@7nsane/zift 1.0.3 → 1.0.4

package/bin/zift.js

@@ -11,32 +11,44 @@ async function main() {
   const args = process.argv.slice(2);
   let target = '.';
   let format = 'text';
+  let isInstallMode = false;
 
-  // Basic arg parsing
+  // Verb detection: zift install <pkg> or zift i <pkg>
+  if (args[0] === 'install' || args[0] === 'i') {
+    isInstallMode = true;
+    target = args[1] || '.';
+  }
+
+  // Flag detection: zift <pkg> --zift (for future-proofing/aliases)
+  if (args.includes('--zift')) {
+    isInstallMode = true;
+  }
+
+  // Basic arg parsing for other flags
   for (let i = 0; i < args.length; i++) {
     if (args[i] === '--format' && args[i + 1]) {
       format = args[i + 1];
       i++;
-    } else if (!args[i].startsWith('-')) {
+    } else if (!args[i].startsWith('-') && !['install', 'i'].includes(args[i])) {
       target = args[i];
     }
   }
 
-  // Determine if target is local path or remote package
+  // Determine if target is a local folder
   const isLocal = fs.existsSync(target) && fs.lstatSync(target).isDirectory();
 
   if (isLocal) {
     await runLocalScan(target, format);
   } else {
     // Treat as remote package name
-    await runRemoteAudit(target, format);
+    await runRemoteAudit(target, format, isInstallMode);
   }
 }
 
 async function runLocalScan(targetDir, format) {
   const scanner = new PackageScanner(targetDir);
   if (format === 'text') {
-    process.stdout.write(chalk.blue(`\n🔍 Scanning local directory at ${path.resolve(targetDir)}...\n`));
+    console.log(chalk.blue(`\n🔍 Scanning local directory: ${path.resolve(targetDir)}`));
   }
 
   try {
@@ -47,120 +59,90 @@ async function runLocalScan(targetDir, format) {
   }
 }
 
-async function runRemoteAudit(packageName, format) {
+async function runRemoteAudit(packageName, format, forceInstall = false) {
   if (format === 'text') {
-    console.log(chalk.blue(`\n🌍 Remote Audit: Attempting to pre-scan package '${packageName}'...`));
+    console.log(chalk.blue(`\n🌍 Remote Audit: Pre-scanning package '${packageName}'...`));
   }
 
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'zift-audit-'));
 
   try {
-    // Download tarball
     cp.execSync(`npm pack ${packageName}`, { cwd: tmpDir, stdio: 'ignore' });
     const tarball = fs.readdirSync(tmpDir).find(f => f.endsWith('.tgz'));
-
-    // Extract
     cp.execSync(`tar -xzf ${tarball}`, { cwd: tmpDir });
-    const scanPath = path.join(tmpDir, 'package');
 
+    const scanPath = path.join(tmpDir, 'package');
     const scanner = new PackageScanner(scanPath);
     const findings = await scanner.scan();
 
-    // Custom reporting for remote audit
     if (format === 'text') {
-      console.log(chalk.green(`✅ Pre-scan of '${packageName}' complete.`));
       const s = getSummary(findings);
-      console.log(chalk.bold('Risk Profile: ') +
-        (s.Critical > 0 ? chalk.red.bold('CRITICAL') :
-          s.High > 0 ? chalk.red('HIGH') :
-            s.Medium > 0 ? chalk.yellow('MEDIUM') : chalk.green('SECURE')));
+      const statusText = s.Critical > 0 ? chalk.red.bold('CRITICAL RISK') :
+        s.High > 0 ? chalk.red('HIGH RISK') :
+          s.Medium > 0 ? chalk.yellow('WARNING') : chalk.green('SECURE');
+
+      console.log(chalk.green(`✅ Audit of '${packageName}' complete. Status: ${statusText}`));
     }
 
     handleFindings(findings, format, scanPath, true);
 
-    // Interactive Prompt
     if (format === 'text') {
       const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-      const question = findings.length > 0
-        ? chalk.yellow(`\n⚠️  Suspicious patterns found. Still install '${packageName}'? (yes/no): `)
-        : chalk.blue(`\nProceed with installation of '${packageName}'? (yes/no): `);
+      const promptText = findings.length > 0
+        ? chalk.yellow(`\n⚠️  Suspicious patterns found. Still install '${packageName}'? (y/n): `)
+        : chalk.blue(`\nProceed with installation of '${packageName}'? (y/n): `);
 
-      rl.question(question, (answer) => {
+      rl.question(promptText, (answer) => {
         rl.close();
-        if (answer.toLowerCase() === 'yes' || answer.toLowerCase() === 'y') {
+        const confirmed = ['y', 'yes'].includes(answer.toLowerCase());
+
+        if (confirmed) {
           console.log(chalk.blue(`\n📦 Installing ${packageName}...`));
           try {
             cp.execSync(`npm install ${packageName}`, { stdio: 'inherit' });
             console.log(chalk.green(`\n✅ ${packageName} installed successfully.`));
-          } catch (e) {
-            console.error(chalk.red(`\n❌ Installation failed.`));
-          }
-          cleanupAndExit(tmpDir, 0);
+          } catch (e) { console.error(chalk.red(`\n❌ Installation failed.`)); }
         } else {
           console.log(chalk.red(`\n❌ Installation aborted by user.`));
-          cleanupAndExit(tmpDir, 0);
         }
+        cleanupAndExit(tmpDir, 0);
       });
     } else {
       cleanupAndExit(tmpDir, 0);
     }
-
   } catch (err) {
-    console.error(chalk.red(`\n❌ Remote Audit failed: Ensure '${packageName}' exists on npm.`));
+    console.error(chalk.red(`\n❌ Audit failed: Ensure '${packageName}' is a valid npm package.`));
     cleanupAndExit(tmpDir, 1);
   }
 }
 
 function handleFindings(findings, format, targetDir, skipExit = false) {
   if (format === 'json') {
-    console.log(JSON.stringify({
-      target: targetDir,
-      timestamp: new Date().toISOString(),
-      findings: findings,
-      summary: getSummary(findings)
-    }, null, 2));
+    process.stdout.write(JSON.stringify({ target: targetDir, findings, summary: getSummary(findings) }, null, 2));
     if (!skipExit) process.exit(findings.some(f => f.score >= 90) ? 1 : 0);
     return;
   }
 
   if (findings.length === 0) {
     if (!skipExit) {
-      console.log(chalk.green('\n✅ No suspicious patterns detected. All modules within safety thresholds.'));
+      console.log(chalk.green('\n✅ No suspicious patterns detected. All modules safe.'));
       process.exit(0);
     }
     return;
   }
 
-  console.log(chalk.yellow(`\n⚠️  Found ${findings.length} suspicious patterns.\n`));
-
-  findings.forEach(finding => {
-    const colorMap = { 'Critical': chalk.red.bold, 'High': chalk.red, 'Medium': chalk.yellow, 'Low': chalk.blue };
-    const theme = colorMap[finding.classification] || chalk.white;
-
-    console.log(theme(`[${finding.classification}] ${finding.id} ${finding.name} (Risk Score: ${finding.score})`));
-    console.log(chalk.gray(`Description: ${finding.description}`));
-
-    finding.triggers.forEach(t => {
-      console.log(chalk.white(`  - ${t.type} in ${t.file}:${t.line} [${t.context}]`));
-    });
-
-    if (finding.isLifecycle) {
-      console.log(chalk.magenta(`  Context: Multiplier applied due to execution in lifecycle script.`));
-    }
+  console.log(chalk.yellow(`\n⚠️  Suspicious patterns found:\n`));
+  findings.forEach(f => {
+    const color = { 'Critical': chalk.red.bold, 'High': chalk.red, 'Medium': chalk.yellow, 'Low': chalk.blue }[f.classification];
+    console.log(color(`[${f.classification}] ${f.id} ${f.name} (Score: ${f.score})`));
+    f.triggers.forEach(t => console.log(chalk.white(`  - ${t.type} in ${t.file}:${t.line} [${t.context}]`)));
     console.log('');
   });
 
   printSummary(findings);
 
   if (!skipExit) {
-    const highestScore = findings.length > 0 ? findings[0].score : 0;
-    if (highestScore >= 90) {
-      console.log(chalk.red.bold(`\n❌ FAILED SAFETY CHECK: Critical risk detected (Score: ${highestScore})\n`));
-      process.exit(1);
-    } else {
-      console.log(chalk.green(`\n✔ Safety check completed with minor warnings.\n`));
-      process.exit(0);
-    }
+    process.exit(findings[0].score >= 90 ? 1 : 0);
   }
 }
 
@@ -170,29 +152,21 @@ function cleanupAndExit(dir, code) {
 }
 
 function handleError(err, format) {
-  if (format === 'json') {
-    console.error(JSON.stringify({ error: err.message }));
-  } else {
-    console.error(chalk.red(`\n❌ Fatal Error: ${err.message}`));
-  }
+  if (format === 'json') console.error(JSON.stringify({ error: err.message }));
+  else console.error(chalk.red(`\n❌ Fatal Error: ${err.message}`));
   process.exit(1);
 }
 
 function getSummary(findings) {
-  const summary = { Critical: 0, High: 0, Medium: 0, Low: 0 };
-  findings.forEach(f => {
-    if (summary[f.classification] !== undefined) {
-      summary[f.classification]++;
-    }
-  });
-  return summary;
+  const s = { Critical: 0, High: 0, Medium: 0, Low: 0 };
+  findings.forEach(f => s[f.classification]++);
+  return s;
 }
 
 function printSummary(findings) {
   const s = getSummary(findings);
   console.log(chalk.bold('Severity Summary:'));
-  console.log(chalk.red(`  Critical: ${s.Critical}`));
-  console.log(chalk.red(`  High:     ${s.High}`));
+  console.log(chalk.red(`  Critical: ${s.Critical}\n  High:     ${s.High}`));
   console.log(chalk.yellow(`  Medium:   ${s.Medium}`));
   console.log(chalk.blue(`  Low:      ${s.Low}`));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7nsane/zift",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "A high-performance, deterministic security scanner for npm packages.",
   "main": "src/scanner.js",
   "bin": {