cli4ai 1.2.9 → 1.2.11

package/dist/commands/add.js

@@ -19,20 +19,7 @@ const CLI4AI_SCOPED_PKG_PATTERN = /^@cli4ai\/[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const URL_LIKE_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
 function validatePackageSpecifier(pkg) {
     if (URL_LIKE_PATTERN.test(pkg)) {
-        let parsed;
-        try {
-            parsed = new URL(pkg);
-        }
-        catch {
-            outputError('INVALID_INPUT', 'Invalid URL', { url: pkg });
-        }
-        if (parsed.protocol !== 'https:') {
-            outputError('INVALID_INPUT', 'Unsupported URL protocol', {
-                url: pkg,
-                protocol: parsed.protocol,
-                allowed: ['https:']
-            });
-        }
+        // URLs are not supported - reject immediately
         outputError('INVALID_INPUT', 'Installing from URLs is not supported', {
             url: pkg,
             hint: 'Use a local path (./path) or a package name (e.g. github, @cli4ai/github)'

package/dist/core/config.js

@@ -476,8 +476,10 @@ export function getGlobalPackages() {
                     installedAt: new Date().toISOString()
                 });
             }
-            catch {
-                // Skip invalid packages
+            catch (err) {
+                // Log warning for debugging, but continue to other packages
+                const errMessage = err instanceof Error ? err.message : String(err);
+                console.error(`Warning: Failed to load package manifest at ${manifestPath}: ${errMessage}`);
             }
         }
     }
@@ -512,8 +514,10 @@ export function getLocalPackages(projectDir) {
                     installedAt: new Date().toISOString()
                 });
             }
-            catch {
-                // Skip invalid packages
+            catch (err) {
+                // Log warning for debugging, but continue to other packages
+                const errMessage = err instanceof Error ? err.message : String(err);
+                console.error(`Warning: Failed to load package manifest at ${manifestPath}: ${errMessage}`);
             }
         }
     }
@@ -610,7 +614,11 @@ function getPackagesFromGlobalDir(globalDir) {
                     });
                     continue;
                 }
-                catch { }
+                catch (err) {
+                    // Log warning but continue - cli4ai.json is invalid, try package.json
+                    const errMessage = err instanceof Error ? err.message : String(err);
+                    console.error(`Warning: Failed to load cli4ai.json at ${cli4aiJsonPath}: ${errMessage}`);
+                }
             }
             if (existsSync(pkgJsonPath)) {
                 try {
@@ -623,11 +631,19 @@ function getPackagesFromGlobalDir(globalDir) {
                         installedAt: new Date().toISOString()
                     });
                 }
-                catch { }
+                catch (err) {
+                    // Log warning but continue to next package
+                    const errMessage = err instanceof Error ? err.message : String(err);
+                    console.error(`Warning: Failed to load package.json at ${pkgJsonPath}: ${errMessage}`);
+                }
             }
         }
     }
-    catch { }
+    catch (err) {
+        // Log error but return partial results
+        const errMessage = err instanceof Error ? err.message : String(err);
+        console.error(`Warning: Error scanning global packages directory ${cli4aiDir}: ${errMessage}`);
+    }
     return packages;
 }
 /**
@@ -685,7 +701,11 @@ function findPackageInGlobalDir(globalDir, name) {
                 installedAt: new Date().toISOString()
             };
         }
-        catch { }
+        catch (err) {
+            // Log warning but continue to try package.json
+            const errMessage = err instanceof Error ? err.message : String(err);
+            console.error(`Warning: Failed to load cli4ai.json at ${manifestPath}: ${errMessage}`);
+        }
     }
     // Even without cli4ai.json, try package.json
     const pkgJsonPath = resolve(scopedPath, 'package.json');
@@ -700,7 +720,11 @@ function findPackageInGlobalDir(globalDir, name) {
                 installedAt: new Date().toISOString()
             };
         }
-        catch { }
+        catch (err) {
+            // Log warning - package has no valid manifest
+            const errMessage = err instanceof Error ? err.message : String(err);
+            console.error(`Warning: Failed to load package.json at ${pkgJsonPath}: ${errMessage}`);
+        }
     }
     return null;
 }

package/dist/core/execute.js

@@ -429,22 +429,31 @@ export async function executeTool(options) {
             ...(options.env ?? {})
         }
     });
+    // Handle stdin - add error handler to prevent unhandled errors on broken pipes
+    proc.stdin.on('error', (err) => {
+        // Ignore EPIPE errors - they occur when the child process exits before reading stdin
+        if (err.code !== 'EPIPE') {
+            // Log other errors but don't throw - the process will handle termination
+            console.error(`stdin error: ${err.message}`);
+        }
+    });
     if (options.stdin !== undefined) {
         proc.stdin.write(options.stdin);
         proc.stdin.end();
     }
     else {
-        // Don’t block on stdin if nothing is provided
+        // Don't block on stdin if nothing is provided
         proc.stdin.end();
     }
     // Set up line-by-line streaming for callbacks
     const stdoutLines = [];
     const stderrLines = [];
-    const readlineInterfaces = [];
+    // Track readline interfaces so we can close them on timeout/exit
+    let stdoutRl;
+    let stderrRl;
     if (proc.stdout) {
-        const rl = createInterface({ input: proc.stdout, crlfDelay: Infinity });
-        readlineInterfaces.push(rl);
-        rl.on('line', (line) => {
+        stdoutRl = createInterface({ input: proc.stdout, crlfDelay: Infinity });
+        stdoutRl.on('line', (line) => {
             stdoutLines.push(line);
             if (options.onStdoutLine) {
                 options.onStdoutLine(line);
@@ -452,9 +461,8 @@ export async function executeTool(options) {
         });
     }
     if (proc.stderr) {
-        const rl = createInterface({ input: proc.stderr, crlfDelay: Infinity });
-        readlineInterfaces.push(rl);
-        rl.on('line', (line) => {
+        stderrRl = createInterface({ input: proc.stderr, crlfDelay: Infinity });
+        stderrRl.on('line', (line) => {
             stderrLines.push(line);
             if (teeStderr) {
                 process.stderr.write(line + '\n');
@@ -464,9 +472,21 @@ export async function executeTool(options) {
             }
         });
     }
+    // Helper to clean up readline interfaces
+    const cleanupReadlines = () => {
+        if (stdoutRl) {
+            stdoutRl.close();
+            stdoutRl = undefined;
+        }
+        if (stderrRl) {
+            stderrRl.close();
+            stderrRl = undefined;
+        }
+    };
     let timeout;
     if (options.timeoutMs && options.timeoutMs > 0) {
         timeout = setTimeout(() => {
+            cleanupReadlines();
             try {
                 proc.kill('SIGTERM');
             }
@@ -485,13 +505,10 @@ export async function executeTool(options) {
     }).finally(() => {
         if (timeout)
             clearTimeout(timeout);
-        // Close all readline interfaces
-        for (const rl of readlineInterfaces) {
-            rl.close();
-        }
     });
-    // Small delay to ensure all readline events are processed
+    // Small delay to ensure all readline events are processed before cleanup
     await new Promise(r => setTimeout(r, 10));
+    cleanupReadlines();
     return {
         exitCode,
         durationMs: Date.now() - startTime,

package/dist/core/remote-client.js

@@ -34,6 +34,24 @@ export class RemoteApiError extends Error {
         this.name = 'RemoteApiError';
     }
 }
+/**
+ * Safely parse JSON response body, returning null on parse errors
+ */
+function safeJsonParse(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Extract error info from response body
+ */
+function extractErrorInfo(body) {
+    const parsed = safeJsonParse(body);
+    return parsed?.error ?? {};
+}
 function makeRequest(url, method, headers, body, timeoutMs = 30000) {
     return new Promise((resolve, reject) => {
         const isHttps = url.protocol === 'https:';
@@ -97,10 +115,13 @@ export async function remoteHealth(remoteName) {
     try {
         const response = await makeRequest(url, 'GET', buildHeaders(remote));
         if (response.statusCode !== 200) {
-            const error = JSON.parse(response.body)?.error;
-            throw new RemoteApiError(remoteName, response.statusCode, error?.code ?? 'API_ERROR', error?.message ?? 'Unknown error', error?.details);
+            const error = extractErrorInfo(response.body);
+            throw new RemoteApiError(remoteName, response.statusCode, error.code ?? 'API_ERROR', error.message ?? 'Unknown error', error.details);
+        }
+        const data = safeJsonParse(response.body);
+        if (!data) {
+            throw new RemoteApiError(remoteName, response.statusCode, 'PARSE_ERROR', 'Invalid JSON response from server');
         }
-        const data = JSON.parse(response.body);
         updateRemoteLastConnected(remoteName);
         return data;
     }
@@ -119,11 +140,15 @@ export async function remoteListPackages(remoteName) {
     try {
         const response = await makeRequest(url, 'GET', buildHeaders(remote));
         if (response.statusCode !== 200) {
-            const error = JSON.parse(response.body)?.error;
-            throw new RemoteApiError(remoteName, response.statusCode, error?.code ?? 'API_ERROR', error?.message ?? 'Unknown error', error?.details);
+            const error = extractErrorInfo(response.body);
+            throw new RemoteApiError(remoteName, response.statusCode, error.code ?? 'API_ERROR', error.message ?? 'Unknown error', error.details);
+        }
+        const data = safeJsonParse(response.body);
+        if (!data) {
+            throw new RemoteApiError(remoteName, response.statusCode, 'PARSE_ERROR', 'Invalid JSON response from server');
         }
         updateRemoteLastConnected(remoteName);
-        return JSON.parse(response.body);
+        return data;
     }
     catch (err) {
         if (err instanceof RemoteApiError)
@@ -143,11 +168,15 @@ export async function remotePackageInfo(remoteName, packageName) {
             return null;
         }
         if (response.statusCode !== 200) {
-            const error = JSON.parse(response.body)?.error;
-            throw new RemoteApiError(remoteName, response.statusCode, error?.code ?? 'API_ERROR', error?.message ?? 'Unknown error', error?.details);
+            const error = extractErrorInfo(response.body);
+            throw new RemoteApiError(remoteName, response.statusCode, error.code ?? 'API_ERROR', error.message ?? 'Unknown error', error.details);
+        }
+        const data = safeJsonParse(response.body);
+        if (!data) {
+            throw new RemoteApiError(remoteName, response.statusCode, 'PARSE_ERROR', 'Invalid JSON response from server');
         }
         updateRemoteLastConnected(remoteName);
-        return JSON.parse(response.body);
+        return data;
     }
     catch (err) {
         if (err instanceof RemoteApiError)
@@ -174,9 +203,12 @@ export async function remoteRunTool(remoteName, options) {
     const requestTimeout = (options.timeout ?? 30000) + 10000;
     try {
         const response = await makeRequest(url, 'POST', buildHeaders(remote), body, requestTimeout);
-        const data = JSON.parse(response.body);
-        // Check for API-level error
-        if (data.error && response.statusCode >= 400 && response.statusCode !== 500) {
+        const data = safeJsonParse(response.body);
+        if (!data) {
+            throw new RemoteApiError(remoteName, response.statusCode, 'PARSE_ERROR', 'Invalid JSON response from server');
+        }
+        // Check for API-level error (4xx errors except 500)
+        if (data.error && response.statusCode >= 400 && response.statusCode < 500) {
             throw new RemoteApiError(remoteName, response.statusCode, data.error.code ?? 'API_ERROR', data.error.message ?? 'Unknown error', data.error.details);
         }
         updateRemoteLastConnected(remoteName);
@@ -201,7 +233,10 @@ export async function remoteRunRoutine(remoteName, routineName, vars) {
         if (response.statusCode === 404) {
             throw new RemoteApiError(remoteName, 404, 'NOT_FOUND', `Routine not found: ${routineName}`);
         }
-        const data = JSON.parse(response.body);
+        const data = safeJsonParse(response.body);
+        if (!data) {
+            throw new RemoteApiError(remoteName, response.statusCode, 'PARSE_ERROR', 'Invalid JSON response from server');
+        }
         if (data.error && response.statusCode >= 400) {
             throw new RemoteApiError(remoteName, response.statusCode, data.error.code ?? 'API_ERROR', data.error.message ?? 'Unknown error', data.error.details);
         }

package/dist/core/routine-engine.d.ts

@@ -25,6 +25,7 @@ export interface RoutineStepEvent {
     status: 'running' | 'success' | 'failed' | 'skipped' | 'caught';
     exitCode?: number;
     durationMs?: number;
+    input?: unknown;
     stdout?: string;
     stderr?: string;
 }

package/dist/core/secrets.js

@@ -17,7 +17,7 @@
  * This ensures that even if an attacker knows the hostname and username,
  * they cannot reconstruct the key without access to the salt file.
  */
-import { readFileSync, writeFileSync, existsSync, chmodSync, statSync, mkdirSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, chmodSync, statSync, mkdirSync, renameSync } from 'fs';
 import { createCipheriv, createDecipheriv, randomBytes, createHash, pbkdf2Sync } from 'crypto';
 import { hostname, userInfo, platform } from 'os';
 import { dirname, resolve } from 'path';
@@ -224,6 +224,15 @@ function checkFilePermissions(filePath, fileName) {
         // Ignore errors
     }
 }
+/**
+ * Atomically write to a file using write-then-rename pattern.
+ * This prevents race conditions and ensures the file is never in a partial state.
+ */
+function atomicWriteFile(filePath, content, mode) {
+    const tmpPath = filePath + '.tmp.' + process.pid + '.' + Date.now();
+    writeFileSync(tmpPath, content, { mode });
+    renameSync(tmpPath, filePath);
+}
 /**
  * Load all secrets from vault
  */
@@ -259,13 +268,14 @@ function loadSecrets() {
             }
         }
         // If we successfully decrypted legacy secrets, rewrite those entries using the current scheme.
+        // Use atomic write to prevent race conditions with concurrent processes.
         if (Object.keys(migrated).length > 0) {
             try {
                 const updated = { ...encrypted };
                 for (const [k, v] of Object.entries(migrated)) {
                     updated[k] = encrypt(v);
                 }
-                writeFileSync(secretsFilePath, JSON.stringify(updated, null, 2), { mode: 0o600 });
+                atomicWriteFile(secretsFilePath, JSON.stringify(updated, null, 2), 0o600);
             }
             catch {
                 // Best-effort migration only. If we can't write (e.g. restricted FS), still return decrypted secrets.
@@ -278,7 +288,7 @@ function loadSecrets() {
     }
 }
 /**
- * Save all secrets to vault
+ * Save all secrets to vault using atomic write
  */
 function saveSecrets(secrets) {
     const secretsFilePath = getSecretsFilePath();
@@ -287,7 +297,7 @@ function saveSecrets(secrets) {
     for (const [key, value] of Object.entries(secrets)) {
         encrypted[key] = encrypt(value);
     }
-    writeFileSync(secretsFilePath, JSON.stringify(encrypted, null, 2), { mode: 0o600 });
+    atomicWriteFile(secretsFilePath, JSON.stringify(encrypted, null, 2), 0o600);
 }
 /**
  * Get a secret value (env var takes precedence)

package/dist/dashboard/api/endpoints.js

@@ -47,6 +47,7 @@ function initEventBridge() {
             status: event.status,
             exitCode: event.exitCode,
             durationMs: event.durationMs,
+            inputJson: event.input,
             stdout: event.stdout,
             stderr: event.stderr,
         });

package/dist/dashboard/db/runs.d.ts

@@ -24,6 +24,7 @@ export interface CreateStepInput {
     status: StepStatus;
     exitCode?: number;
     durationMs?: number;
+    inputJson?: unknown;
     stdout?: string;
     stderr?: string;
     jsonOutput?: unknown;
@@ -109,7 +110,7 @@ export declare function upsertStep(input: CreateStepInput): RunStepRecord;
 /**
  * Update a step
  */
-export declare function updateStep(id: string, updates: Partial<Pick<CreateStepInput, 'status' | 'exitCode' | 'durationMs' | 'stdout' | 'stderr' | 'jsonOutput' | 'errorCode' | 'errorMessage'>>): RunStepRecord | null;
+export declare function updateStep(id: string, updates: Partial<Pick<CreateStepInput, 'status' | 'exitCode' | 'durationMs' | 'inputJson' | 'stdout' | 'stderr' | 'jsonOutput' | 'errorCode' | 'errorMessage'>>): RunStepRecord | null;
 /**
  * Append a log line
  */

package/dist/dashboard/db/runs.js

@@ -204,10 +204,10 @@ export function createStep(input) {
         const stmt = db.prepare(`
       INSERT INTO run_steps (
         id, run_id, step_id, step_type, status, exit_code, duration_ms,
-        stdout, stderr, json_output, error_code, error_message, created_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        input_json, stdout, stderr, json_output, error_code, error_message, created_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
-        stmt.run(id, input.runId, input.stepId, input.stepType, input.status, input.exitCode ?? null, input.durationMs ?? null, input.stdout ?? null, input.stderr ?? null, input.jsonOutput ? JSON.stringify(input.jsonOutput) : null, input.errorCode ?? null, input.errorMessage ?? null, now);
+        stmt.run(id, input.runId, input.stepId, input.stepType, input.status, input.exitCode ?? null, input.durationMs ?? null, input.inputJson ? JSON.stringify(input.inputJson) : null, input.stdout ?? null, input.stderr ?? null, input.jsonOutput ? JSON.stringify(input.jsonOutput) : null, input.errorCode ?? null, input.errorMessage ?? null, now);
         return getStep(id);
     }
     catch (error) {
@@ -249,6 +249,7 @@ export function upsertStep(input) {
             status: input.status,
             exitCode: input.exitCode,
             durationMs: input.durationMs,
+            inputJson: input.inputJson,
             stdout: input.stdout,
             stderr: input.stderr,
             jsonOutput: input.jsonOutput,
@@ -280,6 +281,10 @@ export function updateStep(id, updates) {
         fields.push('duration_ms = ?');
         values.push(updates.durationMs);
     }
+    if (updates.inputJson !== undefined) {
+        fields.push('input_json = ?');
+        values.push(JSON.stringify(updates.inputJson));
+    }
     if (updates.stdout !== undefined) {
         fields.push('stdout = ?');
         values.push(updates.stdout);

package/dist/dashboard/db/schema.d.ts

@@ -30,6 +30,7 @@ export interface RunStepRecord {
     status: StepStatus;
     exit_code: number | null;
     duration_ms: number | null;
+    input_json: string | null;
     stdout: string | null;
     stderr: string | null;
     json_output: string | null;

package/dist/dashboard/db/schema.js

@@ -93,6 +93,7 @@ function createTables(db) {
       status TEXT NOT NULL CHECK (status IN ('success', 'failed', 'skipped', 'caught', 'running')),
       exit_code INTEGER,
       duration_ms INTEGER,
+      input_json TEXT,
       stdout TEXT,
       stderr TEXT,
       json_output TEXT,