@cellajs/cli 0.6.0 → 0.6.2

package/README.md

@@ -414,7 +414,8 @@ previous value, and a package.json without `type` gets upstream's. Set it yourse
 
 1. **Updates.** It lists the outdated packages and runtime pins in one table and asks once which to
    update. Rows with a high or critical advisory start ticked; submitting with nothing ticked skips
-   this layer.
+   this layer. Above the prompt it prints what `pnpm audit` reports right now, including packages
+   that have no row, so a run you cancel has shown them too.
 2. **Security.** It audits the workspace as the picked updates leave it and brings three settings
    in `pnpm-workspace.yaml` in line with that audit.
 

package/dist/index.js

@@ -228,7 +228,7 @@ import process5 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.6.0",
+  version: "0.6.2",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and upgrading it with upstream Cella.",
@@ -1436,6 +1436,129 @@ function formatAlignmentsLine(total, open) {
   return `alignments: ${parts.join(" \xB7 ")}`;
 }
 
+// src/utils/upstream-overrides.ts
+import { Node, Project as Project2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+var LIST_KEYS = ["pinned", "ignored"];
+function resolveExpression(node, sourceFile, depth = 0) {
+  if (!node || depth > 8) return node;
+  if (Node.isParenthesizedExpression(node) || Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) {
+    return resolveExpression(node.getExpression(), sourceFile, depth + 1);
+  }
+  if (Node.isIdentifier(node)) {
+    return resolveExpression(
+      sourceFile.getVariableDeclaration(node.getText())?.getInitializer(),
+      sourceFile,
+      depth + 1
+    );
+  }
+  return node;
+}
+function findConfigObject(sourceFile) {
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
+    if (call.getExpression().getText() !== "defineConfig") continue;
+    const arg = resolveExpression(call.getArguments()[0], sourceFile);
+    if (Node.isObjectLiteralExpression(arg)) return arg;
+  }
+  const exported = sourceFile.getExportAssignment((assignment) => !assignment.isExportEquals());
+  const value = resolveExpression(exported?.getExpression(), sourceFile);
+  return Node.isObjectLiteralExpression(value) ? value : void 0;
+}
+function readProperty(object, name, sourceFile) {
+  for (const property of object.getProperties()) {
+    if (Node.isPropertyAssignment(property)) {
+      if (property.getName().replace(/^['"`]|['"`]$/g, "") !== name) continue;
+      return resolveExpression(property.getInitializer(), sourceFile) ?? null;
+    }
+    if (Node.isShorthandPropertyAssignment(property) && property.getName() === name) {
+      return resolveExpression(property.getNameNode(), sourceFile) ?? null;
+    }
+  }
+  return void 0;
+}
+function readStringEntries(node) {
+  if (!Node.isArrayLiteralExpression(node)) return null;
+  const entries = [];
+  for (const element of node.getElements()) {
+    if (Node.isStringLiteral(element) || Node.isNoSubstitutionTemplateLiteral(element)) {
+      entries.push(element.getLiteralValue());
+    }
+  }
+  return entries;
+}
+function readPackageJsonKeys(config, sourceFile) {
+  const settings = readProperty(config, "settings", sourceFile);
+  if (settings === void 0) return [...DEFAULT_PACKAGE_JSON_KEYS];
+  if (!settings || !Node.isObjectLiteralExpression(settings)) return null;
+  const current = readProperty(settings, "packageJsonKeys", sourceFile);
+  const keys = current === void 0 ? readProperty(settings, "packageJsonSync", sourceFile) : current;
+  if (keys === void 0) return [...DEFAULT_PACKAGE_JSON_KEYS];
+  return keys ? readStringEntries(keys) : null;
+}
+function parseOverrideLists(source) {
+  try {
+    const project = new Project2({ useInMemoryFileSystem: true, skipLoadingLibFiles: true });
+    const sourceFile = project.createSourceFile("cella.config.ts", source);
+    const config = findConfigObject(sourceFile);
+    if (!config) return null;
+    const lists = {
+      pinned: [],
+      ignored: [],
+      packageJsonKeys: readPackageJsonKeys(config, sourceFile)
+    };
+    const overrides = readProperty(config, "overrides", sourceFile);
+    if (overrides === void 0) return lists;
+    if (!overrides || !Node.isObjectLiteralExpression(overrides)) return null;
+    for (const key of LIST_KEYS) {
+      const list = readProperty(overrides, key, sourceFile);
+      if (list === void 0) continue;
+      const entries = list ? readStringEntries(list) : null;
+      if (!entries) return null;
+      lists[key] = entries;
+    }
+    return lists;
+  } catch {
+    return null;
+  }
+}
+function diffOverrideLists(base, incoming, fork) {
+  const diff = (key) => {
+    const baseSet = new Set(base[key].map(normalizeEntry).filter(Boolean));
+    const incomingSet = new Set(incoming[key].map(normalizeEntry).filter(Boolean));
+    const forkEntries = fork[key].map(normalizeEntry).filter(Boolean);
+    return {
+      added: [...incomingSet].filter((entry) => !baseSet.has(entry) && !isUnderAnyFolder(entry, forkEntries)),
+      removed: [...baseSet].filter((entry) => !incomingSet.has(entry) && forkEntries.includes(entry))
+    };
+  };
+  const diffKeys = () => {
+    const [baseKeys, incomingKeys, forkKeys] = [base.packageJsonKeys, incoming.packageJsonKeys, fork.packageJsonKeys];
+    if (!baseKeys || !incomingKeys || !forkKeys) return { added: [], removed: [] };
+    return {
+      added: [...new Set(incomingKeys)].filter((key) => !baseKeys.includes(key) && !forkKeys.includes(key)),
+      removed: [...new Set(baseKeys)].filter((key) => !incomingKeys.includes(key) && forkKeys.includes(key))
+    };
+  };
+  return { pinned: diff("pinned"), ignored: diff("ignored"), packageJsonKeys: diffKeys() };
+}
+async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, forkConfig) {
+  const [baseSource, incomingSource] = await Promise.all(
+    [mergeBaseRef, incomingRef].map((ref) => git(["show", `${ref}:${CONFIG_FILE}`], repoPath, { ignoreErrors: true }))
+  );
+  if (baseSource === incomingSource) return void 0;
+  const base = baseSource ? parseOverrideLists(baseSource) : null;
+  if (!base) return { kind: "unreadable", side: "base" };
+  const incoming = incomingSource ? parseOverrideLists(incomingSource) : null;
+  if (!incoming) return { kind: "unreadable", side: "incoming" };
+  const fork = {
+    pinned: forkConfig.overrides?.pinned ?? [],
+    ignored: forkConfig.overrides?.ignored ?? [],
+    packageJsonKeys: forkConfig.settings.packageJsonKeys ?? DEFAULT_PACKAGE_JSON_KEYS
+  };
+  const changes = diffOverrideLists(base, incoming, fork);
+  const count3 = Object.values(changes).reduce((n, list) => n + list.added.length + list.removed.length, 0);
+  return count3 > 0 ? { kind: "changes", ...changes } : void 0;
+}
+
 // src/utils/overrides.ts
 function normalizeEntry(entry) {
   return entry.trim().replace(/^\.\//, "").replace(/\/+$/, "");
@@ -1491,8 +1614,11 @@ async function validateOverrides(config, forkPath, upstreamRef) {
   }
   if (upstream && pinsUpstreamHas.length > 0) {
     const differs = await listChangedSinceRef(forkPath, upstream, pinsUpstreamHas.map(normalizeEntry));
+    const upstreamSource = await git(["show", `${upstream}:${CONFIG_FILE}`], forkPath, { ignoreErrors: true });
+    const upstreamPins = upstreamSource && parseOverrideLists(upstreamSource)?.pinned.map(normalizeEntry) || [];
     for (const entry of pinsUpstreamHas) {
       if (differs.some((changed) => isUnderAnyFolder(changed, [entry]))) continue;
+      if (upstreamPins.includes(normalizeEntry(entry))) continue;
       warnings.push(`pin is identical to upstream, it only drops upstream's next change: ${entry}`);
     }
   }
@@ -1814,129 +1940,6 @@ function cliVersionMismatch(running, range) {
   ].join("\n");
 }
 
-// src/utils/upstream-overrides.ts
-import { Node, Project as Project2, SyntaxKind as SyntaxKind2 } from "ts-morph";
-var LIST_KEYS = ["pinned", "ignored"];
-function resolveExpression(node, sourceFile, depth = 0) {
-  if (!node || depth > 8) return node;
-  if (Node.isParenthesizedExpression(node) || Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) {
-    return resolveExpression(node.getExpression(), sourceFile, depth + 1);
-  }
-  if (Node.isIdentifier(node)) {
-    return resolveExpression(
-      sourceFile.getVariableDeclaration(node.getText())?.getInitializer(),
-      sourceFile,
-      depth + 1
-    );
-  }
-  return node;
-}
-function findConfigObject(sourceFile) {
-  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind2.CallExpression)) {
-    if (call.getExpression().getText() !== "defineConfig") continue;
-    const arg = resolveExpression(call.getArguments()[0], sourceFile);
-    if (Node.isObjectLiteralExpression(arg)) return arg;
-  }
-  const exported = sourceFile.getExportAssignment((assignment) => !assignment.isExportEquals());
-  const value = resolveExpression(exported?.getExpression(), sourceFile);
-  return Node.isObjectLiteralExpression(value) ? value : void 0;
-}
-function readProperty(object, name, sourceFile) {
-  for (const property of object.getProperties()) {
-    if (Node.isPropertyAssignment(property)) {
-      if (property.getName().replace(/^['"`]|['"`]$/g, "") !== name) continue;
-      return resolveExpression(property.getInitializer(), sourceFile) ?? null;
-    }
-    if (Node.isShorthandPropertyAssignment(property) && property.getName() === name) {
-      return resolveExpression(property.getNameNode(), sourceFile) ?? null;
-    }
-  }
-  return void 0;
-}
-function readStringEntries(node) {
-  if (!Node.isArrayLiteralExpression(node)) return null;
-  const entries = [];
-  for (const element of node.getElements()) {
-    if (Node.isStringLiteral(element) || Node.isNoSubstitutionTemplateLiteral(element)) {
-      entries.push(element.getLiteralValue());
-    }
-  }
-  return entries;
-}
-function readPackageJsonKeys(config, sourceFile) {
-  const settings = readProperty(config, "settings", sourceFile);
-  if (settings === void 0) return [...DEFAULT_PACKAGE_JSON_KEYS];
-  if (!settings || !Node.isObjectLiteralExpression(settings)) return null;
-  const current = readProperty(settings, "packageJsonKeys", sourceFile);
-  const keys = current === void 0 ? readProperty(settings, "packageJsonSync", sourceFile) : current;
-  if (keys === void 0) return [...DEFAULT_PACKAGE_JSON_KEYS];
-  return keys ? readStringEntries(keys) : null;
-}
-function parseOverrideLists(source) {
-  try {
-    const project = new Project2({ useInMemoryFileSystem: true, skipLoadingLibFiles: true });
-    const sourceFile = project.createSourceFile("cella.config.ts", source);
-    const config = findConfigObject(sourceFile);
-    if (!config) return null;
-    const lists = {
-      pinned: [],
-      ignored: [],
-      packageJsonKeys: readPackageJsonKeys(config, sourceFile)
-    };
-    const overrides = readProperty(config, "overrides", sourceFile);
-    if (overrides === void 0) return lists;
-    if (!overrides || !Node.isObjectLiteralExpression(overrides)) return null;
-    for (const key of LIST_KEYS) {
-      const list = readProperty(overrides, key, sourceFile);
-      if (list === void 0) continue;
-      const entries = list ? readStringEntries(list) : null;
-      if (!entries) return null;
-      lists[key] = entries;
-    }
-    return lists;
-  } catch {
-    return null;
-  }
-}
-function diffOverrideLists(base, incoming, fork) {
-  const diff = (key) => {
-    const baseSet = new Set(base[key].map(normalizeEntry).filter(Boolean));
-    const incomingSet = new Set(incoming[key].map(normalizeEntry).filter(Boolean));
-    const forkEntries = fork[key].map(normalizeEntry).filter(Boolean);
-    return {
-      added: [...incomingSet].filter((entry) => !baseSet.has(entry) && !isUnderAnyFolder(entry, forkEntries)),
-      removed: [...baseSet].filter((entry) => !incomingSet.has(entry) && forkEntries.includes(entry))
-    };
-  };
-  const diffKeys = () => {
-    const [baseKeys, incomingKeys, forkKeys] = [base.packageJsonKeys, incoming.packageJsonKeys, fork.packageJsonKeys];
-    if (!baseKeys || !incomingKeys || !forkKeys) return { added: [], removed: [] };
-    return {
-      added: [...new Set(incomingKeys)].filter((key) => !baseKeys.includes(key) && !forkKeys.includes(key)),
-      removed: [...new Set(baseKeys)].filter((key) => !incomingKeys.includes(key) && forkKeys.includes(key))
-    };
-  };
-  return { pinned: diff("pinned"), ignored: diff("ignored"), packageJsonKeys: diffKeys() };
-}
-async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, forkConfig) {
-  const [baseSource, incomingSource] = await Promise.all(
-    [mergeBaseRef, incomingRef].map((ref) => git(["show", `${ref}:${CONFIG_FILE}`], repoPath, { ignoreErrors: true }))
-  );
-  if (baseSource === incomingSource) return void 0;
-  const base = baseSource ? parseOverrideLists(baseSource) : null;
-  if (!base) return { kind: "unreadable", side: "base" };
-  const incoming = incomingSource ? parseOverrideLists(incomingSource) : null;
-  if (!incoming) return { kind: "unreadable", side: "incoming" };
-  const fork = {
-    pinned: forkConfig.overrides?.pinned ?? [],
-    ignored: forkConfig.overrides?.ignored ?? [],
-    packageJsonKeys: forkConfig.settings.packageJsonKeys ?? DEFAULT_PACKAGE_JSON_KEYS
-  };
-  const changes = diffOverrideLists(base, incoming, fork);
-  const count3 = Object.values(changes).reduce((n, list) => n + list.added.length + list.removed.length, 0);
-  return count3 > 0 ? { kind: "changes", ...changes } : void 0;
-}
-
 // src/services/analyze-core.ts
 function isReportableIgnored(filePath) {
   return !isManagedFile(filePath) && !isGeneratedFile(filePath);
@@ -4466,8 +4469,9 @@ async function runAudit(config) {
     }
     const runtimes = planRuntimeUpdates(pins, feeds, { releaseAgeMinutes, now });
     const localTools = planLocalTools(machine, { releaseAgeMinutes, now });
+    const advisories = auditResult ? advisoriesFromAudit(auditResult) : null;
     const rows = [
-      ...packageRows(outdated, auditResult ? advisoriesFromAudit(auditResult) : []),
+      ...packageRows(outdated, advisories ?? []),
       ...runtimes.updates.map(runtimeRow)
     ];
     if (rows.length === 0) {
@@ -4487,6 +4491,7 @@ async function runAudit(config) {
       await runSecurityPass(forkPath, { apply: false, releaseAgeMinutes });
       return;
     }
+    printReported(advisories);
     const selected = await promptForUpdates(rows);
     if (!selected) return;
     const { edits, bumped } = await planEdits(forkPath, rows, selected, pins.nodeImageSuffixes);
@@ -4495,8 +4500,8 @@ async function runAudit(config) {
     spinner.stop();
   }
 }
+var worstSeverity = (advisories, name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
 function packageRows(outdated, advisories) {
-  const severityOf = (name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
   const readDependentPkg = createDependentPkgReader();
   const rows = Object.entries(outdated).map(([key, pkg]) => {
     const name = outdatedPackageName(key);
@@ -4520,7 +4525,7 @@ function packageRows(outdated, advisories) {
       pinnedIn,
       repoUrl,
       releasesUrl: getReleasesUrl(repoUrl),
-      severity: severityOf(name)
+      severity: worstSeverity(advisories, name)
     };
   });
   return rows.sort((a, b) => inText(a).localeCompare(inText(b)) || a.name.localeCompare(b.name));
@@ -4626,6 +4631,40 @@ function printLocalTools(checks) {
   }
   console.info();
 }
+function printReported(advisories) {
+  if (!advisories) {
+    console.info(`${warningMark} pnpm audit gave no answer: a row in the table can lack its dot`);
+    console.info();
+    return;
+  }
+  if (advisories.length === 0) {
+    console.info(`${checkMark} pnpm audit reports nothing ${colors_default.dim("\xB7 with the current overrides and ignores")}`);
+    console.info();
+    return;
+  }
+  const modules = [...new Set(advisories.map((a) => a.module))].map((name) => {
+    const own = advisories.filter((a) => a.module === name);
+    return {
+      name,
+      severity: worstSeverity(own, name) ?? own[0].severity,
+      installed: [...new Set(own.flatMap((a) => a.installed))].join(", "),
+      via: formatDependents([...new Set(own.flatMap((a) => a.via))]),
+      direct: own.some((a) => a.direct)
+    };
+  });
+  modules.sort((a, b) => SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf(b.severity));
+  const nameWidth = Math.min(30, Math.max(...modules.map((m) => m.name.length)));
+  const versionWidth = Math.max(...modules.map((m) => m.installed.length));
+  console.info(`${colors_default.bold("pnpm audit")} ${colors_default.dim("\xB7 with the current overrides and ignores")}`);
+  for (const m of modules) {
+    const name = colors_default.white(middleTruncate(m.name, nameWidth).padEnd(nameWidth));
+    const source = `${m.via}${m.direct ? " (direct)" : ""}`;
+    console.info(
+      `${getVulnIcon(m.severity)} ${name}  ${m.severity.padEnd(8)}  ${m.installed.padEnd(versionWidth)}  ${colors_default.dim(source)}`
+    );
+  }
+  console.info();
+}
 function buildUpdateChoices(rows) {
   const makeChoice = (row) => {
     const devTag = row.isDev ? colors_default.dim(" (dev)") : "";