upstreamfix 0.1.0 → 0.1.3

package/dist/core/runner.js

@@ -1,14 +1,20 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { execFile as execFileCallback } from 'node:child_process';
 import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { registerTemporaryCleanup } from './process-cleanup.js';
 import { promisify } from 'node:util';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
 import { structuredPatch } from 'diff';
 import { Project } from 'ts-morph';
+import { IGNORED_PROJECT_DIRECTORIES, isSupportedSourceMajor } from './project-discovery.js';
+import { parseManifest } from './manifest.js';
 const execFile = promisify(execFileCallback);
 const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs']);
-const IGNORED_DIRS = new Set(['node_modules', 'dist', 'coverage', '.next', '.git', '.venv', 'venv']);
+const MAX_DIFF_INPUT_BYTES = 1024 * 1024;
+const MAX_DIFF_OUTPUT_CHARS = 64 * 1024;
+const MAX_REPORT_DIFF_CHARS = 256 * 1024;
+const LOCKFILE_NAMES = new Set(['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock']);
 export function loadProject(cwd, packageName = 'firebase-admin') {
     const project = new Project({
         skipAddingFilesFromTsConfig: true,
@@ -27,7 +33,7 @@ function loadScopedProject(root, migration) {
         let parsed;
         let invalid = false;
         try {
-            parsed = JSON.parse(readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+            parsed = parseManifest(readFileSync(file, 'utf8'));
         }
         catch {
             invalid = true;
@@ -82,7 +88,7 @@ function loadScopedProject(root, migration) {
             });
             continue;
         }
-        if (!isSourceMajorRange(declaration.range, migration.fromMajor)) {
+        if (!isSupportedSourceMajor(declaration.range, migration.fromMajor)) {
             manual.push({
                 file: sourcePath,
                 line: 1,
@@ -96,9 +102,6 @@ function loadScopedProject(root, migration) {
     }
     return { project, manual, manifestBySource };
 }
-function isSourceMajorRange(range, major) {
-    return new RegExp(`^\\s*[~^]?${major}(?:\\.(?:\\d+|x|\\*)){0,2}\\s*$`, 'i').test(range);
-}
 function isRegistryVersionSpec(spec) {
     // A deliberately narrow subset: registry dist-tags or ordinary semver ranges.
     // Anything that can name a path, URL, Git host, workspace, alias, or patch is manual.
@@ -138,6 +141,9 @@ export function lockfileCommandEnvironment(home) {
         NPM_CONFIG_FUND: 'false',
         NPM_CONFIG_IGNORE_SCRIPTS: 'true',
         COREPACK_ENABLE_PROJECT_SPEC: '0',
+        COREPACK_ENABLE_AUTO_PIN: '0',
+        COREPACK_ENABLE_UNSAFE_CUSTOM_URLS: '0',
+        COREPACK_HOME: path.join(home, 'corepack'),
         GIT_CONFIG_NOSYSTEM: '1',
         GIT_TERMINAL_PROMPT: '0',
     };
@@ -148,7 +154,7 @@ function findSourceFiles(root, packageName) {
         for (const entry of readdirSync(directory, { withFileTypes: true })) {
             const absolutePath = path.join(directory, entry.name);
             if (entry.isDirectory()) {
-                if (!IGNORED_DIRS.has(entry.name))
+                if (!IGNORED_PROJECT_DIRECTORIES.has(entry.name))
                     visit(absolutePath);
                 continue;
             }
@@ -172,7 +178,7 @@ export async function runMigration(migration, options) {
     }
     const scoped = loadScopedProject(options.cwd, migration);
     const project = scoped.project;
-    const originalSources = new Map(project.getSourceFiles().map((file) => [file.getFilePath(), file.getFullText()]));
+    const originalSources = new Map(await Promise.all(project.getSourceFiles().map(async (file) => [file.getFilePath(), await readFile(file.getFilePath(), 'utf8')])));
     const result = migration.transform(project);
     result.manual.unshift(...scoped.manual);
     const compatibilityNotes = migration.inspectManifest
@@ -182,7 +188,7 @@ export async function runMigration(migration, options) {
         throw new Error('This migration has manual review items; no files were written. Resolve them and preview again.');
     }
     const manifestsWithChangedCode = new Set(result.filesChanged.map((sourcePath) => scoped.manifestBySource.get(sourcePath)).filter((file) => Boolean(file)));
-    const manifest = result.manual.length === 0 && result.changes.length > 0
+    const manifest = !options.analysisOnly && result.manual.length === 0 && result.changes.length > 0
         ? await migrateManifests(migration, options, manifestsWithChangedCode)
         : {
             notes: [result.manual.length > 0
@@ -194,6 +200,11 @@ export async function runMigration(migration, options) {
     if (!options.dryRun && manifest.manual.length > 0) {
         throw new Error('A dependency manifest needs manual review; no files were written. Resolve it and preview again.');
     }
+    for (const update of result.fileUpdates ?? []) {
+        if (originalSources.get(update.file)?.startsWith('\uFEFF') && !update.contents.startsWith('\uFEFF')) {
+            update.contents = `\uFEFF${update.contents}`;
+        }
+    }
     const sourceUpdates = new Map((result.fileUpdates ?? []).map((update) => [update.file, update.contents]));
     const proposedFiles = [];
     const proposedDiff = result.filesChanged.flatMap((filePath) => {
@@ -212,6 +223,15 @@ export async function runMigration(migration, options) {
         if (diff)
             proposedDiff.push(diff);
     }
+    let reportedCharacters = 0;
+    for (let index = 0; index < proposedDiff.length; index++) {
+        const remaining = MAX_REPORT_DIFF_CHARS - reportedCharacters;
+        if (remaining < proposedDiff[index].length) {
+            proposedDiff.splice(index, proposedDiff.length - index, `[Further diffs withheld: the report limit is ${MAX_REPORT_DIFF_CHARS} characters.]`);
+            break;
+        }
+        reportedCharacters += proposedDiff[index].length;
+    }
     return {
         ...result,
         filesChanged: [
@@ -232,7 +252,7 @@ async function inspectManifests(migration, cwd) {
         if (!raw.includes(JSON.stringify(migration.packageName)))
             continue;
         try {
-            const manifest = JSON.parse(raw.replace(/^\uFEFF/, ''));
+            const manifest = parseManifest(raw);
             notes.push(...(migration.inspectManifest?.(manifest) ?? []));
         }
         catch {
@@ -258,7 +278,7 @@ async function migrateManifests(migration, options, manifestsWithChangedCode) {
         }
         let manifest;
         try {
-            manifest = JSON.parse(raw.replace(/^\uFEFF/, ''));
+            manifest = parseManifest(raw);
         }
         catch {
             manual.push({
@@ -323,7 +343,9 @@ async function migrateManifests(migration, options, manifestsWithChangedCode) {
                 : existingLocks.length === 1 && path.basename(existingLocks[0]) === 'pnpm-lock.yaml'
                     ? await regeneratePnpmLock(manifestPath, path.resolve(options.cwd, existingLocks[0]), updated, options.cwd)
                     : existingLocks.length === 1 && path.basename(existingLocks[0]) === 'yarn.lock'
-                        ? await regenerateYarnLock(manifestPath, path.resolve(options.cwd, existingLocks[0]), updated, options.cwd)
+                        ? options.allowYarnLockInstall
+                            ? await regenerateYarnLock(manifestPath, path.resolve(options.cwd, existingLocks[0]), updated, options.cwd)
+                            : { reason: 'Yarn Classic lockfile regeneration requires --allow-yarn-lock-install because it runs a full dependency installation (estimated 50–400 MB of downloads without a warm cache).' }
                         : { reason: `This package uses unsupported lockfile(s): ${existingLocks.join(', ')}.` };
             if (!lockResult.contents) {
                 notes.push(...fileNotes.filter((note) => !note.includes(' → ')));
@@ -375,7 +397,7 @@ async function regeneratePackageLock(manifestPath, lockPath, updatedManifest, pr
     let before;
     let lock;
     try {
-        manifest = JSON.parse(updatedManifest.replace(/^\uFEFF/, ''));
+        manifest = parseManifest(updatedManifest);
         before = await readFile(lockPath, 'utf8');
         lock = JSON.parse(before);
     }
@@ -401,11 +423,14 @@ async function regeneratePackageLock(manifestPath, lockPath, updatedManifest, pr
         configDirectory = path.dirname(configDirectory);
     }
     let temporaryDirectory;
+    let unregisterCleanup;
     try {
         temporaryDirectory = await mkdtemp(path.join(tmpdir(), 'upstreamfix-npm-lock-'));
+        unregisterCleanup = registerTemporaryCleanup(() => rm(temporaryDirectory, { recursive: true, force: true }));
         await writeFile(path.join(temporaryDirectory, 'package.json'), updatedManifest, 'utf8');
         await writeFile(path.join(temporaryDirectory, 'package-lock.json'), before, 'utf8');
         const args = ['install', '--package-lock-only', '--lockfile-version=3', '--ignore-scripts', '--no-audit', '--no-fund'];
+        // npm_execpath may be pnpm or Yarn when launched through dlx; resolve npm from PATH instead.
         await execFile('npm', args, { cwd: temporaryDirectory, env: lockfileCommandEnvironment(temporaryDirectory), timeout: 120_000, maxBuffer: 4 * 1024 * 1024 });
         const contents = await readFile(path.join(temporaryDirectory, 'package-lock.json'), 'utf8');
         return { before, contents };
@@ -414,6 +439,7 @@ async function regeneratePackageLock(manifestPath, lockPath, updatedManifest, pr
         return { reason: 'npm could not regenerate package-lock.json in an isolated temporary directory.' };
     }
     finally {
+        unregisterCleanup?.();
         if (temporaryDirectory)
             await rm(temporaryDirectory, { recursive: true, force: true });
     }
@@ -429,7 +455,7 @@ async function regeneratePnpmLock(manifestPath, lockPath, updatedManifest, proje
     let manifest;
     let before;
     try {
-        manifest = JSON.parse(updatedManifest.replace(/^\uFEFF/, ''));
+        manifest = parseManifest(updatedManifest);
         before = await readFile(lockPath, 'utf8');
     }
     catch {
@@ -459,8 +485,10 @@ async function regeneratePnpmLock(manifestPath, lockPath, updatedManifest, proje
         return { reason: 'The packageManager field does not pin an exact pnpm version, so lockfile regeneration cannot be version-checked safely.' };
     }
     let temporaryDirectory;
+    let unregisterCleanup;
     try {
         const probeHome = await mkdtemp(path.join(tmpdir(), 'upstreamfix-pnpm-home-'));
+        const unregisterProbeHome = registerTemporaryCleanup(() => rm(probeHome, { recursive: true, force: true }));
         let versionOutput;
         try {
             ({ stdout: versionOutput } = await execFile('pnpm', ['--version'], {
@@ -471,6 +499,7 @@ async function regeneratePnpmLock(manifestPath, lockPath, updatedManifest, proje
             }));
         }
         finally {
+            unregisterProbeHome();
             await rm(probeHome, { recursive: true, force: true });
         }
         const installedVersion = versionOutput.trim();
@@ -484,6 +513,7 @@ async function regeneratePnpmLock(manifestPath, lockPath, updatedManifest, proje
             }
         }
         temporaryDirectory = await mkdtemp(path.join(tmpdir(), 'upstreamfix-pnpm-lock-'));
+        unregisterCleanup = registerTemporaryCleanup(() => rm(temporaryDirectory, { recursive: true, force: true }));
         // pnpm reads packageManager and may download a different CLI automatically. The exact
         // version was checked above, so omit this metadata from the isolated temporary manifest.
         delete manifest.packageManager;
@@ -506,6 +536,7 @@ async function regeneratePnpmLock(manifestPath, lockPath, updatedManifest, proje
         return { reason: 'pnpm could not regenerate pnpm-lock.yaml in an isolated temporary directory; ensure the pinned pnpm version is installed and registry access is available.' };
     }
     finally {
+        unregisterCleanup?.();
         if (temporaryDirectory)
             await rm(temporaryDirectory, { recursive: true, force: true });
     }
@@ -521,7 +552,7 @@ async function regenerateYarnLock(manifestPath, lockPath, updatedManifest, proje
     let manifest;
     let before;
     try {
-        manifest = JSON.parse(updatedManifest.replace(/^\uFEFF/, ''));
+        manifest = parseManifest(updatedManifest);
         before = await readFile(lockPath, 'utf8');
     }
     catch {
@@ -554,8 +585,10 @@ async function regenerateYarnLock(manifestPath, lockPath, updatedManifest, proje
         return { reason: 'Only an exact Yarn Classic 1.x packageManager pin is supported for automatic lockfile regeneration.' };
     }
     let temporaryDirectory;
+    let unregisterCleanup;
     try {
         const probeHome = await mkdtemp(path.join(tmpdir(), 'upstreamfix-yarn-home-'));
+        const unregisterProbeHome = registerTemporaryCleanup(() => rm(probeHome, { recursive: true, force: true }));
         let versionOutput;
         try {
             ({ stdout: versionOutput } = await execFile('yarn', ['--version'], {
@@ -566,6 +599,7 @@ async function regenerateYarnLock(manifestPath, lockPath, updatedManifest, proje
             }));
         }
         finally {
+            unregisterProbeHome();
             await rm(probeHome, { recursive: true, force: true });
         }
         const installedVersion = versionOutput.trim();
@@ -579,6 +613,7 @@ async function regenerateYarnLock(manifestPath, lockPath, updatedManifest, proje
             }
         }
         temporaryDirectory = await mkdtemp(path.join(tmpdir(), 'upstreamfix-yarn-lock-'));
+        unregisterCleanup = registerTemporaryCleanup(() => rm(temporaryDirectory, { recursive: true, force: true }));
         delete manifest.packageManager;
         await writeFile(path.join(temporaryDirectory, 'package.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf8');
         await writeFile(path.join(temporaryDirectory, 'yarn.lock'), before, 'utf8');
@@ -598,6 +633,7 @@ async function regenerateYarnLock(manifestPath, lockPath, updatedManifest, proje
         return { reason: 'Yarn Classic could not regenerate yarn.lock in an isolated temporary directory; ensure the pinned Yarn 1.x version is installed and registry access is available.' };
     }
     finally {
+        unregisterCleanup?.();
         if (temporaryDirectory)
             await rm(temporaryDirectory, { recursive: true, force: true });
     }
@@ -640,7 +676,7 @@ function findPackageManifests(root) {
         for (const entry of readdirSync(directory, { withFileTypes: true })) {
             const absolutePath = path.join(directory, entry.name);
             if (entry.isDirectory()) {
-                if (!IGNORED_DIRS.has(entry.name))
+                if (!IGNORED_PROJECT_DIRECTORIES.has(entry.name))
                     visit(absolutePath);
             }
             else if (entry.isFile() && entry.name === 'package.json') {
@@ -656,7 +692,7 @@ function addNodeEngineToManifest(raw) {
     if (raw[rootStart] !== '{')
         return undefined;
     const engineMember = findJsonObjectMember(raw, rootStart, 'engines');
-    if (!engineMember && Object.hasOwn(JSON.parse(raw.replace(/^\uFEFF/, '')), 'engines'))
+    if (!engineMember && Object.hasOwn(parseManifest(raw), 'engines'))
         return undefined;
     const objectStart = engineMember?.valueStart ?? rootStart;
     if (raw[objectStart] !== '{')
@@ -676,7 +712,7 @@ function addNodeEngineToManifest(raw) {
         : `${hasMembers ? ', ' : ''}${engineMember ? '"node": ">=22"' : '"engines": { "node": ">=22" }'}`;
     const updated = raw.slice(0, insertAt) + addition + raw.slice(insertAt);
     try {
-        const parsed = JSON.parse(updated.replace(/^\uFEFF/, ''));
+        const parsed = parseManifest(updated);
         return parsed.engines?.node === '>=22' ? updated : undefined;
     }
     catch {
@@ -816,11 +852,92 @@ function jsonValueEnd(text, start) {
 export function unifiedDiff(file, before, after) {
     if (before === after)
         return '';
+    if (LOCKFILE_NAMES.has(path.basename(file)))
+        return summarizeLockfile(file, before, after);
+    if (Buffer.byteLength(before) + Buffer.byteLength(after) > MAX_DIFF_INPUT_BYTES) {
+        return `${file}: diff withheld because the source exceeds ${MAX_DIFF_INPUT_BYTES} bytes.`;
+    }
     const patch = structuredPatch(`a/${file}`, `b/${file}`, before.replace(/\r\n/g, '\n'), after.replace(/\r\n/g, '\n'), '', '', { context: 3 });
     const output = [`--- a/${file}`, `+++ b/${file}`];
     for (const hunk of patch.hunks) {
         output.push(`@@ -${hunk.oldStart},${hunk.oldLines} +${hunk.newStart},${hunk.newLines} @@`);
         output.push(...hunk.lines);
     }
-    return output.join('\n');
+    const rendered = output.join('\n');
+    return rendered.length <= MAX_DIFF_OUTPUT_CHARS
+        ? rendered
+        : `${file}: diff withheld because it exceeds ${MAX_DIFF_OUTPUT_CHARS} characters.`;
+}
+export function summarizeLockfile(file, before, after) {
+    const previous = lockfilePackages(file, before);
+    const next = lockfilePackages(file, after);
+    if (!previous || !next)
+        return `${file}: lockfile changed; package counts unavailable (file too large or unrecognized format). Full diff withheld.`;
+    let added = 0;
+    let removed = 0;
+    let changed = 0;
+    for (const [name, version] of next) {
+        if (!previous.has(name))
+            added++;
+        else if (previous.get(name) !== version)
+            changed++;
+    }
+    for (const name of previous.keys())
+        if (!next.has(name))
+            removed++;
+    return `${file}: lockfile summary — added: ${added}, removed: ${removed}, changed: ${changed}. Full diff withheld.`;
+}
+function lockfilePackages(file, contents) {
+    if (Buffer.byteLength(contents) > 30 * 1024 * 1024)
+        return undefined;
+    if (file.endsWith('.json')) {
+        try {
+            const parsed = JSON.parse(contents);
+            if (!parsed.packages || typeof parsed.packages !== 'object')
+                return undefined;
+            return new Map(Object.entries(parsed.packages)
+                .filter(([name, value]) => name !== '' && value && typeof value.version === 'string')
+                .map(([name, value]) => [name, value.version]));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const packages = new Map();
+    let section = '';
+    let name = '';
+    for (const line of contents.split(/\r?\n/)) {
+        if (file.endsWith('pnpm-lock.yaml')) {
+            if (/^(packages|snapshots):\s*$/.test(line)) {
+                section = line.slice(0, -1);
+                name = '';
+                continue;
+            }
+            if (/^[^\s#]/.test(line)) {
+                section = '';
+                name = '';
+            }
+            const entry = section === 'packages' ? /^  (['"]?)(.+?)\1:\s*$/.exec(line) : null;
+            if (entry) {
+                const rawName = entry[2].replace(/^\//, '').replace(/\(.*$/, '');
+                const separator = rawName.lastIndexOf('@');
+                name = separator > 0 ? rawName.slice(0, separator) : rawName;
+                packages.set(name, separator > 0 ? rawName.slice(separator + 1).split('(')[0] : rawName);
+            }
+            const version = /^    version:\s*['"]?([^\s'"]+)/.exec(line);
+            if (name && version)
+                packages.set(name, version[1]);
+        }
+        else {
+            if (/^[^\s#].*:\s*$/.test(line)) {
+                const selector = line.slice(0, -1).split(',')[0].trim().replace(/^['"]|['"]$/g, '');
+                const separator = selector.lastIndexOf('@');
+                name = separator > 0 ? selector.slice(0, separator) : selector;
+            }
+            const version = /^  version\s+['"]([^'"]+)['"]/.exec(line);
+            if (name && version)
+                packages.set(name, version[1]);
+        }
+    }
+    return packages.size > 0 ? packages : undefined;
 }