seb/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(doctor): avoid unsafe npm audit fallback

Browse Source 
Root-level npm audit fix can crash with isDescendantOf on the same monorepo tree, so workspace audit advisories should explain the lockfile-bump path instead of recommending another manual npm fix command.
This commit is contained in:
Teknium
2026-06-13 05:09:56 -07:00
parent bea6c1c01f
commit 905ed413d1
2 changed files with 42 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hermes_cli/doctor.py
+20 -13
View File
@@ -1547,10 +1547,10 @@ def run_doctor(args):
# safe, but `npm audit fix --workspace <name>` crashes on
# current npm with "Cannot read properties of null (reading
# 'edgesOut')" — an arborist bug with workspace-filtered
# audit fix. Recommend the root-level `npm audit fix`, which
# operates over every workspace and does not crash, instead
# of handing the user a command that errors out.
fix_cmd = f"cd {npm_dir} && npm audit fix"
# audit fix. The root-level `npm audit fix` can crash on the
# same tree with "isDescendantOf", so do not hand the user a
# manual fix command for these build-tool advisories.
fix_cmd = None
elif audit_extra == ["--workspaces=false"]:
fix_cmd = f"cd {npm_dir} && npm audit fix --workspaces=false"
else:
@@ -1558,22 +1558,29 @@ def run_doctor(args):
if total == 0:
check_ok(f"{label} deps", "(no known vulnerabilities)")
elif critical > 0 or high > 0:
if fix_cmd:
vuln_detail = (
f"{critical} critical, {high} high, {moderate} moderate — run: {fix_cmd}"
)
else:
vuln_detail = (
f"{critical} critical, {high} high, {moderate} moderate — "
"build-tool advisory; clears via lockfile bump"
)
check_warn(
f"{label} deps",
f"({critical} critical, {high} high, {moderate} moderate — run: {fix_cmd})"
f"({vuln_detail})"
)
if audit_extra and audit_extra[0] == "--workspace":
# The web/ui-tui workspace advisories are in build-time
# tooling (esbuild/vite, etc.), not runtime code that ships
# to users. `npm audit fix` here may also error with a known
# npm arborist crash (edgesOut / isDescendantOf) on this
# monorepo tree — in that case it is an npm bug, not a
# Hermes one, and the advisories clear via a lockfile bump
# rather than a manual fix.
# to users. Manual npm remediation may error with a known
# arborist crash (edgesOut / isDescendantOf) on this monorepo
# tree — in that case it is an npm bug, not a Hermes one.
check_info(
" ^ build-time tooling (not runtime); if `npm audit fix` "
"errors with an npm arborist crash it's a known npm bug — "
"clears via a lockfile bump"
" ^ build-time tooling (not runtime); if manual npm remediation "
"errors with an arborist crash it's a known npm bug — clears "
"via a lockfile bump"
)
issues.append(
f"{label} has {total} npm "