fix: address CodeRabbit review on PR 136

- encodeURIComponent table names in URL paths
- validate --data is non-null object, --fields is array
- structured dry-run output (no console.log prefix)
- validate webhook IDs as decimal integers
- read CLI version from package.json
- handle primitive arrays in --pretty mode
- use execFileSync in integration tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: eluce2

packages/fmodata/src/cli/commands/query.ts

@@ -61,7 +61,8 @@ export function makeRecordsCommand(): Command {
           where: opts.where as string | undefined,
           orderBy: opts.orderBy as string | undefined,
         });
-        const result = await db._makeRequest<{ value: unknown[] }>(`/${opts.table}${qs}`);
+        const table = encodeURIComponent(opts.table as string);
+        const result = await db._makeRequest<{ value: unknown[] }>(`/${table}${qs}`);
         if (result.error) {
           throw result.error;
         }
@@ -82,11 +83,16 @@ export function makeRecordsCommand(): Command {
         const { db } = buildConnection(globalOpts);
         let data: Record<string, unknown>;
         try {
-          data = JSON.parse(opts.data) as Record<string, unknown>;
+          const parsed: unknown = JSON.parse(opts.data);
+          if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error();
+          }
+          data = parsed as Record<string, unknown>;
         } catch {
           throw new Error("--data must be a valid JSON object");
         }
-        const result = await db._makeRequest<unknown>(`/${opts.table}`, {
+        const table = encodeURIComponent(opts.table as string);
+        const result = await db._makeRequest<unknown>(`/${table}`, {
           method: "POST",
           body: JSON.stringify(data),
         });
@@ -111,12 +117,17 @@ export function makeRecordsCommand(): Command {
         const { db } = buildConnection(globalOpts);
         let data: Record<string, unknown>;
         try {
-          data = JSON.parse(opts.data) as Record<string, unknown>;
+          const parsed: unknown = JSON.parse(opts.data);
+          if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error();
+          }
+          data = parsed as Record<string, unknown>;
         } catch {
           throw new Error("--data must be a valid JSON object");
         }
         const qs = buildQueryString({ where: opts.where as string | undefined });
-        const result = await db._makeRequest<unknown>(`/${opts.table}${qs}`, {
+        const table = encodeURIComponent(opts.table as string);
+        const result = await db._makeRequest<unknown>(`/${table}${qs}`, {
           method: "PATCH",
           body: JSON.stringify(data),
         });
@@ -139,7 +150,8 @@ export function makeRecordsCommand(): Command {
       try {
         const { db } = buildConnection(globalOpts);
         const qs = buildQueryString({ where: opts.where as string | undefined });
-        const result = await db._makeRequest<unknown>(`/${opts.table}${qs}`, {
+        const table = encodeURIComponent(opts.table as string);
+        const result = await db._makeRequest<unknown>(`/${table}${qs}`, {
           method: "DELETE",
         });
         if (result.error) {

packages/fmodata/src/cli/commands/schema.ts

@@ -33,14 +33,15 @@ export function makeSchemaCommand(): Command {
       try {
         let fields: Field[];
         try {
-          fields = JSON.parse(opts.fields) as Field[];
+          const parsed: unknown = JSON.parse(opts.fields);
+          if (!Array.isArray(parsed)) throw new Error();
+          fields = parsed as Field[];
         } catch {
           throw new Error("--fields must be a valid JSON array");
         }
 
         if (!opts.confirm) {
-          console.log("[dry-run] Would create table:");
-          printResult({ tableName: opts.name, fields }, { pretty: globalOpts.pretty ?? false });
+          printResult({ dryRun: true, action: "create-table", tableName: opts.name, fields }, { pretty: globalOpts.pretty ?? false });
           return;
         }
 
@@ -63,14 +64,15 @@ export function makeSchemaCommand(): Command {
       try {
         let fields: Field[];
         try {
-          fields = JSON.parse(opts.fields) as Field[];
+          const parsed: unknown = JSON.parse(opts.fields);
+          if (!Array.isArray(parsed)) throw new Error();
+          fields = parsed as Field[];
         } catch {
           throw new Error("--fields must be a valid JSON array");
         }
 
         if (!opts.confirm) {
-          console.log("[dry-run] Would add fields to table:");
-          printResult({ tableName: opts.table, fields }, { pretty: globalOpts.pretty ?? false });
+          printResult({ dryRun: true, action: "add-fields", tableName: opts.table, fields }, { pretty: globalOpts.pretty ?? false });
           return;
         }
 

packages/fmodata/src/cli/commands/webhook.ts

@@ -4,6 +4,13 @@ import { buildConnection } from "../utils/connection";
 import { handleCliError } from "../utils/errors";
 import { printResult } from "../utils/output";
 
+function parseWebhookId(id: string): number {
+  if (!/^\d+$/.test(id)) {
+    throw new Error(`Invalid webhook ID: "${id}" — must be a positive integer`);
+  }
+  return Number(id);
+}
+
 export function makeWebhookCommand(): Command {
   const webhook = new Command("webhook").description("FileMaker webhook operations");
 
@@ -27,8 +34,9 @@ export function makeWebhookCommand(): Command {
     .action(async (id: string, _opts, cmd) => {
       const globalOpts = cmd.parent?.parent?.opts() as ConnectionOptions & { pretty: boolean };
       try {
+        const parsedId = parseWebhookId(id);
         const { db } = buildConnection(globalOpts);
-        const result = await db.webhook.get(Number(id));
+        const result = await db.webhook.get(parsedId);
         printResult(result, { pretty: globalOpts.pretty ?? false });
       } catch (err) {
         handleCliError(err);
@@ -96,9 +104,10 @@ export function makeWebhookCommand(): Command {
     .action(async (id: string, _opts, cmd) => {
       const globalOpts = cmd.parent?.parent?.opts() as ConnectionOptions & { pretty: boolean };
       try {
+        const parsedId = parseWebhookId(id);
         const { db } = buildConnection(globalOpts);
-        await db.webhook.remove(Number(id));
-        printResult({ removed: true, id: Number(id) }, { pretty: globalOpts.pretty ?? false });
+        await db.webhook.remove(parsedId);
+        printResult({ removed: true, id: parsedId }, { pretty: globalOpts.pretty ?? false });
       } catch (err) {
         handleCliError(err);
       }

packages/fmodata/src/cli/index.ts

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { Command } from "commander";
 import { makeMetadataCommand } from "./commands/metadata";
 import { makeRecordsCommand } from "./commands/query";
@@ -7,12 +8,15 @@ import { makeWebhookCommand } from "./commands/webhook";
 import { ENV_NAMES } from "./utils/connection";
 import { handleCliError } from "./utils/errors";
 
+const require = createRequire(import.meta.url);
+const { version } = require("../../package.json") as { version: string };
+
 const program = new Command();
 
 program
   .name("fmodata")
   .description("FileMaker OData CLI — query, script, webhook, metadata, and schema operations")
-  .version("0.1.0")
+  .version(version)
   .option("--server <url>", `FM server URL [env: ${ENV_NAMES.server}]`)
   .option("--database <name>", `FM database name [env: ${ENV_NAMES.db}]`)
   .option("--username <user>", `FM username [env: ${ENV_NAMES.username}]`)

packages/fmodata/src/cli/utils/output.ts

@@ -24,6 +24,16 @@ function printTable(data: unknown): void {
     return;
   }
 
+  // Array of primitives — render as single column
+  if (Array.isArray(data) && data.length > 0) {
+    const table = new Table({ head: ["Value"] });
+    for (const value of data) {
+      table.push([String(value ?? "")]);
+    }
+    console.log(table.toString());
+    return;
+  }
+
   // Single object — render as key-value pairs
   if (typeof data === "object" && data !== null && !Array.isArray(data)) {
     const table = new Table({ head: ["Key", "Value"] });

packages/fmodata/tests/cli/integration/binary.test.ts

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
@@ -21,7 +21,7 @@ describe("CLI binary integration", () => {
       console.warn("Skipping: CLI binary not built");
       return;
     }
-    const output = execSync(`node ${CLI_PATH} --help`, { encoding: "utf8" });
+    const output = execFileSync(process.execPath, [CLI_PATH, "--help"], { encoding: "utf8" });
     expect(output).toContain("fmodata");
     expect(output).toContain("Usage");
   });
@@ -31,7 +31,7 @@ describe("CLI binary integration", () => {
       console.warn("Skipping: CLI binary not built");
       return;
     }
-    const output = execSync(`node ${CLI_PATH} records --help`, { encoding: "utf8" });
+    const output = execFileSync(process.execPath, [CLI_PATH, "records", "--help"], { encoding: "utf8" });
     expect(output).toContain("list");
     expect(output).toContain("insert");
     expect(output).toContain("update");
@@ -43,7 +43,7 @@ describe("CLI binary integration", () => {
       console.warn("Skipping: CLI binary not built");
       return;
     }
-    const output = execSync(`node ${CLI_PATH} metadata --help`, { encoding: "utf8" });
+    const output = execFileSync(process.execPath, [CLI_PATH, "metadata", "--help"], { encoding: "utf8" });
     expect(output).toContain("get");
     expect(output).toContain("tables");
   });

packages/fmodata/tests/cli/unit/output.test.ts

@@ -41,10 +41,13 @@ describe("printResult", () => {
     expect(output).toContain("ok");
   });
 
-  it("falls back to JSON for non-object data in table mode", () => {
+  it("prints single-column table for primitive arrays in table mode", () => {
     printResult(["a", "b", "c"], { pretty: true });
     const output = stdoutSpy.mock.calls[0]?.[0] as string;
-    expect(output).toContain('"a"');
+    expect(output).toContain("Value");
+    expect(output).toContain("a");
+    expect(output).toContain("b");
+    expect(output).toContain("c");
   });
 });