@guardinstall/cli 0.1.3 → 0.1.5

package/dist/index.js

@@ -39,7 +39,7 @@ const program = new commander_1.Command();
 program
     .name('guardinstall')
     .description('A kernel-level behavioral sandbox for npm/pnpm/bun install scripts')
-    .version('0.0.1');
+    .version('0.1.4');
 program
     .command('install')
     .description('Run npm install with sandbox protection')

package/dist/installer.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPackageManager = void 0;
 const child_process_1 = require("child_process");
 const chalk_1 = __importDefault(require("chalk"));
+const child_process_2 = require("child_process");
 async function runPackageManager(pm, args) {
     const pmMap = {
         npm: 'npm',
@@ -21,16 +22,33 @@ async function runPackageManager(pm, args) {
         // Add --ignore-scripts flag
         args.push('--ignore-scripts');
     }
-    console.log(chalk_1.default.gray(`\n📦 Running: ${command} ${args.join(' ')}\n`));
+    // Remove --ignore-scripts from display (it's expected)
+    const displayArgs = args.filter(a => a !== '--ignore-scripts');
+    console.log(chalk_1.default.gray(`\n📦 Running: ${command} ${displayArgs.join(' ')} (with --ignore-scripts)\n`));
     return new Promise((resolve) => {
+        // Use spawn without shell to avoid npm arborist bug triggered by shell escaping
         const proc = (0, child_process_1.spawn)(command, args, {
             stdio: 'inherit',
-            shell: true
+            shell: false
         });
         let output = '';
         proc.stdout?.on('data', (d) => { output += d.toString(); });
         proc.stderr?.on('data', (d) => { output += d.toString(); });
         proc.on('close', (code) => {
+            // If npm fails with arborist error, try alternative approach
+            if (code !== 0 && command === 'npm') {
+                console.log(chalk_1.default.yellow('\n⚠️  npm encountered an error, trying with --no-audit --no-fund...\n'));
+                try {
+                    // Try running npm without audit/fund which sometimes triggers arborist issues
+                    const fallbackArgs = ['install', '--ignore-scripts', '--no-audit', '--no-fund', ...args.filter(a => a !== 'install' && a !== 'add' && a !== '--ignore-scripts')];
+                    const result = (0, child_process_2.execSync)(`npm ${fallbackArgs.join(' ')}`, { stdio: 'inherit', encoding: 'utf-8' });
+                    resolve({ success: true, output: result || '' });
+                    return;
+                }
+                catch (e) {
+                    // Fallback failed too
+                }
+            }
             resolve({
                 success: code === 0,
                 output

package/dist/resolver.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getInstallScripts = void 0;
 const arborist_1 = __importDefault(require("@npmcli/arborist"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
 const lockfile_1 = require("./lockfile");
 async function getInstallScripts(projectRoot) {
     const arb = new arborist_1.default({ path: projectRoot });
@@ -12,32 +14,93 @@ async function getInstallScripts(projectRoot) {
     try {
         tree = await arb.loadActual();
     }
-    catch {
-        tree = await arb.loadVirtual();
+    catch (e) {
+        console.error('Warning: Error loading package tree:', e instanceof Error ? e.message : e);
+        return getInstallScriptsFromNodeModules(projectRoot); // Fallback to manual scan
     }
     const packagesWithScripts = [];
     const lockfile = (0, lockfile_1.readLockfile)(projectRoot);
-    for (const node of tree.inventory.values()) {
-        const pkg = node.package;
-        if (!pkg)
-            continue;
-        const scripts = pkg.scripts ?? {};
-        const hasInstallScript = ['preinstall', 'install', 'postinstall']
-            .some(s => s in scripts);
-        if (hasInstallScript) {
-            const installScripts = pick(scripts, ['preinstall', 'install', 'postinstall']);
-            packagesWithScripts.push({
-                name: node.name,
-                version: node.version,
-                scripts: installScripts,
-                path: node.path,
-                isNew: !(0, lockfile_1.isInLockfile)(node.name, node.version, lockfile)
-            });
+    try {
+        for (const node of tree.inventory.values()) {
+            const pkg = node.package;
+            if (!pkg)
+                continue;
+            const scripts = pkg.scripts ?? {};
+            const hasInstallScript = ['preinstall', 'install', 'postinstall']
+                .some(s => s in scripts);
+            if (hasInstallScript) {
+                const installScripts = pick(scripts, ['preinstall', 'install', 'postinstall']);
+                packagesWithScripts.push({
+                    name: node.name,
+                    version: node.version,
+                    scripts: installScripts,
+                    path: node.path,
+                    isNew: !(0, lockfile_1.isInLockfile)(node.name, node.version, lockfile)
+                });
+            }
         }
     }
+    catch (e) {
+        console.error('Warning: Error iterating package tree:', e instanceof Error ? e.message : e);
+        return getInstallScriptsFromNodeModules(projectRoot);
+    }
     return packagesWithScripts;
 }
 exports.getInstallScripts = getInstallScripts;
+// Fallback: manually scan node_modules for package.json files
+function getInstallScriptsFromNodeModules(projectRoot) {
+    const packagesWithScripts = [];
+    const lockfile = (0, lockfile_1.readLockfile)(projectRoot);
+    try {
+        const nodeModulesPath = path_1.default.join(projectRoot, 'node_modules');
+        if (!fs_1.default.existsSync(nodeModulesPath))
+            return packagesWithScripts;
+        const scanDir = (dir, depth = 0) => {
+            if (depth > 2)
+                return; // Limit recursion depth
+            try {
+                const entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+                for (const entry of entries) {
+                    if (entry.isDirectory()) {
+                        if (entry.name.startsWith('@')) {
+                            // Scoped package directory
+                            scanDir(path_1.default.join(dir, entry.name), depth + 1);
+                        }
+                        else if (depth === 0 || depth === 1) {
+                            // Check package.json in this directory
+                            const pkgPath = path_1.default.join(dir, entry.name, 'package.json');
+                            if (fs_1.default.existsSync(pkgPath)) {
+                                try {
+                                    const pkgJson = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf-8'));
+                                    if (pkgJson.scripts && ('preinstall' in pkgJson.scripts || 'install' in pkgJson.scripts || 'postinstall' in pkgJson.scripts)) {
+                                        packagesWithScripts.push({
+                                            name: pkgJson.name || entry.name,
+                                            version: pkgJson.version || 'unknown',
+                                            scripts: pick(pkgJson.scripts, ['preinstall', 'install', 'postinstall']),
+                                            path: path_1.default.join(dir, entry.name),
+                                            isNew: !(0, lockfile_1.isInLockfile)(pkgJson.name || entry.name, pkgJson.version || 'unknown', lockfile)
+                                        });
+                                    }
+                                }
+                                catch (e) {
+                                    // Ignore parse errors
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            catch (e) {
+                // Ignore permission errors
+            }
+        };
+        scanDir(nodeModulesPath);
+    }
+    catch (e) {
+        // Ignore errors
+    }
+    return packagesWithScripts;
+}
 function pick(obj, keys) {
     const result = {};
     for (const key of keys) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guardinstall/cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "CLI wrapper for guardinstall - intercepts and sandboxes install scripts",
   "main": "dist/index.js",
   "bin": {
@@ -13,8 +13,8 @@
     "test": "jest"
   },
   "dependencies": {
-    "@guardinstall/policy-engine": "0.1.2",
-    "@guardinstall/sandbox": "0.1.2",
+    "@guardinstall/policy-engine": "0.1.5",
+    "@guardinstall/sandbox": "0.1.5",
     "@npmcli/arborist": "7.5.4",
     "chalk": "4.1.2",
     "commander": "12.1.0"

package/src/index.ts

@@ -13,7 +13,7 @@ const program = new Command()
 program
   .name('guardinstall')
   .description('A kernel-level behavioral sandbox for npm/pnpm/bun install scripts')
-  .version('0.0.1')
+  .version('0.1.4')
 
 program
   .command('install')

package/src/installer.ts

@@ -1,5 +1,6 @@
 import { spawn } from 'child_process'
 import chalk from 'chalk'
+import { execSync } from 'child_process'
 
 export async function runPackageManager(
   pm: string,
@@ -23,12 +24,15 @@ export async function runPackageManager(
     args.push('--ignore-scripts')
   }
 
-  console.log(chalk.gray(`\n📦 Running: ${command} ${args.join(' ')}\n`))
+  // Remove --ignore-scripts from display (it's expected)
+  const displayArgs = args.filter(a => a !== '--ignore-scripts')
+  console.log(chalk.gray(`\n📦 Running: ${command} ${displayArgs.join(' ')} (with --ignore-scripts)\n`))
 
   return new Promise((resolve) => {
+    // Use spawn without shell to avoid npm arborist bug triggered by shell escaping
     const proc = spawn(command, args, {
       stdio: 'inherit',
-      shell: true
+      shell: false
     })
 
     let output = ''
@@ -36,6 +40,20 @@ export async function runPackageManager(
     proc.stderr?.on('data', (d: Buffer) => { output += d.toString() })
 
     proc.on('close', (code) => {
+      // If npm fails with arborist error, try alternative approach
+      if (code !== 0 && command === 'npm') {
+        console.log(chalk.yellow('\n⚠️  npm encountered an error, trying with --no-audit --no-fund...\n'))
+        try {
+          // Try running npm without audit/fund which sometimes triggers arborist issues
+          const fallbackArgs = ['install', '--ignore-scripts', '--no-audit', '--no-fund', ...args.filter(a => a !== 'install' && a !== 'add' && a !== '--ignore-scripts')]
+          const result = execSync(`npm ${fallbackArgs.join(' ')}`, { stdio: 'inherit', encoding: 'utf-8' })
+          resolve({ success: true, output: result || '' })
+          return
+        } catch (e) {
+          // Fallback failed too
+        }
+      }
+      
       resolve({
         success: code === 0,
         output

package/src/resolver.ts

@@ -17,36 +17,97 @@ export async function getInstallScripts(projectRoot: string): Promise<PackageInf
   let tree
   try {
     tree = await arb.loadActual()
-  } catch {
-    tree = await arb.loadVirtual()
+  } catch (e) {
+    console.error('Warning: Error loading package tree:', e instanceof Error ? e.message : e)
+    return getInstallScriptsFromNodeModules(projectRoot) // Fallback to manual scan
   }
 
   const packagesWithScripts: PackageInfo[] = []
   const lockfile = readLockfile(projectRoot)
 
-  for (const node of tree.inventory.values()) {
-    const pkg = node.package
-    if (!pkg) continue
-    
-    const scripts = pkg.scripts ?? {}
-    const hasInstallScript = ['preinstall', 'install', 'postinstall']
-      .some(s => s in scripts)
-
-    if (hasInstallScript) {
-      const installScripts = pick(scripts, ['preinstall', 'install', 'postinstall'])
-      packagesWithScripts.push({
-        name: node.name,
-        version: node.version,
-        scripts: installScripts as Record<string, string> | undefined,
-        path: node.path,
-        isNew: !isInLockfile(node.name, node.version, lockfile)
-      })
+  try {
+    for (const node of tree.inventory.values()) {
+      const pkg = node.package
+      if (!pkg) continue
+      
+      const scripts = pkg.scripts ?? {}
+      const hasInstallScript = ['preinstall', 'install', 'postinstall']
+        .some(s => s in scripts)
+
+      if (hasInstallScript) {
+        const installScripts = pick(scripts, ['preinstall', 'install', 'postinstall'])
+        packagesWithScripts.push({
+          name: node.name,
+          version: node.version,
+          scripts: installScripts as Record<string, string> | undefined,
+          path: node.path,
+          isNew: !isInLockfile(node.name, node.version, lockfile)
+        })
+      }
     }
+  } catch (e) {
+    console.error('Warning: Error iterating package tree:', e instanceof Error ? e.message : e)
+    return getInstallScriptsFromNodeModules(projectRoot)
   }
 
   return packagesWithScripts
 }
 
+// Fallback: manually scan node_modules for package.json files
+function getInstallScriptsFromNodeModules(projectRoot: string): PackageInfo[] {
+  const packagesWithScripts: PackageInfo[] = []
+  const lockfile = readLockfile(projectRoot)
+  
+  try {
+    const nodeModulesPath = path.join(projectRoot, 'node_modules')
+    if (!fs.existsSync(nodeModulesPath)) return packagesWithScripts
+    
+    const scanDir = (dir: string, depth: number = 0) => {
+      if (depth > 2) return // Limit recursion depth
+      
+      try {
+        const entries = fs.readdirSync(dir, { withFileTypes: true })
+        
+        for (const entry of entries) {
+          if (entry.isDirectory()) {
+            if (entry.name.startsWith('@')) {
+              // Scoped package directory
+              scanDir(path.join(dir, entry.name), depth + 1)
+            } else if (depth === 0 || depth === 1) {
+              // Check package.json in this directory
+              const pkgPath = path.join(dir, entry.name, 'package.json')
+              if (fs.existsSync(pkgPath)) {
+                try {
+                  const pkgJson = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'))
+                  if (pkgJson.scripts && ('preinstall' in pkgJson.scripts || 'install' in pkgJson.scripts || 'postinstall' in pkgJson.scripts)) {
+                    packagesWithScripts.push({
+                      name: pkgJson.name || entry.name,
+                      version: pkgJson.version || 'unknown',
+                      scripts: pick(pkgJson.scripts, ['preinstall', 'install', 'postinstall']) as Record<string, string> | undefined,
+                      path: path.join(dir, entry.name),
+                      isNew: !isInLockfile(pkgJson.name || entry.name, pkgJson.version || 'unknown', lockfile)
+                    })
+                  }
+                } catch (e) {
+                  // Ignore parse errors
+                }
+              }
+            }
+          }
+        }
+      } catch (e) {
+        // Ignore permission errors
+      }
+    }
+    
+    scanDir(nodeModulesPath)
+  } catch (e) {
+    // Ignore errors
+  }
+  
+  return packagesWithScripts
+}
+
 function pick<T extends Record<string, unknown>>(obj: T, keys: string[]): Partial<T> {
   const result: Partial<T> = {}
   for (const key of keys) {