fix: add -D flag to fix commands for dev dependencies (#690)

* fix: add -D flag to fix commands for dev dependencies

SuggestedFixTarget now carries isDev, propagated from pkg.dev for
direct findings and looked up via devLookup for parent upgrades.
buildCommandForTargets splits dev/prod into separate install commands.
buildWorkspaceInstallCommands and findSuggestedCommandForFinding both
emit the correct flag per package manager (-D for npm/pnpm/yarn,
--dev for bun).

Closes #689

* fix(action): use --package flag to explicitly resolve cve-lite binary

npx derives the command name from the package name (cve-lite-cli) but
the bin field is named cve-lite, causing exit code 127 on npm 10.x.
Using --package separates the install target from the binary name.

Author: sonukapoor

action.yml

@@ -135,7 +135,7 @@ runs:
         if [[ -n "${INPUT_CA_CERT}" ]]; then
           sync_args+=("--ca-cert" "${INPUT_CA_CERT}")
         fi
-        npx --yes "cve-lite-cli@${INPUT_VERSION}" "${sync_args[@]}"
+        npx --yes --package "cve-lite-cli@${INPUT_VERSION}" cve-lite "${sync_args[@]}"
 
     - name: Run CVE Lite CLI scan
       shell: bash
@@ -202,4 +202,4 @@ runs:
           args+=("--ca-cert" "${INPUT_CA_CERT}")
         fi
 
-        npx --yes "cve-lite-cli@${INPUT_VERSION}" "${args[@]}"
+        npx --yes --package "cve-lite-cli@${INPUT_VERSION}" cve-lite "${args[@]}"

src/remediation/fix-commands.ts

@@ -30,6 +30,7 @@ export type SuggestedFixTarget = {
   coveredPaths?: string[][];
   remainingPaths?: string[][];
   usage?: { imported: boolean; files: string[] } | null;
+  isDev?: boolean;
 };
 
 export type SuggestedFixSkip = {
@@ -83,6 +84,11 @@ export function buildSuggestedFixCommandPlan(
     }
   }
 
+  const devLookup = new Map<string, boolean>();
+  for (const pkg of scanInput.packages) {
+    devLookup.set(`${pkg.name}@${pkg.version}`, pkg.dev ?? false);
+  }
+
   const prioritizedFindings = [...findings]
     .filter(f => f.severity === "critical" || f.severity === "high")
     .sort((a, b) => {
@@ -176,6 +182,7 @@ export function buildSuggestedFixCommandPlan(
           reason: `Direct upgrade target for ${finding.pkg.name}@${finding.pkg.version}`,
           usage: finding.usage ?? null,
           workspaces: pkgWorkspaces.length > 0 ? pkgWorkspaces : undefined,
+          isDev: finding.pkg.dev ?? false,
         });
       } else if (finding.fixVersionValidationNote) {
         skippedByKey.set(`${finding.relationship}:${finding.pkg.name}@${finding.pkg.version}`, {
@@ -234,6 +241,7 @@ export function buildSuggestedFixCommandPlan(
         reason: finding.recommendedNpmTransitiveRemediation.reason,
         command: buildNpmUpdateCommand(finding.recommendedNpmTransitiveRemediation.package, finding.recommendedNpmTransitiveRemediation.workspaces),
         usage: finding.usage ?? null,
+        isDev: devLookup.get(`${finding.recommendedNpmTransitiveRemediation.package}@${finding.recommendedNpmTransitiveRemediation.currentVersion}`) ?? false,
       });
       continue;
     }
@@ -268,6 +276,7 @@ export function buildSuggestedFixCommandPlan(
         coveredPaths: coverage.coveredPaths,
         remainingPaths: coverage.remainingPaths,
         usage: finding.usage ?? null,
+        isDev: devLookup.get(`${finding.recommendedNpmTransitiveRemediation.package}@${finding.recommendedNpmTransitiveRemediation.currentVersion}`) ?? false,
       });
       continue;
     }
@@ -300,6 +309,7 @@ export function buildSuggestedFixCommandPlan(
         coveredPaths: coverage.coveredPaths,
         remainingPaths: coverage.remainingPaths,
         usage: finding.usage ?? null,
+        isDev: devLookup.get(`${finding.recommendedParentUpgrade.package}@${finding.recommendedParentUpgrade.currentVersion}`) ?? false,
       });
       continue;
     }
@@ -448,6 +458,10 @@ function commandPrefix(packageManager: SuggestedFixPackageManager): string {
   return "yarn add";
 }
 
+function devFlag(packageManager: SuggestedFixPackageManager): string {
+  return packageManager === "bun" ? "--dev" : "-D";
+}
+
 export function findSuggestedCommandForFinding(
   plan: SuggestedFixCommandPlan,
   finding: Finding,
@@ -482,7 +496,8 @@ export function findSuggestedCommandForFinding(
     const commands = buildWorkspaceInstallCommands([target], plan.packageManager);
     if (commands.length > 0) return commands.join(" && ");
   }
-  return `${commandPrefix(plan.packageManager)} ${target.package}@${target.targetVersion}`;
+  const flag = target.isDev ? ` ${devFlag(plan.packageManager)}` : "";
+  return `${commandPrefix(plan.packageManager)}${flag} ${target.package}@${target.targetVersion}`;
 }
 
 function packageManagerSourceLabel(scanInput: ScanInput): string {
@@ -520,6 +535,7 @@ function upsertTarget(
         : "parent-upgrade",
     displayTargetVersion: existing.displayTargetVersion ?? next.displayTargetVersion,
     command: existing.command ?? next.command,
+    isDev: (existing.isDev ?? false) && (next.isDev ?? false),
     workspaces: mergeStringArrays(existing.workspaces, next.workspaces),
     coverage: existing.coverage === "partial" || next.coverage === "partial"
       ? "partial"
@@ -700,28 +716,35 @@ function buildWorkspaceInstallCommands(
   const commands: string[] = [];
 
   for (const [wsKey, groupTargets] of groups) {
-    const pkgArgs = groupTargets.map(t => `${t.package}@${t.targetVersion}`).join(" ");
     const workspaces = wsKey ? wsKey.split("\0") : [];
-
-    if (packageManager === "npm") {
-      const wsFlags = workspaces.map(ws => `-w ${ws}`).join(" ");
-      commands.push(`npm install${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
-    } else if (packageManager === "pnpm") {
-      const wsFlags = workspaces.map(ws => `--filter ./${ws}`).join(" ");
-      commands.push(`pnpm add${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
-    } else if (packageManager === "yarn") {
-      if (workspaces.length === 0) {
-        commands.push(`yarn add ${pkgArgs}`);
-      } else {
-        for (const ws of workspaces) {
-          commands.push(`yarn workspace ${ws} add ${pkgArgs}`);
+    const devTargets = groupTargets.filter(t => t.isDev);
+    const prodTargets = groupTargets.filter(t => !t.isDev);
+
+    for (const [targets, isDev] of [[prodTargets, false], [devTargets, true]] as const) {
+      if (targets.length === 0) continue;
+      const pkgArgs = targets.map(t => `${t.package}@${t.targetVersion}`).join(" ");
+      const flag = isDev ? ` ${devFlag(packageManager)}` : "";
+
+      if (packageManager === "npm") {
+        const wsFlags = workspaces.map(ws => `-w ${ws}`).join(" ");
+        commands.push(`npm install${flag}${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
+      } else if (packageManager === "pnpm") {
+        const wsFlags = workspaces.map(ws => `--filter ./${ws}`).join(" ");
+        commands.push(`pnpm add${flag}${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
+      } else if (packageManager === "yarn") {
+        if (workspaces.length === 0) {
+          commands.push(`yarn add${flag} ${pkgArgs}`);
+        } else {
+          for (const ws of workspaces) {
+            commands.push(`yarn workspace ${ws} add${flag} ${pkgArgs}`);
+          }
         }
+      } else if (packageManager === "bun") {
+        const wsFlags = workspaces.map(ws => `--filter ${ws}`).join(" ");
+        commands.push(`bun add${flag}${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
+      } else {
+        commands.push(`${commandPrefix(packageManager)}${flag} ${pkgArgs}`);
       }
-    } else if (packageManager === "bun") {
-      const wsFlags = workspaces.map(ws => `--filter ${ws}`).join(" ");
-      commands.push(`bun add${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
-    } else {
-      commands.push(`${commandPrefix(packageManager)} ${pkgArgs}`);
     }
   }
 
@@ -754,9 +777,14 @@ function buildCommandForTargets(
     if (hasWorkspaces) {
       commandParts.push(...buildWorkspaceInstallCommands(installTargets, packageManager));
     } else {
-      commandParts.push(
-        `${commandPrefix(packageManager)} ${installTargets.map(target => `${target.package}@${target.targetVersion}`).join(" ")}`,
-      );
+      const prodInstall = installTargets.filter(t => !t.isDev);
+      const devInstall = installTargets.filter(t => t.isDev);
+      if (prodInstall.length > 0) {
+        commandParts.push(`${commandPrefix(packageManager)} ${prodInstall.map(t => `${t.package}@${t.targetVersion}`).join(" ")}`);
+      }
+      if (devInstall.length > 0) {
+        commandParts.push(`${commandPrefix(packageManager)} ${devFlag(packageManager)} ${devInstall.map(t => `${t.package}@${t.targetVersion}`).join(" ")}`);
+      }
     }
   }