@reddoorla/maintenance 0.1.2 → 0.1.3

package/dist/cli/bin.js

@@ -270,59 +270,64 @@ function extractAdvisoriesFromNpm(parsed) {
   }
   return [...roots.values()];
 }
-async function tryRun(spawn2, cmd, args, cwd) {
+async function runAuditTool(spawn2, cmd, args, cwd) {
+  let raw;
   try {
-    return await spawn2(cmd, args, { cwd });
+    raw = await spawn2(cmd, args, { cwd });
   } catch (err) {
     const e = err;
-    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { missing: true };
-    throw err;
-  }
-}
-async function securityAudit(ctx) {
-  const spawn2 = ctx.spawn ?? defaultSpawn;
-  const site = ctx.site;
-  const label = siteLabel3(site);
-  let used = "pnpm audit";
-  let raw = await tryRun(
-    spawn2,
-    "pnpm",
-    ["audit", "--json", "--prod"],
-    site.path
-  );
-  if ("missing" in raw) {
-    used = "npm audit";
-    raw = await tryRun(spawn2, "npm", ["audit", "--json", "--omit=dev"], site.path);
-  }
-  if ("missing" in raw) {
-    return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: "neither pnpm nor npm is available on PATH"
-    };
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { kind: "missing" };
+    return { kind: "error", reason: `spawn failed: ${String(err).slice(0, 200)}` };
   }
   if (raw.code !== 0 && raw.code !== 1) {
     return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: `${used} exited with code ${raw.code}`,
-      details: { stderr: raw.stderr }
+      kind: "error",
+      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : ""}`
     };
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw.stdout);
+    parsed = JSON.parse(raw.stdout || "{}");
   } catch (err) {
-    return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: `${used} produced unparseable JSON`,
-      details: { error: String(err), stdout: raw.stdout.slice(0, 500) }
-    };
+    return { kind: "error", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };
+  }
+  const errEnvelope = parsed.error;
+  if (errEnvelope && typeof errEnvelope === "object") {
+    return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
+  }
+  if (!parsed.metadata?.vulnerabilities) {
+    return { kind: "error", reason: "no metadata.vulnerabilities in output" };
+  }
+  return { kind: "ok", parsed };
+}
+async function securityAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel3(site);
+  let used = "pnpm audit";
+  let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
+  if (result.kind !== "ok") {
+    const pnpmReason = result.kind === "missing" ? "not installed" : result.reason;
+    const npmResult = await runAuditTool(
+      spawn2,
+      "npm",
+      ["audit", "--json", "--omit=dev"],
+      site.path
+    );
+    if (npmResult.kind === "ok") {
+      result = npmResult;
+      used = "npm audit";
+    } else {
+      const npmReason = npmResult.kind === "missing" ? "not installed" : npmResult.reason;
+      return {
+        audit: "security",
+        site: label,
+        status: "skip",
+        summary: `cannot run audit \u2014 pnpm: ${pnpmReason}; npm: ${npmReason}`
+      };
+    }
   }
+  const parsed = result.parsed;
   const counts = {
     low: parsed.metadata?.vulnerabilities?.low ?? 0,
     moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,