cli4ai 1.2.0 → 1.2.1

package/dist/commands/add.js

@@ -0,0 +1,459 @@
+/**
+ * cli4ai add - Install packages
+ */
+import { existsSync, symlinkSync, mkdirSync, cpSync, rmSync, readdirSync, unlinkSync, lstatSync } from 'fs';
+import { resolve, dirname, join, normalize } from 'path';
+import { createInterface } from 'readline';
+import { tmpdir } from 'os';
+import { spawnSync } from 'child_process';
+import { output, outputError, log } from '../lib/cli.js';
+import { loadManifest, tryLoadManifest } from '../core/manifest.js';
+import { ensureCli4aiHome, ensureLocalDir, PACKAGES_DIR, LOCAL_PACKAGES_DIR, loadConfig } from '../core/config.js';
+import { lockPackage } from '../core/lockfile.js';
+import { linkPackageDirect, isBinInPath, getPathInstructions } from '../core/link.js';
+const PKG_NAME_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const CLI4AI_SCOPED_PKG_PATTERN = /^@cli4ai\/[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const URL_LIKE_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+function validatePackageSpecifier(pkg) {
+    if (URL_LIKE_PATTERN.test(pkg)) {
+        let parsed;
+        try {
+            parsed = new URL(pkg);
+        }
+        catch {
+            outputError('INVALID_INPUT', 'Invalid URL', { url: pkg });
+        }
+        if (parsed.protocol !== 'https:') {
+            outputError('INVALID_INPUT', 'Unsupported URL protocol', {
+                url: pkg,
+                protocol: parsed.protocol,
+                allowed: ['https:']
+            });
+        }
+        outputError('INVALID_INPUT', 'Installing from URLs is not supported', {
+            url: pkg,
+            hint: 'Use a local path (./path) or a package name (e.g. github, @cli4ai/github)'
+        });
+    }
+    if (pkg.includes('\\') || pkg.includes('..')) {
+        outputError('INVALID_INPUT', 'Invalid package specifier', { package: pkg });
+    }
+    if (pkg.startsWith('@cli4ai/')) {
+        if (!CLI4AI_SCOPED_PKG_PATTERN.test(pkg)) {
+            outputError('INVALID_INPUT', 'Invalid package name', { package: pkg });
+        }
+        return;
+    }
+    if (!PKG_NAME_PATTERN.test(pkg)) {
+        outputError('INVALID_INPUT', 'Invalid package name', { package: pkg });
+    }
+}
+/**
+ * Prompt user for confirmation
+ */
+async function confirm(message) {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+        });
+    });
+}
+/**
+ * Validate extracted tarball paths to prevent path traversal attacks
+ */
+function validateTarballPaths(extractedDir) {
+    function checkPath(dir) {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            const normalizedPath = normalize(fullPath);
+            // Ensure path doesn't escape the extraction directory
+            if (!normalizedPath.startsWith(normalize(extractedDir))) {
+                return false;
+            }
+            // Check for suspicious names
+            if (entry.name.includes('..') || entry.name.startsWith('/')) {
+                return false;
+            }
+            if (entry.isDirectory()) {
+                if (!checkPath(fullPath))
+                    return false;
+            }
+        }
+        return true;
+    }
+    return checkPath(extractedDir);
+}
+/**
+ * Download and extract package from npm registry
+ */
+async function downloadFromNpm(packageName, targetDir) {
+    const tmpDir = join(tmpdir(), `cli4ai-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(tmpDir, { recursive: true });
+    try {
+        // Use npm pack to download the tarball - using spawnSync to prevent command injection
+        log(`Downloading ${packageName} from npm...`);
+        const packResult = spawnSync('npm', ['pack', packageName, `--pack-destination=${tmpDir}`], {
+            stdio: 'pipe',
+            cwd: tmpDir,
+            encoding: 'utf-8'
+        });
+        if (packResult.error) {
+            throw new Error(`npm not found or failed to execute: ${packResult.error.message}`);
+        }
+        if (packResult.status !== 0) {
+            throw new Error(`npm pack failed: ${packResult.stderr || packResult.stdout || 'unknown error'}`);
+        }
+        // Find the tarball (it will be named like cli4ai-slack-1.0.2.tgz)
+        const files = readdirSync(tmpDir);
+        const tarball = files.find(f => f.endsWith('.tgz'));
+        if (!tarball) {
+            throw new Error('Failed to download package tarball');
+        }
+        // Extract the tarball using spawnSync to prevent command injection
+        // Use --strip-components=1 equivalent by extracting to a subdir
+        const tarPath = join(tmpDir, tarball);
+        const extractResult = spawnSync('tar', ['-xzf', tarPath, '-C', tmpDir], {
+            stdio: 'pipe',
+            encoding: 'utf-8'
+        });
+        if (extractResult.status !== 0) {
+            throw new Error(`Failed to extract package: ${extractResult.stderr || 'tar extraction failed'}`);
+        }
+        // The extracted content is in a 'package' folder
+        const extractedPath = join(tmpDir, 'package');
+        if (!existsSync(extractedPath)) {
+            throw new Error('Failed to extract package');
+        }
+        // Validate extracted paths to prevent path traversal attacks
+        if (!validateTarballPaths(extractedPath)) {
+            throw new Error('Package contains suspicious paths - possible path traversal attack');
+        }
+        // Get package name without scope for target directory
+        const shortName = packageName.replace('@cli4ai/', '');
+        const pkgTargetDir = join(targetDir, shortName);
+        // Remove existing if present
+        if (existsSync(pkgTargetDir)) {
+            rmSync(pkgTargetDir, { recursive: true });
+        }
+        // Copy to target directory
+        mkdirSync(dirname(pkgTargetDir), { recursive: true });
+        cpSync(extractedPath, pkgTargetDir, { recursive: true });
+        // Clean up temp directory
+        rmSync(tmpDir, { recursive: true });
+        return pkgTargetDir;
+    }
+    catch (err) {
+        // Clean up on error
+        if (existsSync(tmpDir)) {
+            rmSync(tmpDir, { recursive: true });
+        }
+        throw err;
+    }
+}
+/**
+ * Check if a CLI tool is available
+ */
+function checkCliTool(name) {
+    try {
+        const result = spawnSync('which', [name], { stdio: 'pipe' });
+        return result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Install npm dependencies
+ */
+async function installNpmDependencies(pkgPath, dependencies) {
+    const deps = Object.entries(dependencies).map(([name, version]) => `${name}@${version}`);
+    if (deps.length === 0)
+        return;
+    log(`Installing npm dependencies: ${deps.join(', ')}`);
+    const result = spawnSync('npm', ['install', ...deps], {
+        cwd: pkgPath,
+        stdio: 'inherit'
+    });
+    if (result.status !== 0) {
+        throw new Error(`Failed to install dependencies (exit code: ${result.status})`);
+    }
+}
+/**
+ * Display installation plan
+ */
+function displayInstallPlan(plans) {
+    log('\n┌─────────────────────────────────────────────────────┐');
+    log('│              INSTALLATION PLAN                      │');
+    log('└─────────────────────────────────────────────────────┘\n');
+    for (const plan of plans) {
+        log(`📦 ${plan.manifest.name}@${plan.manifest.version}`);
+        if (plan.manifest.description) {
+            log(`   ${plan.manifest.description}`);
+        }
+        if (plan.npmDependencies.length > 0) {
+            log('\n   npm dependencies to install:');
+            for (const dep of plan.npmDependencies) {
+                log(`     • ${dep}`);
+            }
+        }
+        if (plan.peerDependencies.length > 0) {
+            log('\n   ⚠️  peer dependencies (you must install these yourself):');
+            for (const peer of plan.peerDependencies) {
+                log(`     • ${peer.name} ${peer.version}`);
+                if (peer.description) {
+                    log(`       ${peer.description}`);
+                }
+            }
+        }
+        if (plan.manifest.env) {
+            const requiredEnvs = Object.entries(plan.manifest.env)
+                .filter(([_, def]) => def.required)
+                .map(([name, def]) => ({ name, ...def }));
+            if (requiredEnvs.length > 0) {
+                log('\n   🔐 required environment variables:');
+                for (const envVar of requiredEnvs) {
+                    log(`     • ${envVar.name}`);
+                    if (envVar.description) {
+                        log(`       ${envVar.description}`);
+                    }
+                }
+            }
+        }
+        log('');
+    }
+}
+export async function addCommand(packages, options) {
+    const results = [];
+    const errors = [];
+    const targetDir = options.global ? PACKAGES_DIR : resolve(process.cwd(), LOCAL_PACKAGES_DIR);
+    // Ensure target directory exists
+    if (options.global) {
+        ensureCli4aiHome();
+    }
+    else {
+        ensureLocalDir(process.cwd());
+    }
+    const projectDir = process.cwd();
+    // Build installation plans
+    const plans = [];
+    for (const pkg of packages) {
+        try {
+            const { manifest, path: pkgPath, fromNpm } = await resolvePackage(pkg, options, targetDir);
+            // Build npm dependencies list
+            const npmDependencies = [];
+            if (manifest.dependencies) {
+                for (const [name, version] of Object.entries(manifest.dependencies)) {
+                    npmDependencies.push(`${name}@${version}`);
+                }
+            }
+            // Build peer dependencies list
+            const peerDependencies = [];
+            if (manifest.peerDependencies) {
+                for (const [name, version] of Object.entries(manifest.peerDependencies)) {
+                    peerDependencies.push({ name, version, description: String(version) });
+                }
+            }
+            plans.push({
+                package: pkg,
+                manifest,
+                path: pkgPath,
+                npmDependencies,
+                peerDependencies,
+                fromNpm
+            });
+        }
+        catch (err) {
+            errors.push({
+                package: pkg,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }
+    if (plans.length === 0) {
+        if (errors.length > 0) {
+            outputError('INSTALL_ERROR', 'Failed to resolve packages', { errors });
+        }
+        return;
+    }
+    // Display installation plan
+    displayInstallPlan(plans);
+    // Check peer dependencies availability
+    const peerWarnings = [];
+    for (const plan of plans) {
+        for (const peer of plan.peerDependencies) {
+            // Check if it's a CLI tool (not a cli4ai package reference)
+            if (!peer.version.includes('cli4ai')) {
+                const available = checkCliTool(peer.name);
+                if (!available) {
+                    peerWarnings.push(`${peer.name} is not installed on your system`);
+                }
+            }
+        }
+    }
+    if (peerWarnings.length > 0) {
+        log('⚠️  Warning: Some peer dependencies are missing:');
+        for (const warning of peerWarnings) {
+            log(`   • ${warning}`);
+        }
+        log('');
+    }
+    // Ask for confirmation unless --yes flag is provided
+    if (!options.yes) {
+        const confirmed = await confirm('Proceed with installation?');
+        if (!confirmed) {
+            log('Installation cancelled.');
+            process.exit(0);
+        }
+    }
+    // Proceed with installation
+    for (const plan of plans) {
+        try {
+            let result;
+            if (plan.fromNpm) {
+                // Package already downloaded to target directory
+                result = {
+                    name: plan.manifest.name,
+                    version: plan.manifest.version,
+                    path: plan.path,
+                    source: 'registry'
+                };
+            }
+            else {
+                // Local package - need to symlink/copy
+                result = await installPackage(plan.path, targetDir, plan.manifest, options);
+            }
+            // Install npm dependencies
+            if (plan.manifest.dependencies && Object.keys(plan.manifest.dependencies).length > 0) {
+                await installNpmDependencies(result.path, plan.manifest.dependencies);
+            }
+            // Link to PATH for global installs
+            if (options.global) {
+                result.binPath = linkPackageDirect(plan.manifest, result.path);
+                log(`✓ ${result.name}@${result.version} (linked to ${result.binPath})`);
+            }
+            else {
+                log(`✓ ${result.name}@${result.version}`);
+                // Update lockfile (only for local/project installs)
+                const lockedPkg = {
+                    name: result.name,
+                    version: result.version,
+                    resolved: result.source === 'local' ? result.path : result.path
+                };
+                lockPackage(projectDir, lockedPkg);
+            }
+            result.dependencies = plan.manifest.dependencies;
+            result.peerDependencies = plan.manifest.peerDependencies;
+            results.push(result);
+        }
+        catch (err) {
+            errors.push({
+                package: plan.package,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }
+    if (errors.length > 0 && results.length === 0) {
+        outputError('INSTALL_ERROR', 'Failed to install packages', { errors });
+    }
+    // Show PATH instructions for global installs if not already in PATH
+    if (options.global && results.length > 0 && !isBinInPath()) {
+        console.error('\n' + getPathInstructions() + '\n');
+    }
+    output({
+        installed: results,
+        errors: errors.length > 0 ? errors : undefined,
+        location: options.global ? 'global' : 'local'
+    });
+}
+async function resolvePackage(pkg, options, targetDir) {
+    // Check if it's a local path
+    if (options.local || pkg.startsWith('./') || pkg.startsWith('/') || pkg.startsWith('../')) {
+        const absolutePath = resolve(pkg);
+        if (!existsSync(absolutePath)) {
+            throw new Error(`Path does not exist: ${absolutePath}`);
+        }
+        const manifest = loadManifest(absolutePath);
+        return { manifest, path: absolutePath };
+    }
+    validatePackageSpecifier(pkg);
+    // Check local registries first
+    const config = loadConfig();
+    for (const registryPath of config.localRegistries) {
+        const pkgPath = resolve(registryPath, pkg);
+        const manifest = tryLoadManifest(pkgPath);
+        if (manifest) {
+            return { manifest, path: pkgPath };
+        }
+    }
+    // Check if it's a @cli4ai package - download from npm
+    if (pkg.startsWith('@cli4ai/')) {
+        try {
+            const pkgPath = await downloadFromNpm(pkg, targetDir);
+            const manifest = loadManifest(pkgPath);
+            return { manifest, path: pkgPath, fromNpm: true };
+        }
+        catch (err) {
+            outputError('NPM_ERROR', `Failed to download ${pkg} from npm`, {
+                hint: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }
+    // Auto-resolve to @cli4ai/ scope and try npm
+    const scopedName = `@cli4ai/${pkg}`;
+    let npmError;
+    try {
+        log(`Resolving ${pkg} as ${scopedName}...`);
+        const pkgPath = await downloadFromNpm(scopedName, targetDir);
+        const manifest = loadManifest(pkgPath);
+        return { manifest, path: pkgPath, fromNpm: true };
+    }
+    catch (err) {
+        npmError = err instanceof Error ? err.message : String(err);
+    }
+    outputError('NOT_FOUND', `Package not found: ${pkg}`, {
+        hint: `Tried @cli4ai/${pkg} on npm. Use --local flag for local paths, or add a local registry with "cli4ai config --add-registry <path>"`,
+        npmError
+    });
+}
+async function installPackage(sourcePath, targetDir, manifest, options) {
+    // Create target path
+    const pkgDir = resolve(targetDir, manifest.name);
+    // Remove existing if present
+    if (existsSync(pkgDir)) {
+        try {
+            const stat = lstatSync(pkgDir);
+            if (stat.isSymbolicLink()) {
+                unlinkSync(pkgDir);
+            }
+            else {
+                rmSync(pkgDir, { recursive: true });
+            }
+        }
+        catch {
+            throw new Error(`Failed to remove existing package at ${pkgDir}`);
+        }
+    }
+    // Ensure parent directory exists
+    mkdirSync(dirname(pkgDir), { recursive: true });
+    // Create symlink to source
+    try {
+        symlinkSync(sourcePath, pkgDir, 'dir');
+    }
+    catch (err) {
+        // If symlink fails (Windows?), copy instead
+        log(`Symlink failed, copying instead...`);
+        cpSync(sourcePath, pkgDir, { recursive: true });
+    }
+    return {
+        name: manifest.name,
+        version: manifest.version,
+        path: pkgDir,
+        source: 'local'
+    };
+}

package/dist/commands/browse.d.ts

@@ -0,0 +1,4 @@
+/**
+ * cli4ai browse - Interactive package browser
+ */
+export declare function browseCommand(): Promise<void>;