create-hedgeboard 1.3.0 → 1.4.0

package/index.js

@@ -93,18 +93,85 @@ function fetchBuffer(url, headers = {}) {
 }
 
 // ---------------------------------------------------------------------------
-// ZIP extraction (pure JS, no dependencies)
+// Recursive directory copy (pure JS, no shell — replaces cp -r)
+// ---------------------------------------------------------------------------
+
+function copyDirRecursive(src, dest) {
+    fs.mkdirSync(dest, { recursive: true });
+    for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            copyDirRecursive(srcPath, destPath);
+        } else {
+            fs.copyFileSync(srcPath, destPath);
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// ZIP extraction (pure JS — uses only Node built-in zlib, no dependencies)
 // ---------------------------------------------------------------------------
 
 function extractZip(zipBuffer, destDir) {
-    // Simple ZIP parser — handles DEFLATE and STORE methods
-    // For robustness in production, consider using a proper zip library
-    const { execSync } = require("child_process");
-    const tmpZip = path.join(require("os").tmpdir(), `hedgeboard-${Date.now()}.zip`);
-    fs.writeFileSync(tmpZip, zipBuffer);
+    const zlib = require("zlib");
     fs.mkdirSync(destDir, { recursive: true });
-    execSync(`unzip -o -q "${tmpZip}" -d "${destDir}"`);
-    fs.unlinkSync(tmpZip);
+
+    // Parse ZIP central directory (from end-of-central-directory record)
+    const buf = Buffer.isBuffer(zipBuffer) ? zipBuffer : Buffer.from(zipBuffer);
+    let offset = 0;
+
+    while (offset < buf.length - 4) {
+        // Local file header signature = 0x04034b50
+        const sig = buf.readUInt32LE(offset);
+        if (sig !== 0x04034b50) break;
+
+        const method = buf.readUInt16LE(offset + 8);
+        const compSize = buf.readUInt32LE(offset + 18);
+        const uncompSize = buf.readUInt32LE(offset + 22);
+        const nameLen = buf.readUInt16LE(offset + 26);
+        const extraLen = buf.readUInt16LE(offset + 28);
+        const nameStart = offset + 30;
+        const name = buf.toString("utf8", nameStart, nameStart + nameLen);
+        const dataStart = nameStart + nameLen + extraLen;
+
+        offset = dataStart + compSize;
+
+        // Skip directories (with path traversal guard — P3-9)
+        if (name.endsWith("/")) {
+            const dirPath = path.join(destDir, name);
+            if (!dirPath.startsWith(path.resolve(destDir) + path.sep) &&
+                dirPath !== path.resolve(destDir)) {
+                console.warn(`  Skipping ${name}: path traversal detected`);
+                continue;
+            }
+            fs.mkdirSync(dirPath, { recursive: true });
+            continue;
+        }
+
+        // Path traversal guard — prevent ../../.bashrc attacks (P0-8)
+        const filePath = path.join(destDir, name);
+        if (!filePath.startsWith(path.resolve(destDir) + path.sep) &&
+            filePath !== path.resolve(destDir)) {
+            console.warn(`  Skipping ${name}: path traversal detected`);
+            continue;
+        }
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+
+        const rawData = buf.subarray(dataStart, dataStart + compSize);
+
+        if (method === 0) {
+            // STORE — no compression
+            fs.writeFileSync(filePath, rawData);
+        } else if (method === 8) {
+            // DEFLATE — use raw inflate (no zlib header)
+            const inflated = zlib.inflateRawSync(rawData);
+            fs.writeFileSync(filePath, inflated);
+        } else {
+            // Unsupported method — skip
+            console.warn(`  Skipping ${name}: unsupported compression method ${method}`);
+        }
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -139,7 +206,7 @@ ${c.dim}    ██████╔╝██║   ██║███████
 ${c.dim}    ██╔══██╗██║   ██║██╔══██║██╔══██╗██║  ██║${c.reset}
 ${c.dim}    ██████╔╝╚██████╔╝██║  ██║██║  ██║██████╔╝${c.reset}
 ${c.dim}    ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝ ${c.reset}
-${c.dim}    AI-Native Financial Intelligence — v1.0.8${c.reset}
+${c.dim}    AI-Native Financial Intelligence — v1.3.0${c.reset}
 `);
 }
 
@@ -156,7 +223,9 @@ async function main() {
     if (key) {
         process.stdout.write(`  ${c.gray}◆${c.reset} Validating API key ${c.dim}...${c.reset} `);
         try {
-            const resp = await fetchBuffer(`${APP_URL}/api/data-sources?key=${key}`);
+            const resp = await fetchBuffer(`${APP_URL}/api/data-sources`, {
+                "x-api-key": key,
+            });
             const data = JSON.parse(resp.toString());
             if (data.error) throw new Error(data.error);
             console.log(`${c.green}✓${c.reset}`);
@@ -189,8 +258,8 @@ async function main() {
         if (fs.existsSync(extractedDir)) {
             fs.mkdirSync(path.dirname(absDir), { recursive: true });
             if (fs.existsSync(absDir)) {
-                const { execSync } = require("child_process");
-                execSync(`cp -r "${extractedDir}/"* "${absDir}/"`);
+                // Merge into existing dir — pure JS, no shell (P3-8)
+                copyDirRecursive(extractedDir, absDir);
             } else {
                 fs.renameSync(extractedDir, absDir);
             }
@@ -239,6 +308,7 @@ ${c.dim}  ───────────────────────
   ${c.gray}├──${c.reset} ${c.white}viz/${c.reset}             ${c.dim}Dashboard templates & charts${c.reset}
   ${c.gray}├──${c.reset} ${c.white}brand/${c.reset}           ${c.dim}Your brand settings${c.reset}
   ${c.gray}├──${c.reset} ${c.white}modules/${c.reset}         ${c.dim}356 analysis recipes + indexes${c.reset}
+  ${c.gray}├──${c.reset} ${c.white}docs/${c.reset}            ${c.dim}Data catalog — 35 providers, 15 categories${c.reset}
   ${c.gray}└──${c.reset} ${c.white}output/${c.reset}          ${c.dim}Generated dashboards land here${c.reset}
 
 ${c.dim}  ─────────────────────────────────────${c.reset}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "create-hedgeboard",
-    "version": "1.3.0",
+    "version": "1.4.0",
     "description": "Set up a HedgeBoard financial intelligence workspace",
     "bin": {
         "create-hedgeboard": "index.js"