {
-      log(`   • ${warning}`);
-    }
-    log('');
-  }
-
-  // Ask for confirmation unless --yes flag is provided
-  if (!options.yes) {
-    const confirmed = await confirm('Proceed with installation?');
-    if (!confirmed) {
-      log('Installation cancelled.');
-      process.exit(0);
-    }
-  }
-
-  // Proceed with installation
-  for (const plan of plans) {
-    try {
-      let result: InstallResult;
-
-      if (plan.fromNpm) {
-        // Package already downloaded to target directory
-        result = {
-          name: plan.manifest.name,
-          version: plan.manifest.version,
-          path: plan.path,
-          source: 'registry'
-        };
-      } else {
-        // Local package - need to symlink/copy
-        result = await installPackage(plan.path, targetDir, plan.manifest, options);
-      }
-
-      // Install npm dependencies
-      if (plan.manifest.dependencies && Object.keys(plan.manifest.dependencies).length > 0) {
-        await installNpmDependencies(result.path, plan.manifest.dependencies);
-      }
-
-      // Link to PATH for global installs
-      if (options.global) {
-        result.binPath = linkPackageDirect(plan.manifest, result.path);
-        log(`✓ ${result.name}@${result.version} (linked to ${result.binPath})`);
-      } else {
-        log(`✓ ${result.name}@${result.version}`);
-
-        // Update lockfile (only for local/project installs)
-        const lockedPkg: LockedPackage = {
-          name: result.name,
-          version: result.version,
-          resolved: result.source === 'local' ? result.path : result.path
-        };
-        lockPackage(projectDir, lockedPkg);
-      }
-
-      result.dependencies = plan.manifest.dependencies;
-      result.peerDependencies = plan.manifest.peerDependencies;
-      results.push(result);
-    } catch (err) {
-      errors.push({
-        package: plan.package,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-
-  if (errors.length > 0 && results.length === 0) {
-    outputError('INSTALL_ERROR', 'Failed to install packages', { errors });
-  }
-
-  // Show PATH instructions for global installs if not already in PATH
-  if (options.global && results.length > 0 && !isBinInPath()) {
-    console.error('\n' + getPathInstructions() + '\n');
-  }
-
-  output({
-    installed: results,
-    errors: errors.length > 0 ? errors : undefined,
-    location: options.global ? 'global' : 'local'
-  });
-}
-
-async function resolvePackage(
-  pkg: string,
-  options: AddOptions,
-  targetDir: string
-): Promise<{ manifest: Manifest; path: string; fromNpm?: boolean }> {
-  // Check if it's a local path
-  if (options.local || pkg.startsWith('./') || pkg.startsWith('/') || pkg.startsWith('../')) {
-    const absolutePath = resolve(pkg);
-    if (!existsSync(absolutePath)) {
-      throw new Error(`Path does not exist: ${absolutePath}`);
-    }
-    const manifest = loadManifest(absolutePath);
-    return { manifest, path: absolutePath };
-  }
-
-  validatePackageSpecifier(pkg);
-
-  // Check local registries first
-  const config = loadConfig();
-  for (const registryPath of config.localRegistries) {
-    const pkgPath = resolve(registryPath, pkg);
-    const manifest = tryLoadManifest(pkgPath);
-    if (manifest) {
-      return { manifest, path: pkgPath };
-    }
-  }
-
-  // Check if it's a @cli4ai package - download from npm
-  if (pkg.startsWith('@cli4ai/')) {
-    try {
-      const pkgPath = await downloadFromNpm(pkg, targetDir);
-      const manifest = loadManifest(pkgPath);
-      return { manifest, path: pkgPath, fromNpm: true };
-    } catch (err) {
-      outputError('NPM_ERROR', `Failed to download ${pkg} from npm`, {
-        hint: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-
-  // Auto-resolve to @cli4ai/ scope and try npm
-  const scopedName = `@cli4ai/${pkg}`;
-  let npmError: string | undefined;
-  try {
-    log(`Resolving ${pkg} as ${scopedName}...`);
-    const pkgPath = await downloadFromNpm(scopedName, targetDir);
-    const manifest = loadManifest(pkgPath);
-    return { manifest, path: pkgPath, fromNpm: true };
-  } catch (err) {
-    npmError = err instanceof Error ? err.message : String(err);
-  }
-
-  outputError('NOT_FOUND', `Package not found: ${pkg}`, {
-    hint: `Tried @cli4ai/${pkg} on npm. Use --local flag for local paths, or add a local registry with "cli4ai config --add-registry <path>"`,
-    npmError
-  });
-}
-
-async function installPackage(
-  sourcePath: string,
-  targetDir: string,
-  manifest: Manifest,
-  options: AddOptions
-): Promise<InstallResult> {
-  // Create target path
-  const pkgDir = resolve(targetDir, manifest.name);
-
-  // Remove existing if present
-  if (existsSync(pkgDir)) {
-    try {
-      const stat = lstatSync(pkgDir);
-      if (stat.isSymbolicLink()) {
-        unlinkSync(pkgDir);
-      } else {
-        rmSync(pkgDir, { recursive: true });
-      }
-    } catch {
-      throw new Error(`Failed to remove existing package at ${pkgDir}`);
-    }
-  }
-
-  // Ensure parent directory exists
-  mkdirSync(dirname(pkgDir), { recursive: true });
-
-  // Create symlink to source
-  try {
-    symlinkSync(sourcePath, pkgDir, 'dir');
-  } catch (err) {
-    // If symlink fails (Windows?), copy instead
-    log(`Symlink failed, copying instead...`);
-    cpSync(sourcePath, pkgDir, { recursive: true });
-  }
-
-  return {
-    name: manifest.name,
-    version: manifest.version,
-    path: pkgDir,
-    source: 'local'
-  };
-}