26 lines
1.7 KiB
Python
26 lines
1.7 KiB
Python
"""Read-only audit of pinned local source and installed package metadata. No import/evaluation."""
|
|
from pathlib import Path
|
|
import json,re,hashlib
|
|
root=Path.cwd();lock=json.loads((root/'package-lock.json').read_text());report={}
|
|
names=['@google/genai','esbuild','protobufjs'];bundle=root/'node_modules/@earendil-works/pi-coding-agent/dist/bundle'
|
|
for name in names:
|
|
p=root/'node_modules'/name/'package.json';pkg=json.loads(p.read_text());entry=lock['packages']['node_modules/'+name];assert pkg['version']==entry['version']
|
|
report[name]={'version':entry['version'],'hasInstallScript':entry.get('hasInstallScript'),'lifecycle':{k:v for k,v in pkg['scripts'].items() if k in ['preinstall','postinstall']},'installedPackageJsonSha256':hashlib.sha256(p.read_bytes()).hexdigest(),'externalBundleImports':[]}
|
|
for p in bundle.rglob('*.js'):
|
|
s=p.read_text()
|
|
for m in re.finditer(r'(?:from\s*|\bimport\s*\(|\brequire\s*\(|\b__require\s*\()\s*["\']([^"\']+)',s):
|
|
for name in names:
|
|
if m.group(1)==name or m.group(1).startswith(name+'/'):report[name]['externalBundleImports'].append({'file':str(p.relative_to(root)),'specifier':m.group(1)})
|
|
# Direct package specifiers in the files the copy archives. No node_modules
|
|
# SDK entrypoint is assumed active merely because npm installed it.
|
|
script=(root/'scripts/stack-copy.sh').read_text();block=script.split('COPY_PATHS=(\n',1)[1].split('\n)',1)[0];paths=block.split()
|
|
for name in names:report[name]['copiedSourceMentions']=[]
|
|
for rel in paths:
|
|
p=root/rel;files=p.rglob('*') if p.is_dir() else [p]
|
|
for f in files:
|
|
if f.is_file() and f.suffix in ['.mjs','.js','.sh']:
|
|
s=f.read_text()
|
|
for name in names:
|
|
if name in s:report[name]['copiedSourceMentions'].append(str(f.relative_to(root)))
|
|
print(json.dumps(report,indent=2))
|