[PR #49] [MERGED] feat(deploy): add --env support with security and parsing improvements #269

New issue

Closed

opened 2026-05-06 12:38:52 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:38:52 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/49
Author: @southpolesteve
Created: 2/25/2026
Status: ✅ Merged
Merged: 2/25/2026
Merged by: @southpolesteve

Base: main ← Head: feat/deploy-env-improved

📝 Commits (2)

9c5d53c feat(deploy): add --env support for wrangler deploy
2971da2 fix(deploy): use execFileSync and util.parseArgs for --env support

📊 Changes

4 files changed (+180 additions, -56 deletions)

View changed files

📝 README.md (+4 -1)
📝 packages/vinext/src/cli.ts (+14 -47)
📝 packages/vinext/src/deploy.ts (+66 -8)
📝 tests/deploy.test.ts (+96 -0)

📄 Description

Summary

Adds --env <name> flag to vinext deploy for targeting wrangler environments (addresses #33). Builds on #44 by @liuxiaopai-ai — their commit is preserved as the first commit to retain authorship credit.

This PR layers three improvements on top of the original:

Security: fix command injection — switch from execSync(shell string) to execFileSync(binary, argsArray) so user-supplied --env/--name values are never interpolated into a shell command
Use util.parseArgs — replace hand-rolled parseStringFlag, parseNumericFlag, and rawArgs.includes() with Node.js built-in parseArgs({ strict: true }). This catches typos (--preivew), errors on missing values (--env with no argument), and handles --flag=value automatically
Clean up log derivation — buildWranglerDeployArgs returns { args, env } directly instead of the caller re-parsing the args array to extract the env name

Test coverage

buildWranglerDeployArgs: production default, --preview, explicit env, env-over-preview precedence, empty string env
parseDeployArgs: all flag forms (--env staging, --env=staging), boolean flags, numeric TPR flags, whitespace trimming, strict mode rejection of unknown flags

Typecheck, lint, and all 132 deploy tests pass.

Closes #33
Supersedes #44

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/49 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 2/25/2026 **Status:** ✅ Merged **Merged:** 2/25/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `feat/deploy-env-improved` --- ### 📝 Commits (2) - [`9c5d53c`](https://github.com/cloudflare/vinext/commit/9c5d53ca1f095134f9b408a1859aaad815b51fe6) feat(deploy): add --env support for wrangler deploy - [`2971da2`](https://github.com/cloudflare/vinext/commit/2971da2709aaf8e7f93a3f0db3316d50297a7014) fix(deploy): use execFileSync and util.parseArgs for --env support ### 📊 Changes **4 files changed** (+180 additions, -56 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+4 -1) 📝 `packages/vinext/src/cli.ts` (+14 -47) 📝 `packages/vinext/src/deploy.ts` (+66 -8) 📝 `tests/deploy.test.ts` (+96 -0) </details> ### 📄 Description ## Summary Adds `--env <name>` flag to `vinext deploy` for targeting wrangler environments (addresses #33). Builds on #44 by @liuxiaopai-ai — their commit is preserved as the first commit to retain authorship credit. This PR layers three improvements on top of the original: - **Security: fix command injection** — switch from `execSync(shell string)` to `execFileSync(binary, argsArray)` so user-supplied `--env`/`--name` values are never interpolated into a shell command - **Use `util.parseArgs`** — replace hand-rolled `parseStringFlag`, `parseNumericFlag`, and `rawArgs.includes()` with Node.js built-in `parseArgs({ strict: true })`. This catches typos (`--preivew`), errors on missing values (`--env` with no argument), and handles `--flag=value` automatically - **Clean up log derivation** — `buildWranglerDeployArgs` returns `{ args, env }` directly instead of the caller re-parsing the args array to extract the env name ## Test coverage - `buildWranglerDeployArgs`: production default, `--preview`, explicit env, env-over-preview precedence, empty string env - `parseDeployArgs`: all flag forms (`--env staging`, `--env=staging`), boolean flags, numeric TPR flags, whitespace trimming, strict mode rejection of unknown flags Typecheck, lint, and all 132 deploy tests pass. Closes #33 Supersedes #44 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>