specshield 3.4.7 → 3.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specshield",
-  "version": "3.4.7",
+  "version": "3.4.9",
   "description": "Contract compatibility testing for APIs — catch breaking OpenAPI changes before they reach your consumers, with can-i-deploy deploy gating and GitHub PR checks. (a.k.a. bidirectional contract testing.)",
   "main": "src/cli.js",
   "homepage": "https://specshield.io",

package/src/commands/bdct.js

@@ -6,6 +6,7 @@ const ora = require('ora');
 const path = require('path');
 const fsExtra = require('fs-extra');
 const logger = require('../utils/logger');
+const exitAfterFlush = require('../utils/exitAfterFlush');
 const { getStoredApiKey } = require('../config/localConfig');
 const { applyBdctDefaults } = require('../core/projectConfig');
 const {
@@ -300,7 +301,8 @@ const verifyCommand = new Command('verify')
 
       if (opts.json) {
         process.stdout.write(JSON.stringify(result, null, 2) + '\n');
-        process.exit(success ? 0 : 1);
+        exitAfterFlush(success ? 0 : 1);
+        return;
       }
 
       process.stdout.write('\n');
@@ -352,7 +354,7 @@ const verifyCommand = new Command('verify')
       }
 
       process.stdout.write('\n');
-      process.exit(success ? 0 : 1);
+      exitAfterFlush(success ? 0 : 1);
     } catch (err) {
       if (spinner) spinner.fail('Verification failed');
       logger.error(err.message);
@@ -399,7 +401,8 @@ const canIDeployCommand = new Command('can-i-deploy')
 
       if (opts.json) {
         process.stdout.write(JSON.stringify(result, null, 2) + '\n');
-        process.exit(deployable ? 0 : 1);
+        exitAfterFlush(deployable ? 0 : 1);
+        return;
       }
 
       // Idempotent `v` prefix on display — don't double it when the stored
@@ -433,10 +436,10 @@ const canIDeployCommand = new Command('can-i-deploy')
         process.stdout.write(chalk.gray(`  ➜  Run: specshield bdct verify --consumer <NAME> --provider ${opts.service}\n`));
         process.stdout.write(chalk.gray(`  ➜  to identify and resolve incompatibilities\n`));
         process.stdout.write('\n');
-        process.exit(1);
+        exitAfterFlush(1);
       } else {
         process.stdout.write('\n');
-        process.exit(0);
+        exitAfterFlush(0);
       }
     } catch (err) {
       if (spinner) spinner.fail('Check failed');
@@ -817,7 +820,8 @@ const verifyProviderCommand = new Command('verify-provider')
 
     if (opts.json) {
       process.stdout.write(JSON.stringify(report, null, 2) + '\n');
-      process.exit(report.summary.fail + report.summary.error > 0 ? 1 : 0);
+      exitAfterFlush(report.summary.fail + report.summary.error > 0 ? 1 : 0);
+      return;
     }
 
     // Human report.
@@ -850,7 +854,7 @@ const verifyProviderCommand = new Command('verify-provider')
     const s = report.summary;
     process.stdout.write('  ' + '─'.repeat(60) + '\n');
     process.stdout.write(`  ${s.pass} pass · ${s.fail} fail · ${s.error} error · ${s.skipped} skip   (${s.total} probes)\n\n`);
-    process.exit(s.fail + s.error > 0 ? 1 : 0);
+    exitAfterFlush(s.fail + s.error > 0 ? 1 : 0);
   });
 
 // Repeatable --header parser: collects into a map.

package/src/commands/compare.js

@@ -12,8 +12,10 @@ const { classifyChanges, filterBySeverity } = require('../core/classifyChanges')
 const { formatHuman, formatJson } = require('../core/outputFormatter');
 const { loadConfig } = require('../core/configLoader');
 const { resolveExitCode } = require('../core/exitCode');
+const { resolveRemoteUrl } = require('../core/remoteUrl');
 const { recordCompareAndMaybeRender } = require('../core/conversionPrompt');
 const logger = require('../utils/logger');
+const exitAfterFlush = require('../utils/exitAfterFlush');
 const fsExtra = require('fs-extra');
 const { getStoredApiKey } = require('../config/localConfig');
 
@@ -129,7 +131,7 @@ compare
 
       // Exit code
       const code = resolveExitCode(result, options);
-      process.exit(code);
+      exitAfterFlush(code);
 
     } catch (err) {
       logger.error(`Error: ${err.message}`);
@@ -167,7 +169,7 @@ async function runRemoteComparison(base, target, options, spinner) {
   const baseRaw = await loadSpec(base);
   const targetRaw = await loadSpec(target);
 
-  const url = options.remoteUrl || HOSTED_API_URL + '/compare';
+  const url = resolveRemoteUrl(options.remoteUrl, HOSTED_API_URL);
   const timeout = parseInt(options.timeout, 10) || 10000;
 
   if (spinner) spinner.text = `Sending to hosted API...`;
@@ -185,7 +187,7 @@ async function runRemoteComparison(base, target, options, spinner) {
       { baseSpec: baseRaw, targetSpec: targetRaw },
       { timeout, headers }
     );
-    return response.data;
+    return normalizeRemoteResult(response.data, url);
   } catch (err) {
     const msg = err.response
       ? `Remote API error ${err.response.status}: ${JSON.stringify(err.response.data)}`
@@ -194,6 +196,30 @@ async function runRemoteComparison(base, target, options, spinner) {
   }
 }
 
+/**
+ * A remote response is untrusted input. Without this, a proxy error page or a
+ * redirect to the marketing site arrives as a 200 with an HTML body, and the
+ * first `.filter` downstream throws an unreadable TypeError at the user.
+ */
+function normalizeRemoteResult(data, url) {
+  if (!data || typeof data !== 'object' || !Array.isArray(data.breakingChanges)) {
+    const gotHtml = typeof data === 'string' && /<html|<!doctype/i.test(data);
+    throw new Error(
+      `Unexpected response from ${url}` +
+      (gotHtml
+        ? ' — that URL returned a web page, not the compare API. Pass the server base URL, e.g. --remote-url https://specshield.io'
+        : ' — the response was not a comparison result.')
+    );
+  }
+  // Downstream steps assume all four arrays exist.
+  return {
+    ...data,
+    additions: data.additions || [],
+    modifications: data.modifications || [],
+    warnings: data.warnings || [],
+  };
+}
+
 function applyIgnoreList(result, ignoreList) {
   if (!ignoreList || ignoreList.length === 0) return result;
 

package/src/commands/govern.js

@@ -5,6 +5,7 @@ const chalk = require('chalk');
 const ora = require('ora');
 const fsExtra = require('fs-extra');
 const logger = require('../utils/logger');
+const exitAfterFlush = require('../utils/exitAfterFlush');
 const { loadSpec } = require('../core/loadSpec');
 const { getStoredApiKey } = require('../config/localConfig');
 const { governanceGate } = require('../api/bdctClient');
@@ -80,8 +81,8 @@ const govern = new Command('govern')
         if (opts.output) await fsExtra.outputFile(opts.output, JSON.stringify(resp, null, 2));
       }
 
-      if (opts.advisory) process.exit(0);
-      process.exit(resp.passed ? 0 : 1);
+      if (opts.advisory) exitAfterFlush(0);
+      else exitAfterFlush(resp.passed ? 0 : 1);
     } catch (err) {
       if (err.status === 402) {
         logger.error('API governance requires a paid plan (Team or above). See https://specshield.io/pricing');

package/src/core/remoteUrl.js

@@ -0,0 +1,20 @@
+'use strict';
+
+/**
+ * Resolve the hosted compare endpoint from a base URL.
+ *
+ * `--remote-url` is documented as "Override the hosted API base URL", but the
+ * value used to be passed to axios verbatim — so `--remote-url https://host`
+ * POSTed to the site root instead of /compare. The root answers with a web page
+ * or a 405, and the CLI then died on `Cannot read properties of undefined
+ * (reading 'filter')` while trying to read breakingChanges off HTML.
+ *
+ * A URL that already ends in /compare is returned unchanged, so anyone who
+ * worked around the old behaviour by passing the full endpoint keeps working.
+ */
+function resolveRemoteUrl(remoteUrl, hostedDefault) {
+  const base = String(remoteUrl || hostedDefault).trim().replace(/\/+$/, '');
+  return /\/compare$/i.test(base) ? base : base + '/compare';
+}
+
+module.exports = { resolveRemoteUrl };

package/src/utils/exitAfterFlush.js

@@ -0,0 +1,15 @@
+'use strict';
+
+// process.exit() discards whatever is still buffered in stdout. Writes to a
+// pipe are asynchronous, so `specshield <cmd> --json | jq` truncated large
+// output mid-JSON and still exited 0. Queue an empty chunk and exit from its
+// callback: stream callbacks run in order, so ours fires once every earlier
+// chunk has reached the OS.
+//
+// Use this instead of process.exit() anywhere the command has already written
+// to stdout. See tests/compareStdoutFlush.test.js.
+function exitAfterFlush(code) {
+  process.stdout.write('', () => process.exit(code));
+}
+
+module.exports = exitAfterFlush;