kifaru 1.0.145 → 1.0.147

package/bin/kifaru-allow-scripts.cjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+const approvedPackages = ["kifaru", "agent-browser", "snyk", "esbuild", "workerd", "sharp", "keytar", "node-pty"]
+
+function parseAllowScripts(value) {
+  return value
+    .split(/[,\r\n]+/)
+    .map((item) => item.trim())
+    .filter((item) => item && item !== "null" && item !== "undefined")
+}
+
+function mergeAllowScripts(current, additions = approvedPackages) {
+  return [...new Set([...parseAllowScripts(current), ...additions])]
+}
+
+function resolveUserConfig() {
+  const configured = process.env.NPM_CONFIG_USERCONFIG || process.env.npm_config_userconfig
+  return configured ? path.resolve(configured) : path.join(os.homedir(), ".npmrc")
+}
+
+// npm 12 introduced allow-scripts. npm 10/11 reject the key through
+// `npm config`, so update the forward-compatible user config directly.
+function updateAllowScripts(content, additions = approvedPackages) {
+  const newline = content.includes("\r\n") ? "\r\n" : "\n"
+  const hadTrailingNewline = content.endsWith("\n")
+  const lines = content ? content.split(/\r?\n/) : []
+  if (hadTrailingNewline) lines.pop()
+
+  const values = []
+  for (const line of lines) {
+    const match = line.match(/^\s*allow-scripts\s*=\s*(.*)$/i)
+    if (match) values.push(match[1])
+  }
+
+  const allowed = mergeAllowScripts(values.join(","), additions)
+  const setting = `allow-scripts=${allowed.join(",")}`
+  let replaced = false
+  const next = lines.flatMap((line) => {
+    if (!/^\s*allow-scripts\s*=/i.test(line)) return [line]
+    if (replaced) return []
+    replaced = true
+    return [setting]
+  })
+  if (!replaced) next.push(setting)
+
+  return next.join(newline) + newline
+}
+
+function main() {
+  const userConfig = resolveUserConfig()
+  const current = fs.existsSync(userConfig) ? fs.readFileSync(userConfig, "utf8") : ""
+  const updated = updateAllowScripts(current)
+
+  fs.mkdirSync(path.dirname(userConfig), { recursive: true })
+  fs.writeFileSync(userConfig, updated)
+
+  console.log(`Allowed npm install scripts for: ${approvedPackages.join(", ")}`)
+  console.log(`Updated: ${userConfig}`)
+}
+
+if (require.main === module) {
+  try {
+    main()
+  } catch (error) {
+    console.error(`Failed to update npm install-script policy: ${error.message}`)
+    process.exit(1)
+  }
+}
+
+module.exports = {
+  approvedPackages,
+  mergeAllowScripts,
+  parseAllowScripts,
+  resolveUserConfig,
+  updateAllowScripts,
+}

package/package.json

@@ -1,22 +1,23 @@
 {
   "name": "kifaru",
   "bin": {
-    "kifaru": "./bin/kifaru"
+    "kifaru": "./bin/kifaru",
+    "kifaru-allow-scripts": "./bin/kifaru-allow-scripts.cjs"
   },
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "1.0.145",
+  "version": "1.0.147",
   "dependencies": {
     "@openauthjs/openauth": "0.0.0-20250322224806"
   },
   "optionalDependencies": {
-    "kifaru-linux-arm64": "1.0.145",
-    "kifaru-linux-x64-baseline": "1.0.145",
-    "kifaru-linux-arm64-musl": "1.0.145",
-    "kifaru-linux-x64-baseline-musl": "1.0.145",
-    "kifaru-darwin-arm64": "1.0.145",
-    "kifaru-darwin-x64": "1.0.145",
-    "kifaru-windows-x64": "1.0.145"
+    "kifaru-linux-arm64": "1.0.147",
+    "kifaru-linux-x64-baseline": "1.0.147",
+    "kifaru-linux-arm64-musl": "1.0.147",
+    "kifaru-linux-x64-baseline-musl": "1.0.147",
+    "kifaru-darwin-arm64": "1.0.147",
+    "kifaru-darwin-x64": "1.0.147",
+    "kifaru-windows-x64": "1.0.147"
   }
 }