@aldegad/safedeps 2.1.0

package/scripts/install/install-safedeps-hooks.mjs

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+// safedeps cross-engine installer.
+// Registers the safedeps skill + PreToolUse/PostToolUse hooks for both
+// Claude Code (~/.claude) and Codex CLI (~/.codex).
+//
+// Idempotent: running twice leaves state unchanged.
+// Backup-before-write: every JSON config file is copied to .bak before edit.
+//
+// Usage:
+//   node scripts/install/install-safedeps-hooks.mjs
+//   node scripts/install/install-safedeps-hooks.mjs --uninstall
+//   node scripts/install/install-safedeps-hooks.mjs --link-bin   (optional ~/.local/bin/safedeps)
+
+import { existsSync, lstatSync, readFileSync, writeFileSync, copyFileSync, mkdirSync, symlinkSync, unlinkSync, readlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, "..", "..");
+const HOME = homedir();
+
+const SKILL_ID = "safedeps";
+const PRE_HOOK = join(REPO_ROOT, "scripts", "safedeps-pre-guard.sh");
+const POST_HOOK = join(REPO_ROOT, "scripts", "safedeps-post-verify.sh");
+const CLI_BIN = join(REPO_ROOT, "bin", "safedeps");
+
+const args = new Set(process.argv.slice(2));
+const UNINSTALL = args.has("--uninstall");
+const LINK_BIN = args.has("--link-bin");
+
+function log(...parts) { console.log(`[safedeps-install]`, ...parts); }
+function warn(...parts) { console.warn(`[safedeps-install]`, ...parts); }
+
+function isSymlink(p) {
+  try { return lstatSync(p).isSymbolicLink(); } catch { return false; }
+}
+
+function ensureSymlink(target, linkPath) {
+  if (isSymlink(linkPath)) {
+    const current = readlinkSync(linkPath);
+    if (current === target) { log(`symlink ok   ${linkPath} -> ${target}`); return; }
+    unlinkSync(linkPath);
+  } else if (existsSync(linkPath)) {
+    throw new Error(`refusing to overwrite non-symlink at ${linkPath}`);
+  }
+  mkdirSync(dirname(linkPath), { recursive: true });
+  symlinkSync(target, linkPath);
+  log(`symlink wrote ${linkPath} -> ${target}`);
+}
+
+function removeSymlink(linkPath) {
+  if (isSymlink(linkPath)) {
+    unlinkSync(linkPath);
+    log(`symlink removed ${linkPath}`);
+  }
+}
+
+function readJson(path) {
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new Error(`invalid JSON at ${path}: ${err.message}`);
+  }
+}
+
+function writeJsonWithBackup(path, value) {
+  if (existsSync(path)) {
+    copyFileSync(path, `${path}.bak`);
+  } else {
+    mkdirSync(dirname(path), { recursive: true });
+  }
+  writeFileSync(path, JSON.stringify(value, null, 2) + "\n");
+}
+
+function ensureHook(config, eventName, command) {
+  config.hooks = config.hooks ?? {};
+  config.hooks[eventName] = config.hooks[eventName] ?? [];
+  const buckets = config.hooks[eventName];
+
+  let bashBucket = buckets.find((b) => b && b.matcher === "Bash");
+  if (!bashBucket) {
+    bashBucket = { matcher: "Bash", hooks: [] };
+    buckets.push(bashBucket);
+  }
+  bashBucket.hooks = bashBucket.hooks ?? [];
+
+  const already = bashBucket.hooks.some((h) => h && h.type === "command" && h.command === command);
+  if (already) return false;
+
+  bashBucket.hooks.push({ type: "command", command });
+  return true;
+}
+
+function removeHook(config, eventName, command) {
+  const buckets = config?.hooks?.[eventName];
+  if (!Array.isArray(buckets)) return false;
+  let changed = false;
+  for (const bucket of buckets) {
+    if (!bucket || bucket.matcher !== "Bash" || !Array.isArray(bucket.hooks)) continue;
+    const before = bucket.hooks.length;
+    bucket.hooks = bucket.hooks.filter((h) => !(h && h.type === "command" && h.command === command));
+    if (bucket.hooks.length !== before) changed = true;
+  }
+  return changed;
+}
+
+function pruneLegacySafedepsHooks(config, eventName) {
+  const buckets = config?.hooks?.[eventName];
+  if (!Array.isArray(buckets)) return false;
+  let changed = false;
+  for (const bucket of buckets) {
+    if (!bucket || bucket.matcher !== "Bash" || !Array.isArray(bucket.hooks)) continue;
+    const before = bucket.hooks.length;
+    bucket.hooks = bucket.hooks.filter((h) => {
+      const command = h?.command;
+      if (typeof command !== "string") return true;
+      const legacySafedeps = command.includes("npm-reorg-guard") || command.includes("/safedeps/");
+      const legacyHookName = command.endsWith("/scripts/guard.sh") || command.endsWith("/scripts/verify.sh");
+      return !(legacySafedeps && legacyHookName);
+    });
+    if (bucket.hooks.length !== before) changed = true;
+  }
+  return changed;
+}
+
+function installInEngine({ engineRoot, configPath, label }) {
+  if (!existsSync(engineRoot)) {
+    warn(`skip ${label} (${engineRoot} not present)`);
+    return;
+  }
+  const skillsRoot = join(engineRoot, "skills");
+  const skillLink = join(skillsRoot, SKILL_ID);
+
+  if (UNINSTALL) {
+    removeSymlink(skillLink);
+    if (existsSync(configPath)) {
+      const cfg = readJson(configPath);
+      const pre = removeHook(cfg, "PreToolUse", PRE_HOOK);
+      const post = removeHook(cfg, "PostToolUse", POST_HOOK);
+      if (pre || post) {
+        writeJsonWithBackup(configPath, cfg);
+        log(`patched ${configPath} (removed safedeps hooks)`);
+      } else {
+        log(`config clean ${configPath}`);
+      }
+    }
+    return;
+  }
+
+  ensureSymlink(REPO_ROOT, skillLink);
+
+  const cfg = readJson(configPath);
+  const legacyPreRemoved = pruneLegacySafedepsHooks(cfg, "PreToolUse");
+  const legacyPostRemoved = pruneLegacySafedepsHooks(cfg, "PostToolUse");
+  const preAdded = ensureHook(cfg, "PreToolUse", PRE_HOOK);
+  const postAdded = ensureHook(cfg, "PostToolUse", POST_HOOK);
+  if (legacyPreRemoved || legacyPostRemoved || preAdded || postAdded) {
+    writeJsonWithBackup(configPath, cfg);
+    log(`patched ${configPath} (pre=${preAdded ? "added" : "ok"}, post=${postAdded ? "added" : "ok"}, legacy=${legacyPreRemoved || legacyPostRemoved ? "removed" : "ok"})`);
+  } else {
+    log(`config ok   ${configPath} (hooks already registered)`);
+  }
+}
+
+function maybeLinkBin() {
+  if (!LINK_BIN || UNINSTALL) return;
+  const target = CLI_BIN;
+  const linkPath = join(HOME, ".local", "bin", "safedeps");
+  try {
+    ensureSymlink(target, linkPath);
+  } catch (err) {
+    warn(`bin symlink skipped: ${err.message}`);
+  }
+}
+
+function unlinkBin() {
+  if (!UNINSTALL) return;
+  removeSymlink(join(HOME, ".local", "bin", "safedeps"));
+}
+
+function main() {
+  if (!existsSync(PRE_HOOK) || !existsSync(POST_HOOK)) {
+    throw new Error(`hook scripts not found at ${PRE_HOOK} / ${POST_HOOK}`);
+  }
+
+  installInEngine({
+    engineRoot: join(HOME, ".claude"),
+    configPath: join(HOME, ".claude", "settings.json"),
+    label: "Claude Code",
+  });
+  installInEngine({
+    engineRoot: join(HOME, ".codex"),
+    configPath: join(HOME, ".codex", "hooks.json"),
+    label: "Codex CLI",
+  });
+
+  maybeLinkBin();
+  unlinkBin();
+
+  if (UNINSTALL) {
+    log("uninstall done.");
+  } else {
+    log("install done. New hook events fire on the next session start.");
+  }
+}
+
+main();

package/scripts/install/install-safedeps-recheck-agent.mjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+/* Install a per-user macOS launchd agent for daily safedeps re-check. */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const LABEL = 'com.aldegad.safedeps.recheck';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = path.resolve(__dirname, '..', '..');
+const wrapperPath = path.join(repoRoot, 'scripts', 'safedeps-recheck-alert.sh');
+const safedepsHome = path.join(os.homedir(), '.safedeps');
+const agentRoot = path.join(safedepsHome, 'agent');
+const installedWrapperPath = path.join(agentRoot, 'scripts', 'safedeps-recheck-alert.sh');
+const launchAgentsDir = path.join(os.homedir(), 'Library', 'LaunchAgents');
+const plistPath = path.join(launchAgentsDir, `${LABEL}.plist`);
+const launchdStdoutPath = path.join(safedepsHome, 'launchd-recheck.out.log');
+const launchdStderrPath = path.join(safedepsHome, 'launchd-recheck.err.log');
+
+function usage() {
+  console.log(`usage: install-safedeps-recheck-agent.mjs <install|uninstall|status> [--hour HH] [--minute MM]
+
+Default schedule: 09:00 local time.
+`);
+}
+
+function parseArgs(argv) {
+  const args = { command: argv[0] || 'install', hour: 9, minute: 0 };
+  if (args.command === '-h' || args.command === '--help') {
+    args.command = 'help';
+  }
+  for (let i = 1; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--hour') {
+      args.hour = Number(argv[++i]);
+    } else if (arg === '--minute') {
+      args.minute = Number(argv[++i]);
+    } else if (arg === '-h' || arg === '--help') {
+      args.command = 'help';
+    } else {
+      throw new Error(`unknown argument: ${arg}`);
+    }
+  }
+  if (!Number.isInteger(args.hour) || args.hour < 0 || args.hour > 23) {
+    throw new Error('--hour must be an integer from 0 to 23');
+  }
+  if (!Number.isInteger(args.minute) || args.minute < 0 || args.minute > 59) {
+    throw new Error('--minute must be an integer from 0 to 59');
+  }
+  return args;
+}
+
+function xmlEscape(value) {
+  return String(value)
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&apos;');
+}
+
+function plistXml({ hour, minute }) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xmlEscape(installedWrapperPath)}</string>
+  </array>
+  <key>StartCalendarInterval</key>
+  <dict>
+    <key>Hour</key>
+    <integer>${hour}</integer>
+    <key>Minute</key>
+    <integer>${minute}</integer>
+  </dict>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>SAFEDEPS_HOME</key>
+    <string>${xmlEscape(safedepsHome)}</string>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(launchdStdoutPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(launchdStderrPath)}</string>
+</dict>
+</plist>
+`;
+}
+
+function copyRuntimeFile(relativePath, mode) {
+  const source = path.join(repoRoot, relativePath);
+  const target = path.join(agentRoot, relativePath);
+
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  fs.copyFileSync(source, target);
+  fs.chmodSync(target, mode);
+}
+
+function installRuntime() {
+  copyRuntimeFile('bin/safedeps', 0o755);
+  copyRuntimeFile('lib/providers/providers.sh', 0o755);
+  copyRuntimeFile('lib/ledger/ledger.sh', 0o755);
+  copyRuntimeFile('scripts/safedeps-recheck-alert.sh', 0o755);
+}
+
+function run(command, args, { allowFailure = false } = {}) {
+  const result = spawnSync(command, args, { encoding: 'utf8' });
+  if (result.status !== 0 && !allowFailure) {
+    const detail = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+    throw new Error(`${command} ${args.join(' ')} failed${detail ? `\n${detail}` : ''}`);
+  }
+  return result;
+}
+
+function serviceTarget() {
+  return `gui/${process.getuid()}/${LABEL}`;
+}
+
+function domainTarget() {
+  return `gui/${process.getuid()}`;
+}
+
+function install(args) {
+  if (process.platform !== 'darwin') {
+    throw new Error('launchd re-check agent install is supported on macOS only');
+  }
+  if (!fs.existsSync(wrapperPath)) {
+    throw new Error(`wrapper not found: ${wrapperPath}`);
+  }
+
+  fs.mkdirSync(launchAgentsDir, { recursive: true, mode: 0o700 });
+  fs.mkdirSync(safedepsHome, { recursive: true, mode: 0o700 });
+  fs.chmodSync(wrapperPath, 0o755);
+  installRuntime();
+  fs.writeFileSync(launchdStdoutPath, '');
+  fs.writeFileSync(launchdStderrPath, '');
+
+  const tempPath = `${plistPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tempPath, plistXml(args), { mode: 0o644 });
+  fs.renameSync(tempPath, plistPath);
+
+  run('launchctl', ['bootout', domainTarget(), plistPath], { allowFailure: true });
+  run('launchctl', ['bootstrap', domainTarget(), plistPath]);
+  run('launchctl', ['kickstart', '-k', serviceTarget()]);
+
+  console.log(JSON.stringify({
+    installed: true,
+    label: LABEL,
+    plistPath,
+    agentRoot,
+    program: installedWrapperPath,
+    schedule: { hour: args.hour, minute: args.minute },
+    logs: {
+      recheck: path.join(os.homedir(), '.safedeps', 'recheck.log'),
+      alerts: path.join(os.homedir(), '.safedeps', 'recheck-alerts.jsonl'),
+      launchdStdout: launchdStdoutPath,
+      launchdStderr: launchdStderrPath
+    }
+  }, null, 2));
+}
+
+function uninstall() {
+  if (process.platform !== 'darwin') {
+    throw new Error('launchd re-check agent uninstall is supported on macOS only');
+  }
+  run('launchctl', ['bootout', domainTarget(), plistPath], { allowFailure: true });
+  if (fs.existsSync(plistPath)) {
+    fs.rmSync(plistPath);
+  }
+  console.log(JSON.stringify({ installed: false, label: LABEL, plistPath, agentRoot }, null, 2));
+}
+
+function status() {
+  const result = run('launchctl', ['print', serviceTarget()], { allowFailure: true });
+  process.stdout.write(result.stdout || '');
+  process.stderr.write(result.stderr || '');
+  process.exitCode = result.status === 0 ? 0 : 1;
+}
+
+try {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.command === 'help') {
+    usage();
+  } else if (args.command === 'install') {
+    install(args);
+  } else if (args.command === 'uninstall') {
+    uninstall();
+  } else if (args.command === 'status') {
+    status();
+  } else {
+    throw new Error(`unknown command: ${args.command}`);
+  }
+} catch (error) {
+  console.error(`safedeps re-check agent: ${error.message}`);
+  process.exit(1);
+}

package/scripts/install/migrate-safedeps-state.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/* Migrate legacy npm-reorg-guard state into the safedeps namespace. */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const legacyRoot = process.env.SAFEDEPS_LEGACY_HOME || path.join(os.homedir(), '.npm-reorg-guard');
+const targetRoot = process.env.SAFEDEPS_HOME || path.join(os.homedir(), '.safedeps');
+const keepLegacy = process.argv.includes('--keep-legacy');
+
+function stamp() {
+  return new Date().toISOString().replaceAll(':', '').replaceAll('.', '').replace('Z', 'Z');
+}
+
+function uniqueArchivePath(base) {
+  let candidate = `${base}.migrated-${stamp()}`;
+  let i = 1;
+  while (fs.existsSync(candidate)) {
+    candidate = `${base}.migrated-${stamp()}-${i}`;
+    i += 1;
+  }
+  return candidate;
+}
+
+function walk(root) {
+  const out = [];
+  if (!fs.existsSync(root)) return out;
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const abs = path.join(root, entry.name);
+    if (entry.isDirectory()) {
+      out.push(...walk(abs));
+    } else if (entry.isFile() || entry.isSymbolicLink()) {
+      out.push(abs);
+    }
+  }
+  return out;
+}
+
+function migrate() {
+  if (!fs.existsSync(legacyRoot)) {
+    return { migrated: false, reason: 'legacy_missing', legacyRoot, targetRoot, copied: 0, skipped: 0 };
+  }
+
+  fs.mkdirSync(targetRoot, { recursive: true, mode: 0o700 });
+
+  let copied = 0;
+  let skipped = 0;
+  const skippedPaths = [];
+  for (const source of walk(legacyRoot)) {
+    const rel = path.relative(legacyRoot, source);
+    const target = path.join(targetRoot, rel);
+    if (fs.existsSync(target)) {
+      skipped += 1;
+      skippedPaths.push(rel);
+      continue;
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    fs.copyFileSync(source, target);
+    try {
+      fs.chmodSync(target, fs.statSync(source).mode & 0o777);
+    } catch {
+      fs.chmodSync(target, 0o600);
+    }
+    copied += 1;
+  }
+
+  let archivedAs = null;
+  if (!keepLegacy) {
+    archivedAs = uniqueArchivePath(legacyRoot);
+    fs.renameSync(legacyRoot, archivedAs);
+  }
+
+  return {
+    migrated: true,
+    legacyRoot,
+    targetRoot,
+    copied,
+    skipped,
+    skippedPaths,
+    archivedAs,
+    keptLegacy: keepLegacy
+  };
+}
+
+try {
+  console.log(JSON.stringify(migrate(), null, 2));
+} catch (error) {
+  console.error(`safedeps migrate: ${error.message}`);
+  process.exit(1);
+}