cli4ai 1.1.5 → 1.2.1

package/src/core/link.ts

@@ -1,246 +0,0 @@
-/**
- * PATH linking for global packages
- *
- * Creates executable symlinks in ~/.cli4ai/bin/ that can be added to PATH
- */
-
-import { existsSync, mkdirSync, symlinkSync, unlinkSync, writeFileSync, chmodSync } from 'fs';
-import { resolve, join } from 'path';
-import { homedir } from 'os';
-import { type Manifest } from './manifest.js';
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SECURITY: Shell escaping for safe script generation
-// ═══════════════════════════════════════════════════════════════════════════
-
-/**
- * Validate that a string is safe for shell script embedding.
- * Only allows alphanumeric, hyphens, underscores, and dots.
- * This is a strict allowlist approach for defense in depth.
- */
-function isShellSafe(value: string): boolean {
-  return /^[a-zA-Z0-9._-]+$/.test(value);
-}
-
-/**
- * Escape a string for safe embedding in shell scripts.
- * Uses single quotes which prevent all shell interpretation except for single quotes themselves.
- */
-function shellEscape(value: string): string {
-  // Single quotes prevent shell interpretation; escape any single quotes in the value
-  // by ending the single-quoted string, adding an escaped single quote, and starting a new single-quoted string
-  return "'" + value.replace(/'/g, "'\\''") + "'";
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// PATHS
-// ═══════════════════════════════════════════════════════════════════════════
-
-export const C4AI_BIN = resolve(homedir(), '.cli4ai', 'bin');
-
-// ═══════════════════════════════════════════════════════════════════════════
-// FUNCTIONS
-// ═══════════════════════════════════════════════════════════════════════════
-
-/**
- * Ensure bin directory exists
- */
-export function ensureBinDir(): void {
-  if (!existsSync(C4AI_BIN)) {
-    mkdirSync(C4AI_BIN, { recursive: true });
-  }
-}
-
-/**
- * Create executable wrapper script for a package
- *
- * Creates a shell script that invokes `cli4ai run <package> [args]`
- */
-export function linkPackage(manifest: Manifest, packagePath: string): string {
-  ensureBinDir();
-
-  // SECURITY: Validate manifest values before embedding in shell script
-  if (!isShellSafe(manifest.name)) {
-    throw new Error(`Invalid package name for shell script: ${manifest.name}`);
-  }
-  if (!isShellSafe(manifest.version)) {
-    throw new Error(`Invalid package version for shell script: ${manifest.version}`);
-  }
-
-  const binPath = join(C4AI_BIN, manifest.name);
-
-  // Create wrapper script with escaped values for defense in depth
-  const safeName = shellEscape(manifest.name);
-  const safeVersion = shellEscape(manifest.version);
-
-  const script = `#!/bin/sh
-# cli4ai wrapper for ${safeName}@${safeVersion}
-# Auto-generated - do not edit
-
-exec cli4ai run ${safeName} "$@"
-`;
-
-  writeFileSync(binPath, script);
-  if (process.platform !== 'win32') {
-    chmodSync(binPath, 0o755);
-  }
-
-  // Windows compatibility: generate .cmd and .ps1 launchers
-  if (process.platform === 'win32') {
-    const cmdContent = `@echo off\r\ncli4ai run ${manifest.name} %*\r\nexit /b %errorlevel%\r\n`;
-    writeFileSync(binPath + '.cmd', cmdContent);
-
-    const ps1Content = `& cli4ai run ${manifest.name} @args\nexit $LASTEXITCODE\n`;
-    writeFileSync(binPath + '.ps1', ps1Content);
-  }
-
-  return binPath;
-}
-
-/**
- * Create direct executable wrapper that runs the tool directly
- *
- * This is faster than going through cli4ai run
- */
-export function linkPackageDirect(manifest: Manifest, packagePath: string): string {
-  ensureBinDir();
-
-  // SECURITY: Validate manifest values before embedding in shell script
-  if (!isShellSafe(manifest.name)) {
-    throw new Error(`Invalid package name for shell script: ${manifest.name}`);
-  }
-  if (!isShellSafe(manifest.version)) {
-    throw new Error(`Invalid package version for shell script: ${manifest.version}`);
-  }
-
-  const binPath = join(C4AI_BIN, manifest.name);
-  const entryPath = resolve(packagePath, manifest.entry);
-
-  // SECURITY: Shell-escape the entry path to prevent injection
-  const safeEntryPath = shellEscape(entryPath);
-  const safeName = shellEscape(manifest.name);
-  const safeVersion = shellEscape(manifest.version);
-
-  // Build runtime command - use tsx for TypeScript, node for JavaScript
-  let execCommand: string;
-  if (entryPath.endsWith('.ts') || entryPath.endsWith('.tsx')) {
-    execCommand = `npx tsx ${safeEntryPath}`;
-  } else {
-    execCommand = `node ${safeEntryPath}`;
-  }
-
-  // Create wrapper script that runs the tool directly
-  const script = `#!/bin/sh
-# cli4ai wrapper for ${safeName}@${safeVersion}
-# Auto-generated - do not edit
-
-exec ${execCommand} "$@"
-`;
-
-  writeFileSync(binPath, script);
-  if (process.platform !== 'win32') {
-    chmodSync(binPath, 0o755);
-  }
-
-  // Windows compatibility: generate .cmd and .ps1 launchers
-  if (process.platform === 'win32') {
-    const quotedEntry = `"${entryPath.replaceAll('"', '""')}"`;
-
-    let cmdContent: string;
-    let ps1Content: string;
-    if (entryPath.endsWith('.ts') || entryPath.endsWith('.tsx')) {
-      cmdContent = `@echo off\r\nnpx tsx ${quotedEntry} %*\r\nexit /b %errorlevel%\r\n`;
-      ps1Content = `& npx tsx ${quotedEntry} @args\nexit $LASTEXITCODE\n`;
-    } else {
-      cmdContent = `@echo off\r\nnode ${quotedEntry} %*\r\nexit /b %errorlevel%\r\n`;
-      ps1Content = `& node ${quotedEntry} @args\nexit $LASTEXITCODE\n`;
-    }
-    writeFileSync(binPath + '.cmd', cmdContent);
-    writeFileSync(binPath + '.ps1', ps1Content);
-  }
-
-  return binPath;
-}
-
-/**
- * Remove executable link for a package
- */
-export function unlinkPackage(packageName: string): boolean {
-  // SECURITY: Validate package name to prevent path traversal
-  if (!isShellSafe(packageName) || packageName.includes('..')) {
-    throw new Error(`Invalid package name: ${packageName}`);
-  }
-
-  const basePath = join(C4AI_BIN, packageName);
-  const candidates = process.platform === 'win32'
-    ? [basePath, basePath + '.cmd', basePath + '.ps1']
-    : [basePath];
-
-  let removed = false;
-  for (const path of candidates) {
-    if (existsSync(path)) {
-      unlinkSync(path);
-      removed = true;
-    }
-  }
-
-  return removed;
-}
-
-/**
- * Check if a package is linked
- */
-export function isPackageLinked(packageName: string): boolean {
-  const basePath = join(C4AI_BIN, packageName);
-  if (existsSync(basePath)) return true;
-  if (process.platform === 'win32') {
-    if (existsSync(basePath + '.cmd')) return true;
-    if (existsSync(basePath + '.ps1')) return true;
-  }
-  return false;
-}
-
-/**
- * Get PATH setup instructions
- */
-export function getPathInstructions(): string {
-  if (process.platform === 'win32') {
-    return `
-To use globally installed cli4ai packages from anywhere, add the bin directory to your PATH:
-
-  ${C4AI_BIN}
-
-On Windows, you can:
-1. Use System Settings > Edit environment variables (GUI)
-2. Or run in PowerShell (current session): $env:PATH += ";${C4AI_BIN}"
-3. Or run in PowerShell (permanent): [Environment]::SetEnvironmentVariable("PATH", $env:PATH + ";${C4AI_BIN}", "User")
-
-Then restart your terminal.
-`.trim();
-  }
-
-  const shell = process.env.SHELL || '/bin/bash';
-  const isZsh = shell.includes('zsh');
-  const rcFile = isZsh ? '~/.zshrc' : '~/.bashrc';
-
-  return `
-To use globally installed cli4ai packages from anywhere, add this to your ${rcFile}:
-
-  export PATH="${C4AI_BIN}:$PATH"
-
-Then reload your shell:
-
-  source ${rcFile}
-
-Or start a new terminal session.
-`.trim();
-}
-
-/**
- * Check if bin directory is in PATH
- */
-export function isBinInPath(): boolean {
-  const pathEnv = process.env.PATH || '';
-  const separator = process.platform === 'win32' ? ';' : ':';
-  return pathEnv.split(separator).some(p => resolve(p) === C4AI_BIN);
-}

package/src/core/lockfile.ts

@@ -1,187 +0,0 @@
-/**
- * Lock file management (cli4ai.lock)
- *
- * Tracks installed packages with exact versions and sources
- * for reproducible installations.
- */
-
-import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs';
-import { resolve } from 'path';
-
-// ═══════════════════════════════════════════════════════════════════════════
-// TYPES
-// ═══════════════════════════════════════════════════════════════════════════
-
-export interface LockedPackage {
-  name: string;
-  version: string;
-  resolved: string;  // Source path or registry URL
-  integrity?: string; // Future: content hash
-  dependencies?: Record<string, string>;
-}
-
-export interface Lockfile {
-  lockfileVersion: number;
-  packages: Record<string, LockedPackage>;
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// CONSTANTS
-// ═══════════════════════════════════════════════════════════════════════════
-
-export const LOCKFILE_NAME = 'cli4ai.lock';
-export const LOCKFILE_VERSION = 1;
-
-// ═══════════════════════════════════════════════════════════════════════════
-// FUNCTIONS
-// ═══════════════════════════════════════════════════════════════════════════
-
-/**
- * Get lock file path for a project
- */
-export function getLockfilePath(projectDir: string): string {
-  return resolve(projectDir, LOCKFILE_NAME);
-}
-
-/**
- * Check if lock file exists
- */
-export function lockfileExists(projectDir: string): boolean {
-  return existsSync(getLockfilePath(projectDir));
-}
-
-/**
- * Load lock file, returns empty lockfile if doesn't exist
- */
-export function loadLockfile(projectDir: string): Lockfile {
-  const lockfilePath = getLockfilePath(projectDir);
-
-  if (!existsSync(lockfilePath)) {
-    return {
-      lockfileVersion: LOCKFILE_VERSION,
-      packages: {}
-    };
-  }
-
-  try {
-    const content = readFileSync(lockfilePath, 'utf-8');
-    const data = JSON.parse(content) as Lockfile;
-
-    // Validate version
-    if (data.lockfileVersion !== LOCKFILE_VERSION) {
-      console.error(`Warning: Lock file version mismatch (${data.lockfileVersion} vs ${LOCKFILE_VERSION})`);
-    }
-
-    return data;
-  } catch (err) {
-    console.error('Warning: Could not parse lock file, starting fresh');
-    return {
-      lockfileVersion: LOCKFILE_VERSION,
-      packages: {}
-    };
-  }
-}
-
-/**
- * Save lock file
- */
-export function saveLockfile(projectDir: string, lockfile: Lockfile): void {
-  const lockfilePath = getLockfilePath(projectDir);
-  const content = JSON.stringify(lockfile, null, 2) + '\n';
-  const tmpPath = lockfilePath + '.tmp';
-  writeFileSync(tmpPath, content);
-  renameSync(tmpPath, lockfilePath);
-}
-
-/**
- * Add or update a package in the lock file
- */
-export function lockPackage(
-  projectDir: string,
-  pkg: LockedPackage
-): void {
-  const lockfile = loadLockfile(projectDir);
-  lockfile.packages[pkg.name] = pkg;
-  saveLockfile(projectDir, lockfile);
-}
-
-/**
- * Remove a package from the lock file
- */
-export function unlockPackage(projectDir: string, packageName: string): void {
-  const lockfile = loadLockfile(projectDir);
-
-  if (lockfile.packages[packageName]) {
-    delete lockfile.packages[packageName];
-    saveLockfile(projectDir, lockfile);
-  }
-}
-
-/**
- * Get a locked package by name
- */
-export function getLockedPackage(
-  projectDir: string,
-  packageName: string
-): LockedPackage | null {
-  const lockfile = loadLockfile(projectDir);
-  return lockfile.packages[packageName] || null;
-}
-
-/**
- * Get all locked packages
- */
-export function getLockedPackages(projectDir: string): LockedPackage[] {
-  const lockfile = loadLockfile(projectDir);
-  return Object.values(lockfile.packages);
-}
-
-/**
- * Check if a package is locked
- */
-export function isPackageLocked(projectDir: string, packageName: string): boolean {
-  const lockfile = loadLockfile(projectDir);
-  return packageName in lockfile.packages;
-}
-
-/**
- * Clear all packages from lock file
- */
-export function clearLockfile(projectDir: string): void {
-  saveLockfile(projectDir, {
-    lockfileVersion: LOCKFILE_VERSION,
-    packages: {}
-  });
-}
-
-/**
- * Format lock file as human-readable string
- */
-export function formatLockfile(lockfile: Lockfile): string {
-  const lines: string[] = [
-    `# cli4ai.lock - Auto-generated, do not edit`,
-    `# lockfileVersion: ${lockfile.lockfileVersion}`,
-    ``
-  ];
-
-  const sortedPackages = Object.values(lockfile.packages).sort((a, b) =>
-    a.name.localeCompare(b.name)
-  );
-
-  for (const pkg of sortedPackages) {
-    lines.push(`${pkg.name}@${pkg.version}:`);
-    lines.push(`  resolved: "${pkg.resolved}"`);
-    if (pkg.integrity) {
-      lines.push(`  integrity: ${pkg.integrity}`);
-    }
-    if (pkg.dependencies && Object.keys(pkg.dependencies).length > 0) {
-      lines.push(`  dependencies:`);
-      for (const [depName, depVersion] of Object.entries(pkg.dependencies)) {
-        lines.push(`    ${depName}: "${depVersion}"`);
-      }
-    }
-    lines.push(``);
-  }
-
-  return lines.join('\n');
-}