some fixes

Signed-off-by: ale <ale@manalejandro.com>

package.json

@@ -51,21 +51,14 @@
     "IMPLEMENTATION.md"
   ],
   "dependencies": {
-    "body-parser": "^2.2.0",
     "chalk": "^4.1.2",
     "commander": "^11.1.0",
-    "crypto": "^1.0.1",
-    "debug": "^4.4.1",
-    "express": "^5.1.0",
     "fs-extra": "^11.3.1",
     "inquirer": "^8.2.6",
-    "listr2": "^6.6.1",
-    "lodash": "^4.17.21",
     "node-fetch": "^2.6.12",
     "ora": "^5.4.1",
     "semver": "^7.7.2",
-    "tar": "^6.2.1",
+    "tar": "^6.2.1"
-    "lodash.debounce": "^4.0.8"
   },
   "devDependencies": {
     "eslint": "^8.45.0",

src/core/package-manager.js

@@ -216,7 +216,9 @@ class PackageManager {
           
           try {
             // Write buffer to temporary file and extract from there
-            const tempFile = path.join(os.tmpdir(), `${name}-${Date.now()}.tgz`);
+            // Sanitize package name for file system
+            const sanitizedName = name.replace(/[@/]/g, '-');
+            const tempFile = path.join(os.tmpdir(), `${sanitizedName}-${Date.now()}.tgz`);
             await fs.writeFile(tempFile, packageData);
             
             // Extract the tarball directly to the target directory
@@ -799,7 +801,12 @@ class PackageManager {
     }
     
     // Handle standard npm packages
-    const match = spec.match(/^(@?[^@]+)(?:@(.+))?$/);
+    // Improved regex to handle scoped packages like @scope/package@version
+    const match = spec.match(/^(@[^/]+\/[^@]+|[^@]+)(?:@(.+))?$/);
+    if (!match) {
+      throw new Error(`Invalid package specification: ${spec}`);
+    }
+    
     return {
       name: match[1],
       version: match[2] || 'latest',
@@ -1201,7 +1208,8 @@ class PackageManager {
       
       // Create tarball from cloned directory
       const tar = require('tar');
-      const tarballPath = path.join(os.tmpdir(), `${gitSpec.name}-${Date.now()}.tgz`);
+      const sanitizedName = gitSpec.name.replace(/[@/]/g, '-');
+      const tarballPath = path.join(os.tmpdir(), `${sanitizedName}-${Date.now()}.tgz`);
       
       await tar.create({
         gzip: true,
@@ -1242,7 +1250,8 @@ class PackageManager {
       // Handle directory - create tarball
       const tar = require('tar');
       const os = require('os');
-      const tarballPath = path.join(os.tmpdir(), `${fileSpec.name}-${Date.now()}.tgz`);
+      const sanitizedName = fileSpec.name.replace(/[@/]/g, '-');
+      const tarballPath = path.join(os.tmpdir(), `${sanitizedName}-${Date.now()}.tgz`);
       
       await tar.create({
         gzip: true,