nf build deletes the whole project when the output dir is . or a parent folder

Aperta
  • Qualcosa non va?
#275 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
bun, node.js, typescript
Ambito
backend, cli

Direzione di ricerca

Start with src/lib/utils/files.ts and the resetFolder call in src/action/actions/build.action.ts; trace how the client and server output directories are resolved before deletion. Check how out.dir is validated in libs/config/src/parse/validate-config.ts. Add coverage for unsafe paths, including ., a parent folder, and paths containing the entry file or assets; done means builds reject them before deleting project files.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug command:build lib:config
Which package is this bug report for?

@nanoforge-dev/cli

Which command is this bug report for?

build

Issue description

nf build deletes the whole project when the output folder is . (or a parent folder). Before each build, resetFolder runs rmSync(join(directory, outDir), { recursive: true, force: true }) (src/lib/utils/files.ts#L14-L15, called from src/action/actions/build.action.ts#L139). Neither --client-out-dir/--server-out-dir nor the config's out.dir (libs/config/src/parse/validate-config.ts#L10, a bare z.string()) refuses ., .., an absolute path or a folder that holds the sources.

Steps to reproduce (reproduced with dist/nf.js on a throwaway project):

  1. A project with nanoforge.config.ts (export default { type: "client" };), src/main.ts and assets/sprites/b.png.
  2. nf build -d <project> --client-out-dir .
  3. The output is ENOENT opening root directory "src" / Build of Client failed!, and the project folder is now empty: config, src/ and assets/ are gone.

Expected: the build refuses an output folder that is the project folder, one of its parents, outside the project, or one that contains the entry file or the assets folder, before anything is deleted. The same rule is checked on out.dir in @nanoforge-dev/config, and a test covers it.

Found during a read-only audit of main at e95b881 (2026-11-11).

Code sample
// nanoforge.config.ts
export default { type: "client" };
// then: nf build --client-out-dir .   -> the project folder is emptied
Versions
  • @nanoforge-dev/cli 3.0.1 (main, e95b881)
  • Node.js 26.7.0
  • Bun 1.3.14 (bundled)
  • Linux
Issue priority

High (immediate attention needed)

I have tested this issue on a development release

e95b881

Lingua principale
TypeScript
Stelle
2
Fork
2
Merge medio
2g 18h
PR unite (30g)
17

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NanoForge-dev/CLI

Tutte le issue di NanoForge-dev/CLI

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.