@7nsane/zift 1.0.2 → 1.0.4

package/bin/zift.js

@@ -1,108 +1,172 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 const PackageScanner = require('../src/scanner');
 const chalk = require('chalk');
 const path = require('node:path');
+const fs = require('node:fs');
+const cp = require('node:child_process');
+const os = require('node:os');
+const readline = require('node:readline');
 
 async function main() {
   const args = process.argv.slice(2);
-  let targetDir = '.';
+  let target = '.';
   let format = 'text';
+  let isInstallMode = false;
 
-  // Basic arg parsing
+  // Verb detection: zift install <pkg> or zift i <pkg>
+  if (args[0] === 'install' || args[0] === 'i') {
+    isInstallMode = true;
+    target = args[1] || '.';
+  }
+
+  // Flag detection: zift <pkg> --zift (for future-proofing/aliases)
+  if (args.includes('--zift')) {
+    isInstallMode = true;
+  }
+
+  // Basic arg parsing for other flags
   for (let i = 0; i < args.length; i++) {
     if (args[i] === '--format' && args[i + 1]) {
       format = args[i + 1];
       i++;
-    } else if (!args[i].startsWith('-')) {
-      targetDir = args[i];
+    } else if (!args[i].startsWith('-') && !['install', 'i'].includes(args[i])) {
+      target = args[i];
     }
   }
 
-  const scanner = new PackageScanner(targetDir);
+  // Determine if target is a local folder
+  const isLocal = fs.existsSync(target) && fs.lstatSync(target).isDirectory();
 
+  if (isLocal) {
+    await runLocalScan(target, format);
+  } else {
+    // Treat as remote package name
+    await runRemoteAudit(target, format, isInstallMode);
+  }
+}
+
+async function runLocalScan(targetDir, format) {
+  const scanner = new PackageScanner(targetDir);
   if (format === 'text') {
-    process.stdout.write(chalk.blue(`\n🔍 Scanning package at ${path.resolve(targetDir)}...\n`));
+    console.log(chalk.blue(`\n🔍 Scanning local directory: ${path.resolve(targetDir)}`));
   }
 
   try {
     const findings = await scanner.scan();
+    handleFindings(findings, format, targetDir);
+  } catch (err) {
+    handleError(err, format);
+  }
+}
 
-    if (format === 'json') {
-      console.log(JSON.stringify({
-        targetDir: path.resolve(targetDir),
-        timestamp: new Date().toISOString(),
-        findings: findings,
-        summary: getSummary(findings)
-      }, null, 2));
-      process.exit(findings.some(f => f.score >= 90) ? 1 : 0);
-    }
+async function runRemoteAudit(packageName, format, forceInstall = false) {
+  if (format === 'text') {
+    console.log(chalk.blue(`\n🌍 Remote Audit: Pre-scanning package '${packageName}'...`));
+  }
 
-    if (findings.length === 0) {
-      console.log(chalk.green('\n✅ No suspicious patterns detected. All modules within safety thresholds.'));
-      process.exit(0);
-    }
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'zift-audit-'));
 
-    console.log(chalk.yellow(`\n⚠️  Scan complete. Found ${findings.length} suspicious patterns.\n`));
+  try {
+    cp.execSync(`npm pack ${packageName}`, { cwd: tmpDir, stdio: 'ignore' });
+    const tarball = fs.readdirSync(tmpDir).find(f => f.endsWith('.tgz'));
+    cp.execSync(`tar -xzf ${tarball}`, { cwd: tmpDir });
 
-    findings.forEach(finding => {
-      const colorMap = {
-        'Critical': chalk.red.bold,
-        'High': chalk.red,
-        'Medium': chalk.yellow,
-        'Low': chalk.blue
-      };
+    const scanPath = path.join(tmpDir, 'package');
+    const scanner = new PackageScanner(scanPath);
+    const findings = await scanner.scan();
 
-      const theme = colorMap[finding.classification] || chalk.white;
+    if (format === 'text') {
+      const s = getSummary(findings);
+      const statusText = s.Critical > 0 ? chalk.red.bold('CRITICAL RISK') :
+        s.High > 0 ? chalk.red('HIGH RISK') :
+          s.Medium > 0 ? chalk.yellow('WARNING') : chalk.green('SECURE');
 
-      console.log(theme(`[${finding.classification}] ${finding.id} ${finding.name} (Risk Score: ${finding.score})`));
-      console.log(chalk.gray(`Description: ${finding.description}`));
+      console.log(chalk.green(`✅ Audit of '${packageName}' complete. Status: ${statusText}`));
+    }
 
-      finding.triggers.forEach(t => {
-        console.log(chalk.white(`  - ${t.type} in ${t.file}:${t.line} [${t.context}]`));
+    handleFindings(findings, format, scanPath, true);
+
+    if (format === 'text') {
+      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+      const promptText = findings.length > 0
+        ? chalk.yellow(`\n⚠️  Suspicious patterns found. Still install '${packageName}'? (y/n): `)
+        : chalk.blue(`\nProceed with installation of '${packageName}'? (y/n): `);
+
+      rl.question(promptText, (answer) => {
+        rl.close();
+        const confirmed = ['y', 'yes'].includes(answer.toLowerCase());
+
+        if (confirmed) {
+          console.log(chalk.blue(`\n📦 Installing ${packageName}...`));
+          try {
+            cp.execSync(`npm install ${packageName}`, { stdio: 'inherit' });
+            console.log(chalk.green(`\n✅ ${packageName} installed successfully.`));
+          } catch (e) { console.error(chalk.red(`\n❌ Installation failed.`)); }
+        } else {
+          console.log(chalk.red(`\n❌ Installation aborted by user.`));
+        }
+        cleanupAndExit(tmpDir, 0);
       });
+    } else {
+      cleanupAndExit(tmpDir, 0);
+    }
+  } catch (err) {
+    console.error(chalk.red(`\n❌ Audit failed: Ensure '${packageName}' is a valid npm package.`));
+    cleanupAndExit(tmpDir, 1);
+  }
+}
 
-      if (finding.isLifecycle) {
-        console.log(chalk.magenta(`  Context: Multiplier applied due to execution in lifecycle script.`));
-      }
-      console.log('');
-    });
-
-    printSummary(findings);
+function handleFindings(findings, format, targetDir, skipExit = false) {
+  if (format === 'json') {
+    process.stdout.write(JSON.stringify({ target: targetDir, findings, summary: getSummary(findings) }, null, 2));
+    if (!skipExit) process.exit(findings.some(f => f.score >= 90) ? 1 : 0);
+    return;
+  }
 
-    const highestScore = findings.length > 0 ? findings[0].score : 0;
-    if (highestScore >= 90) {
-      console.log(chalk.red.bold(`\n❌ FAILED SAFETY CHECK: Critical risk detected (Score: ${highestScore})\n`));
-      process.exit(1);
-    } else {
-      console.log(chalk.green(`\n✔ Safety check completed with minor warnings.\n`));
+  if (findings.length === 0) {
+    if (!skipExit) {
+      console.log(chalk.green('\n✅ No suspicious patterns detected. All modules safe.'));
       process.exit(0);
     }
+    return;
+  }
 
-  } catch (err) {
-    if (format === 'json') {
-      console.error(JSON.stringify({ error: err.message }));
-    } else {
-      console.error(chalk.red(`\n❌ Fatal Error: ${err.message}`));
-    }
-    process.exit(1);
+  console.log(chalk.yellow(`\n⚠️  Suspicious patterns found:\n`));
+  findings.forEach(f => {
+    const color = { 'Critical': chalk.red.bold, 'High': chalk.red, 'Medium': chalk.yellow, 'Low': chalk.blue }[f.classification];
+    console.log(color(`[${f.classification}] ${f.id} ${f.name} (Score: ${f.score})`));
+    f.triggers.forEach(t => console.log(chalk.white(`  - ${t.type} in ${t.file}:${t.line} [${t.context}]`)));
+    console.log('');
+  });
+
+  printSummary(findings);
+
+  if (!skipExit) {
+    process.exit(findings[0].score >= 90 ? 1 : 0);
   }
 }
 
+function cleanupAndExit(dir, code) {
+  if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+  if (code !== undefined) process.exit(code);
+}
+
+function handleError(err, format) {
+  if (format === 'json') console.error(JSON.stringify({ error: err.message }));
+  else console.error(chalk.red(`\n❌ Fatal Error: ${err.message}`));
+  process.exit(1);
+}
+
 function getSummary(findings) {
-  const summary = { Critical: 0, High: 0, Medium: 0, Low: 0 };
-  findings.forEach(f => {
-    if (summary[f.classification] !== undefined) {
-      summary[f.classification]++;
-    }
-  });
-  return summary;
+  const s = { Critical: 0, High: 0, Medium: 0, Low: 0 };
+  findings.forEach(f => s[f.classification]++);
+  return s;
 }
 
 function printSummary(findings) {
   const s = getSummary(findings);
   console.log(chalk.bold('Severity Summary:'));
-  console.log(chalk.red(`  Critical: ${s.Critical}`));
-  console.log(chalk.red(`  High:     ${s.High}`));
+  console.log(chalk.red(`  Critical: ${s.Critical}\n  High:     ${s.High}`));
   console.log(chalk.yellow(`  Medium:   ${s.Medium}`));
   console.log(chalk.blue(`  Low:      ${s.Low}`));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7nsane/zift",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "A high-performance, deterministic security scanner for npm packages.",
   "main": "src/scanner.js",
   "bin": {