Escape init config project names by ayskobtw-lil · Pull Request #494 · profullstack/sh1pt

ayskobtw-lil · 2026-05-31T20:05:09Z

Summary

Serialize sh1pt init project names as valid TypeScript string literals
Add focused coverage for apostrophes and escaped newline characters in generated config

Closes #493.

Verification

npx --yes pnpm@9.12.0 exec vitest run packages/cli/src/commands/init-template.test.ts
npx --yes pnpm@9.12.0 --filter @profullstack/sh1pt typecheck

Bounty trail

This is a focused bug fix for the ugig bounty asking for sh1pt bugs plus PRs: https://ugig.net/bounties/c3137a9d-de39-4c1e-b48a-3df804c32bdf

greptile-apps · 2026-05-31T20:07:49Z

Greptile Summary

This PR fixes a bug where project names containing apostrophes or control characters would produce syntactically invalid TypeScript when written to sh1pt.config.ts by sh1pt init. It also bundles several hardening improvements across the Vultr, Flatpak, Snap, and winget adapters.

init.ts: Replaces '${name}' template interpolation with JSON.stringify(name), correctly escaping apostrophes, newlines, backslashes, and double quotes in the generated config file.
vultr/index.ts: Wraps JSON.parse in a try/catch so that non-JSON error responses (e.g. a plain-text 503 page) surface a meaningful error instead of crashing with a parse error.
pkg-flatpak, pkg-snap, pkg-winget: Tightens ID/name validators (consecutive-hyphen check for Snap, letter-first segment requirement for Flatpak), moves validation earlier in call paths, and removes duplicate validator functions that had accumulated at the bottoms of each file.

Confidence Score: 5/5

Safe to merge — all changes are additive fixes or tightened validators with no breaking surface area.

The init template fix is a one-line, well-tested change. The Vultr JSON parse guard is narrowly scoped to error paths. The validator consolidations remove duplicated code that was already unreachable in the old layout. Every changed behaviour is covered by a new test. No data migrations, no public API changes, no auth-boundary modifications.

No files require special attention.

Important Files Changed

Filename	Overview
packages/cli/src/commands/init.ts	Core fix: CONFIG_TEMPLATE now uses JSON.stringify(name) instead of template interpolation, correctly escaping apostrophes, newlines, backslashes, and double quotes in project names. Function is also exported for testing.
packages/cli/src/commands/init-template.test.ts	New test file covering apostrophes, control characters, double quotes, and backslashes in project names — all three cases exercise JSON.stringify serialization semantics correctly.
packages/cloud/vultr/src/index.ts	Wraps JSON.parse in a try/catch: non-JSON error bodies (e.g. HTML 503 pages) now produce a synthetic { message } object rather than throwing a parser error, while OK responses with invalid JSON still rethrow.
packages/targets/pkg-flatpak/src/index.ts	Tightens segment regex to require each Flatpak ID segment to start with a letter (rejects e.g. com.123.App); removes a now-duplicate validateAppId function that appeared further down the file.
packages/targets/pkg-snap/src/index.ts	Adds a consecutive-hyphen check (--) to validateSnapName, moves validation inside renderSnapcraftYaml for defensive coverage, and removes a stale duplicate validator from the bottom of the file.
packages/targets/pkg-winget/src/index.ts	Removes the older duplicate validatePackageId at the bottom, leaving the consolidated version at the top that checks for leading/trailing dots and empty segments, effectively blocking path traversal characters via the segment regex.

_{Reviews (5): Last reviewed commit: "Address snap validation review" | Re-trigger Greptile}

ayskobtw-lil · 2026-05-31T20:13:21Z

Added the extra escaping coverage Greptile suggested in 83f963c: double quotes and backslashes are now asserted against the JSON.stringify contract.

Verification:

npx --yes pnpm@9.12.0 exec vitest run packages/cli/src/commands/init-template.test.ts -> 3 passed
npx --yes pnpm@9.12.0 --filter @profullstack/sh1pt typecheck -> passed

github-actions · 2026-06-01T09:46:53Z