robodev 0.41.0 → 0.42.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "robodev",
-  "version": "0.41.0",
-  "description": "CLI for Robodev Starbase — create, auth, link, deploy, and run a project locally with robodev dev",
+  "version": "0.42.0",
+  "description": "CLI for Robodev Starbase — create, auth, link, deploy, load, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",
   "repository": {

package/src/index.ts

@@ -39,6 +39,7 @@ import {
 import { parseCreateArgs } from "./parse-create-args.js";
 import { parseDeployArgs } from "./parse-deploy-args.js";
 import { ensureDeployLink } from "./ensure-deploy-link.js";
+import { runLoad } from "./load.js";
 import { printLiveUrl } from "./print-live-url.js";
 
 const execFileAsync = promisify(execFile);
@@ -56,6 +57,7 @@ Commands:
   create [path] [--template <id>] [--starter <id>] [--empty] [--org <id>]  Create a project, scaffold a starter, and deploy
   link [projectId]     Write robodev/.robodev in the current folder
   deploy [--force] [--name <name>] [--org <id>]  Deploy schema, APIs, jobs, and frontend (creates and links if unlinked)
+  load                 Download the latest deploy onto this folder
   dev [options]        Run this project's APIs locally on an embedded Postgres, no Starbase needed
 
 dev options:
@@ -682,6 +684,9 @@ async function main(): Promise<void> {
       await runDeploy(parsed.force, {}, { name: parsed.name, orgId: parsed.orgId });
       break;
     }
+    case "load":
+      await runLoad(args);
+      break;
     case "dev": {
       const { main: runDev } = await import("./dev.js");
       await runDev(args);

package/src/load.test.ts

@@ -0,0 +1,238 @@
+import assert from "node:assert/strict";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import {
+  applyLoadFiles,
+  NO_DEPLOYMENT_MESSAGE,
+  NO_LINK_MESSAGE,
+  parseLoadArgs,
+  runLoad,
+  type LoadDeps,
+  type LoadFile,
+} from "./load.js";
+import type { ProjectLink } from "./config.js";
+
+const linked: ProjectLink = {
+  projectId: "proj_load",
+  apiUrl: "https://robodev.povio.dev",
+};
+
+async function withTemp<T>(fn: (root: string) => Promise<T>): Promise<T> {
+  const root = await mkdtemp(join(tmpdir(), "rd-load-"));
+  try {
+    return await fn(root);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+function stubRun(
+  overrides: Partial<LoadDeps> & { files?: LoadFile[] } = {},
+): LoadDeps & { authedPaths: string[]; applied: LoadFile[][] } {
+  const authedPaths: string[] = [];
+  const applied: LoadFile[][] = [];
+  return {
+    authedPaths,
+    applied,
+    readLink: overrides.readLink ?? (async () => linked),
+    authed:
+      overrides.authed ??
+      (async <T>(path: string) => {
+        authedPaths.push(path);
+        return { files: overrides.files ?? [] } as T;
+      }),
+    apply:
+      overrides.apply ??
+      (async (_root, files) => {
+        applied.push(files);
+        return { written: files.length, removed: 0 };
+      }),
+    cwd: overrides.cwd ?? (() => "/tmp/app"),
+    log: overrides.log ?? (() => {}),
+  };
+}
+
+test("parseLoadArgs rejects unknown flags and extra arguments", () => {
+  assert.throws(() => parseLoadArgs(["--force"]), /Unknown flag --force/);
+  assert.throws(() => parseLoadArgs(["--name", "x"]), /Unknown flag --name/);
+  assert.throws(() => parseLoadArgs(["extra"]), /Unexpected argument extra/);
+  parseLoadArgs([]);
+});
+
+test("runLoad fails without a link and does not fetch or write", async () => {
+  const deps = stubRun({
+    readLink: async () => null,
+    authed: async () => {
+      throw new Error("should not fetch");
+    },
+    apply: async () => {
+      throw new Error("should not apply");
+    },
+  });
+  await assert.rejects(() => runLoad([], deps), new Error(NO_LINK_MESSAGE));
+  assert.deepEqual(deps.authedPaths, []);
+  assert.deepEqual(deps.applied, []);
+});
+
+test("runLoad fails on an empty deployment and does not write", async () => {
+  const deps = stubRun({ files: [] });
+  await assert.rejects(() => runLoad([], deps), new Error(NO_DEPLOYMENT_MESSAGE));
+  assert.deepEqual(deps.authedPaths, ["/v1/projects/proj_load/deployment/files"]);
+  assert.deepEqual(deps.applied, []);
+});
+
+test("runLoad rejects unknown flags before reading the link", async () => {
+  const deps = stubRun({
+    readLink: async () => {
+      throw new Error("should not read link");
+    },
+  });
+  await assert.rejects(() => runLoad(["--workspace"], deps), /Unknown flag --workspace/);
+});
+
+test("runLoad fetches deployment files and prints a summary", async () => {
+  const logs: string[] = [];
+  const files = [{ path: "robodev/database.ts", content: "export default {}" }];
+  const deps = stubRun({
+    files,
+    apply: async () => ({ written: 1, removed: 0 }),
+    log: (message) => logs.push(message),
+  });
+  await runLoad([], deps);
+  assert.deepEqual(deps.authedPaths, ["/v1/projects/proj_load/deployment/files"]);
+  assert.deepEqual(logs, ["Loaded 1 files from proj_load."]);
+});
+
+test("runLoad mentions pruned files in the summary", async () => {
+  const logs: string[] = [];
+  const deps = stubRun({
+    files: [{ path: "robodev/database.ts", content: "ok" }],
+    apply: async () => ({ written: 2, removed: 3 }),
+    log: (message) => logs.push(message),
+  });
+  await runLoad([], deps);
+  assert.deepEqual(logs, ["Loaded 2 files from proj_load (3 removed)."]);
+});
+
+test("applyLoadFiles aborts unsafe paths with no writes", async () => {
+  await withTemp(async (root) => {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(join(root, "robodev/database.ts"), "keep");
+    const cases: LoadFile[][] = [
+      [
+        { path: "robodev/database.ts", content: "new" },
+        { path: "../escape.ts", content: "bad" },
+      ],
+      [{ path: "/tmp/abs.ts", content: "bad" }],
+      [{ path: "C:/Windows/x.ts", content: "bad" }],
+      [{ path: "robodev//database.ts", content: "bad" }],
+    ];
+    for (const files of cases) {
+      await assert.rejects(() => applyLoadFiles(root, files), /Invalid file path:/);
+    }
+    assert.equal(await readFile(join(root, "robodev/database.ts"), "utf8"), "keep");
+  });
+});
+
+test("applyLoadFiles skips protected and denied paths", async () => {
+  await withTemp(async (root) => {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await mkdir(join(root, "apps/fe/src"), { recursive: true });
+    await writeFile(join(root, ".env"), "SECRET=1");
+    await writeFile(join(root, ".env.local"), "LOCAL=1");
+    await writeFile(join(root, "robodev/.robodev"), '{"projectId":"keep"}');
+    await writeFile(join(root, "apps/fe/src/App.tsx"), "local-fe");
+    const result = await applyLoadFiles(root, [
+      { path: "robodev/database.ts", content: "export default {}" },
+      { path: ".env", content: "SECRET=leaked" },
+      { path: ".env.local", content: "LOCAL=leaked" },
+      { path: "robodev/.robodev", content: '{"projectId":"overwrite"}' },
+      { path: "apps/fe/src/App.tsx", content: "payload-fe" },
+      { path: "apps/fe/package.json", content: "{}" },
+    ]);
+    assert.equal(result.written, 1);
+    assert.equal(await readFile(join(root, "robodev/database.ts"), "utf8"), "export default {}");
+    assert.equal(await readFile(join(root, ".env"), "utf8"), "SECRET=1");
+    assert.equal(await readFile(join(root, ".env.local"), "utf8"), "LOCAL=1");
+    assert.equal(await readFile(join(root, "robodev/.robodev"), "utf8"), '{"projectId":"keep"}');
+    assert.equal(await readFile(join(root, "apps/fe/src/App.tsx"), "utf8"), "local-fe");
+  });
+});
+
+test("applyLoadFiles treats an all-skipped payload as empty", async () => {
+  await withTemp(async (root) => {
+    await writeFile(join(root, ".env"), "SECRET=1");
+    await assert.rejects(
+      () =>
+        applyLoadFiles(root, [
+          { path: ".env", content: "nope" },
+          { path: "apps/fe/src/App.tsx", content: "nope" },
+        ]),
+      new Error(NO_DEPLOYMENT_MESSAGE),
+    );
+    assert.equal(await readFile(join(root, ".env"), "utf8"), "SECRET=1");
+  });
+});
+
+test("applyLoadFiles overwrites existing allowed files", async () => {
+  await withTemp(async (root) => {
+    await mkdir(join(root, "robodev/api"), { recursive: true });
+    await writeFile(join(root, "robodev/database.ts"), "old-db");
+    await writeFile(join(root, "robodev/api/health.ts"), "old-health");
+    const result = await applyLoadFiles(root, [
+      { path: "robodev/database.ts", content: "new-db" },
+      { path: "robodev/api/health.ts", content: "new-health" },
+    ]);
+    assert.equal(result.written, 2);
+    assert.equal(result.removed, 0);
+    assert.equal(await readFile(join(root, "robodev/database.ts"), "utf8"), "new-db");
+    assert.equal(await readFile(join(root, "robodev/api/health.ts"), "utf8"), "new-health");
+  });
+});
+
+test("applyLoadFiles prunes stale collectable files and leaves apps/fe and .env", async () => {
+  await withTemp(async (root) => {
+    await mkdir(join(root, "robodev/api"), { recursive: true });
+    await mkdir(join(root, "apps/fe/src"), { recursive: true });
+    await writeFile(join(root, "robodev/database.ts"), "old");
+    await writeFile(join(root, "robodev/api/gone.ts"), "stale");
+    await writeFile(join(root, "robodev/api/keep.ts"), "old-keep");
+    await writeFile(join(root, ".env"), "SECRET=1");
+    await writeFile(join(root, "apps/fe/src/App.tsx"), "local-fe");
+    const result = await applyLoadFiles(root, [
+      { path: "robodev/database.ts", content: "new-db" },
+      { path: "robodev/api/keep.ts", content: "new-keep" },
+    ]);
+    assert.equal(result.written, 2);
+    assert.equal(result.removed, 1);
+    assert.equal(await readFile(join(root, "robodev/database.ts"), "utf8"), "new-db");
+    assert.equal(await readFile(join(root, "robodev/api/keep.ts"), "utf8"), "new-keep");
+    await assert.rejects(() => readFile(join(root, "robodev/api/gone.ts")), /ENOENT/);
+    assert.equal(await readFile(join(root, ".env"), "utf8"), "SECRET=1");
+    assert.equal(await readFile(join(root, "apps/fe/src/App.tsx"), "utf8"), "local-fe");
+  });
+});
+
+test("applyLoadFiles decodes public binaries from base64", async () => {
+  await withTemp(async (root) => {
+    const bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    const result = await applyLoadFiles(root, [
+      { path: "index.html", content: "<html></html>" },
+      { path: "public/icon.png", content: bytes.toString("base64") },
+    ]);
+    assert.equal(result.written, 2);
+    assert.deepEqual(await readFile(join(root, "public/icon.png")), bytes);
+    assert.equal(await readFile(join(root, "index.html"), "utf8"), "<html></html>");
+  });
+});
+
+test("applyLoadFiles fails on an empty payload and writes nothing", async () => {
+  await withTemp(async (root) => {
+    await writeFile(join(root, "marker.txt"), "keep");
+    await assert.rejects(() => applyLoadFiles(root, []), new Error(NO_DEPLOYMENT_MESSAGE));
+    assert.equal(await readFile(join(root, "marker.txt"), "utf8"), "keep");
+  });
+});

package/src/load.ts

@@ -0,0 +1,176 @@
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { authed } from "./api.js";
+import { isPublicBinaryCollectedPath, shouldCollectPath } from "./collect-files.js";
+import { readLink, type ProjectLink } from "./config.js";
+
+export const NO_LINK_MESSAGE =
+  "No robodev/.robodev file. Run `robodev link` or `robodev create` first.";
+export const NO_DEPLOYMENT_MESSAGE =
+  "No deployment for this project. Deploy from the dashboard or run `robodev deploy` first.";
+
+const PRUNE_SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".robodev", "apps"]);
+
+export type LoadFile = { path: string; content: string };
+
+export type LoadApplyResult = { written: number; removed: number };
+
+export type LoadDeps = {
+  readLink: (cwd?: string) => Promise<ProjectLink | null>;
+  authed: <T>(path: string, init?: RequestInit) => Promise<T>;
+  apply: (root: string, files: LoadFile[]) => Promise<LoadApplyResult>;
+  cwd?: () => string;
+  log?: (message: string) => void;
+};
+
+export function parseLoadArgs(args: string[]): void {
+  for (const arg of args) {
+    if (arg.startsWith("-")) {
+      throw new Error(`Unknown flag ${arg}`);
+    }
+    throw new Error(`Unexpected argument ${arg}`);
+  }
+}
+
+function normalize(path: string): string {
+  return path.replaceAll("\\", "/");
+}
+
+/** Same conditions as collect-files `isUnsafe`. */
+function isUnsafePath(path: string): boolean {
+  return (
+    path.startsWith("/") ||
+    path.includes("..") ||
+    path.split("/").some((segment) => segment === "") ||
+    /^[A-Za-z]:/.test(path)
+  );
+}
+
+function isProtectedPath(path: string): boolean {
+  if (path === "robodev/.robodev" || path === ".robodev" || path.startsWith(".robodev/")) {
+    return true;
+  }
+  if (path === ".env" || path.startsWith(".env.")) return true;
+  if (path === "credentials.json" || path.endsWith("/credentials.json")) return true;
+  if (path === "apps" || path.startsWith("apps/")) return true;
+  if (path === "node_modules" || path.startsWith("node_modules/")) return true;
+  if (path === ".git" || path.startsWith(".git/")) return true;
+  return false;
+}
+
+function resolveUnderRoot(root: string, rel: string): string | null {
+  const rootResolved = resolve(root);
+  const resolved = resolve(rootResolved, rel);
+  const prefix = rootResolved.endsWith(sep) ? rootResolved : `${rootResolved}${sep}`;
+  if (resolved !== rootResolved && !resolved.startsWith(prefix)) {
+    return null;
+  }
+  return resolved;
+}
+
+type Classified =
+  | { kind: "unsafe"; path: string }
+  | { kind: "denied"; path: string }
+  | { kind: "allowed"; path: string; content: string; abs: string };
+
+export function classifyLoadFiles(root: string, files: LoadFile[]): Classified[] {
+  return files.map((file) => {
+    const path = normalize(file.path);
+    if (isUnsafePath(path)) return { kind: "unsafe", path };
+    const abs = resolveUnderRoot(root, path);
+    if (!abs) return { kind: "unsafe", path };
+    if (isProtectedPath(path) || !shouldCollectPath(path)) return { kind: "denied", path };
+    return { kind: "allowed", path, content: file.content, abs };
+  });
+}
+
+async function listCollectablePaths(root: string): Promise<string[]> {
+  const paths: string[] = [];
+
+  async function walk(dir: string): Promise<void> {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (PRUNE_SKIP_DIRS.has(entry.name)) continue;
+        await walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const path = normalize(relative(root, abs));
+      if (!shouldCollectPath(path)) continue;
+      paths.push(path);
+    }
+  }
+
+  await walk(root);
+  return paths;
+}
+
+export async function applyLoadFiles(root: string, files: LoadFile[]): Promise<LoadApplyResult> {
+  const classified = classifyLoadFiles(root, files);
+  const unsafe = classified.find((item) => item.kind === "unsafe");
+  if (unsafe) {
+    throw new Error(`Invalid file path: ${unsafe.path}`);
+  }
+  const allowed = classified.filter(
+    (item): item is Extract<Classified, { kind: "allowed" }> => item.kind === "allowed",
+  );
+  if (allowed.length === 0) {
+    throw new Error(NO_DEPLOYMENT_MESSAGE);
+  }
+
+  for (const file of allowed) {
+    await mkdir(dirname(file.abs), { recursive: true });
+    if (isPublicBinaryCollectedPath(file.path)) {
+      await writeFile(file.abs, Buffer.from(file.content, "base64"));
+    } else {
+      await writeFile(file.abs, file.content, "utf8");
+    }
+  }
+
+  const keep = new Set(allowed.map((file) => file.path));
+  let removed = 0;
+  for (const path of await listCollectablePaths(root)) {
+    if (keep.has(path)) continue;
+    const abs = resolveUnderRoot(root, path);
+    if (!abs) continue;
+    await unlink(abs);
+    removed += 1;
+  }
+  return { written: allowed.length, removed };
+}
+
+const defaultDeps: LoadDeps = {
+  readLink,
+  authed,
+  apply: applyLoadFiles,
+};
+
+export async function runLoad(args: string[], deps: LoadDeps = defaultDeps): Promise<void> {
+  parseLoadArgs(args);
+  const cwd = deps.cwd?.() ?? process.cwd();
+  const log = deps.log ?? console.log;
+  const link = await deps.readLink(cwd);
+  if (!link) {
+    throw new Error(NO_LINK_MESSAGE);
+  }
+  const body = await deps.authed<{ files?: LoadFile[] }>(
+    `/v1/projects/${link.projectId}/deployment/files`,
+  );
+  const files = body.files ?? [];
+  if (files.length === 0) {
+    throw new Error(NO_DEPLOYMENT_MESSAGE);
+  }
+  const { written, removed } = await deps.apply(cwd, files);
+  if (removed > 0) {
+    log(`Loaded ${written} files from ${link.projectId} (${removed} removed).`);
+  } else {
+    log(`Loaded ${written} files from ${link.projectId}.`);
+  }
+}

package/templates/auth-chat/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.41.0",
+    "robodev": "^0.42.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.41.0",
+    "robodev": "^0.42.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -16,7 +16,7 @@
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.41.0",
+    "robodev": "^0.42.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/marketplace/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.41.0",
+    "robodev": "^0.42.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/space/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.41.0",
+    "robodev": "^0.42.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }