Skip to content

Fix critical audit issues and improve install PATH setup#36

Merged
paulius-krutkis-dcd merged 3 commits into
post-install-launchfrom
cli-critical-audit-fixes
Jun 17, 2026
Merged

Fix critical audit issues and improve install PATH setup#36
paulius-krutkis-dcd merged 3 commits into
post-install-launchfrom
cli-critical-audit-fixes

Conversation

@paulius-krutkis-dcd

@paulius-krutkis-dcd paulius-krutkis-dcd commented Jun 16, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Resolve remaining critical CLI audit items: JSON parsing for object/array flags, real PNG output for --headless png, network error exit codes (7), and EOF-safe setup when stdin is empty.
  • Skip parse/markdown defaults for headless PNG requests so the API returns screenshot bytes instead of markdown.
  • Improve install scripts (v0.1.7): auto-configure PATH, clearer next steps, and optional post-install setup prompt on Unix and Windows.

Test plan

  • pnpm test — all tests pass (includes README command validation and new audit regressions)
  • decodo setup < /dev/null → exit 2; valid token on stdin still works
  • decodo universal --headers not-json → exit 2; valid JSON is parsed into the request body
  • decodo universal --headless png <url> --token … → writes a valid PNG file, not base64 or markdown

- Object/array schema params now register as --flag <json> with a
  JSON-parsing argParser; invalid JSON is a usage error
- Derive binary PNG output context from the built body so generated
  commands (universal --headless png) write a PNG, not base64 text
- Map syscall-coded network failures (ENOTFOUND, ECONNREFUSED, ...) in
  the cause chain to exit 7 and render the cause
- setup now rejects as a usage error on EOF/closed stdin instead of
  exiting 0 having saved nothing; handle TTY EOF and Ctrl+D
- Add offline README docs regression test validating documented
  commands and flags against the command tree built from BundledSchema
@paulius-krutkis-dcd paulius-krutkis-dcd changed the base branch from main to post-install-launch June 16, 2026 12:59
Manual end-to-end testing surfaced that generated commands routed PNG
output correctly but applyRequestDefaults still injected markdown:true,
so the API returned markdown instead of a screenshot and PNG extraction
failed. Skip the defaults when headless is png so universal --headless
png writes a real PNG, matching the curated screenshot command.
@paulius-krutkis-dcd paulius-krutkis-dcd changed the title Fix remaining critical CLI audit items Fix critical audit issues and improve install PATH setup Jun 16, 2026
- Moved CliUsageError definition to a new file for better organization.
- Updated imports across multiple files to reference the new location of CliUsageError.
- Added tests for CliUsageError to ensure proper functionality and error message handling.
@paulius-krutkis-dcd paulius-krutkis-dcd merged commit d06c22f into post-install-launch Jun 17, 2026
1 check passed
paulius-krutkis-dcd added a commit that referenced this pull request Jun 17, 2026
* Update version to 0.1.7 in package.json, enhance installation scripts for better PATH management, and improve README instructions for setup. The install scripts now auto-configure the user's PATH and provide clearer next steps after installation.

* Refactor install.sh to enhance output formatting for next steps. Updated printf statements to use consistent syntax for better readability and maintainability.

* Fix output formatting in install.ps1 for next steps command. Updated string interpolation for improved clarity in user instructions.

* Fix critical audit issues and improve install PATH setup (#36)

* Fix remaining critical CLI audit items

- Object/array schema params now register as --flag <json> with a
  JSON-parsing argParser; invalid JSON is a usage error
- Derive binary PNG output context from the built body so generated
  commands (universal --headless png) write a PNG, not base64 text
- Map syscall-coded network failures (ENOTFOUND, ECONNREFUSED, ...) in
  the cause chain to exit 7 and render the cause
- setup now rejects as a usage error on EOF/closed stdin instead of
  exiting 0 having saved nothing; handle TTY EOF and Ctrl+D
- Add offline README docs regression test validating documented
  commands and flags against the command tree built from BundledSchema

* Skip parse/markdown defaults for headless png screenshots

Manual end-to-end testing surfaced that generated commands routed PNG
output correctly but applyRequestDefaults still injected markdown:true,
so the API returned markdown instead of a screenshot and PNG extraction
failed. Skip the defaults when headless is png so universal --headless
png writes a real PNG, matching the curated screenshot command.

* Refactor CLI error handling by introducing CliUsageError class

- Moved CliUsageError definition to a new file for better organization.
- Updated imports across multiple files to reference the new location of CliUsageError.
- Added tests for CliUsageError to ensure proper functionality and error message handling.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants