securenow 6.0.2 → 6.1.0

package/cli/run.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const { spawn } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const ui = require('./ui');
+
+function isESM(scriptPath) {
+  if (scriptPath.endsWith('.mjs')) return true;
+  if (scriptPath.endsWith('.cjs')) return false;
+
+  let dir = path.resolve(path.dirname(scriptPath));
+  while (true) {
+    const pkgPath = path.join(dir, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        return pkg.type === 'module';
+      } catch { return false; }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return false;
+}
+
+function resolveSecurenowRegister() {
+  // When running from the published package, securenow/register resolves to our own register.js.
+  // When running from the monorepo, resolve relative to this file.
+  try {
+    return require.resolve('securenow/register');
+  } catch {
+    return path.resolve(__dirname, '..', 'register.js');
+  }
+}
+
+function resolveFirewallOnly() {
+  try {
+    return require.resolve('securenow/firewall-only');
+  } catch {
+    return path.resolve(__dirname, '..', 'firewall-only.js');
+  }
+}
+
+function resolveESMHook() {
+  // --import uses ESM resolution which requires file:// URLs for absolute paths
+  // on Windows. Using the bare specifier lets Node's own resolver handle it.
+  try {
+    const resolved = require.resolve('@opentelemetry/instrumentation/hook.mjs');
+    const { pathToFileURL } = require('url');
+    return pathToFileURL(resolved).href;
+  } catch {
+    return '@opentelemetry/instrumentation/hook.mjs';
+  }
+}
+
+/**
+ * securenow run [node-flags...] <script> [app-args...]
+ *
+ * Spawns node with the correct OTel preload flags.
+ * Passes through Node flags (--watch, --inspect, etc.) and app arguments.
+ *
+ * We re-parse from process.argv directly so that flags like --watch and
+ * --inspect are forwarded to node verbatim (the CLI's own arg parser
+ * would otherwise consume them).
+ */
+function run(rawArgs) {
+  // rawArgs comes directly from process.argv, everything after `run` (or the file path)
+  if (!rawArgs || rawArgs.length === 0) {
+    ui.error('Missing script path.');
+    console.log('');
+    console.log(`  ${ui.c.bold('Usage:')} securenow run [node-flags] <script> [app-args]`);
+    console.log('');
+    console.log(`  ${ui.c.bold('Examples:')}`);
+    console.log(`    securenow run src/index.js`);
+    console.log(`    securenow run --watch src/index.js`);
+    console.log(`    securenow run --inspect src/server.js --port 3000`);
+    console.log('');
+    process.exit(1);
+  }
+
+  const args = rawArgs;
+
+  // Split into: node flags (before the script), script path, and app args (after)
+  // --firewall-only is a securenow-specific flag, not a Node flag — consume it.
+  const nodeFlags = [];
+  let firewallOnly = false;
+  let scriptIdx = -1;
+
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--firewall-only') {
+      firewallOnly = true;
+      continue;
+    }
+    if (args[i].startsWith('-')) {
+      nodeFlags.push(args[i]);
+    } else {
+      scriptIdx = i;
+      break;
+    }
+  }
+
+  if (scriptIdx === -1) {
+    ui.error('No script path found. Provide a .js/.mjs/.ts file to run.');
+    process.exit(1);
+  }
+
+  const scriptPath = args[scriptIdx];
+  const appArgs = args.slice(scriptIdx + 1);
+
+  const esm = isESM(scriptPath);
+  const preloadPath = firewallOnly ? resolveFirewallOnly() : resolveSecurenowRegister();
+
+  const otelFlags = [];
+  // ESM hook is only needed for full tracing; firewall-only skips OTel entirely.
+  if (esm && !firewallOnly) {
+    otelFlags.push('--import', resolveESMHook());
+  }
+  otelFlags.push('--require', preloadPath);
+
+  const finalArgs = [...otelFlags, ...nodeFlags, scriptPath, ...appArgs];
+
+  const nodeExe = process.execPath;
+
+  if (process.env.SECURENOW_DEBUG) {
+    console.log(`[securenow] ${ui.c.dim('exec:')} ${nodeExe} ${finalArgs.join(' ')}`);
+  }
+
+  const child = spawn(nodeExe, finalArgs, {
+    stdio: 'inherit',
+    env: process.env,
+    cwd: process.cwd(),
+  });
+
+  child.on('close', (code) => process.exit(code ?? 1));
+  child.on('error', (err) => {
+    ui.error(`Failed to start: ${err.message}`);
+    process.exit(1);
+  });
+
+  // Forward termination signals to the child
+  for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.on(sig, () => child.kill(sig));
+  }
+}
+
+module.exports = { run };