Potential Risk: @hey-api/openapi-ts Clears Directory During Execution

[renjianguo666]

Description

Description:

I’ve encountered a serious issue with the @hey-api/openapi-ts package. It appears that the tool has the potential to clear a directory when executed, which can lead to unintentional data loss.

Steps to Reproduce:

Install the package and configure it according to the documentation.

Run the tool to generate TypeScript types from an OpenAPI specification.

Observe that it might clear the directory or remove files unexpectedly.

Expected Behavior:

The tool should generate TypeScript types without modifying or deleting any files in the project directory unless explicitly configured to do so.

Actual Behavior:

The tool seems to clear or delete files in the specified directory, causing potential data loss.

Possible Impact:

Important files could be accidentally deleted.

Risk of data loss in the project directory without sufficient warning.

Recommendations:

The tool should have better safeguards in place to prevent accidental deletion of files.

It would be helpful if the tool issued a clearer warning or confirmation before performing destructive operations.

Users should be able to configure the behavior of the tool to avoid modifying or deleting critical files.

This should help you explain the issue clearly. Let me know if you'd like to adjust any details!

Reproducible example or configuration

https://stackblitz.com/edit/hey-api-client-fetch-example

OpenAPI specification (optional)

No response

System information (optional)

No response

[bolt-new-by-stackblitz]

Start a new pull request in StackBlitz Codeflow.

• hey-api-client-fetch-example (Open reproduction)

[dosubot]

Hi @renjianguo666! I'm Dosu and I’m helping the openapi-ts team.

You’re correct—by default, @hey-api/openapi-ts will empty (clear) the entire output directory specified in output.path every time you run it, which means all files in that folder are deleted before new files are generated. This is documented behavior and is intended to prevent stale or outdated files, but it can definitely lead to accidental data loss if you keep custom or important files in that directory. There are no interactive warnings or confirmation prompts before this happens—the only safeguard is a configuration option.

To prevent the tool from clearing the output directory, set output.clean to false in your configuration:

export default {
  input: 'hey-api/backend',
  output: {
    clean: false,
    path: 'src/client',
  },
};

Be aware that disabling cleaning may result in broken output if old files conflict with new ones, so make sure to typecheck your code after generation. The documentation explicitly warns about this risk and recommends only disabling cleaning if you’re sure you need to keep files in the output directory. There are currently no built-in warnings or confirmations before destructive operations—behavior is controlled solely by the output.clean option. More details and examples are available in the official docs: output configuration, migration notes.

Best practice: dedicate a directory exclusively for generated files, or always set output.clean to false if you need to preserve custom files, and review the output after each run.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

  

[mrlubos]

@renjianguo666 that's a valid point. How would you design to handle the following scenario?

1. We generate folder with files a, b, c.
2. User changes their configuration.
3. We generate the same folder but with files d, e, f.
4. Files a, b, c are left behind from the previous run and now reference invalid modules, causing the build to fail.