@agentuity/cli - npm Package Compare versions

Comparing version 0.0.20 to 0.0.21

dist/cmd/project/download.d.ts

@@ -8,2 +8,3 @@ import type { Logger } from '../../logger';
     templateBranch?: string;
+    logger: Logger;
 }
@@ -10,0 +11,0 @@ interface SetupOptions {

dist/cmd/project/download.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/cmd/project/download.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,UAAU,eAAe;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,YAAY;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf;AAsBD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAoE9E;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCvE"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/cmd/project/download.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,UAAU,eAAe;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,UAAU,YAAY;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf;AAsBD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAsH9E;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCvE"}

dist/cmd/project/template-flow.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"template-flow.d.ts","sourceRoot":"","sources":["../../../src/cmd/project/template-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAM3C,UAAU,iBAAiB;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0J7E"}
+{"version":3,"file":"template-flow.d.ts","sourceRoot":"","sources":["../../../src/cmd/project/template-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAM3C,UAAU,iBAAiB;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2J7E"}

package.json

 {
 	"name": "@agentuity/cli",
-	"version": "0.0.20",
+	"version": "0.0.21",
 	"type": "module",
@@ -5,0 +5,0 @@ "main": "./src/index.ts",

src/cmd/project/download.ts

@@ -29,2 +29,3 @@ import { join, resolve } from 'node:path';
 	templateBranch?: string;
+	logger: Logger;
 }
@@ -62,3 +63,3 @@
 export async function downloadTemplate(options: DownloadOptions): Promise<void> {
-	const { dest, template, templateDir, templateBranch } = options;
+	const { dest, template, templateDir, templateBranch, logger } = options;
 
@@ -85,4 +86,11 @@ mkdirSync(dest, { recursive: true });
 
+	logger.debug('[download] URL:', url);
+	logger.debug('[download] Branch:', branch);
+	logger.debug('[download] Template path:', templatePath);
+	logger.debug('[download] Temp dir:', tempDir);
+
 	try {
-		// Download tarball to temp file
+		// Step 1: Download tarball to temp file
+		// We download to a file first rather than piping directly to tar-fs
+		// because this avoids Bun/Node stream compatibility issues
 		await downloadWithSpinner(
@@ -96,3 +104,3 @@ {
 			async (stream) => {
-				// Write stream to file
+				// Collect all chunks from the download stream
 				const chunks: Buffer[] = [];
@@ -102,7 +110,13 @@ for await (const chunk of stream) {
 				}
-				await Bun.write(tarballPath, Buffer.concat(chunks));
+				const buffer = Buffer.concat(chunks);
+				await Bun.write(tarballPath, buffer);
+
+				logger.debug('[download] Downloaded bytes:', buffer.length);
+				logger.debug('[download] Tarball path:', tarballPath);
 			}
 		);
 
-		// Extract tarball
+		// Step 2: Extract tarball
+		// We extract only the files within the template directory
+		// The tarball structure is: sdk-{branch}/templates/{template.directory}/...
 		const extractDir = join(tempDir, 'extract');
@@ -112,10 +126,40 @@ mkdirSync(extractDir, { recursive: true });
 		const prefix = `sdk-${branch}/${templatePath}/`;
+		logger.debug('[extract] Extract dir:', extractDir);
+		logger.debug('[extract] Filter prefix:', prefix);
+
+		// Track extraction stats for debugging
+		let ignoredCount = 0;
+		let extractedCount = 0;
+
 		const extractor = extract(extractDir, {
+			// ignore callback: called BEFORE map, receives original tar entry name in header.name
+			// Return true to skip the entry, false to extract it
 			ignore: (_name: string, header?: Headers) => {
-				if (!header) return true;
-				return !header.name.startsWith(prefix) || header.name.length === prefix.length;
+				if (!header) {
+					ignoredCount++;
+					return true;
+				}
+
+				// Skip entries that don't start with our prefix
+				// Also skip the exact prefix directory itself (empty name after substring)
+				const shouldIgnore =
+					!header.name.startsWith(prefix) || header.name.length === prefix.length;
+
+				if (shouldIgnore) {
+					logger.debug('[extract] IGNORE:', header.name);
+					ignoredCount++;
+				} else {
+					logger.debug('[extract] EXTRACT:', header.name);
+					extractedCount++;
+				}
+
+				return shouldIgnore;
 			},
+			// map callback: called AFTER ignore, allows modifying the entry before extraction
+			// We strip the prefix so files are extracted to the root of extractDir
 			map: (header: Headers) => {
 				if (header.name.startsWith(prefix)) {
+					const originalName = header.name;
 					header.name = header.name.substring(prefix.length);
+					logger.debug('[extract] MAP:', originalName, '->', header.name);
 				}
@@ -126,8 +170,15 @@ return header;
 
+		// Pipe: tarball file -> gunzip -> tar extractor
 		createReadStream(tarballPath).pipe(createGunzip()).pipe(extractor);
 		await finished(extractor);
 
+		logger.debug('[extract] Extraction complete');
+		logger.debug('[extract] Ignored entries:', ignoredCount);
+		logger.debug('[extract] Extracted entries:', extractedCount);
+
+		// Step 3: Copy extracted files to destination
 		await cleanup(extractDir, dest);
 	} finally {
 		// Clean up temp directory
+		logger.debug('[cleanup] Removing temp dir:', tempDir);
 		rmSync(tempDir, { recursive: true, force: true });
@@ -134,0 +185,0 @@ }

src/cmd/project/template-flow.ts

@@ -154,2 +154,3 @@ import { basename, resolve } from 'node:path';
 		templateBranch,
+		logger,
 	});
@@ -156,0 +157,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 16 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 16 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

247210

0.85%

Lines of code

5886

0.77%

No dependency changes