@bobfrankston/npmglobalize 1.0.112 → 1.0.114

package/lib.js

@@ -1406,6 +1406,226 @@ function getSecurityNpmignorePatterns() {
 function lineHasPattern(lines, pattern) {
     return lines.some(line => line === pattern || line === pattern.replace('/', ''));
 }
+/** Detect OAuth credentials type from a specific JSON file path.
+ *  Returns 'installed' (public app ID, safe) or 'web' (real secret) or null. */
+function detectCredentialsTypeFromFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        const parsed = JSON.parse(content);
+        if (parsed.installed)
+            return 'installed';
+        if (parsed.web)
+            return 'web';
+        return null; // Unknown format (e.g., Microsoft OAuth)
+    }
+    catch {
+        return null;
+    }
+}
+/** Detect OAuth credentials.json type: "installed" (public app ID, safe to include) or "web" (has real secret, must ignore).
+ *  Returns null if no credentials.json exists or it can't be parsed. */
+function detectCredentialsType(cwd) {
+    return detectCredentialsTypeFromFile(path.join(cwd, 'credentials.json'));
+}
+/** Parse GitHub push protection (GH013) error output and extract secret details + unblock URLs. */
+function parsePushProtection(errorOutput, cwd) {
+    const result = { detected: false, secrets: [], allInstalledOAuth: false };
+    if (!errorOutput)
+        return result;
+    // Strip 'remote: ' prefixes for easier parsing
+    const cleaned = errorOutput.replace(/^remote:\s*/gm, '');
+    if (!cleaned.includes('GH013') && !cleaned.toLowerCase().includes('push protection')) {
+        return result;
+    }
+    result.detected = true;
+    // Split on secret-type headers: "—— Secret Type ————..."
+    const blocks = cleaned.split(/\u2014\u2014\s+/).slice(1);
+    for (const block of blocks) {
+        const typeMatch = block.match(/^(.+?)[\s\u2014]+/);
+        const type = typeMatch ? typeMatch[1].trim() : '';
+        if (!type)
+            continue;
+        const pathMatch = block.match(/path:\s+(\S+?)(?::(\d+))?\s/);
+        const file = pathMatch ? pathMatch[1].trim() : '';
+        const urlMatch = block.match(/(https:\/\/github\.com\/\S+\/unblock-secret\/\S+)/);
+        const unblockUrl = urlMatch ? urlMatch[1].trim() : '';
+        if (type && (file || unblockUrl)) {
+            result.secrets.push({ type, file, unblockUrl });
+        }
+    }
+    // Check if all detected secrets are from Google OAuth installed apps (safe to include)
+    if (result.secrets.length > 0) {
+        result.allInstalledOAuth = result.secrets.every(s => {
+            if (!s.type.toLowerCase().includes('oauth'))
+                return false;
+            if (!s.file)
+                return false;
+            const credType = detectCredentialsTypeFromFile(path.join(cwd, s.file));
+            return credType === 'installed';
+        });
+    }
+    return result;
+}
+/** Try to auto-bypass push protection for installed OAuth secrets via gh API.
+ *  Returns true if all bypasses succeeded and push should be retried. */
+function tryAutoBypassPushProtection(ppInfo, cwd) {
+    if (!ppInfo.allInstalledOAuth || ppInfo.secrets.length === 0)
+        return false;
+    // Check if gh CLI is available
+    const ghCheck = runCommand('gh', ['auth', 'status'], { cwd, silent: true });
+    if (!ghCheck.success)
+        return false;
+    // Extract repo owner/name from unblock URLs or git remote
+    let repo = '';
+    for (const s of ppInfo.secrets) {
+        if (s.unblockUrl) {
+            const repoMatch = s.unblockUrl.match(/github\.com\/([^/]+\/[^/]+)\//);
+            if (repoMatch) {
+                repo = repoMatch[1];
+                break;
+            }
+        }
+    }
+    if (!repo)
+        return false;
+    let allBypassed = true;
+    for (const s of ppInfo.secrets) {
+        if (!s.unblockUrl) {
+            allBypassed = false;
+            continue;
+        }
+        // Extract placeholder_id from unblock URL (last path segment)
+        const idMatch = s.unblockUrl.match(/\/unblock-secret\/(\S+)/);
+        if (!idMatch) {
+            allBypassed = false;
+            continue;
+        }
+        const placeholderId = idMatch[1];
+        console.log(colors.cyan(`  Bypassing push protection for: ${s.type} (false_positive — installed app ID)...`));
+        const bypassResult = runCommand('gh', [
+            'api', `repos/${repo}/secret-scanning/push-protection-bypasses`,
+            '-X', 'POST',
+            '-f', 'reason=false_positive',
+            '-f', `placeholder_id=${placeholderId}`
+        ], { cwd, silent: true });
+        if (!bypassResult.success) {
+            allBypassed = false;
+        }
+    }
+    return allBypassed;
+}
+/** Display push protection guidance based on the type of secrets detected. */
+function showPushProtectionGuidance(ppInfo) {
+    console.error('');
+    console.error(colors.yellow('GitHub Push Protection blocked the push — secrets detected in commits.'));
+    if (ppInfo.allInstalledOAuth) {
+        console.error(colors.cyan('These are Google OAuth credentials for a desktop/installed app.'));
+        console.error(colors.cyan('The "client_secret" is just a public app identifier, not a real secret.'));
+        console.error(colors.cyan('(Google docs: "the client_secret is obviously not treated as a secret")'));
+        console.error('');
+        console.error('To unblock, visit each URL below and allow the secret:');
+    }
+    else {
+        console.error('');
+        console.error('To unblock, review each secret and visit the URL to allow or remove it:');
+    }
+    for (const s of ppInfo.secrets) {
+        console.error(`  ${s.type}: ${s.file}`);
+        if (s.unblockUrl) {
+            console.error(`    ${colors.cyan(s.unblockUrl)}`);
+        }
+    }
+    console.error('');
+    console.error('After unblocking, re-run the push or re-run npmglobalize.');
+}
+/** Push to git with push-protection detection and auto-bypass for installed OAuth.
+ *  Returns true if push succeeded (possibly after auto-bypass). */
+function pushWithProtection(cwd, verbose) {
+    const pushResult = runCommand('git', ['push'], { cwd, silent: true });
+    if (pushResult.success) {
+        if (verbose)
+            console.log(colors.green('  ✓ Pushed to remote'));
+        return true;
+    }
+    const ppInfo = parsePushProtection(pushResult.stderr, cwd);
+    if (!ppInfo.detected) {
+        console.error(colors.red('Git push failed:'));
+        if (pushResult.stderr)
+            console.error(pushResult.stderr);
+        return false;
+    }
+    // Try auto-bypass for installed OAuth credentials
+    if (ppInfo.allInstalledOAuth && tryAutoBypassPushProtection(ppInfo, cwd)) {
+        console.log(colors.green('  ✓ Auto-bypassed push protection (installed OAuth — not a real secret)'));
+        const retryPush = runCommand('git', ['push'], { cwd, silent: true });
+        if (retryPush.success) {
+            if (verbose)
+                console.log(colors.green('  ✓ Pushed to remote'));
+            return true;
+        }
+        console.error(colors.yellow('Push still failed after bypass:'));
+        if (retryPush.stderr)
+            console.error(retryPush.stderr);
+        return false;
+    }
+    // Can't auto-bypass — show manual guidance
+    showPushProtectionGuidance(ppInfo);
+    return false;
+}
+/** Ensure credentials.json is handled correctly in ignore files based on OAuth type.
+ *  "installed" apps: client_secret is just a public app registration ID — must be INCLUDED.
+ *  "web" apps: client_secret is a real secret — must be IGNORED. */
+function conformCredentialsIgnore(cwd) {
+    const credType = detectCredentialsType(cwd);
+    if (!credType)
+        return;
+    for (const ignoreFile of ['.gitignore', '.npmignore']) {
+        const ignorePath = path.join(cwd, ignoreFile);
+        if (!fs.existsSync(ignorePath))
+            continue;
+        const content = fs.readFileSync(ignorePath, 'utf-8');
+        const lines = content.split('\n');
+        const trimmed = lines.map(l => l.trim());
+        if (credType === 'installed') {
+            // Ensure credentials.json is NOT ignored — add negation if it's being blocked
+            const hasBlock = trimmed.some(l => l === 'credentials.json' || l === 'credentials.json/');
+            const hasNegation = trimmed.some(l => l === '!credentials.json');
+            if (hasBlock && !hasNegation) {
+                // Add negation after the blocking line
+                const newLines = [...lines];
+                const blockIdx = trimmed.findIndex(l => l === 'credentials.json' || l === 'credentials.json/');
+                newLines.splice(blockIdx + 1, 0, '!credentials.json');
+                fs.writeFileSync(ignorePath, newLines.join('\n'));
+                console.log(colors.cyan(`  ✓ ${ignoreFile}: added !credentials.json (installed app — public OAuth app ID)`));
+            }
+            else if (!hasBlock && !hasNegation) {
+                // No block exists, but add negation defensively in case a broader pattern catches it
+                const newContent = content.trimEnd() + '\n!credentials.json\n';
+                fs.writeFileSync(ignorePath, newContent);
+                console.log(colors.cyan(`  ✓ ${ignoreFile}: added !credentials.json (installed app — public OAuth app ID)`));
+            }
+        }
+        else if (credType === 'web') {
+            // Ensure credentials.json IS ignored
+            const hasBlock = trimmed.some(l => l === 'credentials.json');
+            if (!hasBlock) {
+                const newContent = content.trimEnd() + '\ncredentials.json\n';
+                fs.writeFileSync(ignorePath, newContent);
+                console.log(colors.cyan(`  ✓ ${ignoreFile}: added credentials.json to ignore (web app — real secret)`));
+            }
+            // Remove any negation that would un-ignore it
+            const negIdx = trimmed.findIndex(l => l === '!credentials.json');
+            if (negIdx >= 0) {
+                const newLines = [...lines];
+                newLines.splice(negIdx, 1);
+                fs.writeFileSync(ignorePath, newLines.join('\n'));
+                console.log(colors.yellow(`  ✓ ${ignoreFile}: removed !credentials.json (web app — must not be public)`));
+            }
+        }
+    }
+}
 /** Check if ignore files need updates; separates security (auto-fix) from recommended (prompt) */
 function checkIgnoreFiles(cwd, options) {
     const changes = [];
@@ -2753,7 +2973,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 runCommand('git', ['add', 'package.json'], { cwd });
                 runCommand('git', ['commit', '-m', 'Restore file: dependencies'], { cwd });
                 if (currentGitStatus.hasRemote) {
-                    runCommand('git', ['push'], { cwd });
+                    pushWithProtection(cwd, verbose);
                 }
             }
         }
@@ -2781,7 +3001,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 runCommand('git', ['add', 'package.json'], { cwd });
                 runCommand('git', ['commit', '-m', 'Restore file: dependencies'], { cwd });
                 if (currentGitStatus.hasRemote) {
-                    runCommand('git', ['push'], { cwd });
+                    pushWithProtection(cwd, verbose);
                 }
             }
         }
@@ -2832,29 +3052,58 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     }
                 }
                 else if (install) {
-                    waitForNpmVersion(pkgName, pkgVersion);
-                    console.log(`Installing ${pkgName}@${pkgVersion} globally from registry...`);
-                    const registryInstallResult = installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd);
-                    if (registryInstallResult.success) {
-                        console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
+                    // Quick check: does this version actually exist on npm?
+                    const vCheck = spawnSafe('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
+                        shell: process.platform === 'win32',
+                        stdio: ['pipe', 'pipe', 'pipe'],
+                        encoding: 'utf-8'
+                    });
+                    const versionOnNpm = vCheck.status === 0 && vCheck.stdout?.trim() === pkgVersion;
+                    if (versionOnNpm) {
+                        console.log(`Installing ${pkgName}@${pkgVersion} globally from registry...`);
+                        const registryInstallResult = installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd);
+                        if (registryInstallResult.success) {
+                            console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
+                        }
+                        else {
+                            console.error(colors.red(`✗ Global install failed`));
+                            console.error(colors.yellow(`  Try running manually: npm install -g ${pkgName}@${pkgVersion}`));
+                        }
                     }
                     else {
-                        console.error(colors.red(`✗ Global install failed`));
-                        console.error(colors.yellow(`  Try running manually: npm install -g ${pkgName}@${pkgVersion}`));
+                        console.log(colors.yellow(`${pkgName}@${pkgVersion} not found on npm — installing from local directory.`));
+                        console.log(colors.dim('  Use -m "message" to publish this version to npm.'));
+                        const localResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                        if (localResult.success) {
+                            console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
+                        }
+                        else {
+                            console.error(colors.red(`✗ Local install failed`));
+                            console.error(colors.yellow('  Try running manually: npm install -g .'));
+                        }
                     }
                 }
                 if (wsl) {
-                    const wslArgs = link ? ['npm', 'install', '-g', '.'] : ['npm', 'install', '-g', `${pkgName}@${pkgVersion}`];
-                    if (!link && !install)
+                    // Check if version is on npm for registry-based WSL install
+                    const useLocal = link || (() => {
+                        const vc = spawnSafe('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
+                            shell: process.platform === 'win32',
+                            stdio: ['pipe', 'pipe', 'pipe'],
+                            encoding: 'utf-8'
+                        });
+                        return !(vc.status === 0 && vc.stdout?.trim() === pkgVersion);
+                    })();
+                    const wslArgs = useLocal ? ['npm', 'install', '-g', '.'] : ['npm', 'install', '-g', `${pkgName}@${pkgVersion}`];
+                    if (!useLocal)
                         waitForNpmVersion(pkgName, pkgVersion);
-                    console.log(`Installing ${pkgName} in WSL${link ? ' (link)' : ' from registry'}...`);
+                    console.log(`Installing ${pkgName} in WSL${useLocal ? ' (local)' : ' from registry'}...`);
                     const wslInstallResult = runCommand('wsl', wslArgs, { cwd, silent: false, showCommand: true });
                     if (wslInstallResult.success) {
                         console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
                     }
                     else {
                         console.error(colors.red(`✗ WSL install failed`));
-                        console.error(colors.yellow('  Try running manually in WSL: npm install -g ' + (link ? '.' : pkgName)));
+                        console.error(colors.yellow('  Try running manually in WSL: npm install -g ' + (useLocal ? '.' : pkgName)));
                     }
                 }
             }
@@ -2953,13 +3202,14 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // Version bump
     console.log(`Bumping version (${bump})...`);
     if (!dryRun) {
-        // Temporarily disable postversion hook to prevent double-publishing
+        // Temporarily disable postversion hook to prevent double-publishing or push
+        // (push is handled separately with push-protection detection)
         const pkg = readPackageJson(cwd);
         const originalPostversion = pkg.scripts?.postversion;
         let postversDisabled = false;
-        if (originalPostversion && originalPostversion.includes('npm publish')) {
+        if (originalPostversion && (originalPostversion.includes('npm publish') || originalPostversion.includes('git push'))) {
             if (verbose) {
-                console.log('Temporarily disabling postversion hook to prevent double-publish...');
+                console.log('Temporarily disabling postversion hook (npmglobalize handles publish/push)...');
             }
             delete pkg.scripts.postversion;
             writePackageJson(cwd, pkg);
@@ -3124,6 +3374,35 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.error('  • Disk space or permissions issues');
                 console.error(colors.yellow('\nTry running with --verbose or check git status manually'));
             }
+            else if (combinedOutput.includes('gh013') || combinedOutput.includes('push protection') || combinedOutput.includes('push declined due to repository rule')) {
+                // GitHub push protection blocked a push (from postversion script)
+                const ppInfo = parsePushProtection(error.stderr || error.stdout || error.message || '', cwd);
+                if (ppInfo.detected) {
+                    showPushProtectionGuidance(ppInfo);
+                }
+                else {
+                    console.error(colors.yellow('\nGitHub push protection blocked the push.'));
+                    console.error(colors.yellow('Check the output above for unblock URLs.'));
+                }
+                console.log(colors.yellow('Version and tag were created locally. Continuing with publish...'));
+                autoFixed = true;
+            }
+            // If version/tag exist locally despite error, postversion script likely failed
+            // (e.g., push protection with inherited stdio that we couldn't capture)
+            if (!autoFixed) {
+                try {
+                    const postPkg = readPackageJson(cwd);
+                    const tagCheck = runCommand('git', ['tag', '-l', `v${postPkg.version}`], { cwd, silent: true });
+                    if (tagCheck.success && tagCheck.output.trim() === `v${postPkg.version}`) {
+                        console.log(colors.yellow('\nVersion and tag created locally — postversion script may have failed.'));
+                        console.log(colors.yellow('Continuing — push will be attempted separately.'));
+                        autoFixed = true;
+                    }
+                }
+                catch {
+                    // ignore — fall through to normal error handling
+                }
+            }
             if (!autoFixed) {
                 if (!force) {
                     return false;
@@ -3333,14 +3612,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     else {
         console.log(`  [dry-run] Would run: npm publish ${quiet ? '--quiet' : ''}`);
     }
-    // Push to git
+    // Push to git (with push-protection detection and auto-bypass)
     if (currentGitStatus.hasRemote) {
         if (verbose) {
             console.log('Pushing to git...');
         }
         if (!dryRun) {
-            runCommand('git', ['push'], { cwd, silent: !verbose });
-            runCommand('git', ['push', '--tags'], { cwd, silent: !verbose });
+            if (pushWithProtection(cwd, verbose)) {
+                const tagResult = runCommand('git', ['push', '--tags'], { cwd, silent: true });
+                if (verbose && tagResult.success)
+                    console.log(colors.green('  ✓ Pushed tags'));
+            }
         }
         else {
             console.log('  [dry-run] Would push to git');
@@ -3440,7 +3722,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             runCommand('git', ['add', 'package.json'], { cwd });
             runCommand('git', ['commit', '-m', 'Restore file: dependencies'], { cwd });
             if (currentGitStatus.hasRemote) {
-                runCommand('git', ['push'], { cwd });
+                pushWithProtection(cwd, verbose);
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.112",
+  "version": "1.0.114",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",