@socketsecurity/cli 0.14.29 → 0.14.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,24 +1,37 @@
1
1
  'use strict';
2
2
 
3
- var vendor = require('./vendor.js');
4
- var constants = require('./constants.js');
5
- var require$$1$3 = require('node:events');
6
- var require$$0 = require('node:fs');
7
- var require$$3$2 = require('node:https');
8
- var require$$1$1 = require('node:path');
9
- var require$$3 = require('node:readline');
10
- var require$$5 = require('node:stream');
11
- var require$$7$1 = require('node:timers/promises');
12
- var require$$5$1 = require('npm-package-arg');
13
- var require$$3$1 = require('@socketregistry/yocto-spinner');
14
- var require$$4 = require('semver');
15
- var require$$6$1 = require('@socketsecurity/config');
16
- var require$$7 = require('@socketsecurity/registry/lib/objects');
17
- var require$$1$2 = require('node:net');
18
- var require$$1 = require('node:os');
19
- var sdk = require('./sdk.js');
20
- var pathResolve = require('./path-resolve.js');
21
- var link = require('./link.js');
3
+ function _interop(e) {
4
+ let d
5
+ if (e) {
6
+ let c = 0
7
+ for (const k in e) {
8
+ d = c++ === 0 && k === 'default' ? e[k] : void 0
9
+ if (!d) break
10
+ }
11
+ }
12
+ return d ?? e
13
+ }
14
+
15
+ var vendor = _interop(require('./vendor.js'));
16
+ var constants = _interop(require('./constants.js'));
17
+ var require$$1$4 = _interop(require('node:events'));
18
+ var require$$0 = _interop(require('node:fs'));
19
+ var require$$3$2 = _interop(require('node:https'));
20
+ var require$$1$1 = _interop(require('node:path'));
21
+ var require$$3 = _interop(require('node:readline'));
22
+ var require$$6$2 = _interop(require('node:timers/promises'));
23
+ var require$$1$3 = _interop(require('@inquirer/confirm'));
24
+ var require$$3$1 = _interop(require('@socketregistry/yocto-spinner'));
25
+ var require$$5$1 = _interop(require('npm-package-arg'));
26
+ var require$$4 = _interop(require('semver'));
27
+ var require$$6$1 = _interop(require('@socketsecurity/config'));
28
+ var require$$7 = _interop(require('@socketsecurity/registry/lib/objects'));
29
+ var require$$1$2 = _interop(require('node:net'));
30
+ var require$$1 = _interop(require('node:os'));
31
+ var require$$5 = _interop(require('node:stream'));
32
+ var sdk = _interop(require('./sdk.js'));
33
+ var pathResolve = _interop(require('./path-resolve.js'));
34
+ var link = _interop(require('./link.js'));
22
35
 
23
36
  var npmInjection$2 = {};
24
37
 
@@ -29,7 +42,7 @@ var arborist = {};
29
42
  var ttyServer$1 = {};
30
43
 
31
44
  var name = "@socketsecurity/cli";
32
- var version = "0.14.29";
45
+ var version = "0.14.31";
33
46
  var description = "CLI tool for Socket.dev";
34
47
  var homepage = "http://github.com/SocketDev/socket-cli";
35
48
  var license = "MIT";
@@ -105,12 +118,14 @@ var scripts = {
105
118
  var dependencies = {
106
119
  "@apideck/better-ajv-errors": "^0.3.6",
107
120
  "@cyclonedx/cdxgen": "^11.0.5",
108
- "@inquirer/prompts": "^7.1.0",
121
+ "@inquirer/confirm": "^5.0.2",
122
+ "@inquirer/password": "^4.0.3",
123
+ "@inquirer/select": "^4.0.3",
109
124
  "@npmcli/promise-spawn": "^8.0.2",
110
125
  "@socketregistry/hyrious__bun.lockb": "1.0.5",
111
126
  "@socketregistry/yocto-spinner": "^1.0.1",
112
127
  "@socketsecurity/config": "^2.1.3",
113
- "@socketsecurity/registry": "^1.0.33",
128
+ "@socketsecurity/registry": "^1.0.35",
114
129
  "@socketsecurity/sdk": "^1.3.0",
115
130
  blessed: "^0.1.81",
116
131
  "blessed-contrib": "^4.11.0",
@@ -275,7 +290,7 @@ var _nodeNet = require$$1$2;
275
290
  var _nodeOs = require$$1;
276
291
  var _nodePath$1 = require$$1$1;
277
292
  var _nodeReadline$1 = require$$3;
278
- var _nodeStream$1 = require$$5;
293
+ var _nodeStream = require$$5;
279
294
  var _package = require$$6;
280
295
  var _misc$1 = sdk.misc;
281
296
  const NEWLINE_CHAR_CODE = 10; /*'\n'*/
@@ -313,10 +328,10 @@ function createNonStandardTTYServer() {
313
328
  if (remote_ipc_version !== _package.version) {
314
329
  throw new Error('Mismatched STDIO tunnel IPC version, ensure you only have 1 version of socket CLI being called.');
315
330
  }
316
- const input = hasInput ? new _nodeStream$1.PassThrough() : null;
331
+ const input = hasInput ? new _nodeStream.PassThrough() : null;
317
332
  input?.pause();
318
333
  if (input) conn.pipe(input);
319
- const output = hasOutput ? new _nodeStream$1.PassThrough() : null;
334
+ const output = hasOutput ? new _nodeStream.PassThrough() : null;
320
335
  if (output) {
321
336
  output.pipe(conn)
322
337
  // Make ora happy
@@ -470,7 +485,7 @@ var issueRules = {};
470
485
  Object.defineProperty(issueRules, "__esModule", {
471
486
  value: true
472
487
  });
473
- issueRules.createIssueUXLookup = createIssueUXLookup;
488
+ issueRules.createAlertUXLookup = createAlertUXLookup;
474
489
  //#region UX Constants
475
490
 
476
491
  const IGNORE_UX = {
@@ -537,7 +552,7 @@ function resolveIssueRuleUX(entriesOrderedIssueRules, defaultValue) {
537
552
  function issueRuleValueDoesNotDefer(issueRule) {
538
553
  if (issueRule === undefined) {
539
554
  return false;
540
- } else if (typeof issueRule === 'object' && issueRule) {
555
+ } else if (issueRule !== null && typeof issueRule === 'object') {
541
556
  const {
542
557
  action
543
558
  } = issueRule;
@@ -569,11 +584,13 @@ function uxForDefinedNonDeferValue(issueRuleValue) {
569
584
 
570
585
  //#region exports
571
586
 
572
- function createIssueUXLookup(settings) {
587
+ function createAlertUXLookup(settings) {
573
588
  const cachedUX = new Map();
574
589
  return context => {
575
- const key = context.issue.type;
576
- let ux = cachedUX.get(key);
590
+ const {
591
+ type
592
+ } = context.alert;
593
+ let ux = cachedUX.get(type);
577
594
  if (ux) {
578
595
  return ux;
579
596
  }
@@ -586,7 +603,7 @@ function createIssueUXLookup(settings) {
586
603
  if (!resolvedTarget) {
587
604
  break;
588
605
  }
589
- const issueRuleValue = resolvedTarget.issueRules?.[key];
606
+ const issueRuleValue = resolvedTarget.issueRules?.[type];
590
607
  if (typeof issueRuleValue !== 'undefined') {
591
608
  orderedIssueRules.push(issueRuleValue);
592
609
  }
@@ -594,7 +611,7 @@ function createIssueUXLookup(settings) {
594
611
  }
595
612
  entriesOrderedIssueRules.push(orderedIssueRules);
596
613
  }
597
- const defaultValue = settings.defaults.issueRules[key];
614
+ const defaultValue = settings.defaults.issueRules[type];
598
615
  let resolvedDefaultValue = {
599
616
  action: 'error'
600
617
  };
@@ -608,7 +625,7 @@ function createIssueUXLookup(settings) {
608
625
  };
609
626
  }
610
627
  ux = resolveIssueRuleUX(entriesOrderedIssueRules, resolvedDefaultValue);
611
- cachedUX.set(key, ux);
628
+ cachedUX.set(type, ux);
612
629
  return ux;
613
630
  };
614
631
  }
@@ -619,16 +636,16 @@ Object.defineProperty(arborist, "__esModule", {
619
636
  });
620
637
  arborist.SafeArborist = void 0;
621
638
  arborist.installSafeArborist = installSafeArborist;
622
- var _nodeEvents = require$$1$3;
639
+ var _nodeEvents = require$$1$4;
623
640
  var _nodeFs = require$$0;
624
641
  var _nodeHttps = require$$3$2;
625
642
  var _nodePath = require$$1$1;
626
643
  var _nodeReadline = require$$3;
627
- var _nodeStream = require$$5;
628
- var _promises = require$$7$1;
644
+ var _promises = require$$6$2;
645
+ var _confirm = require$$1$3;
646
+ var _yoctoSpinner = require$$3$1;
629
647
  var _isInteractive = _interopRequireDefault(vendor.isInteractive);
630
648
  var _npmPackageArg = require$$5$1;
631
- var _yoctoSpinner = require$$3$1;
632
649
  var _semver = require$$4;
633
650
  var _config = require$$6$1;
634
651
  var _objects = require$$7;
@@ -640,7 +657,7 @@ var _misc = sdk.misc;
640
657
  var _pathResolve = pathResolve.pathResolve;
641
658
  var _sdk = sdk.sdk;
642
659
  var _settings = sdk.settings;
643
- const POTENTIALLY_BUG_ERROR_SNIPPET = 'this is potentially a bug with socket-npm caused by changes to the npm cli';
660
+ const POTENTIAL_BUG_ERROR_MESSAGE = `This is may be a bug with socket-npm related to changes to the npm CLI.\nPlease report to ${_constants$1.SOCKET_CLI_ISSUES_URL}.`;
644
661
  const npmEntrypoint = (0, _nodeFs.realpathSync)(process.argv[1]);
645
662
  const npmRootPath = (0, _pathResolve.findRoot)(_nodePath.dirname(npmEntrypoint));
646
663
  function tryRequire(...ids) {
@@ -666,12 +683,9 @@ function tryRequire(...ids) {
666
683
  return undefined;
667
684
  }
668
685
  if (npmRootPath === undefined) {
669
- console.error(`Unable to find npm cli install directory, ${POTENTIALLY_BUG_ERROR_SNIPPET}.`);
670
- console.error(`Searched parent directories of ${npmEntrypoint}`);
686
+ console.error(`Unable to find npm CLI install directory.\nSearched parent directories of ${npmEntrypoint}.\n\n${POTENTIAL_BUG_ERROR_MESSAGE}`);
671
687
  process.exit(127);
672
688
  }
673
- const LOOP_SENTINEL = 1_000_000;
674
- const NPM_REGISTRY_URL = 'https://registry.npmjs.org';
675
689
  const npmNmPath = _nodePath.join(npmRootPath, 'node_modules');
676
690
  const arboristPkgPath = _nodePath.join(npmNmPath, '@npmcli/arborist');
677
691
  const arboristClassPath = _nodePath.join(arboristPkgPath, 'lib/arborist/index.js');
@@ -684,7 +698,7 @@ const log = tryRequire([_nodePath.join(npmNmPath, 'proc-log/lib/index.js'),
684
698
  // is really that of its export log.
685
699
  mod => mod.log], _nodePath.join(npmNmPath, 'npmlog/lib/log.js'));
686
700
  if (log === undefined) {
687
- console.error(`Unable to integrate with npm cli logging infrastructure, ${POTENTIALLY_BUG_ERROR_SNIPPET}.`);
701
+ console.error(`Unable to integrate with npm CLI logging infrastructure.\n\n${POTENTIAL_BUG_ERROR_MESSAGE}.`);
688
702
  process.exit(127);
689
703
  }
690
704
  const pacote = tryRequire(_nodePath.join(npmNmPath, 'pacote'), 'pacote');
@@ -704,7 +718,7 @@ const OverrideSet = require(arboristOverrideSetClassPatch);
704
718
  const kCtorArgs = Symbol('ctorArgs');
705
719
  const kRiskyReify = Symbol('riskyReify');
706
720
  const formatter = new _colorOrMarkdown.ColorOrMarkdown(false);
707
- const pubToken = (0, _sdk.getDefaultKey)() ?? _sdk.FREE_API_KEY;
721
+ const pubToken = (0, _sdk.getDefaultKey)() ?? _constants$1.SOCKET_PUBLIC_API_KEY;
708
722
  const ttyServer = (0, _ttyServer.createTTYServer)((0, _isInteractive.default)({
709
723
  stream: process.stdin
710
724
  }), log);
@@ -719,31 +733,20 @@ async function uxLookup(settings) {
719
733
  return _uxLookup(settings);
720
734
  }
721
735
  async function* batchScan(pkgIds) {
722
- const query = {
723
- packages: pkgIds.map(id => {
724
- const {
725
- name,
726
- version
727
- } = pkgidParts(id);
728
- return {
729
- eco: 'npm',
730
- pkg: name,
731
- ver: version,
732
- top: true
733
- };
734
- })
735
- };
736
- // TODO: Migrate to SDK.
737
- const pkgDataReq = _nodeHttps.request(`${_constants$1.API_V0_URL}/scan/batch`, {
736
+ const req = _nodeHttps.request(`${_constants$1.API_V0_URL}/purl?alerts=true`, {
738
737
  method: 'POST',
739
738
  headers: {
740
739
  Authorization: `Basic ${Buffer.from(`${pubToken}:`).toString('base64url')}`
741
740
  },
742
741
  signal: abortSignal
743
- }).end(JSON.stringify(query));
742
+ }).end(JSON.stringify({
743
+ components: pkgIds.map(id => ({
744
+ purl: `pkg:npm/${id}`
745
+ }))
746
+ }));
744
747
  const {
745
748
  0: res
746
- } = await _nodeEvents.once(pkgDataReq, 'response');
749
+ } = await _nodeEvents.once(req, 'response');
747
750
  const ok = res.statusCode >= 200 && res.statusCode <= 299;
748
751
  if (!ok) {
749
752
  throw new Error(`Socket API Error: ${res.statusCode}`);
@@ -809,101 +812,118 @@ function findSpecificOverrideSet(first, second) {
809
812
  log.silly('Conflicting override sets', first, second);
810
813
  return undefined;
811
814
  }
815
+ function isAlertFixable(alert) {
816
+ const {
817
+ type
818
+ } = alert;
819
+ if (type === 'cve' || type === 'mediumCVE' || type === 'mildCVE' || type === 'criticalCVE') {
820
+ return !!alert.props?.['firstPatchedVersionIdentifier'];
821
+ }
822
+ return type === 'socketUpgradeAvailable';
823
+ }
812
824
  function maybeReadfileSync(filepath) {
813
825
  try {
814
826
  return (0, _nodeFs.readFileSync)(filepath, 'utf8');
815
827
  } catch {}
816
828
  return undefined;
817
829
  }
818
- async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
830
+ async function getPackagesAlerts(safeArb, _registry, pkgs, output) {
819
831
  const spinner = _yoctoSpinner({
820
832
  stream: output
821
833
  });
822
- let result = false;
823
834
  let {
824
835
  length: remaining
825
836
  } = pkgs;
837
+ const packageAlerts = [];
826
838
  if (!remaining) {
827
839
  spinner.success('No changes detected');
828
- return result;
840
+ return packageAlerts;
829
841
  }
830
842
  const getText = () => `Looking up data for ${remaining} packages`;
831
843
  spinner.start(getText());
832
844
  try {
833
- for await (const pkgData of batchScan(pkgs.map(p => p.pkgid))) {
845
+ for await (const artifact of batchScan(pkgs.map(p => p.pkgid))) {
846
+ if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
847
+ continue;
848
+ }
834
849
  const {
835
- pkg: name,
836
- ver: version
837
- } = pkgData;
838
- const id = `${name}@${version}`;
850
+ version
851
+ } = artifact;
852
+ const name = `${artifact.namespace ? `${artifact.namespace}/` : ''}${artifact.name}`;
853
+ const id = `${name}@${artifact.version}`;
854
+ let blocked = false;
839
855
  let displayWarning = false;
840
- let failures = [];
841
- if (pkgData.type === 'missing') {
842
- result = true;
843
- failures.push({
844
- type: 'missingDependency'
856
+ let alerts = [];
857
+ for (const alert of artifact.alerts) {
858
+ // eslint-disable-next-line no-await-in-loop
859
+ const ux = await uxLookup({
860
+ package: {
861
+ name,
862
+ version
863
+ },
864
+ alert: {
865
+ type: alert.type
866
+ }
845
867
  });
846
- } else {
847
- let blocked = false;
848
- for (const failure of pkgData.value.issues) {
849
- // eslint-disable-next-line no-await-in-loop
850
- const ux = await uxLookup({
851
- package: {
852
- name,
853
- version
854
- },
855
- issue: {
856
- type: failure.type
857
- }
868
+ if (ux.block) {
869
+ blocked = true;
870
+ }
871
+ if (ux.display) {
872
+ displayWarning = true;
873
+ }
874
+ if (ux.block || ux.display) {
875
+ alerts.push({
876
+ name,
877
+ version,
878
+ type: alert.type,
879
+ block: ux.block,
880
+ raw: alert,
881
+ fixable: isAlertFixable(alert)
858
882
  });
859
- if (ux.display || ux.block) {
860
- failures.push({
861
- raw: failure,
862
- block: ux.block
863
- });
864
- // Before we ask about problematic issues, check to see if they
865
- // already existed in the old version if they did, be quiet.
866
- const pkg = pkgs.find(p => p.pkgid === id && p.existing?.startsWith(`${name}@`));
867
- if (pkg?.existing) {
868
- // eslint-disable-next-line no-await-in-loop
869
- for await (const oldPkgData of batchScan([pkg.existing])) {
870
- if (oldPkgData.type === 'success') {
871
- failures = failures.filter(issue => oldPkgData.value.issues.find(oldIssue => oldIssue.type === issue.raw.type) == null);
872
- }
873
- }
874
- }
875
- }
876
- if (ux.block) {
877
- result = true;
878
- blocked = true;
879
- }
880
- if (ux.display) {
881
- displayWarning = true;
883
+ // Before we ask about problematic issues, check to see if they
884
+ // already existed in the old version if they did, be quiet.
885
+ const pkg = pkgs.find(p => p.pkgid === id && p.existing?.startsWith(`${name}@`));
886
+ if (pkg?.existing) {
887
+ const oldArtifact =
888
+ // eslint-disable-next-line no-await-in-loop
889
+ (await batchScan([pkg.existing]).next()).value;
890
+ console.log('oldArtifact', oldArtifact);
891
+ // if (oldArtifact.type === 'success') {
892
+ // issues = issues.filter(
893
+ // ({ type }) =>
894
+ // oldPkgData.value.issues.find(
895
+ // oldIssue => oldIssue.type === type
896
+ // ) === undefined
897
+ // )
898
+ // }
882
899
  }
883
900
  }
884
- if (!blocked) {
885
- const pkg = pkgs.find(p => p.pkgid === id);
886
- if (pkg) {
887
- await tarball.stream(id, stream => {
888
- stream.resume();
889
- return stream.promise();
890
- }, {
891
- ...safeArb[kCtorArgs][0]
892
- });
893
- }
901
+ }
902
+ if (!blocked) {
903
+ const pkg = pkgs.find(p => p.pkgid === id);
904
+ if (pkg) {
905
+ await tarball.stream(id, stream => {
906
+ stream.resume();
907
+ return stream.promise();
908
+ }, {
909
+ ...safeArb[kCtorArgs][0]
910
+ });
894
911
  }
895
912
  }
896
913
  if (displayWarning) {
897
914
  spinner.stop(`(socket) ${formatter.hyperlink(id, `https://socket.dev/npm/package/${name}/overview/${version}`)} contains risks:`);
898
- failures.sort((a, b) => a.raw.type < b.raw.type ? -1 : 1);
915
+ alerts.sort((a, b) => a.type < b.type ? -1 : 1);
899
916
  const lines = new Set();
900
- for (const failure of failures) {
901
- const type = failure.raw.type;
902
- if (type) {
903
- const issueTypeTranslation = translations.issues[type];
904
- // TODO: emoji seems to mis-align terminals sometimes
905
- lines.add(` ${issueTypeTranslation?.title ?? type}${failure.block ? '' : ' (non-blocking)'} - ${issueTypeTranslation?.description ?? ''}\n`);
906
- }
917
+ for (const alert of alerts) {
918
+ // Based data from { pageProps: { alertTypes } } of:
919
+ // https://socket.dev/_next/data/94666139314b6437ee4491a0864e72b264547585/en-US.json
920
+ const info = translations.alerts[alert.type];
921
+ const title = info?.title ?? alert.type;
922
+ const attributes = [...(alert.fixable ? ['fixable'] : []), ...(alert.block ? [] : ['non-blocking'])];
923
+ const maybeAttributes = attributes.length ? ` (${attributes.join('; ')})` : '';
924
+ const maybeDesc = info?.description ? ` - ${info.description}` : '';
925
+ // TODO: emoji seems to mis-align terminals sometimes
926
+ lines.add(` ${title}${maybeAttributes}${maybeDesc}\n`);
907
927
  }
908
928
  for (const line of lines) {
909
929
  output?.write(line);
@@ -912,20 +932,14 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
912
932
  }
913
933
  remaining -= 1;
914
934
  spinner.text = remaining > 0 ? getText() : '';
935
+ packageAlerts.push(...alerts);
915
936
  }
916
- return result;
937
+ } catch (e) {
938
+ console.log('error', e);
917
939
  } finally {
918
940
  spinner.stop();
919
941
  }
920
- }
921
- function pkgidParts(pkgid) {
922
- const delimiter = pkgid.lastIndexOf('@');
923
- const name = pkgid.slice(0, delimiter);
924
- const version = pkgid.slice(delimiter + 1);
925
- return {
926
- name,
927
- version
928
- };
942
+ return packageAlerts;
929
943
  }
930
944
  function toRepoUrl(resolved) {
931
945
  return resolved.replace(/#[\s\S]*$/, '').replace(/\?[\s\S]*$/, '').replace(/\/[^/]*\/-\/[\s\S]*$/, '');
@@ -937,7 +951,7 @@ function walk(diff_, needInfoOn = []) {
937
951
  length: queueLength
938
952
  } = queue;
939
953
  while (pos < queueLength) {
940
- if (pos === LOOP_SENTINEL) {
954
+ if (pos === _constants$1.LOOP_SENTINEL) {
941
955
  throw new Error('Detected infinite loop while walking Arborist diff');
942
956
  }
943
957
  const diff = queue[pos++];
@@ -1509,7 +1523,7 @@ class SafeOverrideSet extends OverrideSet {
1509
1523
  length: queueLength
1510
1524
  } = queue;
1511
1525
  while (pos < queueLength) {
1512
- if (pos === LOOP_SENTINEL) {
1526
+ if (pos === _constants$1.LOOP_SENTINEL) {
1513
1527
  throw new Error('Detected infinite loop while comparing override sets');
1514
1528
  }
1515
1529
  const {
@@ -1651,43 +1665,26 @@ class SafeArborist extends Arborist {
1651
1665
  options['save'] = old.save;
1652
1666
  options['saveBundle'] = old.saveBundle;
1653
1667
  // Nothing to check, mmm already installed or all private?
1654
- if (diff.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
1668
+ if (diff.findIndex(c => c.repository_url === _constants$1.NPM_REGISTRY_URL) === -1) {
1655
1669
  return await this[kRiskyReify](...args);
1656
1670
  }
1657
- let proceed = _constants$1.ENV.UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE;
1671
+ let proceed = _constants$1.ENV[_constants$1.UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE];
1658
1672
  if (!proceed) {
1659
1673
  proceed = await ttyServer.captureTTY(async (input, output) => {
1660
1674
  if (input && output) {
1661
- const risky = await packagesHaveRiskyIssues(this, this['registry'], diff, output);
1662
- if (!risky) {
1675
+ const alerts = await getPackagesAlerts(this, this['registry'], diff, output);
1676
+ if (!alerts.length) {
1663
1677
  return true;
1664
1678
  }
1665
- const rlin = new _nodeStream.PassThrough();
1666
- input.pipe(rlin);
1667
- const rlout = new _nodeStream.PassThrough();
1668
- rlout.pipe(output, {
1669
- end: false
1679
+ return await _confirm({
1680
+ message: 'Accept risks of installing these packages?',
1681
+ default: false
1682
+ }, {
1683
+ input,
1684
+ output,
1685
+ signal: abortSignal
1670
1686
  });
1671
- const rli = _nodeReadline.createInterface(rlin, rlout);
1672
- try {
1673
- while (true) {
1674
- // eslint-disable-next-line no-await-in-loop
1675
- const answer = await new Promise(resolve => {
1676
- rli.question('Accept risks of installing these packages (y/N)?\n', {
1677
- signal: abortSignal
1678
- }, resolve);
1679
- });
1680
- if (/^\s*y(?:es)?\s*$/i.test(answer)) {
1681
- return true;
1682
- }
1683
- if (/^(?:\s*no?\s*|)$/i.test(answer)) {
1684
- return false;
1685
- }
1686
- }
1687
- } finally {
1688
- rli.close();
1689
- }
1690
- } else if (await packagesHaveRiskyIssues(this, this['registry'], diff, output)) {
1687
+ } else if ((await getPackagesAlerts(this, this['registry'], diff, output)).length > 0) {
1691
1688
  throw new Error('Socket npm Unable to prompt to accept risk, need TTY to do so');
1692
1689
  }
1693
1690
  return true;
@@ -1788,7 +1785,7 @@ void (async () => {
1788
1785
  }
1789
1786
  });
1790
1787
  }
1791
- _uxLookup = (0, _issueRules.createIssueUXLookup)(settings);
1788
+ _uxLookup = (0, _issueRules.createAlertUXLookup)(settings);
1792
1789
  })();
1793
1790
 
1794
1791
  var _constants = constants.constants;
@@ -1,11 +1,23 @@
1
1
  #!/usr/bin/env node
2
2
  'use strict';
3
3
 
4
- var vendor = require('./vendor.js');
5
- var require$$1 = require('node:path');
6
- var require$$1$1 = require('@npmcli/promise-spawn');
7
- var constants = require('./constants.js');
8
- var link = require('./link.js');
4
+ function _interop(e) {
5
+ let d
6
+ if (e) {
7
+ let c = 0
8
+ for (const k in e) {
9
+ d = c++ === 0 && k === 'default' ? e[k] : void 0
10
+ if (!d) break
11
+ }
12
+ }
13
+ return d ?? e
14
+ }
15
+
16
+ var vendor = _interop(require('./vendor.js'));
17
+ var require$$1 = _interop(require('node:path'));
18
+ var require$$1$1 = _interop(require('@npmcli/promise-spawn'));
19
+ var constants = _interop(require('./constants.js'));
20
+ var link = _interop(require('./link.js'));
9
21
 
10
22
  var npxCli$2 = {};
11
23
 
@@ -1,10 +1,22 @@
1
1
  'use strict';
2
2
 
3
- var require$$1$1 = require('node:fs/promises');
4
- var require$$1 = require('node:path');
5
- var require$$2 = require('ignore');
6
- var require$$3 = require('micromatch');
7
- var require$$8 = require('tinyglobby');
3
+ function _interop(e) {
4
+ let d
5
+ if (e) {
6
+ let c = 0
7
+ for (const k in e) {
8
+ d = c++ === 0 && k === 'default' ? e[k] : void 0
9
+ if (!d) break
10
+ }
11
+ }
12
+ return d ?? e
13
+ }
14
+
15
+ var require$$1$1 = _interop(require('node:fs/promises'));
16
+ var require$$1 = _interop(require('node:path'));
17
+ var require$$2 = _interop(require('ignore'));
18
+ var require$$3 = _interop(require('micromatch'));
19
+ var require$$8 = _interop(require('tinyglobby'));
8
20
 
9
21
  var pathResolve = {};
10
22
 
@@ -3,7 +3,6 @@ import { SocketSdk } from '@socketsecurity/sdk';
3
3
  declare function createDebugLogger(printDebugLogs?: boolean): typeof console.error;
4
4
  declare function isErrnoException(value: unknown): value is NodeJS.ErrnoException;
5
5
  declare function stringJoinWithSeparateFinalSeparator(list: (string | undefined)[], separator?: string): string;
6
- declare const FREE_API_KEY = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
7
6
  declare function getDefaultKey(): string | undefined;
8
7
  declare function setupSdk(apiKey?: string | undefined, apiBaseUrl?: string | undefined, proxy?: string | undefined): Promise<SocketSdk>;
9
- export { createDebugLogger, isErrnoException, stringJoinWithSeparateFinalSeparator, FREE_API_KEY, getDefaultKey, setupSdk };
8
+ export { createDebugLogger, isErrnoException, stringJoinWithSeparateFinalSeparator, getDefaultKey, setupSdk };