npm - robodev - Versions diffs - 0.5.0 → 0.6.0 - Mend

robodev 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/package.json +4 -3
package/src/collect-files.test.ts +41 -0
package/src/collect-files.ts +164 -0
package/src/index.ts +9 -41
package/templates/auth-chat/README.md +4 -8
package/templates/auth-chat/package.json +3 -3
package/templates/auth-chat/src/main.tsx +11 -22
package/templates/space/README.md +4 -8
package/templates/space/package.json +3 -3
package/templates/space/src/main.tsx +10 -9

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "robodev",
-  "version": "0.5.0",
-  "description": "CLI for Robodev Starbase — create, auth, link, and deploy file-based APIs",
+  "version": "0.6.0",
+  "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -23,7 +23,8 @@
   "scripts": {
     "robodev": "tsx src/index.ts",
     "generate:templates": "tsx src/generate-templates.ts",
-    "prepack": "tsx src/generate-templates.ts"
+    "prepack": "tsx src/generate-templates.ts",
+    "test": "tsx --test src/**/*.test.ts"
   },
   "dependencies": {
     "tsx": "^4.20.5"

package/src/collect-files.test.ts ADDED Viewed

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import { mkdir, writeFile } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { collectFiles } from "./collect-files.js";
+test("collectFiles includes hosted sources and skips denied paths", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-cli-"));
+  try {
+    await writeFile(join(root, "database.ts"), "export default {}");
+    await writeFile(join(root, "index.html"), "<html></html>");
+    await mkdir(join(root, "src"), { recursive: true });
+    await writeFile(join(root, "src/main.tsx"), "export {}");
+    await mkdir(join(root, "api"), { recursive: true });
+    await writeFile(join(root, "api/x.ts"), "export {}");
+    await writeFile(join(root, "package.json"), "{}");
+    await mkdir(join(root, "node_modules"), { recursive: true });
+    await writeFile(join(root, "node_modules/x.js"), "nope");
+    await mkdir(join(root, "dist"), { recursive: true });
+    await writeFile(join(root, "dist/x.js"), "nope");
+    await writeFile(join(root, ".env"), "SECRET=1");
+    await mkdir(join(root, ".robodev"), { recursive: true });
+    await writeFile(join(root, ".robodev/x"), "nope");
+    const files = await collectFiles(root);
+    const paths = new Set(files.map((file) => file.path));
+    assert.ok(paths.has("index.html"));
+    assert.ok(paths.has("src/main.tsx"));
+    assert.ok(paths.has("database.ts"));
+    assert.ok(paths.has("api/x.ts"));
+    assert.ok(paths.has("package.json"));
+    assert.ok(!paths.has("node_modules/x.js"));
+    assert.ok(!paths.has("dist/x.js"));
+    assert.ok(!paths.has(".env"));
+    assert.ok(!paths.has(".robodev/x"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/collect-files.ts ADDED Viewed

@@ -0,0 +1,164 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, relative } from "node:path";
+export const MAX_FILE_COUNT = 200;
+export const MAX_FILE_BYTES = 1024 * 1024;
+export const MAX_TREE_BYTES = 15 * 1024 * 1024;
+export const MAX_PATH_LENGTH = 240;
+export const MAX_PATH_DEPTH = 12;
+const SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".robodev"]);
+const BINARY_EXTENSIONS = new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".ico",
+  ".bmp",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".otf",
+  ".wasm",
+  ".zip",
+  ".gz",
+  ".tgz",
+  ".7z",
+  ".pdf",
+  ".mp4",
+  ".webm",
+  ".mp3",
+]);
+const SRC_EXTENSIONS = new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".css",
+  ".json",
+  ".svg",
+]);
+const PUBLIC_EXTENSIONS = new Set([...SRC_EXTENSIONS, ".html", ".txt", ".md"]);
+const ROOT_STATIC_EXTENSIONS = new Set([".html", ".css", ".js", ".mjs", ".svg", ".txt", ".md"]);
+const CONFIG_FILES = new Set([
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "tsconfig.json",
+  "vite.config.ts",
+  "vite.config.js",
+  "vite.config.mts",
+  "vite.config.mjs",
+  "README.md",
+  ".gitignore",
+]);
+export type CollectedFile = { path: string; content: string };
+function normalize(path: string): string {
+  return path.replaceAll("\\", "/");
+}
+function extname(path: string): string {
+  const base = path.split("/").pop() ?? "";
+  const dot = base.lastIndexOf(".");
+  if (dot <= 0) return "";
+  return base.slice(dot).toLowerCase();
+}
+function basename(path: string): string {
+  return path.split("/").pop() ?? path;
+}
+function isUnsafe(path: string): boolean {
+  return (
+    path.startsWith("/") ||
+    path.includes("..") ||
+    path.split("/").some((segment) => segment === "") ||
+    /^[A-Za-z]:/.test(path)
+  );
+}
+function isDenied(path: string): boolean {
+  const top = path.split("/")[0];
+  if (SKIP_DIRS.has(top)) return true;
+  if (path === ".env" || path.startsWith(".env.")) return true;
+  const name = basename(path);
+  if (name.startsWith(".") && name !== ".gitignore") return true;
+  if (BINARY_EXTENSIONS.has(extname(path))) return true;
+  return false;
+}
+function isAllowed(path: string): boolean {
+  if (path === "database.ts") return true;
+  if (path.startsWith("api/")) return path.endsWith(".ts");
+  if (path === "index.html") return true;
+  if (path.startsWith("src/")) return SRC_EXTENSIONS.has(extname(path));
+  if (path.startsWith("public/")) return PUBLIC_EXTENSIONS.has(extname(path));
+  if (CONFIG_FILES.has(path) || CONFIG_FILES.has(basename(path))) return true;
+  if (/^tsconfig\..+\.json$/.test(basename(path)) && !path.includes("/")) return true;
+  if (!path.includes("/") && ROOT_STATIC_EXTENSIONS.has(extname(path))) return true;
+  return false;
+}
+export function shouldCollectPath(path: string): boolean {
+  const normalized = normalize(path);
+  return !isUnsafe(normalized) && !isDenied(normalized) && isAllowed(normalized);
+}
+export async function collectFiles(root: string): Promise<CollectedFile[]> {
+  try {
+    await stat(join(root, "database.ts"));
+  } catch {
+    throw new Error("database.ts not found in the current directory");
+  }
+  const files: CollectedFile[] = [];
+  let totalBytes = 0;
+  async function walk(dir: string): Promise<void> {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        await walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const path = normalize(relative(root, abs));
+      if (!shouldCollectPath(path)) continue;
+      if (path.length > MAX_PATH_LENGTH || path.split("/").length > MAX_PATH_DEPTH) {
+        throw new Error(`Invalid file path: ${path}`);
+      }
+      const content = await readFile(abs, "utf8");
+      const bytes = Buffer.byteLength(content, "utf8");
+      if (bytes > MAX_FILE_BYTES) {
+        throw new Error(`File must be under 1MB: ${path}`);
+      }
+      totalBytes += bytes;
+      if (totalBytes > MAX_TREE_BYTES) {
+        throw new Error("Deploy tree must be under 15MB");
+      }
+      files.push({ path, content });
+      if (files.length > MAX_FILE_COUNT) {
+        throw new Error(`Deploy may include at most ${MAX_FILE_COUNT} files`);
+      }
+    }
+  }
+  await walk(root);
+  if (!files.some((file) => file.path === "database.ts")) {
+    throw new Error("database.ts not found in the current directory");
+  }
+  return files;
+}

package/src/index.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { mkdir, readdir, readFile, stat } from "node:fs/promises";
+import { mkdir, stat } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { basename, join, relative, resolve } from "node:path";
@@ -17,6 +17,7 @@ import {
   writeViteApiUrl,
 } from "./config.js";
 import { waitUntilLive } from "./wait-until-live.js";
+import { collectFiles } from "./collect-files.js";
 import {
   emitStarter,
   loadCatalog,
@@ -39,7 +40,7 @@ Commands:
   projects             List your projects
   create [path] [--starter <id>]  Create a project, scaffold a starter, and deploy
   link [projectId]     Write .robodev in the current folder
-  deploy [--force]     Deploy database.ts and api/*.ts
+  deploy [--force]     Deploy the project file tree (schema, APIs, and frontend)
 `);
   process.exit(1);
 }
@@ -192,44 +193,7 @@ async function runLink(projectId?: string): Promise<void> {
   console.log(`Frontend API ${project.apiUrl}`);
 }
-/** Collects `database.ts` plus every TypeScript file under `api/` for a deploy upload. */
-async function collectFiles(root: string): Promise<{ path: string; content: string }[]> {
-  const files: { path: string; content: string }[] = [];
-  const database = join(root, "database.ts");
-  try {
-    await stat(database);
-    files.push({ path: "database.ts", content: await readFile(database, "utf8") });
-  } catch {
-    throw new Error("database.ts not found in the current directory");
-  }
-  async function walk(dir: string): Promise<void> {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const abs = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        await walk(abs);
-        continue;
-      }
-      if (entry.isFile() && entry.name.endsWith(".ts")) {
-        files.push({
-          path: relative(root, abs).replaceAll("\\", "/"),
-          content: await readFile(abs, "utf8"),
-        });
-      }
-    }
-  }
-  await walk(join(root, "api"));
-  return files;
-}
-/** Uploads schema + APIs. Destructive schema changes need confirmation or `--force`. */
+/** Uploads schema, APIs, and frontend. Destructive schema changes need confirmation or `--force`. */
 async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void> {
   const link = await readLink(root);
   if (!link) {
@@ -245,6 +209,7 @@ async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void
         databaseName: string;
         databaseCreated?: boolean;
         apiUrl: string;
+        appUrl?: string;
         docsUrl: string;
         routes: { method: string; path: string }[];
         plan: { operations: { type: string; table: string; column?: string; sql: string }[] };
@@ -253,7 +218,7 @@ async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void
         body: JSON.stringify({ force, files }),
       });
       await waitUntilLive(result.apiUrl);
-      console.log(`Deployed to ${result.apiUrl}`);
+      console.log(`App      ${result.appUrl ?? result.apiUrl}`);
       console.log(`Docs     ${result.docsUrl}`);
       console.log(
         result.databaseCreated
@@ -302,6 +267,9 @@ async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void
         force = true;
         continue;
       }
+      if (error instanceof ApiError && error.status === 413) {
+        throw new Error(error.message);
+      }
       throw error;
     }
   }

package/templates/auth-chat/README.md CHANGED Viewed

@@ -2,20 +2,16 @@
 Starter app from `robodev create --starter auth-chat`: email + Google sign-in and a shared chat room (`chat` database, `messages` table).
-The backend is already on Starbase. Run the frontend:
+The project host is the app. After create or deploy, open the printed App URL — no `npm run dev` required. Local Vite is optional:
 ```bash
 npm run dev
 ```
-It reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`).
+Local Vite reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`). Hosted builds use the same origin as the APIs.
 Docs: https://robodev.povio.dev/docs/starter
-`GET /me` and `GET/POST /messages` (`api/me.ts`, `api/messages.ts`) require a Robodev Auth Bearer token. `GET /health` stays public. Email auth works without Google. If Google is not configured on Starbase, the button shows a 503 message.
+`GET /me` and `GET/POST /messages` (`api/me.ts`, `api/messages.ts`) require a Robodev Auth Bearer token. `GET /health` stays public. Email auth works without Google. If Google is not configured on Starbase, the button shows a 503 message. Google OAuth may not complete inside the dashboard preview iframe — use Open app.
-Add tables in `database.ts` and routes as `api/<name>.ts`, then:
-```bash
-npx robodev deploy
-```
+Edit files in the dashboard Code page, or here, then Save / `npx robodev deploy`.

package/templates/auth-chat/package.json CHANGED Viewed

@@ -11,8 +11,8 @@
   "dependencies": {
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "@robodev-ai/sdk": "^0.4.0",
-    "@robodev-ai/client": "^0.1.0"
+    "@robodev-ai/sdk": "^0.5.0",
+    "@robodev-ai/client": "^0.2.0"
   },
   "devDependencies": {
     "@types/react": "^18.3.24",
@@ -20,6 +20,6 @@
     "@vitejs/plugin-react": "^4.7.0",
     "typescript": "^5.9.2",
     "vite": "^6.3.5",
-    "robodev": "^0.5.0"
+    "robodev": "^0.6.0"
   }
 }

package/templates/auth-chat/src/main.tsx CHANGED Viewed

@@ -11,8 +11,15 @@ type Message = {
   createdAt: string | null;
 };
-const apiUrl = import.meta.env.VITE_API_URL as string | undefined;
-const api = apiUrl ? createClient({ url: apiUrl }) : null;
+function projectApiUrl(): string {
+  const fromEnv = import.meta.env.VITE_API_URL;
+  if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.replace(/\/+$/, "");
+  if (typeof window !== "undefined") return window.location.origin;
+  return "";
+}
+const apiUrl = projectApiUrl();
+const api = createClient({ url: apiUrl });
 function authorLabel(user: { name?: string | null; email: string }) {
   return user.name?.trim() || user.email;
@@ -33,17 +40,12 @@ function App() {
   const listRef = useRef<HTMLDivElement>(null);
   async function refreshMessages() {
-    if (!api) return;
     const res = await api.fetch("/messages");
     if (!res.ok) throw new Error(await res.text());
     setMessages((await res.json()) as Message[]);
   }
   useEffect(() => {
-    if (!api) {
-      setReady(true);
-      return;
-    }
     api.consumeTokenFromUrl();
     void api.auth
       .getUser()
@@ -53,7 +55,7 @@ function App() {
   }, []);
   useEffect(() => {
-    if (!user || !api) return;
+    if (!user) return;
     let cancelled = false;
     const load = () =>
       refreshMessages().catch((err: unknown) => {
@@ -72,7 +74,6 @@ function App() {
   }, [messages]);
   useEffect(() => {
-    if (!apiUrl) return;
     void fetch(`${apiUrl}/messages`).then((res) => {
       setUnauthStatus(
         `${res.status} ${res.status === 401 ? "unauthorized (expected)" : res.statusText}`,
@@ -82,7 +83,6 @@ function App() {
   async function onEmailAuth(event: FormEvent) {
     event.preventDefault();
-    if (!api) return;
     setPending(true);
     setError(null);
     try {
@@ -100,7 +100,6 @@ function App() {
   }
   async function onGoogle() {
-    if (!api) return;
     setPending(true);
     setError(null);
     try {
@@ -122,7 +121,6 @@ function App() {
   }
   async function onSignOut() {
-    if (!api) return;
     await api.auth.signOut();
     setUser(null);
     setMessages([]);
@@ -130,7 +128,7 @@ function App() {
   async function onSend(event: FormEvent) {
     event.preventDefault();
-    if (!api || !draft.trim()) return;
+    if (!draft.trim()) return;
     setPending(true);
     setError(null);
     try {
@@ -156,15 +154,6 @@ function App() {
     );
   }
-  if (!api) {
-    return (
-      <main>
-        <h1>{{NAME}}</h1>
-        <p className="error">Missing VITE_API_URL. Run `robodev create` or `robodev link`.</p>
-      </main>
-    );
-  }
   if (!user) {
     return (
       <main className="narrow">

package/templates/space/README.md CHANGED Viewed

@@ -1,21 +1,17 @@
 # {{NAME}}
-Starter app from `robodev create`: a `space` database (`planets`, `rockets`), file-based APIs in `api/`, and a small React UI.
+Starter app from `robodev create`: a `space` database (`planets`, `rockets`), file-based APIs in `api/`, and a React UI.
-The backend is already on Starbase. Run the frontend:
+The project host is the app. After create or deploy, open the printed App URL — no `npm run dev` required. Local Vite is optional:
 ```bash
 npm run dev
 ```
-It reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`).
+Local Vite reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`). Hosted builds use the same origin as the APIs.
 Docs: https://robodev.povio.dev/docs
 `GET /me` (`api/me.ts`) requires a Robodev Auth Bearer token. Planet and rocket routes stay public. Optional browser helper: `@robodev-ai/client`. Auth how-to: https://robodev.povio.dev/docs/auth
-Add tables in `database.ts` and routes as `api/<name>.ts`, then:
-```bash
-npx robodev deploy
-```
+Edit files in the dashboard Code page, or here, then Save / `npx robodev deploy`.

package/templates/space/package.json CHANGED Viewed

@@ -11,8 +11,8 @@
   "dependencies": {
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "@robodev-ai/sdk": "^0.4.0",
-    "@robodev-ai/client": "^0.1.0"
+    "@robodev-ai/sdk": "^0.5.0",
+    "@robodev-ai/client": "^0.2.0"
   },
   "devDependencies": {
     "@types/react": "^18.3.24",
@@ -20,6 +20,6 @@
     "@vitejs/plugin-react": "^4.7.0",
     "typescript": "^5.9.2",
     "vite": "^6.3.5",
-    "robodev": "^0.5.0"
+    "robodev": "^0.6.0"
   }
 }

package/templates/space/src/main.tsx CHANGED Viewed

@@ -1,17 +1,20 @@
-/** Starter UI. Calls the deployed project host using `VITE_API_URL` from `.env`. */
+/** Starter UI. Hosted builds use the project origin; local Vite uses `VITE_API_URL`. */
 import { StrictMode, useEffect, useState, type FormEvent } from "react";
 import { createRoot } from "react-dom/client";
 type Planet = { id: string; name: string; climate: string; moons: number };
 type Rocket = { id: string; name: string; destinationId: string; launched: boolean };
-const apiUrl = import.meta.env.VITE_API_URL as string | undefined;
+function projectApiUrl(): string {
+  const fromEnv = import.meta.env.VITE_API_URL;
+  if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.replace(/\/+$/, "");
+  if (typeof window !== "undefined") return window.location.origin;
+  return "";
+}
 async function request<T>(path: string, init?: RequestInit): Promise<T> {
-  if (!apiUrl) {
-    throw new Error("Missing VITE_API_URL. Run `robodev create` or `robodev link`.");
-  }
-  const res = await fetch(`${apiUrl}${path}`, {
+  const base = projectApiUrl();
+  const res = await fetch(`${base}${path}`, {
     ...init,
     headers: { "Content-Type": "application/json", ...init?.headers },
   });
@@ -110,9 +113,7 @@ function App() {
   return (
     <main>
       <h1>{"{{NAME}}"}</h1>
-      <p className="lede">
-        React frontend talking to your Starbase APIs at {apiUrl ?? "(not linked)"}.
-      </p>
+      <p className="lede">React frontend talking to your Starbase APIs at {projectApiUrl()}.</p>
       {error ? <p className="error">{error}</p> : null}
       <div className="grid">