narvy-cli 1.1.1__tar.gz → 1.1.2__tar.gz

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/CHANGELOG.md

@@ -5,6 +5,60 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.2]
+
+### Added
+
+- `python -m narvy` (`py -m narvy` on Windows) runs the CLI. It works when
+  pip put the `narvy` command in a directory that is not on PATH, the
+  default for a user install on Windows and macOS. Run that way, Narvy
+  prints once the command that adds the directory to PATH (PowerShell on
+  Windows, your shell rc file elsewhere). It never changes PATH itself;
+  `NARVY_NO_PATH_HINT=1` turns the hint off.
+- README: install steps for Windows, macOS (Homebrew
+  `externally-managed-environment`) and Linux, with pipx first.
+
+### Fixed
+
+- A user install run as `python -m narvy` (or by the launcher's full path)
+  did not find semgrep in the same off-PATH directory, skipped the code pass
+  and reported only dependency CVEs. semgrep is now looked up there and its
+  directory is put on the PATH it runs with (it starts `pysemgrep` through
+  PATH).
+- macOS: when no Java 11+ was installed, the downloaded JRE was never found
+  ("no bin/ dir found inside"), so APK scans failed on every such Mac. The
+  macOS layout (`Contents/Home/bin`) is handled, Apple Silicon and ARM Linux
+  get the native aarch64 JRE instead of x64, and a cached JRE that does not
+  run is downloaded again.
+- Windows: jadx failed to start when its path contained a space (a user name
+  like `Jean Dupont`, or `C:\Program Files`), because `cmd /c` stripped the
+  wrong quotes. The jadx command line now goes through `cmd /d /s /c` as one
+  quoted string.
+- Windows: tool output (semgrep, jadx, nuclei, ssh) is decoded as UTF-8
+  instead of the console code page, semgrep runs in Python UTF-8 mode, and
+  output redirected to a file or pipe replaces a character the code page
+  cannot encode instead of stopping the scan with `UnicodeEncodeError`.
+- A file still locked in a temporary directory (antivirus, a slow child
+  process) no longer fails the scan at cleanup.
+- SCA: only one version of each package was checked. A lockfile that holds
+  `minimist 1.2.8` and a nested `minimist 0.0.8` now checks both. A version
+  taken from a manifest range is still dropped when a lockfile resolves that
+  package.
+- yarn.lock (berry): the package comes from the `resolution:` line, so
+  aliases (`string-width-cjs@npm:string-width@...`) and `patch:` entries
+  name the real package, and `__metadata`, workspace, git and local entries
+  are no longer sent to OSV as packages.
+- semgrep with more than one worker drops taint-mode results at random with
+  no error. Every rule pack that holds a taint rule now runs in its own
+  single-worker semgrep process (packs still run side by side). Files where
+  a rule hit the per-file timeout are named in the scan notes.
+
+### Changed
+
+- Community rule precision round (PHP, JavaScript, Go, Java, Python, Ruby):
+  fewer findings on code that is not reachable by an attacker. Informational
+  rules are lowered to LOW with the reason.
+
 ## [1.1.1]
 
 ### Added

{narvy_cli-1.1.1/narvy_cli.egg-info → narvy_cli-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.1.1
+Version: 1.1.2
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -63,11 +63,83 @@ exactly in [Telemetry](#telemetry), which you can turn off.
 ## Install
 
 ```bash
-pip install narvy-cli
+pipx install narvy-cli      # recommended, puts `narvy` on PATH (run `pipx ensurepath` once)
+pip install narvy-cli       # or plain pip
 ```
 
-Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
-auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+If your shell says `narvy: command not found` / `The term 'narvy' is not
+recognized`, pip installed the command into a directory that is not on your
+PATH. `python -m narvy` always works (`py -m narvy` on Windows), and prints
+once the command that adds that directory to PATH. Narvy never edits PATH
+itself.
+
+### Windows
+
+Recommended, with [pipx](https://pipx.pypa.io):
+
+```powershell
+py -m pip install --user pipx
+py -m pipx ensurepath          # then close and reopen the terminal
+pipx install narvy-cli
+narvy scan app.apk
+```
+
+Without pipx:
+
+```powershell
+py -m pip install narvy-cli
+py -m narvy scan app.apk
+```
+
+To use the short `narvy` command after a plain `pip install`, add pip's
+Scripts directory to PATH. For the current PowerShell window only
+(Python 3.14 from python.org; change `Python314` to your version):
+
+```powershell
+$env:Path += ";$env:APPDATA\Python\Python314\Scripts"
+```
+
+To make it permanent for your user account, then open a new terminal:
+
+```powershell
+[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$env:APPDATA\Python\Python314\Scripts", "User")
+```
+
+The exact directory is in pip's `WARNING: The script narvy.exe is installed
+in ... which is not on PATH` line, and in the hint `py -m narvy` prints. The
+Microsoft Store Python uses a different one (under
+`%LOCALAPPDATA%\Packages\PythonSoftwareFoundation.Python.3.x_...\LocalCache\local-packages`).
+Windows on ARM: semgrep has no Windows ARM64 build, use x64 Python.
+
+### macOS
+
+Homebrew's Python refuses `pip install` outside a virtualenv
+(`error: externally-managed-environment`). Use pipx:
+
+```bash
+brew install pipx && pipx ensurepath   # then open a new terminal
+pipx install narvy-cli
+```
+
+or a virtualenv (`python3 -m venv ~/.venvs/narvy && ~/.venvs/narvy/bin/pip install narvy-cli`).
+A `pip install --user` puts `narvy` in `~/Library/Python/3.x/bin`, which is
+not on PATH: add it with
+`echo 'export PATH="$HOME/Library/Python/3.14/bin:$PATH"' >> ~/.zshrc`, or run
+`python3 -m narvy`.
+
+### Linux
+
+pipx (`sudo apt install pipx` / `dnf install pipx`, then `pipx ensurepath`) is
+the simplest. Debian 12+ and Ubuntu 23.04+ refuse a system-wide `pip install`
+the same way Homebrew does. A `pip install --user` puts `narvy` in
+`~/.local/bin`; if that is not on PATH, add
+`export PATH="$HOME/.local/bin:$PATH"` to `~/.bashrc`, or run
+`python3 -m narvy`.
+
+### Requirements
+
+Android scans need Java 11+. If none is found, a JRE (and jadx) is
+downloaded into `~/.narvy/tools` on the first APK scan. Everything else
 is pure Python plus a couple of optional extras:
 
 ```bash
@@ -215,6 +287,9 @@ number of checks it did not run. It never hides a finding it did compute.
   in its own output when it applies.
 - Only one architecture's native libraries are checked in a multi-ABI
   APK/split bundle.
+- Windows: a decompiled file whose full path passes 260 characters is only
+  read when Windows long-path support is enabled
+  (`LongPathsEnabled`); a very deep package tree in `%TEMP%` can hit it.
 
 See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
 exact commands this README's examples were run against.

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/README.md

@@ -30,11 +30,83 @@ exactly in [Telemetry](#telemetry), which you can turn off.
 ## Install
 
 ```bash
-pip install narvy-cli
+pipx install narvy-cli      # recommended, puts `narvy` on PATH (run `pipx ensurepath` once)
+pip install narvy-cli       # or plain pip
 ```
 
-Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
-auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+If your shell says `narvy: command not found` / `The term 'narvy' is not
+recognized`, pip installed the command into a directory that is not on your
+PATH. `python -m narvy` always works (`py -m narvy` on Windows), and prints
+once the command that adds that directory to PATH. Narvy never edits PATH
+itself.
+
+### Windows
+
+Recommended, with [pipx](https://pipx.pypa.io):
+
+```powershell
+py -m pip install --user pipx
+py -m pipx ensurepath          # then close and reopen the terminal
+pipx install narvy-cli
+narvy scan app.apk
+```
+
+Without pipx:
+
+```powershell
+py -m pip install narvy-cli
+py -m narvy scan app.apk
+```
+
+To use the short `narvy` command after a plain `pip install`, add pip's
+Scripts directory to PATH. For the current PowerShell window only
+(Python 3.14 from python.org; change `Python314` to your version):
+
+```powershell
+$env:Path += ";$env:APPDATA\Python\Python314\Scripts"
+```
+
+To make it permanent for your user account, then open a new terminal:
+
+```powershell
+[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$env:APPDATA\Python\Python314\Scripts", "User")
+```
+
+The exact directory is in pip's `WARNING: The script narvy.exe is installed
+in ... which is not on PATH` line, and in the hint `py -m narvy` prints. The
+Microsoft Store Python uses a different one (under
+`%LOCALAPPDATA%\Packages\PythonSoftwareFoundation.Python.3.x_...\LocalCache\local-packages`).
+Windows on ARM: semgrep has no Windows ARM64 build, use x64 Python.
+
+### macOS
+
+Homebrew's Python refuses `pip install` outside a virtualenv
+(`error: externally-managed-environment`). Use pipx:
+
+```bash
+brew install pipx && pipx ensurepath   # then open a new terminal
+pipx install narvy-cli
+```
+
+or a virtualenv (`python3 -m venv ~/.venvs/narvy && ~/.venvs/narvy/bin/pip install narvy-cli`).
+A `pip install --user` puts `narvy` in `~/Library/Python/3.x/bin`, which is
+not on PATH: add it with
+`echo 'export PATH="$HOME/Library/Python/3.14/bin:$PATH"' >> ~/.zshrc`, or run
+`python3 -m narvy`.
+
+### Linux
+
+pipx (`sudo apt install pipx` / `dnf install pipx`, then `pipx ensurepath`) is
+the simplest. Debian 12+ and Ubuntu 23.04+ refuse a system-wide `pip install`
+the same way Homebrew does. A `pip install --user` puts `narvy` in
+`~/.local/bin`; if that is not on PATH, add
+`export PATH="$HOME/.local/bin:$PATH"` to `~/.bashrc`, or run
+`python3 -m narvy`.
+
+### Requirements
+
+Android scans need Java 11+. If none is found, a JRE (and jadx) is
+downloaded into `~/.narvy/tools` on the first APK scan. Everything else
 is pure Python plus a couple of optional extras:
 
 ```bash
@@ -182,6 +254,9 @@ number of checks it did not run. It never hides a finding it did compute.
   in its own output when it applies.
 - Only one architecture's native libraries are checked in a multi-ABI
   APK/split bundle.
+- Windows: a decompiled file whose full path passes 260 characters is only
+  read when Windows long-path support is enabled
+  (`LongPathsEnabled`); a very deep package tree in `%TEMP%` can hit it.
 
 See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
 exact commands this README's examples were run against.

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.1.1"
+__version__ = "1.1.2"

narvy_cli-1.1.2/narvy/__main__.py

@@ -0,0 +1,30 @@
+"""`python -m narvy` (or `py -m narvy` on Windows) runs the CLI.
+
+Works even when pip put the `narvy` command in a Scripts/bin directory that is
+not on PATH, which is the default for a user install on Windows and macOS.
+"""
+import os
+import sys
+
+
+def _prog() -> str:
+    """Name shown in usage lines: the interpreter the user actually typed, plus -m narvy."""
+    argv0 = (getattr(sys, "orig_argv", None) or [""])[0]
+    name = os.path.basename(argv0)
+    if name.lower().endswith(".exe"):
+        name = name[:-4]
+    if not name.lower().startswith(("python", "py")):
+        name = "python"
+    return f"{name} -m narvy"
+
+
+def main() -> None:
+    from .pathhint import maybe_print_path_hint
+    from .main import cli
+
+    maybe_print_path_hint()
+    cli(prog=_prog())
+
+
+if __name__ == "__main__":
+    main()

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/apk_memory_preflight.py

@@ -73,7 +73,7 @@ def available_ram_mb() -> Optional[int]:
         elif system == "Darwin":
             # vm_stat exposes reclaimable inactive+purgeable pools that SC_AVPHYS_PAGES omits.
             import subprocess
-            out = subprocess.run(["vm_stat"], capture_output=True, text=True, timeout=10).stdout
+            out = subprocess.run(["vm_stat"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10).stdout
             page = 4096
             pm = re.search(r"page size of (\d+) bytes", out)
             if pm:

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/decompiler.py

@@ -30,8 +30,14 @@ JADX_BIN = os.path.join(JADX_HOME, "bin", "jadx.bat" if _IS_WINDOWS else "jadx")
 # jadx 1.5.0 needs Java 11+; a JRE is fetched when the system has none.
 _JRE_MAJOR = "17"
 _JRE_ADOPTIUM_OS = "windows" if _IS_WINDOWS else ("mac" if _IS_MAC else "linux")
-# x64 only: ARM Linux is unsupported and fails loudly on the archive.
-_JRE_ADOPTIUM_ARCH = "x64"
+# Apple Silicon and ARM Linux get the native aarch64 build (an x64 JRE needs
+# Rosetta on a Mac and does not run at all on ARM Linux). Windows stays x64:
+# Temurin 17 has no Windows ARM JRE, and Windows on ARM emulates x64.
+_JRE_ADOPTIUM_ARCH = (
+    "aarch64"
+    if not _IS_WINDOWS and platform.machine().lower() in ("arm64", "aarch64")
+    else "x64"
+)
 JRE_URL = (
     f"https://api.adoptium.net/v3/binary/latest/{_JRE_MAJOR}/ga/"
     f"{_JRE_ADOPTIUM_OS}/{_JRE_ADOPTIUM_ARCH}/jre/hotspot/normal/eclipse"
@@ -69,7 +75,7 @@ def resolve_jadx_binary():
 
 def _java_major_version(java_bin):
     try:
-        result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, timeout=10)
+        result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10)
     except Exception:
         return None
     out = result.stderr or result.stdout or ""
@@ -87,10 +93,12 @@ def _jre_bin_dir():
     # Discovered, not hardcoded: the Adoptium top-level dir carries the patch version.
     if not os.path.isdir(JRE_HOME):
         return None
-    for entry in os.listdir(JRE_HOME):
-        candidate = os.path.join(JRE_HOME, entry, "bin")
-        if os.path.isdir(candidate):
-            return candidate
+    for entry in sorted(os.listdir(JRE_HOME)):
+        # Linux/Windows: <jdk-17...-jre>/bin. macOS: <jdk-17...-jre>/Contents/Home/bin.
+        for sub in (("bin",), ("Contents", "Home", "bin")):
+            candidate = os.path.join(JRE_HOME, entry, *sub)
+            if os.path.isdir(candidate):
+                return candidate
     return None
 
 
@@ -133,16 +141,31 @@ def resolve_java_home():
 
     bin_dir = _jre_bin_dir()
     if bin_dir:
-        return bin_dir
+        java = os.path.join(bin_dir, "java.exe" if _IS_WINDOWS else "java")
+        # A JRE left by an older narvy can be the wrong architecture (x64 on
+        # Apple Silicon without Rosetta): it must actually run, or it is replaced.
+        if (_java_major_version(java) or 0) >= 11:
+            return bin_dir
+        logger.warning(f"The cached JRE in {JRE_HOME} does not run here - downloading a fresh one")
 
     return _download_jre()
 
 
 def _jadx_cmd(jadx_bin, extra_args):
-    # A .bat needs `cmd /c`; shell=True would mis-quote paths.
-    if _IS_WINDOWS and jadx_bin.lower().endswith(".bat"):
-        return ["cmd", "/c", jadx_bin] + extra_args
-    return [jadx_bin] + extra_args
+    """argv for jadx. On Windows a .bat goes through cmd.exe as ONE string.
+
+    A list like ["cmd", "/c", bat, ...] breaks as soon as the .bat path is quoted
+    (a space in the user name, or C:\\Program Files): cmd /c strips the first
+    and the last quote of the line and runs `C:\\Users\\Jean`. With /s and the
+    whole line wrapped in one extra pair of quotes, cmd strips exactly that pair.
+    """
+    if _IS_WINDOWS and jadx_bin.lower().endswith((".bat", ".cmd")):
+        return 'cmd /d /s /c "' + subprocess.list2cmdline([jadx_bin] + list(extra_args)) + '"'
+    return [jadx_bin] + list(extra_args)
+
+
+def _cmd_text(cmd):
+    return cmd if isinstance(cmd, str) else " ".join(str(c) for c in cmd)
 
 
 def _validate_apk_zip(apk_path: str):
@@ -260,7 +283,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
         process = subprocess.run(
             cmd,
             capture_output=True,
-            text=True,
+            text=True, encoding="utf-8", errors="replace",
             check=True,
             timeout=900,
             env=jadx_env,
@@ -269,7 +292,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
         return True, ""
     except subprocess.CalledProcessError as e:
         # jadx/cmd.exe don't consistently use stderr; report both streams.
-        parts = [f"JADX failed (exit code {e.returncode})", f"Command run: {' '.join(str(c) for c in cmd)}"]
+        parts = [f"JADX failed (exit code {e.returncode})", f"Command run: {_cmd_text(cmd)}"]
         if e.stdout:
             parts.append(f"JADX stdout:\n{e.stdout}")
         if e.stderr:
@@ -279,7 +302,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
                 "No output captured on either stdout or stderr. Run "
                 "`narvy doctor` to check your Java/jadx setup, or try "
                 f"running this exact command yourself to see the raw error: "
-                f"{' '.join(str(c) for c in cmd)}"
+                f"{_cmd_text(cmd)}"
             )
         # OOM is unambiguous; a bare -9 (SIGKILL) is ambiguous, so they differ.
         _combined_output = (e.stdout or "") + (e.stderr or "")

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/doctor.py

@@ -18,7 +18,7 @@ console = Console()
 
 def _java_version(java_bin):
     """Run `java -version` and return (version_line, major_version_int_or_None)."""
-    result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, timeout=10)
+    result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10)
     out = result.stderr or result.stdout or ""
     version_line = out.splitlines()[0] if out else "unknown version"
     # Handles both the old "1.8.0_501" scheme and the modern "17.0.2" one.

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/host/lynis_bootstrap.py

@@ -225,7 +225,7 @@ def scp_to_remote(conn: HostConn, local_path: str, remote_path: str,
             argv = ["sshpass", "-e", *argv]
 
         try:
-            proc = subprocess.run(argv, capture_output=True, text=True,
+            proc = subprocess.run(argv, capture_output=True, text=True, encoding="utf-8", errors="replace",
                                   timeout=timeout, env=env)
         except subprocess.TimeoutExpired as exc:
             raise LynisBootstrapError(

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/host/ssh_exec.py

@@ -85,7 +85,7 @@ def capture_host_key(hostname: str, port: int = 22,
     try:
         proc = subprocess.run(
             ["ssh-keyscan", "-p", str(port), "-T", str(timeout), hostname],
-            capture_output=True, text=True, timeout=timeout + 10,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout + 10,
         )
     except (subprocess.TimeoutExpired, OSError):
         return None
@@ -178,7 +178,7 @@ def ssh_exec(conn: HostConn, remote_cmd: str,
 
         try:
             proc = subprocess.run(
-                argv, capture_output=True, text=True, timeout=timeout, env=env,
+                argv, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout, env=env,
             )
         except subprocess.TimeoutExpired as exc:
             raise SSHExecError(

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/ios/binary_analyzer.py

@@ -54,7 +54,7 @@ def _icdump_class_count(binary_path: str, timeout: int = 60
     try:
         proc = subprocess.run(
             [_sys.executable, "-c", _ICDUMP_PROBE_SCRIPT, binary_path],
-            capture_output=True, text=True, timeout=timeout,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout,
         )
     except subprocess.TimeoutExpired:
         return False, 0, 0, f"timed out after {timeout}s"
@@ -997,7 +997,7 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
             framework_members = [n for n in names if n.startswith(frameworks_prefix)]
 
             import tempfile
-            with tempfile.TemporaryDirectory(prefix="narvy-ios-") as tmpdir:
+            with tempfile.TemporaryDirectory(prefix="narvy-ios-", ignore_cleanup_errors=True) as tmpdir:
                 main_binary_path = _safe_extract_member(zf, main_binary_member, tmpdir)
                 if main_binary_path is None:
                     result["error"] = f"Failed to extract main binary {main_binary_member} " \

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/main.py

@@ -856,7 +856,7 @@ def _run_local_scan(apk_path, max_mem, override_config=None, force=False,
     sca_cov = None
     with scan_progress() as progress:
         task1 = progress.add_task("[green]Decompiling APK...", total=1)
-        with tempfile.TemporaryDirectory() as temp_dir:
+        with tempfile.TemporaryDirectory(ignore_cleanup_errors=True) as temp_dir:
             ok, decompile_error = decompile_apk(apk_path, temp_dir, max_mem, force=force,
                                                 extra_inputs=extra_dex_inputs)
             if not ok:
@@ -2676,8 +2676,23 @@ def cmd_init_ci(args):
     )
 
 
-def cli():
-    parser = _ArgumentParser(allow_abbrev=False, description=(
+def _safe_console_streams():
+    """Redirected output on Windows uses the ANSI code page (cp1252): a finding
+    snippet with a character outside it would crash the whole run with
+    UnicodeEncodeError. Replace such characters instead of dying."""
+    for stream in (sys.stdout, sys.stderr):
+        enc = (getattr(stream, "encoding", None) or "").lower().replace("-", "")
+        if enc.startswith("utf"):
+            continue
+        try:
+            stream.reconfigure(errors="replace")
+        except (AttributeError, ValueError, OSError):
+            pass
+
+
+def cli(prog=None):
+    _safe_console_streams()
+    parser =_ArgumentParser(prog=prog, allow_abbrev=False, description=(
         "Narvy CLI - Static Analysis for Android APKs/AABs, iOS IPAs, "
         "Android/iOS source projects, and web/backend source projects "
         f"({web_source_analyzer.SUPPORTED_LANGUAGES_LABEL})"

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/native_hardening.py

@@ -471,7 +471,7 @@ def scan(apk_path: str) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], Dic
             if not arch_members:
                 return findings, [], stats
 
-            with tempfile.TemporaryDirectory(prefix="narvy-nh-") as tmpdir:
+            with tempfile.TemporaryDirectory(prefix="narvy-nh-", ignore_cleanup_errors=True) as tmpdir:
                 for basename in sorted(arch_members):
                     member = arch_members[basename]
                     local_path = _safe_extract(zf, member, tmpdir)

narvy_cli-1.1.2/narvy/pathhint.py

@@ -0,0 +1,98 @@
+"""One-line hint when `narvy` was installed but its directory is not on PATH.
+
+Only used by `python -m narvy`: someone who typed `narvy` already has it on
+PATH. PATH is never changed for the user, the hint prints the command to run.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import sysconfig
+from typing import List, Optional
+
+MARKER = os.path.join(os.path.expanduser("~/.narvy"), "path_hint_shown")
+
+
+def _launcher_names() -> List[str]:
+    if os.name == "nt":
+        return ["narvy.exe", "narvy"]
+    return ["narvy"]
+
+
+def _candidate_script_dirs() -> List[str]:
+    """Where pip may have written the `narvy` launcher for this interpreter."""
+    dirs: List[str] = []
+    schemes = [None]
+    try:
+        user_scheme = sysconfig.get_preferred_scheme("user")
+    except (AttributeError, KeyError):  # Python < 3.10 or a patched distro build
+        user_scheme = f"{os.name}_user"
+    schemes.append(user_scheme)
+    for scheme in schemes:
+        try:
+            path = sysconfig.get_path("scripts") if scheme is None else sysconfig.get_path("scripts", scheme)
+        except KeyError:
+            continue
+        if path and path not in dirs:
+            dirs.append(path)
+    return dirs
+
+
+def _norm(path: str) -> str:
+    return os.path.normcase(os.path.normpath(path.strip().strip('"'))) if path.strip() else ""
+
+
+def find_unlisted_scripts_dir(environ=None) -> Optional[str]:
+    """The directory holding the `narvy` launcher when it is not on PATH, else None."""
+    environ = os.environ if environ is None else environ
+    path_value = environ.get("PATH", "")
+    if shutil.which("narvy", path=path_value):
+        return None
+    on_path = {_norm(p) for p in path_value.split(os.pathsep) if p.strip()}
+    for d in _candidate_script_dirs():
+        if _norm(d) in on_path:
+            continue
+        if any(os.path.isfile(os.path.join(d, n)) for n in _launcher_names()):
+            return d
+    return None
+
+
+def hint_text(scripts_dir: str, platform: str = sys.platform) -> str:
+    if platform == "win32":
+        ps_dir = scripts_dir.replace("'", "''")  # PowerShell single-quote escape
+        return (
+            f"narvy: the `narvy` command was installed to {scripts_dir}, which is not on PATH. "
+            "To add it for good, run in PowerShell: "
+            "[Environment]::SetEnvironmentVariable('Path', "
+            "[Environment]::GetEnvironmentVariable('Path', 'User') + "
+            f"';{ps_dir}', 'User')  then open a new terminal. "
+            "Until then `py -m narvy` (or `python -m narvy`) works."
+        )
+    shell_rc = "~/.zshrc" if platform == "darwin" else "~/.bashrc"
+    return (
+        f"narvy: the `narvy` command was installed to {scripts_dir}, which is not on PATH. "
+        f"To add it, run: echo 'export PATH=\"{scripts_dir}:$PATH\"' >> {shell_rc}  "
+        "then open a new terminal. Until then `python3 -m narvy` works."
+    )
+
+
+def maybe_print_path_hint() -> None:
+    """Print the hint once per machine, on an interactive terminal only. Never raises."""
+    try:
+        if os.environ.get("NARVY_NO_PATH_HINT") or not sys.stderr.isatty():
+            return
+        if os.path.exists(MARKER):
+            return
+        scripts_dir = find_unlisted_scripts_dir()
+        if not scripts_dir:
+            return
+        sys.stderr.write(hint_text(scripts_dir) + "\n")
+        try:
+            os.makedirs(os.path.dirname(MARKER), exist_ok=True)
+            with open(MARKER, "w", encoding="utf-8") as fh:
+                fh.write(scripts_dir + "\n")
+        except OSError:
+            pass
+    except Exception:
+        pass

{narvy_cli-1.1.1 → narvy_cli-1.1.2}/narvy/proc.py

@@ -54,6 +54,10 @@ def run_tree(cmd: List[str], timeout: Optional[float] = None, check: bool = Fals
     kwargs.setdefault("stdout", subprocess.PIPE)
     kwargs.setdefault("stderr", subprocess.PIPE)
     kwargs.setdefault("text", True)
+    if kwargs.get("text"):
+        # Tools emit UTF-8; the Windows default (cp1252) raises on some of those bytes.
+        kwargs.setdefault("encoding", "utf-8")
+        kwargs.setdefault("errors", "replace")
     if _POSIX and "preexec_fn" not in kwargs:
         kwargs["start_new_session"] = True
     elif _POSIX: