Warn on unknown configs

lib/commands/config.js

@@ -4,23 +4,11 @@ const { spawn } = require('node:child_process')
 const { EOL } = require('node:os')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 const pkgJson = require('@npmcli/package-json')
-const { defaults, definitions } = require('@npmcli/config/lib/definitions')
+const { defaults, definitions, nerfDarts } = require('@npmcli/config/lib/definitions')
 const { log, output } = require('proc-log')
 const BaseCommand = require('../base-cmd.js')
 const { redact } = require('@npmcli/redact')
 
-// These are the configs that we can nerf-dart. Not all of them currently even
-// *have* config definitions so we have to explicitly validate them here.
-// This is used to validate during "npm config set"
-const nerfDarts = [
-  '_auth',
-  '_authToken',
-  '_password',
-  'certfile',
-  'email',
-  'keyfile',
-  'username',
-]
 // These are the config values to swap with "protected".  It does not catch
 // every single sensitive thing a user may put in the npmrc file but it gets
 // the common ones.  This is distinct from nerfDarts because that is used to
@@ -125,7 +113,7 @@ class Config extends BaseCommand {
     const action = argv[2]
     switch (action) {
       case 'set':
-        // todo: complete with valid values, if possible.
+        // TODO: complete with valid values, if possible.
         if (argv.length > 3) {
           return []
         }

lib/npm.js

@@ -2,7 +2,7 @@ const { resolve, dirname, join } = require('node:path')
 const Config = require('@npmcli/config')
 const which = require('which')
 const fs = require('node:fs/promises')
-const { definitions, flatten, shorthands } = require('@npmcli/config/lib/definitions')
+const { definitions, flatten, nerfDarts, shorthands } = require('@npmcli/config/lib/definitions')
 const usage = require('./utils/npm-usage.js')
 const LogFile = require('./utils/log-file.js')
 const Timers = require('./utils/timers.js')
@@ -68,6 +68,7 @@ class Npm {
       npmPath: this.#npmRoot,
       definitions,
       flatten,
+      nerfDarts,
       shorthands,
       argv: [...process.argv, ...argv],
       excludeNpmCwd,

node_modules/.gitignore

@@ -150,9 +150,6 @@
 !/node-gyp/node_modules/tar
 !/node-gyp/node_modules/yallist
 !/nopt
-!/nopt/node_modules/
-/nopt/node_modules/*
-!/nopt/node_modules/abbrev
 !/normalize-package-data
 !/npm-audit-report
 !/npm-bundled

node_modules/nopt/lib/nopt-lib.js

@@ -25,7 +25,9 @@ function nopt (args, {
   types,
   shorthands,
   typeDefs,
-  invalidHandler,
+  invalidHandler, // opt is configured but its value does not validate against given type
+  unknownHandler, // opt is not configured
+  abbrevHandler, // opt is being expanded via abbrev
   typeDefault,
   dynamicTypes,
 } = {}) {
@@ -38,7 +40,9 @@ function nopt (args, {
     original: args.slice(0),
   }
 
-  parse(args, data, argv.remain, { typeDefs, types, dynamicTypes, shorthands })
+  parse(args, data, argv.remain, {
+    typeDefs, types, dynamicTypes, shorthands, unknownHandler, abbrevHandler,
+  })
 
   // now data is full
   clean(data, { types, dynamicTypes, typeDefs, invalidHandler, typeDefault })
@@ -247,6 +251,8 @@ function parse (args, data, remain, {
   typeDefs = {},
   shorthands = {},
   dynamicTypes,
+  unknownHandler,
+  abbrevHandler,
 } = {}) {
   const StringType = typeDefs.String?.type
   const NumberType = typeDefs.Number?.type
@@ -282,7 +288,7 @@ function parse (args, data, remain, {
 
       // see if it's a shorthand
       // if so, splice and back up to re-parse it.
-      const shRes = resolveShort(arg, shortAbbr, abbrevs, { shorthands })
+      const shRes = resolveShort(arg, shortAbbr, abbrevs, { shorthands, abbrevHandler })
       debug('arg=%j shRes=%j', arg, shRes)
       if (shRes) {
         args.splice.apply(args, [i, 1].concat(shRes))
@@ -298,7 +304,13 @@ function parse (args, data, remain, {
         arg = arg.slice(3)
       }
 
-      if (abbrevs[arg]) {
+      // abbrev includes the original full string in its abbrev list
+      if (abbrevs[arg] && abbrevs[arg] !== arg) {
+        if (abbrevHandler) {
+          abbrevHandler(arg, abbrevs[arg])
+        } else if (abbrevHandler !== false) {
+          debug(`abbrev: ${arg} -> ${abbrevs[arg]}`)
+        }
         arg = abbrevs[arg]
       }
 
@@ -331,6 +343,23 @@ function parse (args, data, remain, {
          (argType === null ||
           isTypeArray && ~argType.indexOf(null)))
 
+      if (typeof argType === 'undefined') {
+        // la is going to unexpectedly be parsed outside the context of this arg
+        const hangingLa = !hadEq && la && !la?.startsWith('-') && !['true', 'false'].includes(la)
+        if (unknownHandler) {
+          if (hangingLa) {
+            unknownHandler(arg, la)
+          } else {
+            unknownHandler(arg)
+          }
+        } else if (unknownHandler !== false) {
+          debug(`unknown: ${arg}`)
+          if (hangingLa) {
+            debug(`unknown: ${la} parsed as normal opt`)
+          }
+        }
+      }
+
       if (isBool) {
         // just set and move along
         val = !no
@@ -420,7 +449,7 @@ const singleCharacters = (arg, shorthands) => {
 }
 
 function resolveShort (arg, ...rest) {
-  const { types = {}, shorthands = {} } = rest.length ? rest.pop() : {}
+  const { abbrevHandler, types = {}, shorthands = {} } = rest.length ? rest.pop() : {}
   const shortAbbr = rest[0] ?? abbrev(Object.keys(shorthands))
   const abbrevs = rest[1] ?? abbrev(Object.keys(types))
 
@@ -457,7 +486,13 @@ function resolveShort (arg, ...rest) {
   }
 
   // if it's an abbr for a shorthand, then use that
+  // exact match has already happened so we don't need to account for that here
   if (shortAbbr[arg]) {
+    if (abbrevHandler) {
+      abbrevHandler(arg, shortAbbr[arg])
+    } else if (abbrevHandler !== false) {
+      debug(`abbrev: ${arg} -> ${shortAbbr[arg]}`)
+    }
     arg = shortAbbr[arg]
   }
 

node_modules/nopt/lib/nopt.js

@@ -18,6 +18,8 @@ function nopt (types, shorthands, args = process.argv, slice = 2) {
     shorthands: shorthands || {},
     typeDefs: exports.typeDefs,
     invalidHandler: exports.invalidHandler,
+    unknownHandler: exports.unknownHandler,
+    abbrevHandler: exports.abbrevHandler,
   })
 }
 
@@ -26,5 +28,7 @@ function clean (data, types, typeDefs = exports.typeDefs) {
     types: types || {},
     typeDefs,
     invalidHandler: exports.invalidHandler,
+    unknownHandler: exports.unknownHandler,
+    abbrevHandler: exports.abbrevHandler,
   })
 }

node_modules/nopt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nopt",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "Option parsing for Node, supporting types, shorthands, etc. Used by npm.",
   "author": "GitHub Inc.",
   "main": "lib/nopt.js",
@@ -23,11 +23,11 @@
   },
   "license": "ISC",
   "dependencies": {
-    "abbrev": "^2.0.0"
+    "abbrev": "^3.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.23.3",
+    "@npmcli/template-oss": "4.23.6",
     "tap": "^16.3.0"
   },
   "tap": {
@@ -46,7 +46,7 @@
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "windowsCI": false,
-    "version": "4.23.3",
+    "version": "4.23.6",
     "publish": true
   }
 }