(mode, args)
| 66 | } |
| 67 | |
| 68 | async runMode (mode, args) { |
| 69 | this.#mode = mode |
| 70 | |
| 71 | if (this.npm.global) { |
| 72 | throw Object.assign( |
| 73 | new Error(`\`npm ${this.constructor.name}\` does not work for global installs`), |
| 74 | { code: 'EGLOBAL' } |
| 75 | ) |
| 76 | } |
| 77 | |
| 78 | // `prune` has its own flow: it reads the literal package.json#allowScripts |
| 79 | // map, not the resolved policy. |
| 80 | if (mode === 'prune') { |
| 81 | return this.runPrune(args) |
| 82 | } |
| 83 | |
| 84 | // `--allow-scripts-pending` is only honored by commands that declare it; the namespace lists via `ls` instead. |
| 85 | const pending = this.constructor.params.includes('allow-scripts-pending') && |
| 86 | !!this.npm.config.get('allow-scripts-pending') |
| 87 | const all = !!this.npm.config.get('all') |
| 88 | // The `ls` subcommand lists, and so does `--allow-scripts-pending` on the write commands. |
| 89 | const list = mode === 'list' || pending |
| 90 | |
| 91 | if (list && (args.length > 0 || all)) { |
| 92 | const what = mode === 'list' ? '`npm install-scripts ls`' : '`--allow-scripts-pending`' |
| 93 | throw this.usageError( |
| 94 | `${what} cannot be combined with positional arguments or \`--all\`.` |
| 95 | ) |
| 96 | } |
| 97 | if (!list && !all && args.length === 0) { |
| 98 | throw this.usageError() |
| 99 | } |
| 100 | if (mode === 'deny' && pending) { |
| 101 | throw this.usageError( |
| 102 | '`npm deny-scripts --allow-scripts-pending` is not supported; ' + |
| 103 | 'run `npm install-scripts ls` to list unreviewed packages.' |
| 104 | ) |
| 105 | } |
| 106 | |
| 107 | const Arborist = require('@npmcli/arborist') |
| 108 | const { policy } = await resolveAllowScripts(this.npm) |
| 109 | const arb = new Arborist({ |
| 110 | ...this.npm.flatOptions, |
| 111 | path: this.npm.prefix, |
| 112 | allowScripts: policy, |
| 113 | }) |
| 114 | await arb.loadActual() |
| 115 | |
| 116 | // Keep listing unreviewed packages even with ignore-scripts set, so |
| 117 | // you can move from a blanket ignore-scripts to an allowlist. This |
| 118 | // only lists; nothing runs. |
| 119 | const unreviewed = await checkAllowScripts({ arb, npm: this.npm, includeWhenIgnored: true }) |
| 120 | |
| 121 | if (list) { |
| 122 | return this.runPending(unreviewed) |
| 123 | } |
| 124 | |
| 125 | if (all) { |
no test coverage detected