lsh-framework 0.8.3 → 0.9.0

package/dist/lib/secrets-manager.js

@@ -66,15 +66,16 @@ export class SecretsManager {
             return decrypted;
         }
         catch (error) {
-            if (error.message.includes('bad decrypt') || error.message.includes('wrong final block length')) {
+            const err = error;
+            if (err.message.includes('bad decrypt') || err.message.includes('wrong final block length')) {
                 throw new Error('Decryption failed. This usually means:\n' +
                     '  1. You need to set LSH_SECRETS_KEY environment variable\n' +
                     '  2. The key must match the one used during encryption\n' +
                     '  3. Generate a shared key with: lsh secrets key\n' +
                     '  4. Add it to your .env: LSH_SECRETS_KEY=<key>\n' +
-                    '\nOriginal error: ' + error.message);
+                    '\nOriginal error: ' + err.message);
             }
-            throw error;
+            throw err;
         }
     }
     /**
@@ -116,10 +117,48 @@ export class SecretsManager {
         })
             .join('\n') + '\n';
     }
+    /**
+     * Detect destructive changes (filled secrets becoming empty)
+     */
+    detectDestructiveChanges(cloudSecrets, localSecrets) {
+        const destructive = [];
+        for (const [key, cloudValue] of Object.entries(cloudSecrets)) {
+            // Only check if key exists in local AND cloud has a non-empty value
+            if (key in localSecrets && cloudValue.trim() !== '') {
+                const localValue = localSecrets[key];
+                // If cloud had value but local is now empty/whitespace - this is destructive
+                if (localValue.trim() === '') {
+                    destructive.push({ key, cloudValue, localValue });
+                }
+            }
+        }
+        return destructive;
+    }
+    /**
+     * Format error message for destructive changes
+     */
+    formatDestructiveChangesError(destructive) {
+        const count = destructive.length;
+        const plural = count === 1 ? 'secret' : 'secrets';
+        let message = `⚠️  Destructive change detected!\n\n`;
+        message += `${count} ${plural} would go from filled → empty:\n\n`;
+        for (const { key, cloudValue } of destructive) {
+            // Mask the value for security (show first 4-5 chars)
+            const preview = cloudValue.length > 5
+                ? cloudValue.substring(0, 5) + '****'
+                : '****';
+            message += `  • ${key}: "${preview}" → "" (empty)\n`;
+        }
+        message += `\nThis is likely unintentional and could break your application.\n\n`;
+        message += `To proceed anyway, use the --force flag:\n`;
+        message += `  lsh lib secrets push --force\n`;
+        message += `  lsh lib secrets sync --force\n`;
+        return message;
+    }
     /**
      * Push local .env to Supabase
      */
-    async push(envFilePath = '.env', environment = 'dev') {
+    async push(envFilePath = '.env', environment = 'dev', force = false) {
         if (!fs.existsSync(envFilePath)) {
             throw new Error(`File not found: ${envFilePath}`);
         }
@@ -138,6 +177,51 @@ export class SecretsManager {
         logger.info(`Pushing ${envFilePath} to Supabase (${environment})...`);
         const content = fs.readFileSync(envFilePath, 'utf8');
         const env = this.parseEnvFile(content);
+        // Check for destructive changes unless force is true
+        if (!force) {
+            try {
+                const jobs = await this.persistence.getActiveJobs();
+                const safeFilename = filename.replace(/[^a-zA-Z0-9._-]/g, '_');
+                const secretsJobs = jobs
+                    .filter(j => {
+                    return j.command === 'secrets_sync' &&
+                        j.job_id.includes(environment) &&
+                        j.job_id.includes(safeFilename);
+                })
+                    .sort((a, b) => new Date(b.started_at).getTime() - new Date(a.started_at).getTime());
+                if (secretsJobs.length > 0) {
+                    const latestSecret = secretsJobs[0];
+                    if (latestSecret.output) {
+                        try {
+                            const decrypted = this.decrypt(latestSecret.output);
+                            const cloudEnv = this.parseEnvFile(decrypted);
+                            const destructive = this.detectDestructiveChanges(cloudEnv, env);
+                            if (destructive.length > 0) {
+                                throw new Error(this.formatDestructiveChangesError(destructive));
+                            }
+                        }
+                        catch (error) {
+                            const err = error;
+                            // If decryption fails, it's a key mismatch - let it proceed
+                            // (will fail later with proper error)
+                            if (!err.message.includes('Destructive change')) {
+                                // Only ignore decryption errors, re-throw destructive change errors
+                                throw err;
+                            }
+                            throw err;
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                const err = error;
+                // Re-throw any errors (including destructive change errors)
+                if (err.message.includes('Destructive change') || err.message.includes('Decryption failed')) {
+                    throw err;
+                }
+                // Ignore other errors (like connection issues) and proceed
+            }
+        }
         // Encrypt entire .env content
         const encrypted = this.encrypt(content);
         // Include filename in job_id for tracking multiple .env files
@@ -227,7 +311,7 @@ export class SecretsManager {
                 let filename = '.env';
                 if (parts.length >= 4) {
                     // New format with filename
-                    const timestamp = parts[parts.length - 1];
+                    const _timestamp = parts[parts.length - 1];
                     // Reconstruct filename from middle parts
                     const filenameParts = parts.slice(2, -1);
                     if (filenameParts.length > 0) {
@@ -322,13 +406,13 @@ export class SecretsManager {
                         status.cloudKeys = Object.keys(env).length;
                         status.keyMatches = true;
                     }
-                    catch (error) {
+                    catch (_error) {
                         status.keyMatches = false;
                     }
                 }
             }
         }
-        catch (error) {
+        catch (_error) {
             // Cloud check failed, likely no connection
         }
         return status;
@@ -378,6 +462,7 @@ export class SecretsManager {
             return true;
         }
         catch (error) {
+            const err = error;
             logger.error(`Failed to save encryption key: ${error.message}`);
             logger.info('Please set it manually:');
             logger.info(`export LSH_SECRETS_KEY=${key}`);
@@ -414,6 +499,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 return true;
             }
             catch (error) {
+                const err = error;
                 logger.error(`Failed to create ${envFilePath}: ${error.message}`);
                 return false;
             }
@@ -431,6 +517,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
             return true;
         }
         catch (error) {
+            const err = error;
             logger.error(`Failed to create ${envFilePath}: ${error.message}`);
             return false;
         }
@@ -475,7 +562,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
      * Smart sync command - automatically set up and synchronize secrets
      * This is the new enhanced sync that does everything automatically
      */
-    async smartSync(envFilePath = '.env', environment = 'dev', autoExecute = true, loadMode = false) {
+    async smartSync(envFilePath = '.env', environment = 'dev', autoExecute = true, loadMode = false, force = false) {
         // In load mode, suppress all logger output to prevent zsh glob interpretation
         // Save original level and restore at the end
         const originalLogLevel = loadMode ? logger['config'].level : undefined;
@@ -519,9 +606,9 @@ LSH_SECRETS_KEY=${this.encryptionKey}
             }
             out();
             // Step 4: Determine action and execute if auto mode
-            let action = 'in-sync';
+            let _action = 'in-sync';
             if (status.cloudExists && status.keyMatches === false) {
-                action = 'key-mismatch';
+                _action = 'key-mismatch';
                 out('⚠️  Encryption key mismatch!');
                 out('   The local key does not match the cloud storage.');
                 out('   Please use the original key or push new secrets with:');
@@ -530,13 +617,13 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 return;
             }
             if (!status.localExists && !status.cloudExists) {
-                action = 'create-and-push';
+                _action = 'create-and-push';
                 out('🆕 No secrets found locally or in cloud');
                 out('   Creating new .env file...');
                 if (autoExecute) {
                     await this.createEnvFromExample(envFilePath);
                     out('   Pushing to cloud...');
-                    await this.push(envFilePath, effectiveEnv);
+                    await this.push(envFilePath, effectiveEnv, force);
                     out();
                     out('✅ Setup complete! Edit your .env and run sync again to update.');
                 }
@@ -551,11 +638,11 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 return;
             }
             if (status.localExists && !status.cloudExists) {
-                action = 'push';
+                _action = 'push';
                 out('⬆️  Local .env exists but not in cloud');
                 if (autoExecute) {
                     out('   Pushing to cloud...');
-                    await this.push(envFilePath, effectiveEnv);
+                    await this.push(envFilePath, effectiveEnv, force);
                     out('✅ Secrets pushed to cloud!');
                 }
                 else {
@@ -569,7 +656,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 return;
             }
             if (!status.localExists && status.cloudExists && status.keyMatches) {
-                action = 'pull';
+                _action = 'pull';
                 out('⬇️  Cloud secrets available but no local file');
                 if (autoExecute) {
                     out('   Pulling from cloud...');
@@ -604,13 +691,13 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                         return;
                     }
                     if (localNewer) {
-                        action = 'push';
+                        _action = 'push';
                         out('⬆️  Local file is newer than cloud');
                         out(`   Local: ${status.localModified.toLocaleString()}`);
                         out(`   Cloud: ${status.cloudModified.toLocaleString()}`);
                         if (autoExecute) {
                             out('   Pushing to cloud...');
-                            await this.push(envFilePath, effectiveEnv);
+                            await this.push(envFilePath, effectiveEnv, force);
                             out('✅ Secrets synced to cloud!');
                         }
                         else {
@@ -618,7 +705,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                         }
                     }
                     else {
-                        action = 'pull';
+                        _action = 'pull';
                         out('⬇️  Cloud is newer than local file');
                         out(`   Local: ${status.localModified.toLocaleString()}`);
                         out(`   Cloud: ${status.cloudModified.toLocaleString()}`);

package/dist/lib/zsh-import-manager.js

@@ -124,15 +124,16 @@ export class ZshImportManager {
             return result;
         }
         catch (error) {
+            const err = error;
             this.log({
                 type: 'error',
                 name: 'IMPORT_ERROR',
                 status: 'failed',
-                reason: error.message
+                reason: err.message
             });
             const result = {
                 success: false,
-                message: `Import failed: ${error.message}`,
+                message: `Import failed: ${err.message}`,
                 diagnostics: this.diagnostics,
                 stats: { total: 0, succeeded: 0, failed: 1, skipped: 0, conflicts: 0 },
             };
@@ -280,7 +281,7 @@ export class ZshImportManager {
      */
     async loadExistingItems() {
         // Get existing aliases from context
-        const context = this.executor.context;
+        const context = this.executor.getContext();
         if (context && context.variables) {
             for (const key in context.variables) {
                 if (key.startsWith('alias_')) {
@@ -353,11 +354,12 @@ export class ZshImportManager {
                 stats.succeeded++;
             }
             catch (error) {
+                const err = error;
                 this.log({
                     type: 'alias',
                     name: alias.name,
                     status: 'failed',
-                    reason: error.message,
+                    reason: err.message,
                     source: `line ${alias.line}`,
                 });
                 stats.failed++;
@@ -415,11 +417,12 @@ export class ZshImportManager {
                 stats.succeeded++;
             }
             catch (error) {
+                const err = error;
                 this.log({
                     type: 'export',
                     name: export_.name,
                     status: 'failed',
-                    reason: error.message,
+                    reason: err.message,
                     source: `line ${export_.line}`,
                 });
                 stats.failed++;
@@ -490,11 +493,12 @@ export class ZshImportManager {
                 stats.succeeded++;
             }
             catch (error) {
+                const err = error;
                 this.log({
                     type: 'function',
                     name: func.name,
                     status: 'disabled',
-                    reason: `Parse error: ${error.message}`,
+                    reason: `Parse error: ${err.message}`,
                     source: `line ${func.line}`,
                 });
                 stats.failed++;
@@ -521,11 +525,12 @@ export class ZshImportManager {
                 stats.succeeded++;
             }
             catch (error) {
+                const err = error;
                 this.log({
                     type: 'setopt',
                     name: setopt.option,
                     status: 'disabled',
-                    reason: error.message,
+                    reason: err.message,
                     source: `line ${setopt.line}`,
                 });
                 stats.failed++;
@@ -635,7 +640,8 @@ export class ZshImportManager {
             fs.appendFileSync(this.options.diagnosticLog, logContent + '\n\n', 'utf8');
         }
         catch (error) {
-            console.error(`Failed to write diagnostic log: ${error.message}`);
+            const err = error;
+            console.error(`Failed to write diagnostic log: ${err.message}`);
         }
     }
     /**
@@ -684,7 +690,7 @@ export class ZshImportManager {
             if (diagnostic.status === 'conflict')
                 stats.conflicts++;
             if (!stats.byType[diagnostic.type]) {
-                stats.byType[diagnostic.type] = { total: 0, succeeded: 0, failed: 0, skipped: 0 };
+                stats.byType[diagnostic.type] = { total: 0, succeeded: 0, failed: 0, skipped: 0, conflicts: 0 };
             }
             stats.byType[diagnostic.type].total++;
             if (diagnostic.status === 'success')
@@ -693,6 +699,8 @@ export class ZshImportManager {
                 stats.byType[diagnostic.type].failed++;
             if (diagnostic.status === 'skipped')
                 stats.byType[diagnostic.type].skipped++;
+            if (diagnostic.status === 'conflict')
+                stats.byType[diagnostic.type].conflicts++;
         }
         return stats;
     }

package/dist/pipeline/job-tracker.js

@@ -443,7 +443,7 @@ export class JobTracker extends EventEmitter {
             targetSystem: row.target_system,
             status: row.status,
             priority: row.priority,
-            config: row.config,
+            config: row.config || {},
             parameters: row.parameters,
             cpuRequest: row.cpu_request ? parseFloat(row.cpu_request) : undefined,
             memoryRequest: row.memory_request,

package/dist/pipeline/mcli-bridge.js

@@ -140,12 +140,14 @@ export class MCLIBridge extends EventEmitter {
     // Webhook handler for MCLI callbacks
     async handleWebhook(payload) {
         const { job_id, status, result, error, metrics, artifacts } = payload;
+        const jobIdStr = job_id;
         // Get pipeline job ID
-        let pipelineJobId = this.jobMapping.get(job_id);
-        if (!pipelineJobId && payload.metadata?.pipeline_job_id) {
-            pipelineJobId = payload.metadata.pipeline_job_id;
+        let pipelineJobId = this.jobMapping.get(jobIdStr);
+        const metadata = payload.metadata;
+        if (!pipelineJobId && metadata?.pipeline_job_id) {
+            pipelineJobId = metadata.pipeline_job_id;
             if (pipelineJobId) {
-                this.jobMapping.set(job_id, pipelineJobId);
+                this.jobMapping.set(jobIdStr, pipelineJobId);
             }
         }
         if (!pipelineJobId) {
@@ -169,7 +171,8 @@ export class MCLIBridge extends EventEmitter {
                 break;
             case 'failed':
             case 'error':
-                await this.jobTracker.failExecution(execution.id, error?.message || 'Job failed in MCLI', error);
+                const errorObj = error;
+                await this.jobTracker.failExecution(execution.id, errorObj?.message || 'Job failed in MCLI', error);
                 break;
             case 'cancelled':
                 await this.jobTracker.updateJobStatus(pipelineJobId, JobStatus.CANCELLED);
@@ -258,11 +261,13 @@ export class MCLIBridge extends EventEmitter {
     // Helper methods
     async updateJobExternalId(jobId, externalId) {
         // This would be implemented in JobTracker, but for now we'll use raw SQL
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const pool = this.jobTracker.pool;
         await pool.query('UPDATE pipeline_jobs SET external_id = $1 WHERE id = $2', [externalId, jobId]);
     }
     async getLatestExecution(jobId) {
         // This would be implemented in JobTracker
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const pool = this.jobTracker.pool;
         const result = await pool.query(`SELECT * FROM job_executions
        WHERE job_id = $1
@@ -271,6 +276,7 @@ export class MCLIBridge extends EventEmitter {
         if (result.rows.length === 0) {
             return null;
         }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         return this.jobTracker.parseExecutionRow(result.rows[0]);
     }
     // Health check

package/dist/pipeline/workflow-engine.js

@@ -208,22 +208,23 @@ export class WorkflowEngine extends EventEmitter {
     }
     async executeJobNode(execution, node) {
         // Create job from node configuration
+        const config = node.config;
         const jobConfig = {
             name: `${execution.runId}-${node.name}`,
-            type: node.config.type || 'workflow_job',
+            type: config.type || 'workflow_job',
             sourceSystem: 'workflow',
-            targetSystem: node.config.targetSystem || 'mcli',
+            targetSystem: config.targetSystem || 'mcli',
             status: JobStatus.PENDING,
-            priority: node.config.priority || JobPriority.NORMAL,
+            priority: config.priority || JobPriority.NORMAL,
             config: {
-                ...node.config,
+                ...config,
                 workflowExecutionId: execution.id,
                 workflowNodeId: node.id,
                 workflowRunId: execution.runId
             },
             parameters: {
                 ...execution.parameters,
-                ...node.config.parameters
+                ...(config.parameters || {})
             },
             owner: execution.triggeredBy,
             tags: [`workflow:${execution.workflowId}`, `run:${execution.runId}`]
@@ -262,7 +263,8 @@ export class WorkflowEngine extends EventEmitter {
         await this.checkAndContinueExecution(execution);
     }
     async executeWaitNode(execution, node) {
-        const waitMs = node.config.waitMs || 1000;
+        const config = node.config;
+        const waitMs = config.waitMs || 1000;
         setTimeout(async () => {
             const nodeState = execution.nodeStates[node.id];
             nodeState.status = NodeStatus.COMPLETED;
@@ -300,7 +302,8 @@ export class WorkflowEngine extends EventEmitter {
             nodeState.durationMs = nodeState.completedAt.getTime() - nodeState.startedAt.getTime();
         }
         if (status === 'failed') {
-            nodeState.error = data.errorMessage || 'Job failed';
+            const errorData = data;
+            nodeState.error = errorData.errorMessage || 'Job failed';
             // Check retry policy
             const workflow = await this.getWorkflow(targetExecution.workflowId);
             const node = workflow?.nodes.find(n => n.id === targetNodeId);

package/dist/services/cron/cron-registrar.js

@@ -48,22 +48,23 @@ export class CronCommandRegistrar extends BaseCommandRegistrar {
                 { flags: '-p, --priority <priority>', description: 'Priority (0-10)', defaultValue: '5' }
             ],
             action: async (templateId, options) => {
+                const opts = options;
                 const result = await this.withCronManager(async (manager) => {
                     const customizations = {};
-                    if (options.name)
-                        customizations.name = options.name;
-                    if (options.command)
-                        customizations.command = options.command;
-                    if (options.schedule)
-                        customizations.schedule = { cron: options.schedule };
-                    if (options.workingDir)
-                        customizations.workingDirectory = options.workingDir;
-                    if (options.env)
-                        customizations.environment = this.parseJSON(options.env, 'environment variables');
-                    if (options.tags)
-                        customizations.tags = this.parseTags(options.tags);
-                    if (options.priority)
-                        customizations.priority = parseInt(options.priority);
+                    if (opts.name)
+                        customizations.name = opts.name;
+                    if (opts.command)
+                        customizations.command = opts.command;
+                    if (opts.schedule)
+                        customizations.schedule = { cron: opts.schedule };
+                    if (opts.workingDir)
+                        customizations.workingDirectory = opts.workingDir;
+                    if (opts.env)
+                        customizations.environment = this.parseJSON(opts.env, 'environment variables');
+                    if (opts.tags)
+                        customizations.tags = this.parseTags(opts.tags);
+                    if (opts.priority)
+                        customizations.priority = parseInt(opts.priority);
                     return await manager.createJobFromTemplate(templateId, customizations);
                 });
                 this.logSuccess('Job created from template:');
@@ -84,8 +85,9 @@ export class CronCommandRegistrar extends BaseCommandRegistrar {
                 { flags: '-f, --filter <filter>', description: 'Filter by status' }
             ],
             action: async (options) => {
+                const opts = options;
                 const jobs = await this.withCronManager(async (manager) => {
-                    return await manager.listJobs(options.filter ? { status: options.filter } : undefined);
+                    return await manager.listJobs(opts.filter ? { status: opts.filter } : undefined);
                 });
                 this.logInfo(`Cron Jobs (${jobs.length} total):`);
                 jobs.forEach(job => {
@@ -146,10 +148,11 @@ export class CronCommandRegistrar extends BaseCommandRegistrar {
                 { flags: '-s, --signal <signal>', description: 'Signal to send', defaultValue: 'SIGTERM' }
             ],
             action: async (jobId, options) => {
+                const opts = options;
                 await this.withCronManager(async (manager) => {
-                    await manager.stopJob(jobId, options.signal);
+                    await manager.stopJob(jobId, opts.signal);
                 });
-                this.logSuccess(`Job ${jobId} stopped with signal ${options.signal}`);
+                this.logSuccess(`Job ${jobId} stopped with signal ${opts.signal}`);
             }
         });
         // Remove job
@@ -161,8 +164,9 @@ export class CronCommandRegistrar extends BaseCommandRegistrar {
                 { flags: '-f, --force', description: 'Force removal', defaultValue: false }
             ],
             action: async (jobId, options) => {
+                const opts = options;
                 await this.withCronManager(async (manager) => {
-                    await manager.removeJob(jobId, options.force);
+                    await manager.removeJob(jobId, opts.force);
                 });
                 this.logSuccess(`Job ${jobId} removed`);
             }
@@ -218,13 +222,14 @@ export class CronCommandRegistrar extends BaseCommandRegistrar {
                 { flags: '-o, --output <file>', description: 'Output file path' }
             ],
             action: async (options) => {
+                const opts = options;
                 const data = await this.withCronManager(async (manager) => {
-                    return await manager.exportJobData(options.format);
+                    return await manager.exportJobData(opts.format);
                 });
-                if (options.output) {
+                if (opts.output) {
                     const fs = await import('fs');
-                    fs.writeFileSync(options.output, data);
-                    this.logSuccess(`Data exported to ${options.output}`);
+                    fs.writeFileSync(opts.output, data);
+                    this.logSuccess(`Data exported to ${opts.output}`);
                 }
                 else {
                     this.logInfo(data);