safeinstall-cli 0.1.0

package/dist/specs.js

@@ -0,0 +1,185 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractRequestedSpecs = extractRequestedSpecs;
+exports.buildInstallPlan = buildInstallPlan;
+exports.parseManifestDependency = parseManifestDependency;
+const npm_package_arg_1 = __importDefault(require("npm-package-arg"));
+const FLAGS_WITH_VALUES = new Set([
+    "-C",
+    "-c",
+    "-w",
+    "--cache",
+    "--config",
+    "--cwd",
+    "--filter",
+    "--global-dir",
+    "--prefix",
+    "--registry",
+    "--save-prefix",
+    "--store-dir",
+    "--tag",
+    "--userconfig"
+]);
+function classifySourceType(result) {
+    switch (result.type) {
+        case "git":
+            return "git";
+        case "remote":
+            return result.fetchSpec?.endsWith(".tgz") || result.fetchSpec?.endsWith(".tar.gz") ? "tarball" : "url";
+        case "file":
+            return "file";
+        case "directory":
+            return "directory";
+        case "tag":
+        case "range":
+        case "version":
+        case "alias":
+            return "registry";
+        default:
+            return "unknown";
+    }
+}
+function classifyRegistrySpecKind(result) {
+    switch (result.type) {
+        case "tag":
+            return "tag";
+        case "version":
+            return "version";
+        case "range":
+        case "alias":
+            return "range";
+        default:
+            return undefined;
+    }
+}
+function isFlag(token) {
+    return token.startsWith("-");
+}
+function extractRequestedSpecs(args) {
+    const specs = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        if (token === "--") {
+            break;
+        }
+        if (!isFlag(token)) {
+            specs.push(token);
+            continue;
+        }
+        if (token.includes("=")) {
+            continue;
+        }
+        if (FLAGS_WITH_VALUES.has(token)) {
+            index += 1;
+        }
+    }
+    return specs;
+}
+function parseRequestedPackage(raw) {
+    if (raw.startsWith("github:") ||
+        raw.startsWith("git+ssh://") ||
+        raw.startsWith("git+https://") ||
+        raw.startsWith("git@")) {
+        return {
+            name: raw,
+            raw,
+            requested: raw,
+            sourceType: "git"
+        };
+    }
+    const parsed = raw.startsWith("workspace:")
+        ? {
+            name: raw.replace(/^workspace:/, ""),
+            rawSpec: raw,
+            type: "directory"
+        }
+        : (0, npm_package_arg_1.default)(raw);
+    const sourceType = raw.startsWith("workspace:") ? "workspace" : classifySourceType(parsed);
+    const name = parsed.name ?? raw;
+    const requested = raw.startsWith("workspace:")
+        ? raw
+        : parsed.type === "version" || parsed.type === "range" || parsed.type === "tag"
+            ? parsed.rawSpec ?? "latest"
+            : raw;
+    return {
+        name,
+        raw,
+        requested,
+        sourceType,
+        registrySpecKind: raw.startsWith("workspace:")
+            ? undefined
+            : classifyRegistrySpecKind(parsed)
+    };
+}
+function isSupportedInstallCommand(manager, command) {
+    const normalized = command.toLowerCase();
+    if (manager === "npm") {
+        return normalized === "install" || normalized === "ci";
+    }
+    if (manager === "pnpm") {
+        return normalized === "install" || normalized === "add";
+    }
+    return normalized === "install" || normalized === "add";
+}
+function splitManagerArgsAndCommand(argv) {
+    const [managerRaw, ...rest] = argv;
+    const manager = managerRaw;
+    if (!manager || (manager !== "npm" && manager !== "pnpm" && manager !== "bun")) {
+        throw new Error("Usage: safeinstall <npm|pnpm|bun> <install-command> [...args]");
+    }
+    const preCommandArgs = [];
+    for (let index = 0; index < rest.length; index += 1) {
+        const token = rest[index];
+        if (!isFlag(token)) {
+            return {
+                manager,
+                managerArgs: preCommandArgs,
+                command: token,
+                forwardedArgs: rest.slice(index + 1)
+            };
+        }
+        preCommandArgs.push(token);
+        if (!token.includes("=") && FLAGS_WITH_VALUES.has(token) && rest[index + 1]) {
+            preCommandArgs.push(rest[index + 1]);
+            index += 1;
+        }
+    }
+    throw new Error(`Missing command for ${manager}.`);
+}
+function buildInstallPlan(argv) {
+    const { manager, managerArgs, command, forwardedArgs } = splitManagerArgsAndCommand(argv);
+    if (!isSupportedInstallCommand(manager, command)) {
+        throw new Error(`Unsupported command: ${manager} ${command}. SafeInstall supports install/add flows only.`);
+    }
+    const requestedSpecs = extractRequestedSpecs(forwardedArgs);
+    const packages = requestedSpecs.map(parseRequestedPackage);
+    return {
+        manager,
+        command,
+        managerArgs,
+        forwardedArgs,
+        packages,
+        projectInstall: packages.length === 0
+    };
+}
+function parseManifestDependency(name, spec) {
+    if (spec.startsWith("workspace:")) {
+        return {
+            name,
+            raw: `${name}@${spec}`,
+            requested: spec,
+            sourceType: "workspace"
+        };
+    }
+    const parsed = npm_package_arg_1.default.resolve(name, spec);
+    return {
+        name,
+        raw: `${name}@${spec}`,
+        requested: parsed.rawSpec ?? spec,
+        sourceType: spec.startsWith("workspace:") ? "workspace" : classifySourceType(parsed),
+        registrySpecKind: spec.startsWith("workspace:") ? undefined : classifyRegistrySpecKind(parsed)
+    };
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "safeinstall-cli",
+  "version": "0.1.0",
+  "description": "Local-first CLI that blocks risky npm, pnpm, and bun installs before they run. Open source.",
+  "packageManager": "pnpm@10.17.0",
+  "license": "MIT",
+  "keywords": [
+    "security",
+    "supply-chain",
+    "npm",
+    "pnpm",
+    "bun",
+    "cli",
+    "vibe-coding",
+    "ai-coding"
+  ],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "SUPPORT.md",
+    "safeinstall.config.example.json"
+  ],
+  "bin": {
+    "safeinstall": "dist/cli.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Mickdownunder/SafeInstall.git"
+  },
+  "homepage": "https://safeinstall.dev",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "pnpm build && node dist/cli.js",
+    "prepack": "pnpm build",
+    "pack:smoke": "node scripts/pack-smoke.mjs",
+    "release:check": "pnpm typecheck && pnpm test && pnpm build && pnpm pack:smoke",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "npm-package-arg": "^12.0.2",
+    "semver": "^7.7.2",
+    "yaml": "^2.8.3"
+  },
+  "devDependencies": {
+    "@types/node": "^24.6.0",
+    "@types/npm-package-arg": "^6.1.4",
+    "@types/semver": "^7.7.1",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
+  }
+}

package/safeinstall.config.example.json

@@ -0,0 +1,21 @@
+{
+  "minimumReleaseAgeHours": 72,
+  "registryUrl": "https://registry.npmjs.org",
+  "allowedScripts": {
+    "esbuild": ["postinstall"]
+  },
+  "allowedSources": ["registry", "workspace", "file", "directory"],
+  "allowedPackages": [],
+  "ciMode": true,
+  "packageManagerDefaults": {
+    "npm": {
+      "ignoreScripts": true
+    },
+    "pnpm": {
+      "ignoreScripts": true
+    },
+    "bun": {
+      "ignoreScripts": true
+    }
+  }
+}