tsoft-cli 3.14.1 → 3.14.4

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to T-Soft CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.14.4] - 2026-10-26
+
+### Fixed
+- `theme push` now tells you when your theme is too big to publish, instead of "Server error occurred." A theme over the store's upload limit was refused with a size error, but the CLI only looked for codes it already knew and reported it as a generic server failure, so there was no way to tell that the fix was on your side or what to remove. When the store reports the package size, the message now gives it next to the limit ("Theme package is too large: 11.4 MB (limit 8 MB).") and lists the largest files in the package, followed by a hint to compress or remove large images. A store that only answers with a bare size refusal gets "Theme package exceeds the server limit." and the same hint. With `--json` the sizes and the file list are returned under `error.details`. Other push errors read exactly as before.
+
+## [3.14.3] - 2026-10-15
+
+### Security
+- Theme archives are now opened with `adm-zip` 0.6.1, which closes a set of published advisories in the 0.5 line. A `^0.5.16` range can never reach 0.6, so even a fresh install picked up 0.5.18, and a crafted archive could make it allocate memory without limit or write an empty file over one already in your theme: an entry that declared its uncompressed size as zero was inflated in full, and an archive that named the same file twice was accepted. Both are now refused before anything in your theme directory is touched, the same way a broken download already was. Normal theme downloads behave exactly as before.
+- `axios` now requires 1.20.0 or later. The previous `^1.14.0` range still admitted 1.14–1.19, which carry advisories around proxy handling, header injection and redirects; an older install could keep one of those. Raising the floor rules them out.
+
+## [3.14.2] - 2026-10-15
+
+### Fixed
+- `tsoft login` now says plainly when the port it needs for sign-in is taken, and no longer sends you to the browser first. The browser opened and waited for you to sign in before the CLI noticed it could not receive the answer, and what came back was `listen EADDRINUSE: address already in use :::8046` followed by a pointer to log files the CLI does not write — so you signed in for nothing and were left with a line that said nothing about what to do. The local connection is now opened before the browser, and when the port is in use the message names it, suggests stopping a `tsoft login` left running in another terminal, and gives the command to see which application holds the port (`lsof` on macOS and Linux, `netstat` on Windows). Other reasons the connection cannot be opened get their own message, the raw error is still available under `--verbose`, and the misleading log-file line is gone from every login error.
+
 ## [3.14.1] - 2026-09-22
 
 ### Fixed

package/locales/en.json

@@ -22,6 +22,10 @@
   "error.push.backend_reject.hint": "For details: tsoft theme push --verbose",
   "error.push.unexpected.message": "An unexpected error occurred.",
   "error.push.unexpected.hint": "For details: tsoft theme push --verbose",
+  "error.push.payload_too_large.message": "Theme package is too large: {{size}} MB (limit {{limit}} MB).",
+  "error.push.payload_too_large.message_unknown_size": "Theme package exceeds the server limit.",
+  "error.push.payload_too_large.hint": "Compress large images or remove them from the theme.",
+  "error.push.payload_too_large.largest_files_title": "Largest files:",
   "error.http.401.message": "Authorization error.",
   "error.http.401.hint": "Login again: tsoft login --org",
   "error.http.403.message": "You do not have permission for this operation.",
@@ -54,7 +58,11 @@
   "login.tip": "💡 Tip: Use \"tsoft whoami\" to check your status.",
   "login.json_error.message": "Login command requires interactive mode.",
   "login.json_error.hint": "For CI/CD, authenticate with tsoft login first to store the token, then use it.",
-  "login.error_log": "Check log files for details.",
+  "login.port_in_use.message": "Port {{port}}, which sign-in needs, is already in use by another application.",
+  "login.port_in_use.close_hint": "If \"tsoft login\" is still running in another terminal, stop it there with Ctrl+C and try again.",
+  "login.port_in_use.find_hint": "To see which application is using the port, run: {{command}}",
+  "login.server_start_failed.message": "Sign-in could not start: the local connection it needs could not be opened on this computer.",
+  "login.server_start_failed.hint": "For details: tsoft login --verbose",
   "login.security_error": "State parameter mismatch! This may indicate a security issue.",
   "logout.starting": "🚪 Logging out...",
   "logout.not_logged_in": "▲ You are not logged in.",

package/locales/tr.json

@@ -22,6 +22,10 @@
   "error.push.backend_reject.hint": "Detaylar için: tsoft theme push --verbose",
   "error.push.unexpected.message": "Beklenmeyen bir hata oluştu.",
   "error.push.unexpected.hint": "Detaylar için: tsoft theme push --verbose",
+  "error.push.payload_too_large.message": "Tema paketi çok büyük: {{size}} MB (sınır {{limit}} MB).",
+  "error.push.payload_too_large.message_unknown_size": "Tema paketi sunucu sınırını aşıyor.",
+  "error.push.payload_too_large.hint": "Büyük görselleri sıkıştırın ya da temadan çıkarın.",
+  "error.push.payload_too_large.largest_files_title": "En büyük dosyalar:",
   "error.http.401.message": "Yetkilendirme hatası.",
   "error.http.401.hint": "Tekrar giriş yapın: tsoft login --org",
   "error.http.403.message": "Bu işlem için yetkiniz yok.",
@@ -54,7 +58,11 @@
   "login.tip": "💡 İpucu: Durum kontrolü için \"tsoft whoami\" komutunu kullanın.",
   "login.json_error.message": "Login komutu interaktif mod gerektiriyor.",
   "login.json_error.hint": "CI/CD için önceden tsoft login ile kimlik doğrulayıp token'i sakladıktan sonra kullanın.",
-  "login.error_log": "Detaylar için log dosyalarını kontrol edin.",
+  "login.port_in_use.message": "Giriş için gereken {{port}} numaralı port şu anda başka bir uygulama tarafından kullanılıyor.",
+  "login.port_in_use.close_hint": "Başka bir terminalde açık kalmış bir \"tsoft login\" varsa o pencerede Ctrl+C ile durdurup tekrar deneyin.",
+  "login.port_in_use.find_hint": "Portu hangi uygulamanın kullandığını görmek için şunu çalıştırın: {{command}}",
+  "login.server_start_failed.message": "Giriş başlatılamadı: giriş için gereken yerel bağlantı bu bilgisayarda açılamadı.",
+  "login.server_start_failed.hint": "Detaylar için: tsoft login --verbose",
   "login.security_error": "State parametresi eşleşmiyor! Güvenlik hatası olabilir.",
   "logout.starting": "🚪 Çıkış yapılıyor...",
   "logout.not_logged_in": "▲ Zaten giriş yapmamışsınız.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tsoft-cli",
-  "version": "3.14.1",
+  "version": "3.14.4",
   "description": "Command-line tool for tsoft360 theme development and management",
   "type": "module",
   "main": "src/index.js",
@@ -44,8 +44,8 @@
   ],
   "dependencies": {
     "@inquirer/prompts": "^8.0.2",
-    "adm-zip": "^0.5.16",
-    "axios": "^1.14.0",
+    "adm-zip": "^0.6.1",
+    "axios": "^1.20.0",
     "boxen": "^8.0.1",
     "chalk": "^5.3.0",
     "chokidar": "^5.0.0",

package/src/commands/login.js

@@ -4,7 +4,7 @@ import {generateCodeVerifier, generateCodeChallenge} from '../pkce.js';
 import {startCallbackServer} from '../server.js';
 import {exchangeToken, saveTokens, setActiveStore} from '../storage.js';
 import * as config from '../config.js';
-import { isJsonMode, jsonOut } from '../output-mode.js';
+import { isJsonMode, jsonOut, verboseLog } from '../output-mode.js';
 import { t } from '../i18n.js';
 
 /**
@@ -43,7 +43,8 @@ export async function loginCommand() {
         authUrl.searchParams.set('prompt', 'select_org_store');
 
         // 3. Callback server'ı başlat
-        const serverPromise = startCallbackServer(config.CALLBACK_PORT);
+        const callbackServer = await startCallbackServer(config.CALLBACK_PORT)
+            .catch((error) => exitOnListenFailure(error, config.CALLBACK_PORT));
 
         // 4. Browser'ı aç
         console.log(chalk.cyan(t('login.browser_opening')));
@@ -56,7 +57,7 @@ export async function loginCommand() {
         console.log(chalk.gray('   ' + t('login.waiting_detail') + '\n'));
 
         // 5. Callback'i bekle
-        const {code, state: returnedState, store} = await serverPromise;
+        const {code, state: returnedState, store} = await callbackServer.result;
 
         // 6. State doğrula (CSRF koruması)
         if (state !== returnedState) {
@@ -89,7 +90,25 @@ export async function loginCommand() {
 
     } catch (error) {
         console.error(chalk.red('\n❌ Hata: ') + error.message);
-        console.error(chalk.gray('\n' + t('login.error_log')));
         process.exit(1);
     }
 }
+
+function exitOnListenFailure(error, port) {
+    verboseLog(error.message);
+
+    if (error.code === 'EADDRINUSE') {
+        console.error(chalk.red('\n❌ ' + t('login.port_in_use.message', { port })));
+        console.error(chalk.gray('   ' + t('login.port_in_use.close_hint')));
+        console.error(chalk.gray('   ' + t('login.port_in_use.find_hint', { command: findPortOwnerCommand(port) })));
+    } else {
+        console.error(chalk.red('\n❌ ' + t('login.server_start_failed.message')));
+        console.error(chalk.gray('   ' + t('login.server_start_failed.hint')));
+    }
+
+    process.exit(1);
+}
+
+function findPortOwnerCommand(port) {
+    return process.platform === 'win32' ? `netstat -ano | findstr :${port}` : `lsof -i :${port}`;
+}

package/src/commands/theme-push.js

@@ -2,7 +2,7 @@ import chalk from 'chalk';
 import ora from 'ora';
 import { createApiClient } from '../api-client.js';
 import { describeActiveTheme, getActiveStore } from '../storage.js';
-import { mapPushError } from '../errors/error-mapper.js';
+import { formatMegabytes, mapPushError } from '../errors/error-mapper.js';
 import { isJsonMode, jsonOut } from '../output-mode.js';
 import { t } from '../i18n.js';
 
@@ -15,6 +15,8 @@ const CHANGE_CATEGORIES = {
     'Meta': ['meta_object_added', 'meta_object_removed', 'meta_field_added', 'meta_field_removed'],
 };
 
+const LARGEST_FILES_SHOWN = 5;
+
 const PARTNERS_BASE = 'https://partners.tsoft360.com';
 const PARTNERS_THEMES_INDEX = `${PARTNERS_BASE}/themes`;
 
@@ -77,6 +79,16 @@ function displayDiffSummary(data, previousVersion) {
     console.log(chalk.gray('  ' + t(hintKey)));
 }
 
+function displayLargestFiles(details) {
+    const files = details?.largest_files ?? [];
+    if (files.length === 0) return;
+
+    console.log(chalk.gray(`  ${t('error.push.payload_too_large.largest_files_title')}`));
+    for (const file of files.slice(0, LARGEST_FILES_SHOWN)) {
+        console.log(chalk.gray(`  - ${file.path}  ${formatMegabytes(file.bytes)} MB`));
+    }
+}
+
 /**
  * Tema push komutu
  * @param {string|null} themeName - Tema adi/UUID (opsiyonel)
@@ -187,6 +199,7 @@ export async function themePushCommand(themeName, options = {}) {
                 error: {
                     message: mapped.message,
                     hint: mapped.hint || null,
+                    ...(mapped.details ? { details: mapped.details } : {}),
                 }
             });
             process.exit(1);
@@ -196,6 +209,7 @@ export async function themePushCommand(themeName, options = {}) {
         if (error.response) {
             const mapped = mapPushError(error, verbose);
             console.error(chalk.red(`X ${mapped.message}`));
+            displayLargestFiles(mapped.details);
             if (mapped.hint) {
                 console.log(chalk.yellow(`  ${mapped.hint}`));
             }

package/src/errors/error-mapper.js

@@ -1,7 +1,7 @@
 /**
  * Push error code -> locale key mapper
  */
-import { t } from '../i18n.js';
+import { t, getLocale } from '../i18n.js';
 import { isReloginRequired } from '../storage.js';
 
 const ERROR_MAP = {
@@ -25,8 +25,73 @@ const ERROR_MAP = {
         message: 'error.push.unexpected.message',
         hint: 'error.push.unexpected.hint',
     },
+    'PUSH-PAYLOAD-TOO-LARGE': {
+        message: 'error.push.payload_too_large.message',
+        messageUnknownSize: 'error.push.payload_too_large.message_unknown_size',
+        hint: 'error.push.payload_too_large.hint',
+    },
 };
 
+const PAYLOAD_TOO_LARGE_STATUS = 413;
+const BYTES_PER_MEGABYTE = 1048576;
+
+const SMALLEST_ROUNDED_MEGABYTES = 0.1;
+
+export function formatMegabytes(bytes) {
+    const megabytes = bytes / BYTES_PER_MEGABYTE;
+    const precision = megabytes < SMALLEST_ROUNDED_MEGABYTES
+        ? { maximumSignificantDigits: 1 }
+        : { maximumFractionDigits: 1 };
+
+    return new Intl.NumberFormat(getLocale(), precision).format(megabytes);
+}
+
+function toPositiveNumber(value) {
+    if (typeof value !== 'number' && typeof value !== 'string') return null;
+    if (typeof value === 'string' && value.trim() === '') return null;
+    const number = Number(value);
+    return Number.isFinite(number) && number > 0 ? number : null;
+}
+
+function isPayloadTooLarge(responseData, errorCode, statusCode) {
+    if (errorCode === 'PUSH-PAYLOAD-TOO-LARGE') return true;
+    if (!errorCode) return statusCode === PAYLOAD_TOO_LARGE_STATUS;
+    if (errorCode !== 'PUSH-BACKEND-ERROR') return false;
+
+    return statusCode === PAYLOAD_TOO_LARGE_STATUS
+        || Number(responseData?.details?.status) === PAYLOAD_TOO_LARGE_STATUS;
+}
+
+function normalizeLargestFiles(files) {
+    if (!Array.isArray(files)) return [];
+    return files
+        .filter((file) => typeof file?.path === 'string' && toPositiveNumber(file?.bytes) !== null)
+        .map((file) => ({ path: file.path, bytes: toPositiveNumber(file.bytes) }));
+}
+
+function mapPayloadTooLarge(responseData, verbose) {
+    const mapped = ERROR_MAP['PUSH-PAYLOAD-TOO-LARGE'];
+    const details = responseData?.details;
+    const sizeBytes = toPositiveNumber(details?.size_bytes);
+    const limitBytes = toPositiveNumber(details?.limit_bytes);
+    const raw = verbose ? responseData : null;
+
+    if (sizeBytes === null || limitBytes === null) {
+        return { message: t(mapped.messageUnknownSize), hint: t(mapped.hint), raw };
+    }
+
+    return {
+        message: t(mapped.message, { size: formatMegabytes(sizeBytes), limit: formatMegabytes(limitBytes) }),
+        hint: t(mapped.hint),
+        raw,
+        details: {
+            size_bytes: sizeBytes,
+            limit_bytes: limitBytes,
+            largest_files: normalizeLargestFiles(details.largest_files),
+        },
+    };
+}
+
 const HTTP_STATUS_MAP = {
     401: {
         message: 'error.http.401.message',
@@ -61,6 +126,10 @@ export function mapPushError(error, verbose = false) {
     const errorCode = responseData?.error_code;
     const statusCode = error.response?.status;
 
+    if (isPayloadTooLarge(responseData, errorCode, statusCode)) {
+        return mapPayloadTooLarge(responseData, verbose);
+    }
+
     // 1. error_code oncelikli
     if (errorCode && ERROR_MAP[errorCode]) {
         const mapped = ERROR_MAP[errorCode];

package/src/i18n.js

@@ -59,6 +59,10 @@ export function initLocale() {
     }
 }
 
+export function getLocale() {
+    return currentLocale;
+}
+
 /**
  * Translate a key. Returns the key itself as fallback if not found.
  * Supports {{var}} placeholder interpolation.

package/src/server.js

@@ -7,7 +7,15 @@ import { URL } from 'url';
  * @returns {Promise<{code: string, state: string, store: string}>}
  */
 export function startCallbackServer(port) {
-  return new Promise((resolve, reject) => {
+  let resolve;
+  let reject;
+  const result = new Promise((resolveResult, rejectResult) => {
+    resolve = resolveResult;
+    reject = rejectResult;
+  });
+
+  return new Promise((resolveListening, rejectListening) => {
+    let listening = false;
     const server = http.createServer((req, res) => {
       const url = new URL(req.url, `http://localhost:${port}`);
 
@@ -45,15 +53,29 @@ export function startCallbackServer(port) {
     });
 
     server.on('error', (err) => {
-      reject(new Error(`Server başlatılamadı: ${err.message}`));
+      if (listening) {
+        reject(err);
+        return;
+      }
+      server.close();
+      rejectListening(listenFailure(err, port));
     });
 
     server.listen(port, () => {
+      listening = true;
       console.log(`✓ Callback sunucusu başlatıldı (http://localhost:${port}/callback)`);
+      resolveListening({ result });
     });
   });
 }
 
+function listenFailure(err, port) {
+  const failure = new Error(err.message, { cause: err });
+  failure.code = err.code;
+  failure.port = port;
+  return failure;
+}
+
 function successHtml() {
   return `
 <!DOCTYPE html>