@pwddd/skills-scanner 3.0.6 → 3.0.7

package/src/deps.ts

@@ -1,112 +1,77 @@
-/**
- * Dependency management module
- */
-
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { promisify } from "node:util";
-import { exec } from "node:child_process";
-import { join } from "node:path";
-
-const execAsync = promisify(exec);
-
-export function hasUv(): boolean {
-  try {
-    execSync("uv --version", { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export function hasPython(): boolean {
-  try {
-    execSync("python3 --version", { stdio: "ignore" });
-    return true;
-  } catch {
-    try {
-      execSync("python --version", { stdio: "ignore" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-}
-
-export function getPythonCommand(): string {
-  try {
-    execSync("python3 --version", { stdio: "ignore" });
-    return "python3";
-  } catch {
-    return "python";
-  }
-}
-
-export function isVenvReady(venvPython: string): boolean {
-  if (!existsSync(venvPython)) return false;
-
-  try {
-    execSync(`"${venvPython}" -c "import requests"`, { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export async function ensureDeps(
-  skillDir: string,
-  venvPython: string,
-  logger: any
-): Promise<boolean> {
-  if (isVenvReady(venvPython)) {
-    logger.info("[skills-scanner] Python dependencies ready (requests installed)");
-    return true;
-  }
-
-  const useUv = hasUv();
-  const usePython = !useUv && hasPython();
-
-  if (!useUv && !usePython) {
-    logger.error(
-      "[skills-scanner] Neither uv nor python3 found. Please install one of them:"
-    );
-    logger.error("[skills-scanner]   - uv: brew install uv or curl -LsSf https://astral.sh/uv/install.sh | sh");
-    logger.error("[skills-scanner]   - python3: brew install python3 or apt-get install python3 python3-venv python3-pip");
-    return false;
-  }
-
-  logger.info(`[skills-scanner] Installing Python dependencies using ${useUv ? "uv" : "python3"}...`);
-
-  try {
-    const venvDir = join(skillDir, ".venv");
-
-    if (existsSync(venvDir)) {
-      logger.info("[skills-scanner] Cleaning old virtual environment...");
-      rmSync(venvDir, { recursive: true, force: true });
-    }
-
-    if (useUv) {
-      // Use uv (faster)
-      await execAsync(`uv venv "${venvDir}" --python 3.10`);
-      logger.info("[skills-scanner] Virtual environment created (uv)");
-
-      logger.info("[skills-scanner] Installing requests...");
-      await execAsync(`uv pip install --python "${venvPython}" requests>=2.31.0`);
-    } else {
-      // Fallback to standard Python venv + pip
-      const pythonCmd = getPythonCommand();
-      await execAsync(`${pythonCmd} -m venv "${venvDir}"`);
-      logger.info("[skills-scanner] Virtual environment created (python -m venv)");
-
-      logger.info("[skills-scanner] Installing requests...");
-      await execAsync(`"${venvPython}" -m pip install --quiet requests>=2.31.0`);
-    }
-
-    execSync(`"${venvPython}" -c "import requests"`, { stdio: "ignore" });
-    logger.info("[skills-scanner] ✅ Dependencies installed successfully");
-    return true;
-  } catch (err: any) {
-    logger.error(`[skills-scanner] ⚠️  Dependency installation failed: ${err.message}`);
-    return false;
-  }
-}
+/**
+ * Dependency management module
+ */
+
+import { execSync, exec } from "node:child_process";
+import { promisify } from "node:util";
+
+const execAsync = promisify(exec);
+
+function detectPythonCommand(): string | null {
+  try {
+    execSync("python3 --version", { stdio: "ignore" });
+    return "python3";
+  } catch {
+    try {
+      execSync("python --version", { stdio: "ignore" });
+      return "python";
+    } catch {
+      return null;
+    }
+  }
+}
+
+export const getPythonCommand = (): string | null => detectPythonCommand();
+export const hasPython = (): boolean => detectPythonCommand() !== null;
+
+export function isRequestsInstalled(pythonCmd: string | null): boolean {
+  if (!pythonCmd) return false;
+  try {
+    execSync(`${pythonCmd} -c "import requests"`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export const isPythonReady = (pythonCmd: string | null): boolean =>
+  hasPython() && isRequestsInstalled(pythonCmd);
+
+export async function ensureDeps(pythonCmd: string | null, logger: any): Promise<boolean> {
+  const resolvedPython = pythonCmd ?? getPythonCommand();
+
+  if (!resolvedPython) {
+    logger.error("[skills-scanner] Python not found. Please install Python 3.10+:");
+    logger.error("[skills-scanner]   - macOS: brew install python3");
+    logger.error("[skills-scanner]   - Linux: apt-get install python3 python3-pip");
+    logger.error("[skills-scanner]   - Windows: https://www.python.org/downloads/");
+    return false;
+  }
+
+  if (isRequestsInstalled(resolvedPython)) {
+    logger.info("[skills-scanner] Python dependencies ready (requests installed)");
+    return true;
+  }
+
+  logger.info(`[skills-scanner] Installing requests package using ${resolvedPython}...`);
+
+  try {
+    await execAsync(`${resolvedPython} -m pip install --user --quiet "requests>=2.31.0"`, {
+      timeout: 120000,
+    });
+
+    if (isRequestsInstalled(resolvedPython)) {
+      logger.info("[skills-scanner] Dependencies installed successfully");
+      return true;
+    } else {
+      throw new Error("requests package not found after installation");
+    }
+  } catch (err: any) {
+    logger.error(`[skills-scanner] Dependency installation failed: ${err.message}`);
+    logger.error(`[skills-scanner] Please install manually:`);
+    logger.error(`[skills-scanner]   ${resolvedPython} -m pip install --user requests`);
+    logger.error(`[skills-scanner] Or with sudo:`);
+    logger.error(`[skills-scanner]   sudo ${resolvedPython} -m pip install requests`);
+    return false;
+  }
+}

package/src/report.ts

@@ -15,7 +15,7 @@ export async function buildDailyReport(
   useLLM: boolean,
   policy: string,
   logger: any,
-  venvPython: string,
+  pythonCmd: string | null,
   scanScript: string
 ): Promise<string> {
   const now = new Date();
@@ -41,7 +41,7 @@ export async function buildDailyReport(
   for (const dir of dirs) {
     if (!existsSync(dir)) continue;
     const tmpJson = join(STATE_DIR, `tmp-${Date.now()}.json`);
-    await runScan(venvPython, scanScript, "batch", dir, {
+    await runScan(pythonCmd, scanScript, "batch", dir, {
       behavioral,
       recursive: true,
       jsonOut: tmpJson,

package/src/scanner.ts

@@ -9,12 +9,16 @@ import type { ScanOptions, ScanResult } from "./types.js";
 const execAsync = promisify(exec);
 
 export async function runScan(
-  venvPython: string,
+  pythonCmd: string | null,
   scanScript: string,
   mode: "scan" | "batch" | "clawhub",
   target: string,
   opts: ScanOptions = {}
 ): Promise<ScanResult> {
+  if (!pythonCmd) {
+    return { exitCode: 1, output: "Python is not available on this host" };
+  }
+
   const args = [mode, target];
   if (opts.detailed) args.push("--detailed");
   if (opts.behavioral) args.push("--behavioral");
@@ -24,7 +28,7 @@ export async function runScan(
   if (opts.jsonOut) args.push("--json", opts.jsonOut);
   if (opts.apiUrl) args.unshift("--api-url", opts.apiUrl);
 
-  const cmd = `"${venvPython}" "${scanScript}" ${args.map((a) => `"${a}"`).join(" ")}`;
+  const cmd = `"${pythonCmd}" "${scanScript}" ${args.map((a) => `"${a}"`).join(" ")}`;
 
   try {
     const env = { ...process.env };

package/src/watcher.ts

@@ -17,7 +17,7 @@ export async function handleNewSkill(
   policy: string,
   notifyFn: (msg: string) => void,
   logger: any,
-  venvPython: string,
+  pythonCmd: string | null,
   scanScript: string,
   quarantineDir: string
 ): Promise<void> {
@@ -27,7 +27,7 @@ export async function handleNewSkill(
   logger.info(`[skills-scanner] 🔍 检测到新 Skill，开始安装前扫描: ${name}`);
   notifyFn(`🔍 检测到新 Skill \`${name}\`，正在安全扫描...`);
 
-  const res = await runScan(venvPython, scanScript, "scan", skillPath, {
+  const res = await runScan(pythonCmd, scanScript, "scan", skillPath, {
     behavioral,
     detailed: true,
     apiUrl,
@@ -77,7 +77,7 @@ export function startWatcher(
   policy: string,
   notifyFn: (msg: string) => void,
   logger: any,
-  venvPython: string,
+  pythonCmd: string | null,
   scanScript: string,
   quarantineDir: string
 ): () => void {
@@ -105,12 +105,12 @@ export function startWatcher(
             apiUrl,
             useLLM,
             policy,
-            notifyFn,
-            logger,
-            venvPython,
-            scanScript,
-            quarantineDir
-          );
+          notifyFn,
+          logger,
+          pythonCmd,
+          scanScript,
+          quarantineDir
+        );
         }, 500)
       );
     });