i18ntk 2.3.8 → 2.5.0

package/utils/npm-version-warning.js

@@ -1,147 +1,18 @@
-const https = require('https');
-const { compareVersions } = require('./version-utils');
+'use strict';
 
-const DEFAULT_TIMEOUT_MS = 1800;
-const NPM_REGISTRY_BASE = 'https://registry.npmjs.org';
+/**
+ * Update checks were intentionally removed to avoid outbound network access
+ * during CLI startup and to reduce scanner noise in restricted environments.
+ *
+ * We keep the same exported API for backwards compatibility.
+ */
 
-function isSemverLike(version) {
-  return typeof version === 'string' && /^\d+\.\d+\.\d+([-.][0-9A-Za-z.-]+)?$/.test(version.trim());
+async function checkNpmOutdated() {
+  return null;
 }
 
-function fetchPackageMetadata(packageName, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const safePackageName = encodeURIComponent(packageName);
-  const requestUrl = `${NPM_REGISTRY_BASE}/${safePackageName}`;
-
-  return new Promise((resolve) => {
-    let settled = false;
-
-    const finish = (value) => {
-      if (!settled) {
-        settled = true;
-        resolve(value);
-      }
-    };
-
-    const req = https.get(
-      requestUrl,
-      {
-        timeout: timeoutMs,
-        headers: {
-          Accept: 'application/json',
-          'User-Agent': 'i18ntk-version-check'
-        }
-      },
-      (res) => {
-        if (res.statusCode !== 200) {
-          res.resume();
-          finish(null);
-          return;
-        }
-
-        let raw = '';
-        res.on('data', (chunk) => {
-          raw += chunk;
-        });
-        res.on('end', () => {
-          try {
-            finish(JSON.parse(raw));
-          } catch {
-            finish(null);
-          }
-        });
-      }
-    );
-
-    req.on('timeout', () => {
-      req.destroy();
-      finish(null);
-    });
-    req.on('error', () => finish(null));
-  });
-}
-
-function getOutdatedStatus(currentVersion, metadata) {
-  if (!isSemverLike(currentVersion) || !metadata || !metadata.versions) {
-    return null;
-  }
-
-  const distTags = metadata['dist-tags'] || {};
-  const taggedLatest = distTags.latest;
-  const allPublishedVersions = Object.keys(metadata.versions).filter(isSemverLike);
-
-  if (allPublishedVersions.length === 0) {
-    return null;
-  }
-
-  const latestVersion = isSemverLike(taggedLatest)
-    ? taggedLatest
-    : allPublishedVersions.sort(compareVersions).at(-1);
-
-  if (!latestVersion || !isSemverLike(latestVersion)) {
-    return null;
-  }
-
-  const currentMeta = metadata.versions[currentVersion] || null;
-  const isCurrentDeprecated = Boolean(currentMeta && currentMeta.deprecated);
-  const isOutdated = compareVersions(currentVersion, latestVersion) < 0;
-
-  const newerStableVersions = allPublishedVersions.filter((version) => (
-    compareVersions(version, currentVersion) > 0 &&
-    compareVersions(version, latestVersion) <= 0
-  ));
-
-  return {
-    latestVersion,
-    isOutdated,
-    isCurrentDeprecated,
-    newerStableCount: newerStableVersions.length
-  };
-}
-
-async function checkNpmOutdated({ packageName, currentVersion, timeoutMs = DEFAULT_TIMEOUT_MS }) {
-  const metadata = await fetchPackageMetadata(packageName, timeoutMs);
-  return getOutdatedStatus(currentVersion, metadata);
-}
-
-async function printUpgradeWarningIfOutdated({
-  packageName,
-  currentVersion,
-  timeoutMs = DEFAULT_TIMEOUT_MS
-}) {
-  const enabled = String(process.env.I18NTK_ENABLE_UPDATE_CHECK || '').toLowerCase();
-  if (!(enabled === '1' || enabled === 'true' || enabled === 'yes')) {
-    return;
-  }
-
-  if (process.env.I18NTK_DISABLE_UPDATE_CHECK === 'true') {
-    return;
-  }
-
-  const status = await checkNpmOutdated({ packageName, currentVersion, timeoutMs });
-  if (!status) {
-    return;
-  }
-
-  if (status.isCurrentDeprecated) {
-    console.warn(
-      `\n⚠️  Installed ${packageName}@${currentVersion} is deprecated on npm. ` +
-      `Upgrade to ${packageName}@${status.latestVersion}:\n` +
-      `   npm install -g ${packageName}@latest`
-    );
-    return;
-  }
-
-  if (status.isOutdated) {
-    const suffix = status.newerStableCount === 1 ? '' : 's';
-    console.warn(
-      `\n⚠️  Update available for ${packageName}: ${currentVersion} -> ${status.latestVersion} ` +
-      `(${status.newerStableCount} newer release${suffix}).\n` +
-      `   Run: npm install -g ${packageName}@latest`
-    );
-  }
+async function printUpgradeWarningIfOutdated() {
+  return;
 }
 
-module.exports = {
-  checkNpmOutdated,
-  printUpgradeWarningIfOutdated
-};
+module.exports = { checkNpmOutdated, printUpgradeWarningIfOutdated };

package/utils/prompt-helper.js

@@ -1,41 +1,44 @@
-const { getGlobalReadline, closeGlobalReadline, ask } = require('./cli');
-
-function isInteractive(opts={}) {
-  const envSilent = process.env.CI === 'true' || process.env.I18NTK_SILENT === '1' || (process.env.npm_config_loglevel||'').toLowerCase()==='silent';
-  if (opts.noPrompt) return false;
-  if (envSilent) return false;
-  return process.stdin.isTTY === true;
-}
-
-class NoopPrompt {
-  question(_q) { return Promise.resolve(''); }
-  close() {}
-  async pressEnterToContinue() { return; }
-}
-
-class RLPrompt {
-  constructor() {
-    this.rl = getGlobalReadline();
-    this.closed = false;
-  }
-  question(q) {
-    if (this.closed) return Promise.resolve('');
-    return new Promise(res => this.rl.question(q, ans => res(ans)));
-  }
-  close() { 
-    if (!this.closed) { 
-      closeGlobalReadline(); 
-      this.closed = true; 
-    } 
-  }
-  async pressEnterToContinue(msg='\nPress Enter to continue...') {
-    if (this.closed) return;
-    await ask(msg);
-  }
-}
-
-function createPrompt(opts={}) {
-  return isInteractive(opts) ? new RLPrompt() : new NoopPrompt();
-}
-
-module.exports = { createPrompt, isInteractive };
+const { getGlobalReadline, closeGlobalReadline, ask } = require('./cli');
+const { envManager } = require('./env-manager');
+
+function isInteractive(opts={}) {
+  const envSilent = envManager.getBoolean('CI') ||
+    envManager.getBoolean('I18NTK_SILENT') ||
+    envManager.get('npm_config_loglevel') === 'silent';
+  if (opts.noPrompt) return false;
+  if (envSilent) return false;
+  return process.stdin.isTTY === true;
+}
+
+class NoopPrompt {
+  question(_q) { return Promise.resolve(''); }
+  close() {}
+  async pressEnterToContinue() { return; }
+}
+
+class RLPrompt {
+  constructor() {
+    this.rl = getGlobalReadline();
+    this.closed = false;
+  }
+  question(q) {
+    if (this.closed) return Promise.resolve('');
+    return new Promise(res => this.rl.question(q, ans => res(ans)));
+  }
+  close() { 
+    if (!this.closed) { 
+      closeGlobalReadline(); 
+      this.closed = true; 
+    } 
+  }
+  async pressEnterToContinue(msg='\nPress Enter to continue...') {
+    if (this.closed) return;
+    await ask(msg);
+  }
+}
+
+function createPrompt(opts={}) {
+  return isInteractive(opts) ? new RLPrompt() : new NoopPrompt();
+}
+
+module.exports = { createPrompt, isInteractive };

package/utils/secure-errors.js

@@ -1,154 +1,156 @@
-// Secure error handling utilities
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-
-class SecureError extends Error {
-  constructor(message, code = 'SECURE_ERROR', details = {}) {
-    super(message);
-    this.name = 'SecureError';
-    this.code = code;
-    this.details = details;
-    this.timestamp = new Date().toISOString();
-    this.errorId = crypto.randomBytes(8).toString('hex');
-    
-    // Capture stack trace, excluding constructor call from it
-    Error.captureStackTrace(this, this.constructor);
-  }
-
-  toJSON() {
-    return {
-      error: this.name,
-      message: this.message,
-      code: this.code,
-      errorId: this.errorId,
-      timestamp: this.timestamp
-    };
-  }
-
-  static sanitizeError(error) {
-    if (error instanceof SecureError) {
-      return error.toJSON();
-    }
-    
-    // For non-SecureError instances, return a sanitized version
-    return {
-      error: 'InternalError',
-      message: 'An internal error occurred',
-      code: 'INTERNAL_ERROR',
-      errorId: crypto.randomBytes(8).toString('hex'),
-      timestamp: new Date().toISOString()
-    };
-  }
-}
-
-// Common error types
-class ValidationError extends SecureError {
-  constructor(message = 'Validation failed', details = {}) {
-    super(message, 'VALIDATION_ERROR', details);
-    this.name = 'ValidationError';
-  }
-}
-
-class SecurityError extends SecureError {
-  constructor(message = 'Security violation detected', details = {}) {
-    super(message, 'SECURITY_VIOLATION', details);
-    this.name = 'SecurityError';
-  }
-}
-
-class EncryptionError extends SecureError {
-  constructor(message = 'Encryption/decryption failed', details = {}) {
-    super(message, 'ENCRYPTION_ERROR', details);
-    this.name = 'EncryptionError';
-  }
-}
-
-// Secure error handler middleware
-function secureErrorHandler(options = {}) {
-  const defaults = {
-    logErrors: process.env.NODE_ENV !== 'production',
-    logFunction: console.error,
-    logFilePath: null,
-    sanitizeStack: true
-  };
-
-  const config = { ...defaults, ...options };
-  
-  // Ensure log directory exists
-  if (config.logFilePath && !SecurityUtils.safeExistsSync(path.dirname(config.logFilePath))) {
-    try {
-      fs.mkdirSync(path.dirname(config.logFilePath), { recursive: true });
-    } catch (e) {
-      console.error('Failed to create log directory:', e);
-    }
-  }
-
-  return function(error, req, res, next) {
-    // Handle specific error types
-    let statusCode = 500;
-    let response = {};
-
-    if (error instanceof ValidationError) {
-      statusCode = 400;
-      response = error.toJSON();
-    } else if (error instanceof SecurityError) {
-      statusCode = 403;
-      response = error.toJSON();
-    } else if (error instanceof EncryptionError) {
-      statusCode = 400;
-      response = error.toJSON();
-    } else {
-      // Generic error handling
-      response = SecureError.sanitizeError(error);
-    }
-
-    // Log the error if enabled
-    if (config.logErrors) {
-      const logEntry = {
-        timestamp: new Date().toISOString(),
-        error: {
-          name: error.name,
-          message: error.message,
-          stack: config.sanitizeStack 
-            ? error.stack.split('\n').slice(0, 3).join('\n') + '\n    ...'
-            : error.stack,
-          ...(error.details && { details: error.details }),
-          errorId: response.errorId
-        },
-        request: req ? {
-          method: req.method,
-          url: req.originalUrl,
-          ip: req.ip,
-          userAgent: req.get('user-agent')
-        } : undefined
-      };
-
-      // Log to console
-      if (typeof config.logFunction === 'function') {
-        SecurityUtils.safeWriteFileSync(config.logFilePath, JSON.stringify(logEntry, null, 2));
-      }
-
-      // Log to file if configured
-      if (config.logFilePath) {
-        SecurityUtils.safeWriteFileSync(
-          config.logFilePath,
-          JSON.stringify(logEntry) + '\n',
-          'utf8'
-        );
-      }
-    }
-
-    // Send response
-    res.status(statusCode).json(response);
-  };
-}
-
-module.exports = {
-  SecureError,
-  ValidationError,
-  SecurityError,
-  EncryptionError,
-  secureErrorHandler,
-  createError: (message, code, details) => new SecureError(message, code, details)
-};
+// Secure error handling utilities
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const SecurityUtils = require('./security');
+const { envManager } = require('./env-manager');
+
+class SecureError extends Error {
+  constructor(message, code = 'SECURE_ERROR', details = {}) {
+    super(message);
+    this.name = 'SecureError';
+    this.code = code;
+    this.details = details;
+    this.timestamp = new Date().toISOString();
+    this.errorId = crypto.randomBytes(8).toString('hex');
+    
+    // Capture stack trace, excluding constructor call from it
+    Error.captureStackTrace(this, this.constructor);
+  }
+
+  toJSON() {
+    return {
+      error: this.name,
+      message: this.message,
+      code: this.code,
+      errorId: this.errorId,
+      timestamp: this.timestamp
+    };
+  }
+
+  static sanitizeError(error) {
+    if (error instanceof SecureError) {
+      return error.toJSON();
+    }
+    
+    // For non-SecureError instances, return a sanitized version
+    return {
+      error: 'InternalError',
+      message: 'An internal error occurred',
+      code: 'INTERNAL_ERROR',
+      errorId: crypto.randomBytes(8).toString('hex'),
+      timestamp: new Date().toISOString()
+    };
+  }
+}
+
+// Common error types
+class ValidationError extends SecureError {
+  constructor(message = 'Validation failed', details = {}) {
+    super(message, 'VALIDATION_ERROR', details);
+    this.name = 'ValidationError';
+  }
+}
+
+class SecurityError extends SecureError {
+  constructor(message = 'Security violation detected', details = {}) {
+    super(message, 'SECURITY_VIOLATION', details);
+    this.name = 'SecurityError';
+  }
+}
+
+class EncryptionError extends SecureError {
+  constructor(message = 'Encryption/decryption failed', details = {}) {
+    super(message, 'ENCRYPTION_ERROR', details);
+    this.name = 'EncryptionError';
+  }
+}
+
+// Secure error handler middleware
+function secureErrorHandler(options = {}) {
+  const defaults = {
+    logErrors: envManager.get('NODE_ENV') !== 'production',
+    logFunction: console.error,
+    logFilePath: null,
+    sanitizeStack: true
+  };
+
+  const config = { ...defaults, ...options };
+  
+  // Ensure log directory exists
+  if (config.logFilePath && !SecurityUtils.safeExistsSync(path.dirname(config.logFilePath))) {
+    try {
+      fs.mkdirSync(path.dirname(config.logFilePath), { recursive: true });
+    } catch (e) {
+      console.error('Failed to create log directory:', e);
+    }
+  }
+
+  return function(error, req, res, next) {
+    // Handle specific error types
+    let statusCode = 500;
+    let response = {};
+
+    if (error instanceof ValidationError) {
+      statusCode = 400;
+      response = error.toJSON();
+    } else if (error instanceof SecurityError) {
+      statusCode = 403;
+      response = error.toJSON();
+    } else if (error instanceof EncryptionError) {
+      statusCode = 400;
+      response = error.toJSON();
+    } else {
+      // Generic error handling
+      response = SecureError.sanitizeError(error);
+    }
+
+    // Log the error if enabled
+    if (config.logErrors) {
+      const logEntry = {
+        timestamp: new Date().toISOString(),
+        error: {
+          name: error.name,
+          message: error.message,
+          stack: config.sanitizeStack 
+            ? error.stack.split('\n').slice(0, 3).join('\n') + '\n    ...'
+            : error.stack,
+          ...(error.details && { details: error.details }),
+          errorId: response.errorId
+        },
+        request: req ? {
+          method: req.method,
+          url: req.originalUrl,
+          ip: req.ip,
+          userAgent: req.get('user-agent')
+        } : undefined
+      };
+
+      // Log to console
+      if (typeof config.logFunction === 'function') {
+        SecurityUtils.safeWriteFileSync(config.logFilePath, JSON.stringify(logEntry, null, 2));
+      }
+
+      // Log to file if configured
+      if (config.logFilePath) {
+        SecurityUtils.safeWriteFileSync(
+          config.logFilePath,
+          JSON.stringify(logEntry) + '\n',
+          'utf8'
+        );
+      }
+    }
+
+    // Send response
+    res.status(statusCode).json(response);
+  };
+}
+
+module.exports = {
+  SecureError,
+  ValidationError,
+  SecurityError,
+  EncryptionError,
+  secureErrorHandler,
+  createError: (message, code, details) => new SecureError(message, code, details)
+};