@bobfrankston/npmglobalize 1.0.114 → 1.0.116

package/README.md

@@ -127,6 +127,16 @@ npmglobalize --fix        # Runs npm audit fix
 npmglobalize --no-fix
 ```
 
+### 🔑 OAuth Credentials Handling
+
+`npmglobalize` automatically detects `credentials.json` files and handles them based on OAuth app type:
+
+- **Desktop/installed apps** (`"installed"` key in JSON): The `client_secret` is just a public app registration ID, not a real secret. Google's own docs state: *"the client_secret is obviously not treated as a secret."* These files are kept in the repo — `!credentials.json` is added to `.gitignore`/`.npmignore` to override any broader ignore patterns.
+
+- **Web apps** (`"web"` key in JSON): The `client_secret` is a real secret. These files are automatically added to `.gitignore`/`.npmignore` to prevent accidental exposure.
+
+This distinction also drives the **push protection auto-bypass**: when GitHub blocks a push because it detects an OAuth client secret, `npmglobalize` checks the credential file type. For installed apps, it auto-bypasses (marking as `false_positive`) since the credential is public by design.
+
 ### 🔄 File Reference Management
 
 **Default behavior** (restore file: references after publish):
@@ -165,6 +175,10 @@ npmglobalize --rebase     # Auto-rebase if behind remote
 
 For single-developer projects, this safely pulls remote changes before publishing.
 
+**Failed publish recovery**: If a previous run bumped the version locally but the publish or push failed (e.g., network error, push protection), `npmglobalize` detects this automatically on the next run. It checks whether the current version actually exists on npm — if not, it republishes without re-bumping the version. Unpushed commits from a failed push are also pushed automatically.
+
+**GitHub Push Protection (GH013)**: When GitHub's secret scanning blocks a push, `npmglobalize` detects the error and checks whether the flagged secrets are actually safe. For Google OAuth desktop/installed app credentials (where the "client_secret" is just a public app identifier, not a real secret), it automatically bypasses push protection via the GitHub API (`gh` CLI required) and retries the push. For other secret types, it displays the unblock URLs with guidance.
+
 **Note:** This tool is designed for single-developer, single-branch workflows where automatic rebase and tag cleanup are safe operations.
 
 ### 📂 Git Repository Setup
@@ -390,17 +404,18 @@ npmglobalize --dry-run     # See what would happen
 ## How It Works
 
 1. **Validates** package.json and git status
-2. **Updates dependencies** (if `--update-deps`)
-3. **Publishes file: dependencies** (if needed)
-4. **Backs up** original file: references to `.dependencies`
-5. **Converts** `file:` → npm version references
-6. **Commits** changes
-7. **Bumps** version (using npm version)
-8. **Publishes** to npm
-9. **Pushes** to git
-10. **Installs** globally (if `--install`)
-11. **Restores** file: references (if `--files`, default)
-12. **Runs audit** (shows security status)
+2. **Checks** if current version is on npm (recovers from failed publishes)
+3. **Updates dependencies** (if `--update-deps`)
+4. **Publishes file: dependencies** (if needed)
+5. **Backs up** original file: references to `.dependencies`
+6. **Converts** `file:` → npm version references
+7. **Commits** changes
+8. **Bumps** version (using npm version) — skipped if recovering a failed publish
+9. **Publishes** to npm
+10. **Pushes** to git (with push-protection detection and auto-bypass)
+11. **Installs** globally (if `--install`)
+12. **Restores** file: references (if `--files`, default)
+13. **Runs audit** (shows security status)
 
 ## Operational Details
 

package/lib.js

@@ -1440,30 +1440,51 @@ function parsePushProtection(errorOutput, cwd) {
         return result;
     }
     result.detected = true;
-    // Split on secret-type headers: "—— Secret Type ————..."
-    const blocks = cleaned.split(/\u2014\u2014\s+/).slice(1);
-    for (const block of blocks) {
-        const typeMatch = block.match(/^(.+?)[\s\u2014]+/);
-        const type = typeMatch ? typeMatch[1].trim() : '';
-        if (!type)
-            continue;
-        const pathMatch = block.match(/path:\s+(\S+?)(?::(\d+))?\s/);
-        const file = pathMatch ? pathMatch[1].trim() : '';
-        const urlMatch = block.match(/(https:\/\/github\.com\/\S+\/unblock-secret\/\S+)/);
-        const unblockUrl = urlMatch ? urlMatch[1].trim() : '';
-        if (type && (file || unblockUrl)) {
-            result.secrets.push({ type, file, unblockUrl });
+    // Match secret blocks using a single regex across any dash characters
+    // Pattern: "-- Type Name ---..." then "path: file:line" then "unblock-secret/id" URL
+    // Handles em-dash (—), en-dash (–), and regular dash (-)
+    const secretRegex = /[-\u2014\u2013]{2,}\s+(.+?)\s+[-\u2014\u2013]{2,}[\s\S]*?path:\s+(\S+?)(?::\d+)?\s[\s\S]*?(https:\/\/github\.com\/\S+\/unblock-secret\/\S+)/g;
+    let match;
+    while ((match = secretRegex.exec(cleaned)) !== null) {
+        result.secrets.push({
+            type: match[1].trim(),
+            file: match[2].trim(),
+            unblockUrl: match[3].trim()
+        });
+    }
+    // If regex didn't match (encoding issues), fall back to finding unblock URLs + paths
+    if (result.secrets.length === 0) {
+        const urlRegex = /(https:\/\/github\.com\/\S+\/unblock-secret\/\S+)/g;
+        const pathRegex = /path:\s+(\S+?)(?::\d+)?\s/g;
+        const urls = [];
+        const files = [];
+        let m;
+        while ((m = urlRegex.exec(cleaned)) !== null)
+            urls.push(m[1].trim());
+        while ((m = pathRegex.exec(cleaned)) !== null)
+            files.push(m[1].trim());
+        // Try to detect secret type from text
+        const hasOAuth = cleaned.toLowerCase().includes('oauth');
+        const secretType = hasOAuth ? 'Google OAuth Credential' : 'Secret';
+        for (let i = 0; i < Math.max(urls.length, files.length); i++) {
+            result.secrets.push({
+                type: secretType,
+                file: files[i] || '',
+                unblockUrl: urls[i] || ''
+            });
         }
     }
     // Check if all detected secrets are from Google OAuth installed apps (safe to include)
     if (result.secrets.length > 0) {
         result.allInstalledOAuth = result.secrets.every(s => {
-            if (!s.type.toLowerCase().includes('oauth'))
-                return false;
             if (!s.file)
                 return false;
+            // Check by type name OR by inspecting the actual credential file
             const credType = detectCredentialsTypeFromFile(path.join(cwd, s.file));
-            return credType === 'installed';
+            if (credType === 'installed')
+                return true;
+            // Also match if the type name mentions OAuth (even if file check failed)
+            return s.type.toLowerCase().includes('oauth') && credType !== 'web';
         });
     }
     return result;
@@ -3012,103 +3033,127 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // Check if there are changes to commit or a custom message
     // Skip this check for first publish (currentAccess null) or just-initialized repos
     const isFirstPublish = !currentAccess;
+    let skipVersionBump = false;
     if (!currentGitStatus.hasUncommitted && !message && !justInitialized && !isFirstPublish) {
-        console.log('');
-        if (currentAccess === 'public') {
-            console.log(`${pkg.name}@${pkg.version} is already PUBLIC on npm. No changes to publish.`);
-        }
-        else if (currentAccess === 'restricted') {
-            console.log(`${pkg.name}@${pkg.version} is PRIVATE on npm. No changes to publish.`);
+        // Check if the current version is actually on npm (it might have failed to publish previously)
+        const versionCheck = spawnSafe('npm', ['view', `${pkg.name}@${pkg.version}`, 'version'], {
+            shell: process.platform === 'win32',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            encoding: 'utf-8'
+        });
+        const versionIsOnNpm = versionCheck.status === 0 && versionCheck.stdout?.trim() === pkg.version;
+        if (!versionIsOnNpm && currentAccess) {
+            // Version not on npm — previous publish/push likely failed
+            // Skip version bump but fall through to publish+push
+            console.log('');
+            console.log(colors.yellow(`${pkg.name}@${pkg.version} is NOT on npm (previous publish may have failed).`));
+            console.log(colors.yellow('Republishing current version...'));
+            skipVersionBump = true;
         }
         else {
-            console.log('No changes to commit and no custom message specified.');
-        }
-        console.log(colors.dim('  Use -m "message" to force a version bump and republish.'));
-        // If install/link flag is set, install globally
-        if (install || link || wsl) {
-            if (verbose) {
-                console.log('');
-                console.log(link ? 'Installing from local directory (link)...' : 'Installing from registry...');
-            }
-            const pkgName = pkg.name;
-            const pkgVersion = pkg.version;
-            if (!pkg.bin && (install || link || wsl)) {
-                const proceed = await offerAddBin(cwd, pkg);
-                if (!proceed) {
-                    console.log(colors.yellow('Skipping global install — library packages should not be installed globally.'));
-                    console.log(colors.yellow(`To use in projects: npm install ${pkgName}`));
-                }
-            }
-            if (pkg.bin && (install || link || wsl)) {
-                if (link) {
-                    console.log(`Installing ${pkgName} globally from local directory (link)...`);
-                    const localInstallResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
-                    if (localInstallResult.success) {
-                        console.log(colors.green(`✓ Linked globally: ${pkgName}@${pkgVersion}`));
-                    }
-                    else {
-                        console.error(colors.red(`✗ Global link install failed`));
-                        console.error(colors.yellow('  Try running manually: npm install -g .'));
+            // Version is on npm — truly nothing to publish
+            console.log('');
+            if (currentAccess === 'public') {
+                console.log(`${pkg.name}@${pkg.version} is already PUBLIC on npm. No changes to publish.`);
+            }
+            else if (currentAccess === 'restricted') {
+                console.log(`${pkg.name}@${pkg.version} is PRIVATE on npm. No changes to publish.`);
+            }
+            else {
+                console.log('No changes to commit and no custom message specified.');
+            }
+            console.log(colors.dim('  Use -m "message" to force a version bump and republish.'));
+            // Push any unpushed commits (e.g., from a previous failed push)
+            if (currentGitStatus.hasRemote && currentGitStatus.hasUnpushed && !dryRun) {
+                console.log(colors.yellow('Pushing unpushed commits...'));
+                pushWithProtection(cwd, verbose);
+            }
+            // If install/link flag is set, install globally
+            if (install || link || wsl) {
+                if (verbose) {
+                    console.log('');
+                    console.log(link ? 'Installing from local directory (link)...' : 'Installing from registry...');
+                }
+                const pkgName = pkg.name;
+                const pkgVersion = pkg.version;
+                if (!pkg.bin && (install || link || wsl)) {
+                    const proceed = await offerAddBin(cwd, pkg);
+                    if (!proceed) {
+                        console.log(colors.yellow('Skipping global install — library packages should not be installed globally.'));
+                        console.log(colors.yellow(`To use in projects: npm install ${pkgName}`));
                     }
                 }
-                else if (install) {
-                    // Quick check: does this version actually exist on npm?
-                    const vCheck = spawnSafe('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
-                        shell: process.platform === 'win32',
-                        stdio: ['pipe', 'pipe', 'pipe'],
-                        encoding: 'utf-8'
-                    });
-                    const versionOnNpm = vCheck.status === 0 && vCheck.stdout?.trim() === pkgVersion;
-                    if (versionOnNpm) {
-                        console.log(`Installing ${pkgName}@${pkgVersion} globally from registry...`);
-                        const registryInstallResult = installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd);
-                        if (registryInstallResult.success) {
-                            console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
-                        }
-                        else {
-                            console.error(colors.red(`✗ Global install failed`));
-                            console.error(colors.yellow(`  Try running manually: npm install -g ${pkgName}@${pkgVersion}`));
-                        }
-                    }
-                    else {
-                        console.log(colors.yellow(`${pkgName}@${pkgVersion} not found on npm — installing from local directory.`));
-                        console.log(colors.dim('  Use -m "message" to publish this version to npm.'));
-                        const localResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
-                        if (localResult.success) {
-                            console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
+                if (pkg.bin && (install || link || wsl)) {
+                    if (link) {
+                        console.log(`Installing ${pkgName} globally from local directory (link)...`);
+                        const localInstallResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                        if (localInstallResult.success) {
+                            console.log(colors.green(`✓ Linked globally: ${pkgName}@${pkgVersion}`));
                         }
                         else {
-                            console.error(colors.red(`✗ Local install failed`));
+                            console.error(colors.red(`✗ Global link install failed`));
                             console.error(colors.yellow('  Try running manually: npm install -g .'));
                         }
                     }
-                }
-                if (wsl) {
-                    // Check if version is on npm for registry-based WSL install
-                    const useLocal = link || (() => {
-                        const vc = spawnSafe('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
+                    else if (install) {
+                        // Quick check: does this version actually exist on npm?
+                        const vCheck = spawnSafe('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
                             shell: process.platform === 'win32',
                             stdio: ['pipe', 'pipe', 'pipe'],
                             encoding: 'utf-8'
                         });
-                        return !(vc.status === 0 && vc.stdout?.trim() === pkgVersion);
-                    })();
-                    const wslArgs = useLocal ? ['npm', 'install', '-g', '.'] : ['npm', 'install', '-g', `${pkgName}@${pkgVersion}`];
-                    if (!useLocal)
-                        waitForNpmVersion(pkgName, pkgVersion);
-                    console.log(`Installing ${pkgName} in WSL${useLocal ? ' (local)' : ' from registry'}...`);
-                    const wslInstallResult = runCommand('wsl', wslArgs, { cwd, silent: false, showCommand: true });
-                    if (wslInstallResult.success) {
-                        console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
+                        const vOnNpm = vCheck.status === 0 && vCheck.stdout?.trim() === pkgVersion;
+                        if (vOnNpm) {
+                            console.log(`Installing ${pkgName}@${pkgVersion} globally from registry...`);
+                            const registryInstallResult = installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd);
+                            if (registryInstallResult.success) {
+                                console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
+                            }
+                            else {
+                                console.error(colors.red(`✗ Global install failed`));
+                                console.error(colors.yellow(`  Try running manually: npm install -g ${pkgName}@${pkgVersion}`));
+                            }
+                        }
+                        else {
+                            console.log(colors.yellow(`${pkgName}@${pkgVersion} not found on npm — installing from local directory.`));
+                            console.log(colors.dim('  Use -m "message" to publish this version to npm.'));
+                            const localResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                            if (localResult.success) {
+                                console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
+                            }
+                            else {
+                                console.error(colors.red(`✗ Local install failed`));
+                                console.error(colors.yellow('  Try running manually: npm install -g .'));
+                            }
+                        }
                     }
-                    else {
-                        console.error(colors.red(`✗ WSL install failed`));
-                        console.error(colors.yellow('  Try running manually in WSL: npm install -g ' + (useLocal ? '.' : pkgName)));
+                    if (wsl) {
+                        // Check if version is on npm for registry-based WSL install
+                        const useLocal = link || (() => {
+                            const vc = spawnSafe('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
+                                shell: process.platform === 'win32',
+                                stdio: ['pipe', 'pipe', 'pipe'],
+                                encoding: 'utf-8'
+                            });
+                            return !(vc.status === 0 && vc.stdout?.trim() === pkgVersion);
+                        })();
+                        const wslArgs = useLocal ? ['npm', 'install', '-g', '.'] : ['npm', 'install', '-g', `${pkgName}@${pkgVersion}`];
+                        if (!useLocal)
+                            waitForNpmVersion(pkgName, pkgVersion);
+                        console.log(`Installing ${pkgName} in WSL${useLocal ? ' (local)' : ' from registry'}...`);
+                        const wslInstallResult = runCommand('wsl', wslArgs, { cwd, silent: false, showCommand: true });
+                        if (wslInstallResult.success) {
+                            console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
+                        }
+                        else {
+                            console.error(colors.red(`✗ WSL install failed`));
+                            console.error(colors.yellow('  Try running manually in WSL: npm install -g ' + (useLocal ? '.' : pkgName)));
+                        }
                     }
                 }
             }
+            return true;
         }
-        return true;
     }
     // Ensure node_modules is in .gitignore before any git operations
     if (currentGitStatus.isRepo && !dryRun) {
@@ -3199,9 +3244,14 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             console.log('  Pulled latest from remote');
         }
     }
-    // Version bump
-    console.log(`Bumping version (${bump})...`);
-    if (!dryRun) {
+    // Version bump (skip if republishing a version that's already bumped locally)
+    if (skipVersionBump) {
+        console.log(`Skipping version bump — ${pkg.version} already set locally.`);
+    }
+    else {
+        console.log(`Bumping version (${bump})...`);
+    }
+    if (!dryRun && !skipVersionBump) {
         // Temporarily disable postversion hook to prevent double-publishing or push
         // (push is handled separately with push-protection detection)
         const pkg = readPackageJson(cwd);
@@ -3411,7 +3461,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             }
         }
     }
-    else {
+    else if (!skipVersionBump) {
         console.log(`  [dry-run] Would run: npm version ${bump}`);
     }
     // Publish

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.114",
+  "version": "1.0.116",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",