node-power-user 2.1.7 → 2.2.0

package/README.md

@@ -107,9 +107,13 @@ npu out --heal        # skip the menu: reinstall copies that don't match package
 npu out --sync        # skip the menu: install packages to match package.json
 npu out -r            # skip the menu: reconcile package.json to installed versions
 npu out -P | -m | -M  # skip the menu: apply patch / minor / major updates
+npu out --min-age 14  # only update packages published ≥ 14 days ago (default: 7)
+npu out --min-age 0   # disable age filtering — update everything
 npu out --force       # bypass Socket protection
 ```
 
+The table includes a **Released** column showing when each package's latest version was published and how many days ago. Packages published less than `--min-age` days ago (default: 7) are flagged with ⚠ and **automatically skipped** during updates — unless that version is already installed. This protects against supply chain attacks that target brand-new releases.
+
 Every run starts with an integrity check: npu compares what `node_modules/.package-lock.json` claims is installed against the packages physically on disk — including transitive deps the table can't show. Desynced copies (stale or partially-extracted installs, typically left behind by an interrupted or Socket-blocked install) make npm silently no-op (`npm install` trusts the lockfile over the disk), so npu warns about them and offers to heal.
 
 When problems are found, the menu offers context-aware actions:

package/dist/cli.js

@@ -10,6 +10,7 @@ const ALIASES = {
   global: ['-g', '--global'],
   audit: ['--audit'],
   install: ['-i', '--install', 'i'],
+  npx: ['--npx'],
   open: ['--open', 'repo', '--repo'],
   outdated: ['-o', 'out', '--outdated', '-u', '--update', 'up', 'update'],
   packages: ['-p', 'pack', '--packages'],
@@ -46,6 +47,10 @@ function resolveCommand(options) {
 function Main() {}
 
 Main.prototype.process = async function (options) {
+  // Prevent recursion: zsh/PATH wrappers route npm/npx → npu. When npu
+  // spawns subprocesses (sfw, npm, npx), they must NOT loop back to npu.
+  process.env._NPU_GUARD = '1';
+
   // Fix options
   options = options || {};
   options._ = options._ || [];

package/dist/commands/npx.js

@@ -0,0 +1,42 @@
+// Libraries
+const logger = new (require('../lib/logger'))('node-power-user');
+const socket = require('../lib/socket');
+
+// Module
+module.exports = async function (options) {
+  // Get everything after "npx" as the command to run
+  const args = (options._ || []).slice(1);
+
+  if (args.length === 0) {
+    logger.error('Usage: npu npx <command> [args...]');
+    logger.log(`Example: ${logger.format.cyan('npu npx create-react-app my-app')}`);
+    return;
+  }
+
+  const command = `npx ${args.join(' ')}`;
+
+  // Check firewall status upfront (blocks if not installed unless --force)
+  await socket.check({ force: options.force });
+
+  // Log
+  logger.log(`Running: ${logger.format.cyan(command)}`);
+
+  // Wrap with Socket Firewall
+  try {
+    await socket.wrap(command, { force: options.force });
+  } catch (e) {
+    if (e.reason === 'npm-failed') {
+      logger.log('');
+      logger.log('npx command failed. See the error output above.');
+      return;
+    }
+
+    logger.log('');
+    logger.log('Command blocked. See the output above for details.');
+    logger.log('To retry without firewall protection:');
+    logger.log(logger.format.cyan(`  npu npx ${args.join(' ')} --force`));
+    return;
+  }
+
+  logger.log(logger.format.green('Done.'));
+};

package/dist/commands/outdated.js

@@ -51,6 +51,8 @@ module.exports = async function (options) {
     logger.log(chalk.dim(`Ignoring: ${ignoreList.join(', ')}`));
   }
 
+  const minAge = options.minAge != null ? Number(options.minAge) : 7;
+
   // Run ncu for patch, minor, and latest (include peer dependencies)
   const ncuOptions = {
     packageFile: packageJsonPath,
@@ -108,6 +110,25 @@ module.exports = async function (options) {
     }
   }
 
+  // Fetch publish dates for packages with updates
+  if (allPackages.size > 0) {
+    await Promise.all([...allPackages.values()].map(async (pkg) => {
+      if (!pkg.latestVersion) return;
+
+      try {
+        const output = await execute(`npm view ${pkg.name} time --json`, { log: false });
+        const times = JSON.parse(output);
+        const publishDate = times[pkg.latestVersion];
+        if (publishDate) {
+          pkg.publishedDate = new Date(publishDate);
+          pkg.daysSincePublish = Math.floor((Date.now() - pkg.publishedDate.getTime()) / (1000 * 60 * 60 * 24));
+        }
+      } catch {
+        // Release date is supplementary — skip on failure
+      }
+    }));
+  }
+
   // Display unified table
   if (allPackages.size === 0 && desynced.length === 0) {
     logger.log(logger.format.green('\nAll packages are up to date!'));
@@ -115,7 +136,7 @@ module.exports = async function (options) {
   }
 
   if (allPackages.size > 0) {
-    const dataTable = [['Package', 'package.json', 'Installed', 'Latest', 'Type']];
+    const dataTable = [['Package', 'package.json', 'Installed', 'Latest', 'Released', 'Type']];
 
     for (const pkg of allPackages.values()) {
       const pkgVersionColor = pkg.hasDiscrepancy ? 'red' : 'green';
@@ -134,21 +155,34 @@ module.exports = async function (options) {
         latestDisplay = chalk.dim('-');
       }
 
+      let releasedDisplay;
+      if (pkg.daysSincePublish != null) {
+        const dateStr = pkg.publishedDate.toISOString().split('T')[0];
+        const display = `${dateStr} (${pkg.daysSincePublish}d)`;
+        releasedDisplay = pkg.daysSincePublish < minAge ? chalk.magenta(display + ' ⚠') : chalk.dim(display);
+      } else {
+        releasedDisplay = chalk.dim('-');
+      }
+
       dataTable.push([
         pkg.name,
         chalk[pkgVersionColor](pkg.packageVersion),
         chalk.green(pkg.installedVersion),
         latestDisplay,
+        releasedDisplay,
         pkg.type,
       ]);
     }
 
     console.log(table(dataTable));
 
-    // Only show legend if there are major updates
     const hasMajorUpdates = [...allPackages.values()].some(pkg => pkg.hasMajorUpdate);
-    if (hasMajorUpdates) {
-      logger.log(chalk.dim('Legend: ') + chalk.magenta('⚠ = major version (breaking changes)'));
+    const hasRecentReleases = [...allPackages.values()].some(pkg => pkg.daysSincePublish != null && pkg.daysSincePublish < minAge);
+    if (hasMajorUpdates || hasRecentReleases) {
+      const legends = [];
+      if (hasMajorUpdates) legends.push(chalk.magenta('⚠ = major version (breaking changes)'));
+      if (hasRecentReleases) legends.push(chalk.magenta(`⚠ = published < ${minAge} days ago (auto-skipped)`));
+      logger.log(chalk.dim('Legend: ') + legends.join(chalk.dim(' · ')));
     }
   }
 
@@ -411,9 +445,32 @@ module.exports = async function (options) {
   }
 
   // Handle patch/minor/major updates
-  const upgrades = action === 'patch' ? patchUpgrades
+  const allUpgrades = action === 'patch' ? patchUpgrades
     : action === 'minor' ? minorUpgrades
     : latestUpgrades;
+
+  // Filter out packages whose target version was published too recently
+  const tooNew = [...allPackages.values()]
+    .filter(pkg => pkg.daysSincePublish != null && pkg.daysSincePublish < minAge)
+    .filter(pkg => allUpgrades[pkg.name] && pkg.installedVersion !== version.clean(allUpgrades[pkg.name]))
+    .map(pkg => pkg.name);
+
+  const upgrades = {};
+  for (const [name, ver] of Object.entries(allUpgrades)) {
+    if (!tooNew.includes(name)) {
+      upgrades[name] = ver;
+    }
+  }
+
+  if (tooNew.length > 0) {
+    logger.warn(`\nSkipped ${tooNew.length} package(s) published < ${minAge} days ago:`);
+    for (const name of tooNew) {
+      const pkg = allPackages.get(name);
+      logger.warn(`  ${chalk.magenta('⚠')} ${name}@${pkg.latestVersion} (${pkg.daysSincePublish}d old)`);
+    }
+    logger.log(chalk.dim(`Use --min-age 0 to include all packages regardless of age.`));
+  }
+
   const packageNames = Object.keys(upgrades);
 
   if (packageNames.length === 0) {
@@ -428,10 +485,12 @@ module.exports = async function (options) {
   const packageJsonBackup = jetpack.read(packageJsonPath);
   const lockfileBackup = jetpack.read(lockfilePath);
 
+  const rejectList = [...ignoreList, ...tooNew];
   await ncu.run({
     packageFile: packageJsonPath,
     target: action,
     upgrade: true,
+    ...(rejectList.length > 0 ? { reject: rejectList } : {}),
   });
 
   logger.log(logger.format.green(`\nUpdated ${packageNames.length} package(s) in package.json.`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-power-user",
-  "version": "2.1.7",
+  "version": "2.2.0",
   "description": "Easy tools for every Node.js developer!",
   "main": "dist/index.js",
   "scripts": {
@@ -41,7 +41,7 @@
   },
   "homepage": "https://itwcreativeworks.com",
   "dependencies": {
-    "@inquirer/prompts": "^8.4.3",
+    "@inquirer/prompts": "^8.5.2",
     "chalk": "^5.6.2",
     "cli-progress": "^3.12.0",
     "fs-jetpack": "^5.1.0",
@@ -54,7 +54,7 @@
     "yargs": "^18.0.0"
   },
   "devDependencies": {
-    "mocha": "^11.7.5",
+    "mocha": "^11.7.6",
     "prepare-package": "^2.1.0"
   }
 }