depsentinel 0.1.5 → 0.1.6

package/dist/commands/fix.js

@@ -56,7 +56,7 @@ function collectFixPlans(cwd) {
         pkgDirty = true;
     }
     if (pkgDirty) {
-        plans.push(planSafeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n"));
+        plans.push(planSafeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", { backupOnUpdate: false }));
     }
     // Bunfig
     if (facts.packageManager === "bun") {

package/dist/commands/init.js

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { applySafePlan, planSafeFile } from "../core/safe-write.js";
 import { detectProjectFacts } from "../core/detector.js";
@@ -20,6 +21,26 @@ function buildNpmRc() {
         ""
     ].join("\n");
 }
+function mergeNpmRc(existing) {
+    const lines = existing.split(/\r?\n/);
+    const keys = new Map();
+    for (let i = 0; i < lines.length; i += 1) {
+        const m = lines[i]?.match(/^\s*([a-zA-Z0-9-]+)\s*=\s*(.*)\s*$/);
+        if (m)
+            keys.set(m[1], i);
+    }
+    const required = [
+        ["ignore-scripts", "true"],
+        ["allow-git", "none"],
+        ["min-release-age", "3"]
+    ];
+    for (const [key, value] of required) {
+        if (!keys.has(key)) {
+            lines.push(`${key}=${value}`);
+        }
+    }
+    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+}
 function buildPnpmWorkspace() {
     return [
         "packages:",
@@ -37,6 +58,36 @@ function buildPnpmWorkspace() {
         ""
     ].join("\n");
 }
+function mergePnpmWorkspace(existing) {
+    const lines = existing.split(/\r?\n/);
+    const has = (k) => lines.some((line) => line.trim().startsWith(`${k}:`));
+    if (!has("minimumReleaseAge"))
+        lines.push("minimumReleaseAge: 43200");
+    if (!has("trustPolicy"))
+        lines.push("trustPolicy: no-downgrade");
+    if (!has("blockExoticSubdeps"))
+        lines.push("blockExoticSubdeps: true");
+    if (!has("strictDepBuilds"))
+        lines.push("strictDepBuilds: true");
+    const allowIdx = lines.findIndex((line) => line.trim() === "allowBuilds:");
+    if (allowIdx === -1) {
+        lines.push("allowBuilds:");
+        lines.push("  esbuild: true");
+        lines.push("  rolldown: true");
+        lines.push("  unrs-resolver: true");
+    }
+    else {
+        const addAllow = (pkg) => {
+            const exists = lines.some((line) => line.trim().startsWith(`${pkg}:`));
+            if (!exists)
+                lines.splice(allowIdx + 1, 0, `  ${pkg}: true`);
+        };
+        addAllow("esbuild");
+        addAllow("rolldown");
+        addAllow("unrs-resolver");
+    }
+    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+}
 function buildBunfig() {
     return [
         "[install]",
@@ -111,12 +162,14 @@ export function runInit(options = {}) {
     };
     const planned = [
         planSafeFile(path.join(cwd, "depsentinel.json"), `${buildDepsentinelConfig(preset, context)}\n`),
-        planSafeFile(path.join(cwd, ".npmrc"), buildNpmRc()),
+        planSafeFile(path.join(cwd, ".npmrc"), existsSync(path.join(cwd, ".npmrc")) ? mergeNpmRc(readFileSync(path.join(cwd, ".npmrc"), "utf8")) : buildNpmRc(), { backupOnUpdate: false }),
         planSafeFile(path.join(cwd, ".npmignore"), buildNpmIgnore()),
         planSafeFile(path.join(cwd, ".github", "workflows", "depsentinel-ci.yml"), `${buildCiWorkflow()}\n`)
     ];
     if (facts.packageManager === "pnpm" || facts.packageManager === "unknown") {
-        planned.push(planSafeFile(path.join(cwd, "pnpm-workspace.yaml"), buildPnpmWorkspace()));
+        planned.push(planSafeFile(path.join(cwd, "pnpm-workspace.yaml"), existsSync(path.join(cwd, "pnpm-workspace.yaml"))
+            ? mergePnpmWorkspace(readFileSync(path.join(cwd, "pnpm-workspace.yaml"), "utf8"))
+            : buildPnpmWorkspace(), { backupOnUpdate: false }));
     }
     if (facts.packageManager === "bun") {
         planned.push(planSafeFile(path.join(cwd, "bunfig.toml"), buildBunfig()));

package/dist/core/safe-write.js

@@ -9,7 +9,7 @@ function nextBackupPath(filePath) {
     }
     return candidate;
 }
-export function planSafeFile(filePath, content) {
+export function planSafeFile(filePath, content, options = {}) {
     if (!existsSync(filePath)) {
         return { path: filePath, content, status: "create" };
     }
@@ -21,7 +21,7 @@ export function planSafeFile(filePath, content) {
         path: filePath,
         content,
         status: "update",
-        backupPath: nextBackupPath(filePath)
+        backupPath: options.backupOnUpdate === false ? undefined : nextBackupPath(filePath)
     };
 }
 export function applySafePlan(plan, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depsentinel",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "JS/TS supply-chain hardening CLI — scan, secure, and enforce dependency policies",
   "license": "MIT",
   "author": "depsentinel contributors",