@agentuity/cli - npm Package Compare versions

Comparing version 0.0.15 to 0.0.16

dist/cmd/project/download.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/cmd/project/download.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,UAAU,eAAe;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,YAAY;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf;AAsBD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD9E;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCvE"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/cmd/project/download.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,UAAU,eAAe;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,YAAY;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf;AAsBD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD9E;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCvE"}

package.json

 {
 	"name": "@agentuity/cli",
-	"version": "0.0.15",
+	"version": "0.0.16",
 	"type": "module",
@@ -5,0 +5,0 @@ "main": "./src/index.ts",

src/cmd/project/download.ts

 import { join, resolve } from 'node:path';
-import { existsSync, mkdirSync, renameSync, readdirSync, cpSync, rmSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { existsSync, mkdirSync, mkdtempSync, renameSync, readdirSync, cpSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
 import { pipeline } from 'node:stream/promises';
@@ -71,37 +71,34 @@ import { createGunzip } from 'node:zlib';
 	const url = `https://codeload.github.com/${GITHUB_REPO}/tar.gz/${branch}`;
-	const tempDir = join(dest, '.temp-download');
-	mkdirSync(tempDir, { recursive: true });
+	const tempDir = mkdtempSync(join(tmpdir(), 'agentuity-'));
 
-	await downloadWithSpinner(
-		{
-			url,
-			message: templateBranch
-				? `Downloading template files from branch ${branch}...`
-				: 'Downloading template files...',
-		},
-		async (stream) => {
-			// Extract only the template directory from tarball
-			const prefix = `sdk-${branch}/${templatePath}/`;
-			await pipeline(
-				stream,
-				createGunzip(),
-				extract(tempDir, {
-					filter: (name: string) => name.startsWith(prefix),
-					map: (header: Headers) => {
-						header.name = header.name.substring(prefix.length);
-						return header;
-					},
-				})
-			);
-		}
-	);
+	try {
+		await downloadWithSpinner(
+			{
+				url,
+				message: templateBranch
+					? `Downloading template files from branch ${branch}...`
+					: 'Downloading template files...',
+			},
+			async (stream) => {
+				// Extract only the template directory from tarball
+				const prefix = `sdk-${branch}/${templatePath}/`;
+				await pipeline(
+					stream,
+					createGunzip(),
+					extract(tempDir, {
+						filter: (name: string) => name.startsWith(prefix),
+						map: (header: Headers) => {
+							header.name = header.name.substring(prefix.length);
+							return header;
+						},
+					})
+				);
+			}
+		);
 
-	await cleanup(tempDir, dest);
-
-	// Extra safety: refuse to delete root or home directories
-	const home = homedir();
-	if (tempDir === '/' || tempDir === home) {
-		throw new Error(`Refusing to delete protected path: ${tempDir}`);
+		await cleanup(tempDir, dest);
+	} finally {
+		// Clean up temp directory
+		rmSync(tempDir, { recursive: true, force: true });
 	}
-	rmSync(tempDir, { recursive: true, force: true });
 }
@@ -108,0 +105,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 16 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 16 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

244653

-0.05%

Lines of code

5819

-0.03%

No dependency changes