@cyberhub/shieldpm 0.1.0

package/dist/analyzer/typosquat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat.js","sourceRoot":"","sources":["../../src/analyzer/typosquat.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4EAA4E;AAE5E,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ;IACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;IACxE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO;IACtE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;IACvE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK;IAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM;IACpE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO;IAClE,WAAW,EAAE,OAAO;CACrB,CAAC;AA0BF,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEnB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEtB,4DAA4D;IAC5D,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAChB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAQ,WAAW;YAC9B,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAI,YAAY;YAC/B,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAE,eAAe;aACpC,CAAC;QACJ,CAAC;QACD,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,4EAA4E;AAE5E,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,KAAK,EAAE,CAAC;YACR,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC;QAC/B,OAAO,CACL,EAAE,GAAG,EAAE,KAAK,CAAC;YACb,KAAK,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CACzB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAC3D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,aAAuB;IAClE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,qBAAqB;IACrB,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAE9E,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;YACrC,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC;gBACnC,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,UAAU,KAAK,2BAA2B,KAAK,GAAG;aAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAa,EAAE,MAAc;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAErD,sEAAsE;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAE5E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,gBAA0B,gBAAgB;IAE1C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAE9D,4DAA4D;IAC5D,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,mCAAmC;IACnC,IAAI,SAAS,GAA2B,IAAI,CAAC;IAC7C,IAAI,YAAY,GAAG,QAAQ,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAExD,kEAAkE;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhE,8BAA8B;QAC9B,IAAI,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,IAAI,WAAW,mBAAmB,KAAK,iCAAiC;aACjF,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,IAAI,WAAW,yCAAyC,KAAK,GAAG;aACzE,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,IAAI,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,oBAAoB;gBAC5B,MAAM,EAAE,IAAI,WAAW,2CAA2C,KAAK,GAAG;aAC3E,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,IAAI,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,IAAI,WAAW,yCAAyC,KAAK,GAAG;aACzE,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;YACrC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS,GAAG;gBACV,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,IAAI,WAAW,QAAQ,IAAI,uBAAuB,KAAK,GAAG;aACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAsB,EACtB,gBAA0B,gBAAgB;IAE1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+/**
+ * ShieldPM — CLI Entry Point
+ * Runtime-aware package firewall for Node.js
+ *
+ * Usage:
+ *   shieldpm <command> [options]
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG"}

package/dist/cli.js

@@ -0,0 +1,621 @@
+#!/usr/bin/env node
+/**
+ * ShieldPM — CLI Entry Point
+ * Runtime-aware package firewall for Node.js
+ *
+ * Usage:
+ *   shieldpm <command> [options]
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { bold, cyan, red, green, yellow, dim, boldRed, boldGreen, boldYellow, boldCyan } from './utils/colors.js';
+import log from './utils/logger.js';
+import { analyzePackage } from './analyzer/static.js';
+import { checkTyposquatting } from './analyzer/typosquat.js';
+import { runSandboxed } from './sandbox/runner.js';
+import { loadManifest, saveManifest, generateManifest } from './monitor/permissions.js';
+import { generateProfile, saveProfile } from './fingerprint/profile.js';
+import { diffLockfiles } from './diff/dependency.js';
+// ── Version ──────────────────────────────────────────────────────────────
+const VERSION = '0.1.0';
+// ── ASCII banner ─────────────────────────────────────────────────────────
+function printBanner() {
+    console.log(boldCyan(`
+  ███████╗██╗  ██╗██╗███████╗██╗     ██████╗ ██████╗ ███╗   ███╗
+  ██╔════╝██║  ██║██║██╔════╝██║     ██╔══██╗██╔══██╗████╗ ████║
+  ███████╗███████║██║█████╗  ██║     ██║  ██║██████╔╝██╔████╔██║
+  ╚════██║██╔══██║██║██╔══╝  ██║     ██║  ██║██╔═══╝ ██║╚██╔╝██║
+  ███████║██║  ██║██║███████╗███████╗██████╔╝██║     ██║ ╚═╝ ██║
+  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚═════╝ ╚═╝     ╚═╝     ╚═╝
+`));
+    console.log(dim('  Runtime-aware package firewall for Node.js'));
+    console.log();
+}
+// ── Help text ────────────────────────────────────────────────────────────
+function printHelp() {
+    printBanner();
+    console.log(bold('  USAGE'));
+    console.log(`    ${cyan('shieldpm')} ${dim('<command>')} ${dim('[options]')}`);
+    console.log();
+    console.log(bold('  COMMANDS'));
+    const commands = [
+        ['install <package>', 'Install a package with protection checks'],
+        ['audit', 'Audit current project dependencies'],
+        ['audit --deep', 'Deep behavioral analysis of all dependencies'],
+        ['inspect <package>', 'Show what a package does (static analysis)'],
+        ['sandbox <command>', 'Run a command in a sandboxed environment'],
+        ['manifest generate', 'Auto-generate permission manifest'],
+        ['manifest enforce', 'Enforce permission manifest at runtime'],
+        ['diff', 'Show dependency changes since last lock'],
+        ['help', 'Show this help message'],
+        ['version', 'Show version'],
+    ];
+    const maxCmd = Math.max(...commands.map(([c]) => c.length));
+    for (const [cmd, desc] of commands) {
+        console.log(`    ${green(cmd.padEnd(maxCmd + 2))} ${dim(desc)}`);
+    }
+    console.log();
+    console.log(bold('  OPTIONS'));
+    console.log(`    ${green('--verbose')}          ${dim('Enable debug logging')}`);
+    console.log(`    ${green('--no-color')}         ${dim('Disable colored output')}`);
+    console.log(`    ${green('--json')}             ${dim('Output results as JSON')}`);
+    console.log();
+    console.log(dim('  https://github.com/nrupaks/shieldpm'));
+    console.log();
+}
+// ── Formatters ───────────────────────────────────────────────────────────
+function severityColor(severity) {
+    switch (severity) {
+        case 'critical': return boldRed;
+        case 'high': return red;
+        case 'medium': return yellow;
+        case 'low': return dim;
+        default: return dim;
+    }
+}
+function scoreBar(score) {
+    const filled = Math.round(score);
+    const empty = 10 - filled;
+    const color = score >= 7 ? red : score >= 4 ? yellow : green;
+    return color('\u2588'.repeat(filled)) + dim('\u2591'.repeat(empty)) + ` ${score}/10`;
+}
+function printFindings(findings, limit = 20) {
+    const shown = findings.slice(0, limit);
+    for (const f of shown) {
+        const sev = severityColor(f.severity)(f.severity.toUpperCase().padEnd(8));
+        console.log(`  ${sev} ${dim(f.file + ':' + f.line)} ${f.message}`);
+        if (f.snippet) {
+            console.log(`           ${dim(f.snippet)}`);
+        }
+    }
+    if (findings.length > limit) {
+        console.log(dim(`  ... and ${findings.length - limit} more findings`));
+    }
+}
+function printRiskReport(report, packageName) {
+    const label = packageName ? ` for ${bold(packageName)}` : '';
+    log.header(`Risk Report${label}`);
+    console.log();
+    console.log(`  ${bold('Score:')}  ${scoreBar(report.score)}`);
+    console.log(`  ${bold('Files:')}  ${report.filesScanned} scanned`);
+    console.log(`  ${bold('Result:')} ${report.summary}`);
+    console.log();
+    if (Object.keys(report.categoryCounts).length > 0) {
+        console.log(bold('  Category Breakdown:'));
+        for (const [cat, count] of Object.entries(report.categoryCounts)) {
+            console.log(`    ${dim(cat.padEnd(24))} ${count} finding${count !== 1 ? 's' : ''}`);
+        }
+        console.log();
+    }
+    if (report.findings.length > 0) {
+        console.log(bold('  Findings:'));
+        printFindings(report.findings);
+        console.log();
+    }
+}
+// ── Command handlers ─────────────────────────────────────────────────────
+async function cmdInstall(packageName, flags) {
+    log.header(`Installing ${packageName} with protection`);
+    console.log();
+    // Step 1: Typosquatting check
+    log.info('Checking for typosquatting...');
+    const typoResult = checkTyposquatting(packageName);
+    if (typoResult) {
+        console.log();
+        console.log(boldRed('  !! TYPOSQUATTING WARNING !!'));
+        console.log(red(`  "${packageName}" looks suspicious:`));
+        console.log(yellow(`  Similar to: ${bold(typoResult.similarTo)}`));
+        console.log(yellow(`  Method: ${typoResult.method} (distance: ${typoResult.distance})`));
+        console.log(yellow(`  ${typoResult.reason}`));
+        console.log();
+        console.log(red('  Installation blocked. If this is intentional, use --force.'));
+        if (!flags.has('--force')) {
+            process.exitCode = 1;
+            return;
+        }
+        console.log(yellow('  --force flag set, continuing anyway...'));
+        console.log();
+    }
+    else {
+        log.success('No typosquatting detected');
+    }
+    // Step 2: Install the package
+    log.info(`Running npm install ${packageName}...`);
+    try {
+        execSync(`npm install --ignore-scripts ${packageName}`, {
+            stdio: 'inherit',
+            cwd: process.cwd(),
+        });
+    }
+    catch {
+        log.error('npm install failed');
+        process.exitCode = 1;
+        return;
+    }
+    // Step 3: Static analysis
+    const pkgDir = resolve('node_modules', packageName);
+    if (existsSync(pkgDir)) {
+        log.info('Running static analysis...');
+        const report = await analyzePackage(pkgDir);
+        printRiskReport(report, packageName);
+        if (report.score >= 7) {
+            log.error('Package has critical risk score. Review findings above.');
+            console.log(yellow('  To keep the package, add it to your shieldpm.json manifest.'));
+        }
+        else if (report.score >= 4) {
+            log.warn('Package has elevated risk. Review findings above.');
+        }
+        else {
+            log.success('Package appears safe.');
+        }
+        // Step 4: Generate profile
+        try {
+            const pkgJson = JSON.parse(await readFile(join(pkgDir, 'package.json'), 'utf-8'));
+            const profile = await generateProfile(pkgDir, packageName, pkgJson.version ?? '0.0.0');
+            const profilePath = await saveProfile(process.cwd(), profile);
+            log.info(`Behavioral profile saved: ${dim(profilePath)}`);
+        }
+        catch {
+            log.warn('Could not generate behavioral profile');
+        }
+        // Step 5: Run postinstall in sandbox if present
+        try {
+            const pkgJson = JSON.parse(await readFile(join(pkgDir, 'package.json'), 'utf-8'));
+            const postinstall = pkgJson.scripts?.postinstall || pkgJson.scripts?.install;
+            if (postinstall) {
+                log.info('Running postinstall script in sandbox...');
+                const result = await runSandboxed('sh', ['-c', postinstall], {
+                    cwd: pkgDir,
+                    timeout: 30_000,
+                    blockNetwork: true,
+                    blockEnv: true,
+                });
+                if (result.warnings.length > 0) {
+                    for (const w of result.warnings)
+                        log.warn(w);
+                }
+                if (result.blocked.length > 0) {
+                    for (const b of result.blocked)
+                        log.info(`Blocked: ${b}`);
+                }
+                if (result.exitCode === 0) {
+                    log.success('Postinstall completed in sandbox');
+                }
+                else {
+                    log.warn(`Postinstall exited with code ${result.exitCode}`);
+                }
+            }
+        }
+        catch {
+            // No postinstall — fine
+        }
+    }
+    console.log();
+}
+async function cmdAudit(deep, flags) {
+    log.header(deep ? 'Deep Dependency Audit' : 'Dependency Audit');
+    console.log();
+    const nodeModules = resolve('node_modules');
+    if (!existsSync(nodeModules)) {
+        log.error('No node_modules found. Run npm install first.');
+        process.exitCode = 1;
+        return;
+    }
+    // Read top-level dependencies from package.json
+    let deps = [];
+    try {
+        const pkgJson = JSON.parse(await readFile(resolve('package.json'), 'utf-8'));
+        deps = [
+            ...Object.keys(pkgJson.dependencies ?? {}),
+            ...Object.keys(pkgJson.devDependencies ?? {}),
+        ];
+    }
+    catch {
+        log.error('Cannot read package.json');
+        process.exitCode = 1;
+        return;
+    }
+    if (deps.length === 0) {
+        log.info('No dependencies found.');
+        return;
+    }
+    log.info(`Scanning ${deps.length} dependencies...`);
+    console.log();
+    let totalScore = 0;
+    let maxScore = 0;
+    let maxPkg = '';
+    const highRisk = [];
+    for (const dep of deps) {
+        const pkgDir = resolve('node_modules', dep);
+        if (!existsSync(pkgDir)) {
+            log.warn(`${dep}: not found in node_modules`);
+            continue;
+        }
+        const report = await analyzePackage(pkgDir);
+        totalScore += report.score;
+        if (report.score > maxScore) {
+            maxScore = report.score;
+            maxPkg = dep;
+        }
+        const scoreStr = report.score >= 7
+            ? boldRed(report.score.toFixed(1))
+            : report.score >= 4
+                ? boldYellow(report.score.toFixed(1))
+                : boldGreen(report.score.toFixed(1));
+        console.log(`  ${scoreStr.padStart(18)} ${dep} ${dim(`(${report.findings.length} findings)`)}`);
+        if (report.score >= 4) {
+            highRisk.push({ name: dep, score: report.score });
+        }
+        if (deep && report.findings.length > 0) {
+            printFindings(report.findings, 5);
+            console.log();
+        }
+        // Typosquatting check
+        const typo = checkTyposquatting(dep);
+        if (typo) {
+            console.log(yellow(`           Typosquatting alert: similar to "${typo.similarTo}" (${typo.method})`));
+        }
+    }
+    console.log();
+    console.log(bold('  Summary:'));
+    console.log(`    Packages scanned:  ${deps.length}`);
+    console.log(`    Average risk score: ${(totalScore / deps.length).toFixed(1)}/10`);
+    console.log(`    Highest risk:      ${maxPkg} (${maxScore.toFixed(1)}/10)`);
+    if (highRisk.length > 0) {
+        console.log();
+        console.log(boldYellow(`  ${highRisk.length} package(s) need attention:`));
+        for (const pkg of highRisk) {
+            console.log(yellow(`    - ${pkg.name} (${pkg.score.toFixed(1)}/10)`));
+        }
+    }
+    console.log();
+    if (flags.has('--json')) {
+        // Could output machine-readable results; for now just note it
+        log.info('JSON output: use --json with programmatic API for structured data');
+    }
+}
+async function cmdInspect(packageName) {
+    // Try node_modules first, then treat as a directory
+    let targetDir = resolve('node_modules', packageName);
+    if (!existsSync(targetDir)) {
+        targetDir = resolve(packageName);
+    }
+    if (!existsSync(targetDir)) {
+        log.error(`Package "${packageName}" not found in node_modules or as a path.`);
+        log.info('Install it first: shieldpm install ' + packageName);
+        process.exitCode = 1;
+        return;
+    }
+    const report = await analyzePackage(targetDir);
+    printRiskReport(report, packageName);
+    // Also show imports and profile
+    try {
+        const pkgJson = JSON.parse(await readFile(join(targetDir, 'package.json'), 'utf-8'));
+        const version = pkgJson.version ?? 'unknown';
+        const profile = await generateProfile(targetDir, packageName, version);
+        if (profile.imports.length > 0) {
+            console.log(bold('  Imports:'));
+            for (const imp of profile.imports.slice(0, 30)) {
+                const isBuiltin = !imp.startsWith('.') && !imp.startsWith('/');
+                console.log(`    ${isBuiltin ? cyan(imp) : dim(imp)}`);
+            }
+            if (profile.imports.length > 30) {
+                console.log(dim(`    ... and ${profile.imports.length - 30} more`));
+            }
+            console.log();
+        }
+        if (profile.networkEndpoints.length > 0) {
+            console.log(boldYellow('  Network Endpoints:'));
+            for (const ep of profile.networkEndpoints) {
+                console.log(`    ${yellow(ep)}`);
+            }
+            console.log();
+        }
+        if (profile.nativeBindings.length > 0) {
+            console.log(bold('  Native Bindings:'));
+            for (const nb of profile.nativeBindings) {
+                console.log(`    ${red(nb)}`);
+            }
+            console.log();
+        }
+    }
+    catch {
+        // Not a valid package directory
+    }
+}
+async function cmdSandbox(command) {
+    if (command.length === 0) {
+        log.error('No command specified. Usage: shieldpm sandbox <command>');
+        process.exitCode = 1;
+        return;
+    }
+    const fullCommand = command.join(' ');
+    log.header(`Sandboxing: ${fullCommand}`);
+    console.log();
+    log.info('Environment: network blocked, env stripped, 30s timeout');
+    console.log();
+    const result = await runSandboxed(command[0], command.slice(1), {
+        timeout: 30_000,
+        blockNetwork: true,
+        blockEnv: true,
+    });
+    if (result.stdout) {
+        console.log(dim('  --- stdout ---'));
+        console.log(result.stdout);
+    }
+    if (result.stderr) {
+        console.log(dim('  --- stderr ---'));
+        console.log(result.stderr);
+    }
+    console.log();
+    if (result.blocked.length > 0) {
+        console.log(bold('  Blocked:'));
+        for (const b of result.blocked) {
+            console.log(`    ${red(b)}`);
+        }
+    }
+    if (result.warnings.length > 0) {
+        console.log(bold('  Warnings:'));
+        for (const w of result.warnings) {
+            console.log(`    ${yellow(w)}`);
+        }
+    }
+    console.log();
+    console.log(`  Exit code: ${result.exitCode ?? 'killed'}`);
+    console.log(`  Duration:  ${result.durationMs}ms`);
+    if (result.timedOut) {
+        console.log(boldRed('  TIMED OUT'));
+    }
+    console.log();
+    process.exitCode = result.exitCode ?? 1;
+}
+async function cmdManifestGenerate() {
+    log.header('Generating Permission Manifest');
+    console.log();
+    const projectDir = process.cwd();
+    log.info('Scanning dependencies...');
+    const manifest = await generateManifest(projectDir);
+    const pkgCount = Object.keys(manifest.permissions).length;
+    if (pkgCount === 0) {
+        log.warn('No packages found in node_modules.');
+        return;
+    }
+    const path = await saveManifest(manifest, projectDir);
+    log.success(`Generated manifest for ${pkgCount} packages`);
+    log.info(`Saved to: ${dim(path)}`);
+    console.log();
+    console.log(dim('  Review the manifest and fill in allowed destinations/paths.'));
+    console.log(dim('  Then run: shieldpm manifest enforce'));
+    console.log();
+}
+async function cmdManifestEnforce() {
+    log.header('Enforcing Permission Manifest');
+    console.log();
+    const manifest = await loadManifest();
+    if (!manifest) {
+        log.error('No shieldpm.json found. Run: shieldpm manifest generate');
+        process.exitCode = 1;
+        return;
+    }
+    const pkgCount = Object.keys(manifest.permissions).length;
+    log.info(`Loaded manifest with ${pkgCount} package rules`);
+    console.log();
+    // Validate that all installed deps have manifest entries
+    try {
+        const pkgJson = JSON.parse(await readFile(resolve('package.json'), 'utf-8'));
+        const deps = [
+            ...Object.keys(pkgJson.dependencies ?? {}),
+            ...Object.keys(pkgJson.devDependencies ?? {}),
+        ];
+        let missing = 0;
+        let covered = 0;
+        for (const dep of deps) {
+            if (manifest.permissions[dep]) {
+                covered++;
+                const perms = manifest.permissions[dep];
+                const restrictions = [];
+                if (perms.net === false)
+                    restrictions.push('net:blocked');
+                else if (Array.isArray(perms.net))
+                    restrictions.push(`net:${perms.net.length} rules`);
+                if (perms.fs === false)
+                    restrictions.push('fs:blocked');
+                else if (Array.isArray(perms.fs))
+                    restrictions.push(`fs:${perms.fs.length} paths`);
+                if (perms.native)
+                    restrictions.push('native:yes');
+                if (perms.exec)
+                    restrictions.push('exec:yes');
+                console.log(`  ${green('\u2713')} ${dep} ${dim(`[${restrictions.join(', ')}]`)}`);
+            }
+            else {
+                missing++;
+                console.log(`  ${red('\u2717')} ${dep} ${red('(no manifest entry — will be fully restricted)')}`);
+            }
+        }
+        console.log();
+        console.log(`  Covered: ${covered}/${deps.length}`);
+        if (missing > 0) {
+            log.warn(`${missing} packages have no manifest entry and will be fully restricted.`);
+            log.info('Run: shieldpm manifest generate');
+        }
+        else {
+            log.success('All dependencies have manifest entries.');
+        }
+    }
+    catch {
+        log.error('Cannot read package.json');
+        process.exitCode = 1;
+    }
+    console.log();
+}
+async function cmdDiff() {
+    log.header('Dependency Diff');
+    console.log();
+    // Look for git-tracked package-lock.json
+    const lockPath = resolve('package-lock.json');
+    if (!existsSync(lockPath)) {
+        log.error('No package-lock.json found.');
+        process.exitCode = 1;
+        return;
+    }
+    // Get the last committed version
+    let oldLock;
+    try {
+        oldLock = execSync('git show HEAD:package-lock.json', {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        log.error('Could not get previous package-lock.json from git.');
+        log.info('This command requires a git repository with a committed package-lock.json.');
+        process.exitCode = 1;
+        return;
+    }
+    const newLock = await readFile(lockPath, 'utf-8');
+    const report = diffLockfiles(oldLock, newLock);
+    console.log(`  ${dim('Old packages:')} ${report.oldPackageCount}`);
+    console.log(`  ${dim('New packages:')} ${report.newPackageCount}`);
+    console.log();
+    if (report.added.length > 0) {
+        console.log(bold(green(`  + ${report.added.length} added:`)));
+        for (const pkg of report.added) {
+            console.log(`    ${green('+')} ${pkg.name} ${dim(pkg.newVersion ?? '')}`);
+            for (const flag of pkg.flags) {
+                console.log(`      ${yellow('!')} ${flag.message}`);
+            }
+        }
+        console.log();
+    }
+    if (report.removed.length > 0) {
+        console.log(bold(red(`  - ${report.removed.length} removed:`)));
+        for (const pkg of report.removed) {
+            console.log(`    ${red('-')} ${pkg.name} ${dim(pkg.oldVersion ?? '')}`);
+        }
+        console.log();
+    }
+    if (report.changed.length > 0) {
+        console.log(bold(yellow(`  ~ ${report.changed.length} changed:`)));
+        for (const pkg of report.changed) {
+            console.log(`    ${yellow('~')} ${pkg.name} ${dim((pkg.oldVersion ?? '') + ' -> ' + (pkg.newVersion ?? ''))}`);
+            for (const flag of pkg.flags) {
+                console.log(`      ${yellow('!')} ${flag.message}`);
+            }
+        }
+        console.log();
+    }
+    if (report.flags.length > 0) {
+        console.log(boldYellow(`  ${report.flags.length} flag(s) to review`));
+    }
+    else if (report.added.length === 0 && report.removed.length === 0 && report.changed.length === 0) {
+        log.success('No dependency changes detected.');
+    }
+    console.log();
+}
+// ── Arg parsing ──────────────────────────────────────────────────────────
+function parseArgs(argv) {
+    const args = [];
+    const flags = new Set();
+    for (const arg of argv.slice(2)) {
+        if (arg.startsWith('--')) {
+            flags.add(arg);
+        }
+        else {
+            args.push(arg);
+        }
+    }
+    return {
+        command: args[0] ?? 'help',
+        args: args.slice(1),
+        flags,
+    };
+}
+// ── Main ─────────────────────────────────────────────────────────────────
+async function main() {
+    const { command, args, flags } = parseArgs(process.argv);
+    if (flags.has('--verbose')) {
+        log.setLevel('debug');
+    }
+    switch (command) {
+        case 'install':
+            if (!args[0]) {
+                log.error('Missing package name. Usage: shieldpm install <package>');
+                process.exitCode = 1;
+                return;
+            }
+            await cmdInstall(args[0], flags);
+            break;
+        case 'audit':
+            await cmdAudit(flags.has('--deep'), flags);
+            break;
+        case 'inspect':
+            if (!args[0]) {
+                log.error('Missing package name. Usage: shieldpm inspect <package>');
+                process.exitCode = 1;
+                return;
+            }
+            await cmdInspect(args[0]);
+            break;
+        case 'sandbox':
+            await cmdSandbox(args);
+            break;
+        case 'manifest':
+            if (args[0] === 'generate') {
+                await cmdManifestGenerate();
+            }
+            else if (args[0] === 'enforce') {
+                await cmdManifestEnforce();
+            }
+            else {
+                log.error('Unknown manifest subcommand. Use: manifest generate | manifest enforce');
+                process.exitCode = 1;
+            }
+            break;
+        case 'diff':
+            await cmdDiff();
+            break;
+        case 'version':
+        case '--version':
+        case '-v':
+            console.log(`shieldpm v${VERSION}`);
+            break;
+        case 'help':
+        case '--help':
+        case '-h':
+            printHelp();
+            break;
+        default:
+            log.error(`Unknown command: "${command}"`);
+            console.log(dim('  Run "shieldpm help" for usage information.'));
+            process.exitCode = 1;
+            break;
+    }
+}
+main().catch((err) => {
+    log.error(err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map