ripencli 1.1.0 → 1.2.0

package/README.md

@@ -1,6 +1,6 @@
 # ripen
 
-> Interactive dependency updater for npm, pnpm, yarn, and bun
+> Security-first interactive dependency updater for npm, pnpm, yarn, and bun
 
 ![npm version](https://img.shields.io/npm/v/ripencli) ![node](https://img.shields.io/node/v/ripencli) ![GitHub License](https://img.shields.io/github/license/yusifaliyevpro/ripen)
 
@@ -10,9 +10,9 @@
 
 ## Features
 
+- **Security first** — ripen never executes commands. Everything goes to your clipboard; you review and run it yourself
 - **Interactive TUI** — navigate packages with arrow keys, select with space
-- **Clipboard-first** — copies the ready-to-run update command to your clipboard, nothing is executed for you
-- **Publish age** — shows how long ago the latest version was published (yellow if < 1 day, useful for pnpm's `minimumReleaseAge`)
+- **Publish age** — shows how long ago the latest version was published (yellow if < 1 day, useful for spotting freshly published packages before trusting them)
 - **Version picker** — choose any specific version from the npm registry, not just latest
 - **Changelog viewer** — see GitHub release notes before you update
 - **npm, pnpm, yarn & bun** — auto-detects your package manager
@@ -47,6 +47,9 @@ ripen -g
 # Show all packages, not just outdated ones
 ripen --all
 
+# Show all global packages, not just outdated ones
+ripen -g -a
+
 # Help
 ripen --help
 ```
@@ -86,6 +89,7 @@ Press `s` to open the settings screen. Settings are persisted at `~/.config/ripe
 | Enable scope grouping        | Off     | Group scoped packages under their scope prefix               |
 | Show grouped scopes on top   | Off     | Grouped scopes appear before ungrouped packages              |
 | Grouped scopes               | —       | List of scopes to group (e.g. `@heroui`, `@radix-ui`)       |
+| SFW Firewall                 | Off     | Prepend `sfw` before every generated command (requires [sfw](https://github.com/nicolo-ribaudo/sfw)) |
 
 When using `ripen -g`, all available package managers (npm, pnpm, yarn) are checked in parallel so you see every global package in one place. Bun is not included in global checking because it doesn't provide a JSON output for its outdated command.
 

package/dist/cli.js

@@ -221,7 +221,7 @@ async function fetchRegistryInfoWithRetry(packageName) {
 		clearTimeout(timeout);
 		if (!res.ok) return null;
 		const data = await res.json();
-		const version = data["dist-tags"]?.latest ?? null;
+		const version = data["dist-tags"]?.latest ?? Object.keys(data.versions ?? {}).at(-1) ?? null;
 		if (!version) return null;
 		return {
 			version,
@@ -291,6 +291,108 @@ async function getOutdatedPackages(manager, cwd, global = false, onLine, showAll
 		packages
 	};
 }
+/** Fetch publish dates from the registry and attach them to existing packages in-place. */
+async function hydratePublishDates(packages) {
+	if (packages.length === 0) return;
+	const info = await fetchAllLatest(packages.map((p) => p.name), 8);
+	for (const pkg of packages) {
+		const r = info.get(pkg.name);
+		if (r?.publishedAt) pkg.latestPublishedAt = r.publishedAt;
+	}
+}
+/**
+* List all globally installed packages for a manager.
+* Returns name + currently installed version.
+*/
+async function listGlobalPackages(manager, cwd) {
+	try {
+		if (manager === "npm") {
+			const { stdout } = await execa("npm", [
+				"list",
+				"-g",
+				"--depth=0",
+				"--json"
+			], {
+				cwd,
+				reject: false
+			});
+			const data = JSON.parse(stdout);
+			return Object.entries(data.dependencies ?? {}).map(([name, info]) => ({
+				name,
+				current: info.version ?? "N/A"
+			}));
+		}
+		if (manager === "pnpm") {
+			const { stdout } = await execa("pnpm", [
+				"list",
+				"-g",
+				"--json"
+			], {
+				cwd,
+				reject: false
+			});
+			const data = JSON.parse(stdout);
+			const deps = Array.isArray(data) ? data[0]?.dependencies ?? {} : data.dependencies ?? {};
+			return Object.entries(deps).map(([name, info]) => ({
+				name,
+				current: info.version ?? "N/A"
+			}));
+		}
+		if (manager === "yarn") {
+			const { stdout } = await execa("yarn", [
+				"global",
+				"list",
+				"--depth=0",
+				"--json"
+			], {
+				cwd,
+				reject: false
+			});
+			const pkgs = [];
+			for (const line of stdout.trim().split("\n")) try {
+				const obj = JSON.parse(line);
+				if (obj.type === "tree" && obj.data?.trees) for (const tree of obj.data.trees) {
+					const match = tree.name?.match(/^(.+)@([^@]+)$/);
+					if (match) pkgs.push({
+						name: match[1],
+						current: match[2]
+					});
+				}
+			} catch {}
+			return pkgs;
+		}
+	} catch {}
+	return [];
+}
+/** Global mode, showAll=true: list all installed packages then check registry for latest. */
+async function getGlobalAllPackages(manager, cwd, onLine) {
+	const installed = await listGlobalPackages(manager, cwd);
+	if (installed.length === 0) return {
+		ok: true,
+		packages: []
+	};
+	const registryInfo = await fetchAllLatest(installed.map((p) => p.name), 8, onLine);
+	const packages = [];
+	for (const dep of installed) {
+		const info = registryInfo.get(dep.name);
+		if (!info) continue;
+		packages.push({
+			name: dep.name,
+			current: dep.current,
+			wanted: info.version,
+			latest: info.version,
+			dependent: "",
+			type: "global",
+			selected: false,
+			targetVersion: info.version,
+			latestPublishedAt: info.publishedAt || void 0
+		});
+	}
+	return {
+		ok: true,
+		packages
+	};
+}
 /** Global mode: shell out to manager's outdated command */
 async function getGlobalOutdatedPackages(manager, cwd, onLine) {
 	const args = [
@@ -336,34 +438,36 @@ async function getGlobalOutdatedPackages(manager, cwd, onLine) {
 		ok: true,
 		packages: []
 	};
+	let packages;
 	if (manager === "yarn") try {
-		return {
-			ok: true,
-			packages: parseYarnOutdated(raw, true)
-		};
+		packages = parseYarnOutdated(raw, true);
 	} catch {
 		return {
 			ok: false,
 			error: "Failed to parse yarn outdated output. Try again."
 		};
 	}
-	const jsonStr = extractJson(raw);
-	if (!jsonStr) return {
-		ok: false,
-		error: stderr.trim() || raw.slice(0, 120)
-	};
-	try {
-		const data = JSON.parse(jsonStr);
-		return {
-			ok: true,
-			packages: manager === "pnpm" ? parsePnpmOutdated(data) : parseNpmOutdated(data)
-		};
-	} catch {
-		return {
+	else {
+		const jsonStr = extractJson(raw);
+		if (!jsonStr) return {
 			ok: false,
-			error: "Failed to parse outdated output. Try again."
+			error: stderr.trim() || raw.slice(0, 120)
 		};
+		try {
+			const data = JSON.parse(jsonStr);
+			packages = manager === "pnpm" ? parsePnpmOutdated(data) : parseNpmOutdated(data);
+		} catch {
+			return {
+				ok: false,
+				error: "Failed to parse outdated output. Try again."
+			};
+		}
 	}
+	await hydratePublishDates(packages);
+	return {
+		ok: true,
+		packages
+	};
 }
 /**
 * Extract the first top-level JSON object from a string that may contain
@@ -419,15 +523,16 @@ const ALL_MANAGERS = [
 	"yarn"
 ];
 /**
-* Check all available package managers for global outdated packages in parallel.
+* Check all available package managers for global packages in parallel.
 * Each returned package is tagged with its owning manager.
+* showAll=true lists every installed package, not just outdated ones.
 */
-async function getAllGlobalOutdated(cwd, onLine) {
+async function getAllGlobalOutdated(cwd, onLine, showAll = false) {
 	const managers = (await Promise.all(ALL_MANAGERS.map(async (m) => ({
 		manager: m,
 		ok: await isManagerAvailable(m)
 	})))).filter((a) => a.ok).map((a) => a.manager);
-	const results = await Promise.all(managers.map((m) => getOutdatedPackages(m, cwd, true, onLine)));
+	const results = await Promise.all(managers.map((m) => showAll ? getGlobalAllPackages(m, cwd, onLine) : getOutdatedPackages(m, cwd, true, onLine)));
 	const allPackages = [];
 	for (let i = 0; i < managers.length; i++) {
 		const result = results[i];
@@ -468,7 +573,7 @@ function parseYarnOutdated(raw, global) {
 }
 //#endregion
 //#region src/executor.ts
-function buildUpdateCommands(manager, packages, global = false) {
+function buildUpdateCommands(manager, packages, global = false, sfwFirewall = false) {
 	const commands = [];
 	const deps = packages.filter((p) => !global && p.type === "dependencies");
 	const devDeps = packages.filter((p) => !global && p.type === "devDependencies");
@@ -478,7 +583,7 @@ function buildUpdateCommands(manager, packages, global = false) {
 			const version = pkg.targetVersion ?? pkg.latest;
 			return `${pkg.name}@${version}`;
 		});
-		return `${mgr} ${(mgr === "yarn" && global ? [
+		const cmd = `${mgr} ${(mgr === "yarn" && global ? [
 			"global",
 			"add",
 			...pkgArgs
@@ -487,6 +592,7 @@ function buildUpdateCommands(manager, packages, global = false) {
 			...flags,
 			...pkgArgs
 		]).join(" ")}`;
+		return sfwFirewall ? `sfw ${cmd}` : cmd;
 	};
 	if (deps.length > 0) commands.push(makeCmd(manager, deps, []));
 	if (devDeps.length > 0) commands.push(makeCmd(manager, devDeps, [manager === "bun" ? "-d" : "-D"]));
@@ -511,7 +617,8 @@ const DEFAULT_CONFIG = {
 	groupScopes: [],
 	groupsOnTop: false,
 	frequencySort: false,
-	separateDevDeps: true
+	separateDevDeps: true,
+	sfwFirewall: false
 };
 const CONFIG_DIR = join(homedir(), ".config", "ripen");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
@@ -1872,6 +1979,7 @@ function Settings({ config, onConfigChange, onClose }) {
 		{ type: "toggle-separate-dev" },
 		{ type: "toggle-group" },
 		{ type: "toggle-groups-top" },
+		{ type: "toggle-sfw" },
 		{ type: "list-header" },
 		...scopes.map((_, i) => ({
 			type: "list-item",
@@ -1934,6 +2042,10 @@ function Settings({ config, onConfigChange, onClose }) {
 				...config,
 				groupsOnTop: !config.groupsOnTop
 			});
+			else if (currentRow?.type === "toggle-sfw") onConfigChange({
+				...config,
+				sfwFirewall: !config.sfwFirewall
+			});
 			else if (currentRow?.type === "list-header") {
 				setInputMode(true);
 				setInputValue("");
@@ -1995,6 +2107,12 @@ function Settings({ config, onConfigChange, onClose }) {
 				focused: currentRow?.type === "toggle-groups-top",
 				disabled: !config.groupByScope
 			}),
+			/* @__PURE__ */ jsx(SettingsToggle, {
+				label: "SFW firewall",
+				description: "Prepend \"sfw\" before every generated install command",
+				checked: config.sfwFirewall,
+				focused: currentRow?.type === "toggle-sfw"
+			}),
 			/* @__PURE__ */ jsxs(Box, {
 				flexDirection: "column",
 				marginBottom: 1,
@@ -2024,7 +2142,7 @@ function Settings({ config, onConfigChange, onClose }) {
 						})]
 					}),
 					scopes.map((scope, i) => {
-						const itemFocused = flatCursor === 5 + i;
+						const itemFocused = flatCursor === 6 + i;
 						return /* @__PURE__ */ jsxs(Box, {
 							marginLeft: 4,
 							gap: 1,
@@ -2111,10 +2229,9 @@ function Settings({ config, onConfigChange, onClose }) {
 }
 //#endregion
 //#region src/ui/SelfUpdatePrompt.tsx
-function SelfUpdatePrompt({ currentVersion, latestVersion, updating, error, onUpdate, onSkip }) {
+function SelfUpdatePrompt({ currentVersion, latestVersion, onUpdate, onSkip }) {
 	const [selected, setSelected] = useState(0);
-	useInput((input, key) => {
-		if (updating) return;
+	useInput((_input, key) => {
 		if (key.upArrow) setSelected(0);
 		if (key.downArrow) setSelected(1);
 		if (key.return) if (selected === 0) onUpdate();
@@ -2131,9 +2248,9 @@ function SelfUpdatePrompt({ currentVersion, latestVersion, updating, error, onUp
 			}),
 			/* @__PURE__ */ jsx(Box, {
 				marginTop: 1,
-				flexDirection: "column",
 				children: /* @__PURE__ */ jsxs(Text, { children: [
-					"A new version is available! ",
+					"A new version is available!",
+					"  ",
 					/* @__PURE__ */ jsx(Text, {
 						color: "gray",
 						children: currentVersion
@@ -2148,23 +2265,7 @@ function SelfUpdatePrompt({ currentVersion, latestVersion, updating, error, onUp
 					})
 				] })
 			}),
-			error && /* @__PURE__ */ jsxs(Box, {
-				marginTop: 1,
-				children: [/* @__PURE__ */ jsxs(Text, {
-					color: "red",
-					children: ["✗ Update failed: ", error]
-				}), /* @__PURE__ */ jsx(Text, {
-					color: "gray",
-					children: " Continuing…"
-				})]
-			}),
-			updating ? /* @__PURE__ */ jsx(Box, {
-				marginTop: 1,
-				children: /* @__PURE__ */ jsx(Text, {
-					color: "gray",
-					children: "Updating ripen…"
-				})
-			}) : /* @__PURE__ */ jsxs(Box, {
+			/* @__PURE__ */ jsxs(Box, {
 				marginTop: 1,
 				flexDirection: "column",
 				children: [/* @__PURE__ */ jsxs(Text, { children: [selected === 0 ? /* @__PURE__ */ jsx(Text, {
@@ -2172,7 +2273,7 @@ function SelfUpdatePrompt({ currentVersion, latestVersion, updating, error, onUp
 					children: "❯ "
 				}) : /* @__PURE__ */ jsx(Text, { children: "  " }), /* @__PURE__ */ jsx(Text, {
 					color: selected === 0 ? "white" : "gray",
-					children: "Update"
+					children: "Update (copies command to clipboard)"
 				})] }), /* @__PURE__ */ jsxs(Text, { children: [selected === 1 ? /* @__PURE__ */ jsx(Text, {
 					color: "greenBright",
 					children: "❯ "
@@ -2233,8 +2334,6 @@ function TerminalOutputBox({ message, command, outputLines, maxLines }) {
 //#region src/ui/hooks/use-self-update.ts
 function useSelfUpdate(currentVersion, installManager) {
 	const [latestVersion, setLatestVersion] = useState(null);
-	const [selfUpdating, setSelfUpdating] = useState(false);
-	const [selfUpdateError, setSelfUpdateError] = useState(null);
 	const [checkComplete, setCheckComplete] = useState(false);
 	const [hasUpdate, setHasUpdate] = useState(false);
 	useEffect(() => {
@@ -2251,33 +2350,17 @@ function useSelfUpdate(currentVersion, installManager) {
 			cancelled = true;
 		};
 	}, []);
-	const performUpdate = async () => {
-		setSelfUpdating(true);
-		try {
-			await execa(installManager, installManager === "yarn" ? [
-				"global",
-				"add",
-				`ripencli@${latestVersion}`
-			] : [
-				"add",
-				"--global",
-				`ripencli@${latestVersion}`
-			]);
-			setSelfUpdating(false);
-			return true;
-		} catch (err) {
-			setSelfUpdateError(err.message ?? "Unknown error");
-			setSelfUpdating(false);
-			return false;
-		}
+	const buildUpdateCommand = () => {
+		const version = latestVersion ?? "latest";
+		if (installManager === "yarn") return `yarn global add ripencli@${version}`;
+		if (installManager === "bun") return `bun add -g ripencli@${version}`;
+		return `${installManager} add -g ripencli@${version}`;
 	};
 	return {
 		latestVersion,
-		selfUpdating,
-		selfUpdateError,
 		checkComplete,
 		hasUpdate,
-		performUpdate
+		buildUpdateCommand
 	};
 }
 //#endregion
@@ -2367,7 +2450,7 @@ function App({ project, global, showAll, version, installManager, onCancelled, o
 	useInput((_input, key) => {
 		if (key.ctrl && _input === "c") setScreen("cancelled");
 	});
-	useExitOnScreen(screen, ["self-update-done", "empty"], exit);
+	useExitOnScreen(screen, ["empty"], exit);
 	useExitOnScreen(screen, ["cancelled"], exit, {
 		delay: 200,
 		beforeExit: () => onCancelled?.()
@@ -2377,9 +2460,12 @@ function App({ project, global, showAll, version, installManager, onCancelled, o
 		if (screen !== "self-update-check") return;
 		setScreen(selfUpdate.hasUpdate ? "self-update" : "loading");
 	}, [selfUpdate.checkComplete]);
-	const handleSelfUpdate = async () => {
-		if (await selfUpdate.performUpdate()) setScreen("self-update-done");
-		else setTimeout(() => setScreen("loading"), 2e3);
+	const handleSelfUpdate = () => {
+		const raw = selfUpdate.buildUpdateCommand();
+		const cmd = config.sfwFirewall ? `sfw ${raw}` : raw;
+		copyToClipboard(cmd);
+		onCopied?.([cmd]);
+		exit();
 	};
 	const [fetchStarted, setFetchStarted] = useState(false);
 	useEffect(() => {
@@ -2387,7 +2473,7 @@ function App({ project, global, showAll, version, installManager, onCancelled, o
 		setFetchStarted(true);
 		terminal.setLoadingMsg("Checking for outdated packages…");
 		terminal.setTerminalCmd(global ? "Checking all package managers…" : "Checking npm registry…");
-		(global ? getAllGlobalOutdated(project.cwd, terminal.onLine) : getOutdatedPackages(project.manager, project.cwd, false, terminal.onLine, showAll)).then((result) => {
+		(global ? getAllGlobalOutdated(project.cwd, terminal.onLine, showAll) : getOutdatedPackages(project.manager, project.cwd, false, terminal.onLine, showAll)).then((result) => {
 			if (!result.ok) {
 				setErrorMsg(result.error);
 				setScreen("error");
@@ -2408,7 +2494,7 @@ function App({ project, global, showAll, version, installManager, onCancelled, o
 	const handleConfirm = () => {
 		const selected = packages.filter((p) => p.selected);
 		if (selected.length === 0) return;
-		const commands = buildUpdateCommands(project.manager, selected, global);
+		const commands = buildUpdateCommands(project.manager, selected, global, config.sfwFirewall);
 		copyToClipboard(commands.join(" && "));
 		incrementFrequency(selected.map((p) => p.name));
 		setFrequency(loadFrequency());
@@ -2433,30 +2519,9 @@ function App({ project, global, showAll, version, installManager, onCancelled, o
 	if (screen === "self-update") return /* @__PURE__ */ jsx(SelfUpdatePrompt, {
 		currentVersion: version,
 		latestVersion: selfUpdate.latestVersion,
-		updating: selfUpdate.selfUpdating,
-		error: selfUpdate.selfUpdateError,
 		onUpdate: handleSelfUpdate,
 		onSkip: () => setScreen("loading")
 	});
-	if (screen === "self-update-done") return /* @__PURE__ */ jsxs(Box, {
-		flexDirection: "column",
-		padding: 1,
-		children: [/* @__PURE__ */ jsxs(Text, {
-			color: "greenBright",
-			bold: true,
-			children: [" ", "ripen"]
-		}), /* @__PURE__ */ jsx(Box, {
-			marginTop: 1,
-			children: /* @__PURE__ */ jsxs(Text, {
-				color: "green",
-				children: [
-					"✓ Updated to v",
-					selfUpdate.latestVersion,
-					". Run ripen again to use the new version."
-				]
-			})
-		})]
-	});
 	if (screen === "loading") return /* @__PURE__ */ jsx(TerminalOutputBox, {
 		message: terminal.loadingMsg,
 		command: terminal.terminalCmd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ripencli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Interactive dependency updater for npm, pnpm, yarn, and bun",
   "license": "MIT",
   "author": {
@@ -28,7 +28,7 @@
   },
   "type": "module",
   "bin": {
-    "ripen": "./dist/cli.js"
+    "ripen": "dist/cli.js"
   },
   "scripts": {
     "build": "tsdown",
@@ -68,7 +68,8 @@
     "execa": "9.6.1",
     "ink": "7.0.3",
     "ink-scroll-view": "0.3.7",
-    "react": "19.2.6"
+    "react": "19.2.6",
+    "ripencli": "link:"
   },
   "devDependencies": {
     "@types/node": "24.12.2",