Files
pmg/internal/alias/alias.go
T
648adcbda4 feat: add uvx (uv tool run) package executor (#357)
* feat(uvx): add uvx (uv tool run) package executor

Adds support for `uvx`, implemented as a PyPI Executor alongside pipx.
uvx is an alias for `uv tool run`: it installs a tool into an ephemeral
environment and runs it, so it has no install/list subcommand and the
first positional argument (or --from) is the package to audit.

Parsing highlights:
- --from overrides the positional command as the package to audit
- --with packages are audited as additional environment dependencies
- name@version shorthand (ruff@0.3.0, ruff@latest) is normalized
- flag parsing stops at the tool name so the tool's own flags are not
  misread as uvx options; uvx's value/boolean flags are registered so
  none greedily consume the package positional
- VCS/URL/local-path specs are skipped for registry auditing

Wires up command registration, analytics, shell alias/shim, cloud audit
mapping, a dedicated `uvx` sandbox profile (UV_*/PIP_* env, uv cache and
tool dirs), config policy, docs, unit tests and an E2E workflow step.

Closes #326

https://claude.ai/code/session_011hyLxq7oWJX5Dp4tCEfG19

* chore(uvx): align docs and base profile with uvx support

Incorporates the low-risk, non-parser improvements from the community
PR #345 (author non-responsive) into our implementation:

- list uvx (and the previously-missing pipx) as PyPI managers in the
  pypi-restrictive base profile package_managers and its README, so the
  base profile applies directly when selected via --sandbox-profile
- document uvx in docs/github-action.md and docs/proxy-mode.md
- add version / IsExplicitVersion assertions to the uvx parser tests

Our pflag-based parser is kept as-is: unlike #345 it audits --with
packages and handles all uvx short flags (e.g. -w), both of which the
community PR misses.

* fix(uvx): skip interpreter requests; use require in tests

Addresses review feedback on PR #357:

- uvx interpreter requests (`uvx python`, `uvx python@3.12`, `uvx pypy`,
  ...) launch an isolated interpreter rather than installing a PyPI tool.
  Treating the positional as a package made the guard flow resolve/analyze
  pkg:pypi/python (and python==3.12), which could wrongly block or fail a
  valid invocation. Skip these for the positional; --with packages on the
  same command are still audited.
- Use require.NoError / require.Len for fatal assertions in the uvx tests,
  matching the repo's testing convention, so a failure stops the subtest
  before a nil dereference instead of panicking.

* docs(uvx): document fail-open and --with-requirements trade-offs

Record the two deliberate parsing decisions raised in review as in-code
trade-off comments (no behavior change):

- unknown flags are tolerated (fail open), consistent with the other
  executors; the residual gap only affects non-proxy guard mode since the
  default proxy flow intercepts every registry download.
- --with-requirements / --with-editable values are consumed but not
  expanded into audit targets; expanding them needs manifest-extractor and
  guard changes, tracked as follow-up. Proxy mode still covers them.

* docs(uvx): drop --with-requirements limitation note

Per maintainer review: guard mode is being deprecated and auditing the
contents of an existing requirements file is a scanner's responsibility,
not PMG's. Remove the "known limitation / follow-up" note; the flags stay
registered only so their values are not mistaken for the tool positional.

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-07-02 18:49:31 +05:30

264 lines
6.6 KiB
Go

package alias
import (
"fmt"
"os"
"path/filepath"
"strings"
"github.com/safedep/dry/log"
)
// AliasManager manages shell aliases for package managers.
type AliasManager struct {
config AliasConfig
rcFileManager RcFileManager
}
// AliasConfig holds configuration for alias management.
type AliasConfig struct {
RcFileName string
PackageManagers []string
Shells []Shell
}
// RcFileManager handles creation and removal of RC files.
type RcFileManager interface {
Create(aliases []string) (string, error)
Remove() error
GetRcPath() string
}
// DefaultRcFileManager implements RcFileManager for managing the RC file.
type defaultRcFileManager struct {
HomeDir string
RcFileName string
}
var _ RcFileManager = &defaultRcFileManager{}
// NewDefaultRcFileManager creates a new DefaultRcFileManager.
func NewDefaultRcFileManager(rcFileName string) (*defaultRcFileManager, error) {
homeDir, err := os.UserHomeDir()
if err != nil {
return nil, err
}
return &defaultRcFileManager{
HomeDir: homeDir,
RcFileName: rcFileName,
}, nil
}
// Create creates the RC file with the given aliases.
func (m *defaultRcFileManager) Create(aliases []string) (string, error) {
rcPath := m.GetRcPath()
f, err := os.Create(rcPath)
if err != nil {
return "", err
}
defer func() {
if err := f.Close(); err != nil {
log.Warnf("failed to close rc file %s: %v", rcPath, err)
}
}()
for _, alias := range aliases {
if _, err := f.WriteString(alias); err != nil {
return "", fmt.Errorf("failed to write alias: %w", err)
}
}
return rcPath, nil
}
// Remove deletes the RC file.
func (m *defaultRcFileManager) Remove() error {
rcPath := m.GetRcPath()
if err := os.Remove(rcPath); err != nil && !os.IsNotExist(err) {
return fmt.Errorf("could not delete %s: %w", rcPath, err)
}
return nil
}
// GetRcPath returns the full path to the RC file.
func (m *defaultRcFileManager) GetRcPath() string {
return filepath.Join(m.HomeDir, m.RcFileName)
}
// DefaultConfig returns the default configuration for alias management.
func DefaultConfig() AliasConfig {
var shells []Shell
fishShell, _ := NewFishShell()
zshShell, _ := NewZshShell()
bashShell, _ := NewBashShell()
shells = append(shells, fishShell, zshShell, bashShell)
return AliasConfig{
RcFileName: ".pmg.rc",
PackageManagers: []string{"npm", "pip", "pip3", "pipx", "pnpm", "bun", "uv", "uvx", "yarn", "poetry", "npx", "pnpx"},
Shells: shells,
}
}
// New creates a new AliasManager with the given configuration and RC file manager.
func New(config AliasConfig, rcFileManager RcFileManager) *AliasManager {
return &AliasManager{
config: config,
rcFileManager: rcFileManager,
}
}
// Install creates the RC file with aliases and sources it in shell configurations.
func (a *AliasManager) Install() error {
aliases := a.buildAliases()
_, err := a.rcFileManager.Create(aliases)
if err != nil {
return fmt.Errorf("failed to create alias file: %w", err)
}
err = a.sourceRcFile()
if err != nil {
return fmt.Errorf("failed to update shell configs: %w", err)
}
return nil
}
// Remove deletes the RC file and removes source lines from shell configurations.
func (a *AliasManager) Remove() error {
if err := a.rcFileManager.Remove(); err != nil {
log.Warnf("Warning: %v", err)
}
if err := a.removeSourceLinesFromShells(); err != nil {
return fmt.Errorf("failed to clean shell configs: %w", err)
}
return nil
}
// GetRcPath returns the path to the alias RC file managed by AliasManager.
func (a *AliasManager) GetRcPath() string {
return a.rcFileManager.GetRcPath()
}
// IsInstalled checks if the PMG aliases are sourced in any of the shell config files.
func (a *AliasManager) IsInstalled() (bool, error) {
homeDir, err := os.UserHomeDir()
if err != nil {
return false, err
}
for _, shell := range a.config.Shells {
for _, configPath := range shell.CandidateRcFiles(homeDir) {
data, err := os.ReadFile(configPath)
if err != nil {
if os.IsNotExist(err) {
continue
}
log.Warnf("Warning: could not read %s (%s)", configPath, err)
continue
}
for _, line := range strings.Split(string(data), "\n") {
trimmed := strings.TrimSpace(line)
if strings.HasPrefix(trimmed, "#") {
continue
}
if strings.Contains(trimmed, a.config.RcFileName) {
return true, nil
}
}
}
}
return false, nil
}
// buildAliases creates the alias strings for all configured package managers.
func (a *AliasManager) buildAliases() []string {
aliases := make([]string, 0, len(a.config.PackageManagers))
for _, pm := range a.config.PackageManagers {
aliases = append(aliases, fmt.Sprintf("alias %s='pmg %s'\n", pm, pm))
}
return aliases
}
// sourceRcFile adds source lines to all shell configuration files.
func (a *AliasManager) sourceRcFile() error {
homeDir, err := os.UserHomeDir()
if err != nil {
return err
}
primary := PrimaryShellName()
for _, shell := range a.config.Shells {
files, err := shell.InstallRcFiles(homeDir, shell.Name() == primary)
if err != nil {
log.Warnf("Warning: skipping %s (%s)", shell.Name(), err)
continue
}
for _, configPath := range files {
if err := a.addSourceLine(configPath, shell.Source(a.rcFileManager.GetRcPath())); err != nil {
log.Warnf("Warning: skipping %s (%s)", configPath, err)
}
}
}
return nil
}
// removeSourceLinesFromShells removes source lines from all shell configuration files.
func (a *AliasManager) removeSourceLinesFromShells() error {
homeDir, err := os.UserHomeDir()
if err != nil {
return err
}
drop := func(line string) bool {
return strings.Contains(line, a.config.RcFileName) ||
strings.TrimSpace(line) == strings.TrimSpace(commentForRemovingShellSource)
}
for _, shell := range a.config.Shells {
for _, configPath := range shell.CandidateRcFiles(homeDir) {
if err := RewriteFileDroppingLines(configPath, drop); err != nil {
log.Warnf("Warning: failed to update %s: %s", configPath, err)
}
}
}
return nil
}
// addSourceLine adds a source line to the specified shell configuration file.
func (a *AliasManager) addSourceLine(configPath, sourceLine string) error {
// Read existing content - only proceed if file exists
data, err := os.ReadFile(configPath)
if err != nil {
return err // file doesn't exist or can't read, skip
}
if strings.Contains(string(data), a.config.RcFileName) {
return nil // already sourced, skip
}
f, err := os.OpenFile(configPath, os.O_APPEND|os.O_WRONLY, 0o644)
if err != nil {
return err
}
defer func() {
if err := f.Close(); err != nil {
log.Warnf("failed to close config file %s: %v", configPath, err)
}
}()
_, err = fmt.Fprintf(f, "\n%s", sourceLine)
return err
}