Fix: unguarded js method and trusted publishing npm

.github/workflows/publish-js.yml

@@ -39,5 +39,3 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

packages/js/README.md

@@ -9,3 +9,5 @@ npx envoic scan ~/projects
 For full documentation, see the [main repository](https://github.com/mahimailabs/envoic).
 
 Also available for Python: `uvx envoic scan .`
+
+> Development note: local JS development (`npm ci`, `npm run lint`, `npm run build`) requires Node `>=20.19.0`.

packages/js/package.json

@@ -33,7 +33,7 @@
     "directory": "packages/js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20.19.0"
   },
   "dependencies": {
     "@inquirer/prompts": "^7.10.1",

packages/js/src/detector.ts

@@ -46,7 +46,12 @@ function countTopLevelPackages(nodeModulesPath: string): number {
 }
 
 function pathSizeBytes(targetPath: string): number {
-  const stat = fs.lstatSync(targetPath);
+  let stat: fs.Stats;
+  try {
+    stat = fs.lstatSync(targetPath);
+  } catch {
+    return 0;
+  }
   if (stat.isSymbolicLink()) return stat.size;
   if (stat.isFile()) return stat.size;
   if (!stat.isDirectory()) return 0;
@@ -98,7 +103,22 @@ export function detectEnvironment(
   if (hasPnpmMarker) signals.push("pnpm-marker");
   if (hasPackageJson) signals.push("package.json");
 
-  const stat = fs.statSync(nodeModulesPath);
+  let stat: fs.Stats;
+  try {
+    stat = fs.statSync(nodeModulesPath);
+  } catch {
+    return {
+      path: nodeModulesPath,
+      packageManager: detectPackageManager(nodeModulesPath),
+      packageCount: deep ? countTopLevelPackages(nodeModulesPath) : null,
+      sizeBytes: deep ? pathSizeBytes(nodeModulesPath) : null,
+      created: null,
+      modified: null,
+      isStale: false,
+      isOutdated: false,
+      signals: [...signals, "stat-unavailable"],
+    };
+  }
   const created = stat.birthtime ?? null;
   const modified = stat.mtime ?? null;
   const staleThreshold = Date.now() - staleDays * 86400000;

packages/js/src/report.ts

@@ -138,7 +138,12 @@ export function formatInfo(env: EnvInfo, topPackages: Array<{ name: string; size
 export function topLargestPackages(nodeModulesPath: string, limit = 10): Array<{ name: string; size: number }> {
   const resolvedPath = path.resolve(nodeModulesPath);
   const result: Array<{ name: string; size: number }> = [];
-  const direct = fs.readdirSync(resolvedPath, { withFileTypes: true });
+  let direct: fs.Dirent[];
+  try {
+    direct = fs.readdirSync(resolvedPath, { withFileTypes: true });
+  } catch {
+    return [];
+  }
   for (const entry of direct) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".")) continue;