@cassiomc1/forgeloop 0.1.14 → 0.1.15

package/src/core/verification-capability.js

@@ -1,3 +1,4 @@
+import fs from "node:fs/promises";
 import {
   E_AUTHORITY_UNTRUSTED_SOURCE,
   resolveTrustedAuthority,
@@ -11,6 +12,7 @@ export {
 
 export const E_VERIFICATION_TOOL_UNAVAILABLE = "E_VERIFICATION_TOOL_UNAVAILABLE";
 export const E_INSTALLATION_AUTHORITY_REQUIRED = "E_INSTALLATION_AUTHORITY_REQUIRED";
+export const E_COMMAND_RESOLUTION_AMBIGUOUS = "E_COMMAND_RESOLUTION_AMBIGUOUS";
 export const E_AUTHORITY_INVALID = "E_AUTHORITY_INVALID";
 export const E_AUTHORITY_SCOPE_MISMATCH = "E_AUTHORITY_SCOPE_MISMATCH";
 
@@ -155,8 +157,397 @@ function extractToolFromArgs(args) {
   return null;
 }
 
-function classifySingleCommand(commandString) {
-  const tokens = tokenizeCommand(commandString);
+function extractNpmExecTool(args) {
+  if (!Array.isArray(args) || args.length === 0) return null;
+  for (let idx = 0; idx < args.length; idx++) {
+    const arg = args[idx];
+    if (arg === "-p" || arg === "--package") {
+      if (args[idx + 1] && !args[idx + 1].startsWith("-")) {
+        return args[idx + 1];
+      }
+    }
+    if (arg.startsWith("--package=")) {
+      return arg.slice("--package=".length);
+    }
+  }
+  let afterDoubleDash = false;
+  for (let idx = 0; idx < args.length; idx++) {
+    const arg = args[idx];
+    if (arg === "--") {
+      afterDoubleDash = true;
+      if (args[idx + 1] && !args[idx + 1].startsWith("-")) {
+        return args[idx + 1];
+      }
+      continue;
+    }
+    if (!afterDoubleDash && !arg.startsWith("-")) {
+      return arg;
+    }
+  }
+  return null;
+}
+
+function normalizeExecutableName(binaryToken) {
+  const base = binaryToken.split(/[\\/]/u).pop() ?? binaryToken;
+  return base.toLowerCase().replace(/\.(?:cmd|bat|exe)$/u, "");
+}
+
+const NPM_INSTALL_COMMANDS = new Set([
+  "install", "add", "i", "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall",
+]);
+
+const NPM_CI_COMMANDS = new Set([
+  "ci", "clean-install", "ic", "install-clean", "isntall-clean",
+]);
+
+const NPM_INSTALL_TEST_COMMANDS = new Set([
+  "install-test", "it",
+]);
+
+const NPM_INSTALL_CI_TEST_COMMANDS = new Set([
+  "install-ci-test", "cit", "clean-install-test", "sit",
+]);
+
+const NPM_EXEC_COMMANDS = new Set([
+  "exec", "x",
+]);
+
+const NPM_INIT_COMMANDS = new Set([
+  "init", "create", "innit",
+]);
+
+const NPM_SCRIPT_COMMANDS = new Set([
+  "test", "t", "tst", "start", "stop", "restart", "run", "run-script", "rum", "urn",
+]);
+
+const NPM_KNOWN_NON_INSTALLING_COMMANDS = new Set([
+  "v", "view", "info", "show", "list", "ls", "outdated", "config", "help", "help-search", "doctor", "ping", "root", "prefix", "bin", "whoami",
+]);
+
+const NPM_KNOWN_BOOLEAN_OPTIONS = new Set([
+  "--silent", "--json", "--long", "--parseable", "--global", "-g", "--force", "--yes", "-y", "--no",
+]);
+
+const NPM_OPTIONS_WITH_VALUE = new Set([
+  "--workspace",
+  "-w",
+  "--loglevel",
+  "--prefix",
+  "-C",
+  "--userconfig",
+  "--registry",
+  "--cache",
+]);
+
+export function parseNpmInvocationArgs(rest) {
+  if (!Array.isArray(rest)) {
+    return {
+      subcommand: null,
+      subcommandIndex: -1,
+      args: [],
+      leadingOptions: [],
+      workspace: null,
+      workspaces: false,
+      ambiguous: true,
+    };
+  }
+
+  const leadingOptions = [];
+  let workspace = null;
+  let workspaces = false;
+
+  let i = 0;
+  while (i < rest.length) {
+    const arg = rest[i];
+
+    if (arg === "--") {
+      break;
+    }
+
+    if (!arg.startsWith("-")) {
+      break;
+    }
+
+    if (arg === "--workspaces" || arg === "--ws") {
+      workspaces = true;
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+
+    if (arg.startsWith("--workspace=")) {
+      workspace = arg.slice("--workspace=".length) || null;
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+
+    if (arg.startsWith("-w=")) {
+      workspace = arg.slice(3) || null;
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+
+    if (arg === "--workspace" || arg === "-w") {
+      leadingOptions.push(arg);
+      const value = rest[i + 1] ?? null;
+      if (value !== null && !value.startsWith("-")) {
+        workspace = value;
+        leadingOptions.push(value);
+        i += 2;
+      } else {
+        workspace = value;
+        i += 1;
+      }
+      continue;
+    }
+
+    if (NPM_OPTIONS_WITH_VALUE.has(arg)) {
+      leadingOptions.push(arg);
+      const value = rest[i + 1] ?? null;
+      if (value !== null && !value.startsWith("-")) {
+        leadingOptions.push(value);
+        i += 2;
+      } else {
+        i += 1;
+      }
+      continue;
+    }
+
+    if (/^--[^=]+=/.test(arg)) {
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+
+    if (NPM_KNOWN_BOOLEAN_OPTIONS.has(arg)) {
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+
+    if (/^--/.test(arg)) {
+      const next = rest[i + 1];
+      if (next && !next.startsWith("-")) {
+        return {
+          subcommand: null,
+          subcommandIndex: -1,
+          args: [],
+          leadingOptions,
+          workspace,
+          workspaces,
+          ambiguous: true,
+          reason: "NPM_OPTION_VALUE_AMBIGUOUS",
+        };
+      }
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+
+    if (arg.startsWith("-")) {
+      leadingOptions.push(arg);
+      i += 1;
+      continue;
+    }
+  }
+
+  const subcommand = rest[i] ? rest[i].toLowerCase() : null;
+  const trailingArgs = subcommand ? rest.slice(i + 1) : [];
+
+  for (let j = 0; j < trailingArgs.length; j++) {
+    const tArg = trailingArgs[j];
+    if (tArg === "--") break;
+    if (tArg === "--workspaces" || tArg === "--ws") {
+      workspaces = true;
+    } else if (tArg.startsWith("--workspace=")) {
+      workspace = tArg.slice("--workspace=".length) || null;
+    } else if (tArg.startsWith("-w=")) {
+      workspace = tArg.slice(3) || null;
+    } else if (tArg === "--workspace" || tArg === "-w") {
+      const val = trailingArgs[j + 1];
+      if (val && !val.startsWith("-")) {
+        workspace = val;
+        j += 1;
+      }
+    }
+  }
+
+  const ambiguous = subcommand === null;
+  return {
+    subcommand,
+    subcommandIndex: subcommand ? i : -1,
+    args: trailingArgs,
+    leadingOptions,
+    workspace,
+    workspaces,
+    ambiguous,
+    ...(ambiguous ? { reason: "NPM_SUBCOMMAND_AMBIGUOUS" } : {}),
+  };
+}
+
+export function parseNpmInvocation(argv) {
+  const tokens = unwrapCommandArgv(Array.isArray(argv) ? argv : tokenizeCommand(argv));
+  if (!tokens || tokens.length === 0) {
+    return {
+      subcommand: null,
+      subcommandIndex: -1,
+      args: [],
+      leadingOptions: [],
+      workspace: null,
+      workspaces: false,
+      ambiguous: true,
+    };
+  }
+  const binary = normalizeExecutableName(tokens[0]);
+  if (binary !== "npm") {
+    return {
+      subcommand: null,
+      subcommandIndex: -1,
+      args: [],
+      leadingOptions: [],
+      workspace: null,
+      workspaces: false,
+      ambiguous: true,
+    };
+  }
+  return parseNpmInvocationArgs(tokens.slice(1));
+}
+
+export function npmWorkspaceSelection(npmInvocation) {
+  return {
+    scoped: Boolean(npmInvocation?.workspace || npmInvocation?.workspaces),
+    workspace: npmInvocation?.workspace ?? null,
+    allWorkspaces: npmInvocation?.workspaces === true,
+  };
+}
+
+export function classifyNpmInvocation(npm) {
+  const sub = npm.subcommand;
+
+  if (npm.ambiguous) {
+    return {
+      resolutionMode: "UNKNOWN",
+      mayInstall: true,
+      installer: "npm",
+      tool: null,
+      reason: npm.reason || "NPM_SUBCOMMAND_AMBIGUOUS",
+    };
+  }
+
+  if (NPM_EXEC_COMMANDS.has(sub)) {
+    return {
+      resolutionMode: "INSTALL_CAPABLE_RESOLUTION",
+      mayInstall: true,
+      installer: `npm ${sub}`,
+      tool: extractNpmExecTool(npm.args),
+    };
+  }
+
+  if (NPM_INSTALL_COMMANDS.has(sub) || NPM_CI_COMMANDS.has(sub) || NPM_INSTALL_TEST_COMMANDS.has(sub) || NPM_INSTALL_CI_TEST_COMMANDS.has(sub)) {
+    let tool = null;
+    let installer = `npm ${sub}`;
+    if (NPM_INSTALL_COMMANDS.has(sub)) {
+      tool = extractToolFromArgs(npm.args);
+      installer = "npm";
+    }
+    return {
+      resolutionMode: "EXPLICIT_INSTALLATION",
+      mayInstall: true,
+      installer,
+      tool,
+    };
+  }
+
+  if (NPM_INIT_COMMANDS.has(sub)) {
+    let firstMeaningful = null;
+    for (let i = 0; i < npm.args.length; i++) {
+      const arg = npm.args[i];
+      if (arg === "--") {
+        const next = npm.args[i + 1];
+        firstMeaningful = next && !next.startsWith("-") ? next : null;
+        break;
+      }
+      if (!arg.startsWith("-")) {
+        firstMeaningful = arg;
+        break;
+      }
+    }
+    if (firstMeaningful) {
+      return {
+        resolutionMode: "INSTALL_CAPABLE_RESOLUTION",
+        mayInstall: true,
+        installer: `npm ${sub}`,
+        tool: firstMeaningful,
+      };
+    }
+    return {
+      resolutionMode: "LOCAL_PACKAGE_BINARY",
+      mayInstall: false,
+      installer: null,
+      tool: null,
+    };
+  }
+
+  if (sub === "update" || sub === "up" || sub === "upgrade") {
+    return {
+      resolutionMode: "INSTALL_CAPABLE_RESOLUTION",
+      mayInstall: true,
+      installer: `npm ${sub}`,
+      tool: extractToolFromArgs(npm.args),
+    };
+  }
+
+  if (sub === "audit") {
+    if (npm.args.includes("fix")) {
+      return {
+        resolutionMode: "INSTALL_CAPABLE_RESOLUTION",
+        mayInstall: true,
+        installer: "npm audit fix",
+        tool: null,
+      };
+    }
+    return {
+      resolutionMode: "LOCAL_PACKAGE_BINARY",
+      mayInstall: false,
+      installer: null,
+      tool: null,
+    };
+  }
+
+  if (NPM_SCRIPT_COMMANDS.has(sub)) {
+    return {
+      resolutionMode: "LOCAL_PACKAGE_BINARY",
+      mayInstall: false,
+      installer: null,
+      tool: null,
+      dispatch: {
+        kind: "npm-script-command",
+      },
+    };
+  }
+
+  if (NPM_KNOWN_NON_INSTALLING_COMMANDS.has(sub)) {
+    return {
+      resolutionMode: "LOCAL_PACKAGE_BINARY",
+      mayInstall: false,
+      installer: null,
+      tool: null,
+    };
+  }
+
+  return {
+    resolutionMode: "UNKNOWN",
+    mayInstall: true,
+    installer: "npm",
+    tool: null,
+    reason: "NPM_COMMAND_UNCLASSIFIED",
+  };
+}
+
+function classifySingleCommand(commandInput) {
+  const tokens = Array.isArray(commandInput) ? [...commandInput] : tokenizeCommand(commandInput);
   if (tokens.length === 0) {
     return { resolutionMode: "UNKNOWN", mayInstall: false, installer: null, tool: null };
   }
@@ -170,9 +561,13 @@ function classifySingleCommand(commandString) {
   }
 
   const binaryToken = tokens[i];
-  const binary = path.basename(binaryToken).toLowerCase();
+  const binary = normalizeExecutableName(binaryToken);
   const rest = tokens.slice(i + 1);
 
+  if (binary === "call") {
+    return classifyCommandResolution(rest);
+  }
+
   if (binaryToken.includes("node_modules/.bin/") || binaryToken.startsWith("./node_modules/")) {
     return { resolutionMode: "LOCAL_PACKAGE_BINARY", mayInstall: false, installer: null, tool: binary };
   }
@@ -300,15 +695,8 @@ function classifySingleCommand(commandString) {
 
   // Check npm
   if (binary === "npm") {
-    if (["install", "i", "add"].includes(rest[0])) {
-      return {
-        resolutionMode: "EXPLICIT_INSTALLATION",
-        mayInstall: true,
-        installer: "npm",
-        tool: extractToolFromArgs(rest.slice(1)),
-      };
-    }
-    return { resolutionMode: "LOCAL_PACKAGE_BINARY", mayInstall: false, installer: null, tool: null };
+    const npm = parseNpmInvocationArgs(rest);
+    return classifyNpmInvocation(npm);
   }
 
   // Check python/pip
@@ -360,12 +748,30 @@ function classifySingleCommand(commandString) {
   return { resolutionMode: "LOCAL_EXECUTABLE", mayInstall: false, installer: null, tool: null };
 }
 
-export function classifyCommandResolution(commandString) {
-  if (typeof commandString !== "string" || commandString.trim() === "") {
+export function classifyCommandResolution(commandInput) {
+  if (Array.isArray(commandInput)) {
+    if (commandInput.length === 0 || commandInput.some((item) => typeof item !== "string" || item.trim() === "")) {
+      return { resolutionMode: "UNKNOWN", mayInstall: false, installer: null, tool: null };
+    }
+    const binary = normalizeExecutableName(commandInput[0]);
+    if (["sh", "bash", "zsh", "dash", "ksh"].includes(binary)) {
+      const shellFlagIndex = commandInput.findIndex((item, index) => index > 0 && /^-.*c/.test(item));
+      const shellCommand = shellFlagIndex >= 0 ? commandInput[shellFlagIndex + 1] : null;
+      if (shellCommand) return classifyCommandResolution(shellCommand);
+    }
+    if (binary === "cmd") {
+      const shellFlagIndex = commandInput.findIndex((item, index) => index > 0 && /^\/c$/iu.test(item));
+      const shellCommand = shellFlagIndex >= 0 ? commandInput.slice(shellFlagIndex + 1).join(" ") : null;
+      if (shellCommand) return classifyCommandResolution(shellCommand);
+    }
+    return classifySingleCommand(commandInput);
+  }
+
+  if (typeof commandInput !== "string" || commandInput.trim() === "") {
     return { resolutionMode: "UNKNOWN", mayInstall: false, installer: null, tool: null };
   }
 
-  const subcommands = splitCommandPipeline(commandString);
+  const subcommands = splitCommandPipeline(commandInput);
   for (const subcommand of subcommands) {
     const res = classifySingleCommand(subcommand);
     if (res.mayInstall) {
@@ -373,7 +779,211 @@ export function classifyCommandResolution(commandString) {
     }
   }
 
-  return classifySingleCommand(subcommands[0] || commandString);
+  return classifySingleCommand(subcommands[0] || commandInput);
+}
+
+function unwrapCommandArgv(argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return null;
+  let i = 0;
+  while (i < argv.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i])) {
+    i++;
+  }
+  if (i >= argv.length) return null;
+  const binary = normalizeExecutableName(argv[i]);
+  if (["sh", "bash", "zsh", "dash", "ksh"].includes(binary)) {
+    const shellFlagIndex = argv.findIndex((item, index) => index > i && /^-.*c/.test(item));
+    const shellCommand = shellFlagIndex >= 0 ? argv[shellFlagIndex + 1] : null;
+    if (shellCommand) return tokenizeCommand(shellCommand);
+  }
+  if (binary === "cmd") {
+    const shellFlagIndex = argv.findIndex((item, index) => index > i && /^\/c$/iu.test(item));
+    const shellCommand = shellFlagIndex >= 0 ? argv.slice(shellFlagIndex + 1).join(" ") : null;
+    if (shellCommand) return tokenizeCommand(shellCommand);
+  }
+  if (binary === "call") {
+    return argv.slice(i + 1);
+  }
+  return argv.slice(i);
+}
+
+export function getNpmScriptName(argv) {
+  const npm = parseNpmInvocation(argv);
+  if (npm.ambiguous || !npm.subcommand) {
+    return null;
+  }
+
+  const sub = npm.subcommand;
+  const args = npm.args;
+
+  if (["test", "t", "tst"].includes(sub)) return "test";
+  if (["start", "stop", "restart"].includes(sub)) return sub;
+  if (["run", "run-script", "rum", "urn"].includes(sub)) {
+    let afterDoubleDash = false;
+    for (let idx = 0; idx < args.length; idx++) {
+      const arg = args[idx];
+      if (arg === "--") {
+        afterDoubleDash = true;
+        if (args[idx + 1] && !args[idx + 1].startsWith("-")) {
+          return args[idx + 1];
+        }
+        continue;
+      }
+      if (!afterDoubleDash && !arg.startsWith("-")) {
+        if (idx > 0 && (args[idx - 1] === "-w" || args[idx - 1] === "--workspace" || NPM_OPTIONS_WITH_VALUE.has(args[idx - 1]))) {
+          continue;
+        }
+        return arg;
+      }
+    }
+  }
+  return null;
+}
+
+export function getNpmLifecycleCandidates({ scriptName, scripts = {} } = {}) {
+  if (scriptName === "restart") {
+    if (typeof scripts?.restart === "string" && scripts.restart.trim() !== "") {
+      return ["prerestart", "restart", "postrestart"];
+    }
+    return [
+      "prerestart",
+      "prestop",
+      "stop",
+      "poststop",
+      "prestart",
+      "start",
+      "poststart",
+      "postrestart",
+    ];
+  }
+  return [`pre${scriptName}`, scriptName, `post${scriptName}`];
+}
+
+export const MAX_NPM_SCRIPT_DEPTH = 16;
+
+async function resolveNpmScriptRisk({
+  scriptName,
+  packageJson,
+  visited = new Set(),
+  depth = 0,
+} = {}) {
+  if (depth > MAX_NPM_SCRIPT_DEPTH) {
+    return {
+      resolutionMode: "UNKNOWN",
+      mayInstall: true,
+      installer: "npm-script",
+      tool: null,
+      reason: "MAX_SCRIPT_DEPTH",
+    };
+  }
+
+  if (visited.has(scriptName)) {
+    return {
+      resolutionMode: "UNKNOWN",
+      mayInstall: true,
+      installer: "npm-script",
+      tool: null,
+      reason: "SCRIPT_CYCLE",
+    };
+  }
+
+  const nextVisited = new Set(visited);
+  nextVisited.add(scriptName);
+
+  const candidates = getNpmLifecycleCandidates({
+    scriptName,
+    scripts: packageJson?.scripts ?? {},
+  });
+
+  for (const candidate of candidates) {
+    const scriptBody = packageJson?.scripts?.[candidate];
+    if (typeof scriptBody !== "string" || scriptBody.trim() === "") {
+      continue;
+    }
+
+    const direct = classifyCommandResolution(scriptBody);
+    if (direct.mayInstall) {
+      return {
+        resolutionMode: direct.resolutionMode,
+        mayInstall: true,
+        installer: direct.installer ?? "npm-script",
+        tool: direct.tool,
+        dispatch: {
+          kind: "npm-script",
+          scriptName: candidate,
+        },
+      };
+    }
+
+    const subcommands = splitCommandPipeline(scriptBody);
+    for (const subcommand of subcommands) {
+      const nestedScriptName = getNpmScriptName(subcommand);
+      if (nestedScriptName) {
+        const nested = await resolveNpmScriptRisk({
+          scriptName: nestedScriptName,
+          packageJson,
+          visited: nextVisited,
+          depth: depth + 1,
+        });
+        if (nested?.mayInstall) {
+          return nested;
+        }
+      }
+    }
+  }
+
+  return null;
+}
+
+async function readPackageJsonIfPresent(cwd) {
+  if (!cwd || typeof cwd !== "string") return null;
+  try {
+    const pkgPath = path.resolve(cwd, "package.json");
+    const raw = await fs.readFile(pkgPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+export async function resolveExecutionResolution({ argv, cwd } = {}) {
+  const direct = classifyCommandResolution(argv);
+  if (direct.mayInstall && direct.resolutionMode !== "UNKNOWN") return direct;
+
+  const npmInvocation = parseNpmInvocation(argv);
+  const scriptName = getNpmScriptName(argv);
+
+  if (scriptName && (npmInvocation.workspace || npmInvocation.workspaces)) {
+    return {
+      resolutionMode: "UNKNOWN",
+      mayInstall: true,
+      installer: "npm-workspace",
+      tool: null,
+      reason: "NPM_WORKSPACE_SCRIPT_UNRESOLVED",
+      dispatch: {
+        kind: "npm-workspace-script",
+        scriptName,
+      },
+    };
+  }
+
+  if (direct.mayInstall) return direct;
+  if (!scriptName) return direct;
+
+  const packageJson = await readPackageJsonIfPresent(cwd);
+  if (!packageJson || typeof packageJson.scripts !== "object" || packageJson.scripts === null) {
+    return direct;
+  }
+
+  const nestedRisk = await resolveNpmScriptRisk({
+    scriptName,
+    packageJson,
+  });
+
+  if (nestedRisk?.mayInstall) {
+    return nestedRisk;
+  }
+
+  return direct;
 }
 
 export function getInstallationAuthorityRef(check) {
@@ -489,16 +1099,17 @@ export function validateAuthorityGrant({ authority, taskId, type = "SOFTWARE_INS
 }
 
 export function validateVerificationAuthority(check, options = {}) {
+  const canonicalResolution = check?.execution?.resolution ?? check?.details?.execution?.resolution;
   const command = check?.details?.command
     ?? (check?.kind === "command" && typeof check?.source === "string" && !check.source.startsWith("check:")
       ? check.source
       : null);
 
-  if (!command || typeof command !== "string") {
+  if (!canonicalResolution && (!command || typeof command !== "string")) {
     return { valid: true, error: null };
   }
 
-  const classification = classifyCommandResolution(command);
+  const classification = canonicalResolution ?? classifyCommandResolution(command);
   if (!classification.mayInstall) {
     return { valid: true, error: null };
   }