@cyberhub/shieldpm 0.1.0

package/dist/sandbox/runner.js

@@ -0,0 +1,216 @@
+/**
+ * ShieldPM — Sandbox Runner
+ * Executes commands (especially postinstall scripts) in a restricted environment
+ * with network blocking, timeout enforcement, and output capture.
+ */
+import { spawn } from 'node:child_process';
+import { platform } from 'node:os';
+// ── Safe environment builder ─────────────────────────────────────────────
+const SAFE_ENV_VARS = new Set([
+    'PATH',
+    'HOME',
+    'USER',
+    'SHELL',
+    'LANG',
+    'LC_ALL',
+    'TERM',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'NODE_ENV',
+    'NODE_PATH',
+]);
+const SENSITIVE_ENV_VARS = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'NPM_TOKEN',
+    'NPM_AUTH_TOKEN',
+    'DOCKER_PASSWORD',
+    'SSH_AUTH_SOCK',
+    'GPG_TTY',
+    'DATABASE_URL',
+    'REDIS_URL',
+    'API_KEY',
+    'SECRET_KEY',
+    'PRIVATE_KEY',
+]);
+function buildSandboxEnv(blockNetwork, blockEnv, allowedEnvVars) {
+    const env = {};
+    if (blockEnv) {
+        // Only pass through safe variables
+        const allowed = new Set([...SAFE_ENV_VARS, ...allowedEnvVars]);
+        for (const key of allowed) {
+            if (process.env[key] !== undefined) {
+                env[key] = process.env[key];
+            }
+        }
+    }
+    else {
+        // Pass through everything except sensitive vars
+        for (const [key, value] of Object.entries(process.env)) {
+            if (!SENSITIVE_ENV_VARS.has(key) && value !== undefined) {
+                env[key] = value;
+            }
+        }
+        // Also pass explicitly allowed
+        for (const key of allowedEnvVars) {
+            if (process.env[key] !== undefined) {
+                env[key] = process.env[key];
+            }
+        }
+    }
+    // Block network via proxy settings
+    if (blockNetwork) {
+        env['HTTP_PROXY'] = 'http://blocked.shieldpm.local:0';
+        env['HTTPS_PROXY'] = 'http://blocked.shieldpm.local:0';
+        env['http_proxy'] = 'http://blocked.shieldpm.local:0';
+        env['https_proxy'] = 'http://blocked.shieldpm.local:0';
+        env['no_proxy'] = '';
+        env['NODE_OPTIONS'] = [
+            env['NODE_OPTIONS'] ?? '',
+            '--dns-result-order=verbatim',
+        ].filter(Boolean).join(' ');
+    }
+    // Prevent spawning of sub-shells from modifying real config
+    env['npm_config_ignore_scripts'] = 'true';
+    return env;
+}
+// ── Platform-specific restrictions ───────────────────────────────────────
+function buildPlatformArgs() {
+    const args = [];
+    if (platform() === 'linux') {
+        // On Linux, we could use unshare for network namespace isolation
+        // For now, we rely on proxy blocking; future: seccomp/landlock
+    }
+    return args;
+}
+// ── Output truncation ────────────────────────────────────────────────────
+function truncateOutput(output, maxSize) {
+    if (Buffer.byteLength(output) <= maxSize)
+        return output;
+    const truncated = output.slice(0, maxSize);
+    return truncated + `\n... [output truncated at ${Math.round(maxSize / 1024)}KB]`;
+}
+// ── Main runner ──────────────────────────────────────────────────────────
+/**
+ * Run a command inside a restricted sandbox environment.
+ */
+export async function runSandboxed(command, args = [], options = {}) {
+    const { cwd = process.cwd(), timeout = 30_000, blockNetwork = true, blockEnv = true, allowedEnvVars = [], maxOutputSize = 1024 * 1024, // 1MB
+    verbose = false, } = options;
+    const warnings = [];
+    const blocked = [];
+    // Build restricted environment
+    const env = buildSandboxEnv(blockNetwork, blockEnv, allowedEnvVars);
+    if (blockNetwork) {
+        blocked.push('network: HTTP/HTTPS proxied to blocked endpoint');
+    }
+    if (blockEnv) {
+        const removedCount = Object.keys(process.env).length - Object.keys(env).length;
+        blocked.push(`environment: ${removedCount} env vars stripped`);
+    }
+    const startTime = Date.now();
+    let timedOut = false;
+    return new Promise((resolve) => {
+        let child;
+        let stdoutChunks = [];
+        let stderrChunks = [];
+        let stdoutSize = 0;
+        let stderrSize = 0;
+        try {
+            child = spawn(command, args, {
+                cwd,
+                env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                shell: true,
+                // Kill the entire process group on timeout
+                detached: false,
+            });
+        }
+        catch (err) {
+            resolve({
+                exitCode: 1,
+                stdout: '',
+                stderr: `Failed to spawn process: ${err instanceof Error ? err.message : String(err)}`,
+                warnings,
+                blocked,
+                timedOut: false,
+                durationMs: Date.now() - startTime,
+            });
+            return;
+        }
+        // Capture stdout
+        child.stdout?.on('data', (chunk) => {
+            if (stdoutSize < maxOutputSize) {
+                stdoutChunks.push(chunk);
+                stdoutSize += chunk.length;
+            }
+        });
+        // Capture stderr
+        child.stderr?.on('data', (chunk) => {
+            if (stderrSize < maxOutputSize) {
+                stderrChunks.push(chunk);
+                stderrSize += chunk.length;
+            }
+            // Watch for suspicious patterns in stderr
+            const text = chunk.toString();
+            if (/ECONNREFUSED|ENOTFOUND|blocked\.shieldpm/.test(text)) {
+                warnings.push('Process attempted network access (blocked by sandbox)');
+            }
+        });
+        // Timeout
+        const timer = setTimeout(() => {
+            timedOut = true;
+            warnings.push(`Process killed: exceeded ${timeout}ms timeout`);
+            child.kill('SIGKILL');
+        }, timeout);
+        // Completion
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            const stdout = truncateOutput(Buffer.concat(stdoutChunks).toString('utf-8'), maxOutputSize);
+            const stderr = truncateOutput(Buffer.concat(stderrChunks).toString('utf-8'), maxOutputSize);
+            if (code !== 0 && !timedOut) {
+                warnings.push(`Process exited with code ${code}`);
+            }
+            resolve({
+                exitCode: code,
+                stdout,
+                stderr,
+                warnings,
+                blocked,
+                timedOut,
+                durationMs: Date.now() - startTime,
+            });
+        });
+        child.on('error', (err) => {
+            clearTimeout(timer);
+            resolve({
+                exitCode: 1,
+                stdout: Buffer.concat(stdoutChunks).toString('utf-8'),
+                stderr: err.message,
+                warnings: [...warnings, `Spawn error: ${err.message}`],
+                blocked,
+                timedOut: false,
+                durationMs: Date.now() - startTime,
+            });
+        });
+        // Close stdin immediately
+        child.stdin?.end();
+    });
+}
+/**
+ * Run an npm postinstall script in the sandbox.
+ */
+export async function runPostInstall(packageDir, script, options = {}) {
+    return runSandboxed('sh', ['-c', script], {
+        cwd: packageDir,
+        timeout: 30_000,
+        blockNetwork: true,
+        blockEnv: true,
+        ...options,
+    });
+}
+//# sourceMappingURL=runner.js.map

package/dist/sandbox/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/sandbox/runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAsCnC,4EAA4E;AAE5E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,WAAW;IACX,SAAS;IACT,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,eAAe,CACtB,YAAqB,EACrB,QAAiB,EACjB,cAAwB;IAExB,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,QAAQ,EAAE,CAAC;QACb,mCAAmC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QACD,+BAA+B;QAC/B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,YAAY,CAAC,GAAG,iCAAiC,CAAC;QACtD,GAAG,CAAC,aAAa,CAAC,GAAG,iCAAiC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,iCAAiC,CAAC;QACtD,GAAG,CAAC,aAAa,CAAC,GAAG,iCAAiC,CAAC;QACvD,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACrB,GAAG,CAAC,cAAc,CAAC,GAAG;YACpB,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;YACzB,6BAA6B;SAC9B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,4DAA4D;IAC5D,GAAG,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC;IAE1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,iEAAiE;QACjE,+DAA+D;IACjE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAE5E,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACrD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,SAAS,GAAG,8BAA8B,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;AACnF,CAAC;AAED,4EAA4E;AAE5E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,OAAiB,EAAE,EACnB,UAA0B,EAAE;IAE5B,MAAM,EACJ,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,OAAO,GAAG,MAAM,EAChB,YAAY,GAAG,IAAI,EACnB,QAAQ,GAAG,IAAI,EACf,cAAc,GAAG,EAAE,EACnB,aAAa,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;IACnC,OAAO,GAAG,KAAK,GAChB,GAAG,OAAO,CAAC;IAEZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,+BAA+B;IAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEpE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,gBAAgB,YAAY,oBAAoB,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,IAAI,KAAmB,CAAC;QACxB,IAAI,YAAY,GAAa,EAAE,CAAC;QAChC,IAAI,YAAY,GAAa,EAAE,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC3B,GAAG;gBACH,GAAG;gBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,KAAK,EAAE,IAAI;gBACX,2CAA2C;gBAC3C,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACtF,QAAQ;gBACR,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,iBAAiB;QACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC7B,CAAC;YAED,0CAA0C;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU;QACV,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,4BAA4B,OAAO,YAAY,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,aAAa;QACb,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;YAE5F,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;YAED,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,OAAO;gBACP,QAAQ;gBACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACrD,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACtD,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,MAAc,EACd,UAA0B,EAAE;IAE5B,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;QACxC,GAAG,EAAE,UAAU;QACf,OAAO,EAAE,MAAM;QACf,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;QACd,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/colors.d.ts

@@ -0,0 +1,31 @@
+/**
+ * ShieldPM — Terminal color helpers (zero dependencies)
+ * Simple ANSI escape code wrapper, no chalk needed.
+ */
+export declare const red: (text: string) => string;
+export declare const green: (text: string) => string;
+export declare const yellow: (text: string) => string;
+export declare const blue: (text: string) => string;
+export declare const magenta: (text: string) => string;
+export declare const cyan: (text: string) => string;
+export declare const white: (text: string) => string;
+export declare const gray: (text: string) => string;
+export declare const bold: (text: string) => string;
+export declare const dim: (text: string) => string;
+export declare const italic: (text: string) => string;
+export declare const underline: (text: string) => string;
+export declare const reset: (text: string) => string;
+export declare const redBright: (text: string) => string;
+export declare const greenBright: (text: string) => string;
+export declare const yellowBright: (text: string) => string;
+export declare const blueBright: (text: string) => string;
+export declare const cyanBright: (text: string) => string;
+export declare const bgRed: (text: string) => string;
+export declare const bgGreen: (text: string) => string;
+export declare const bgYellow: (text: string) => string;
+export declare const boldRed: (t: string) => string;
+export declare const boldGreen: (t: string) => string;
+export declare const boldYellow: (t: string) => string;
+export declare const boldCyan: (t: string) => string;
+export declare const boldBlue: (t: string) => string;
+//# sourceMappingURL=colors.d.ts.map

package/dist/utils/colors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../../src/utils/colors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,eAAO,MAAM,GAAG,SAPA,MAAM,KAAG,MAOU,CAAC;AACpC,eAAO,MAAM,KAAK,SARF,MAAM,KAAG,MAQY,CAAC;AACtC,eAAO,MAAM,MAAM,SATH,MAAM,KAAG,MASa,CAAC;AACvC,eAAO,MAAM,IAAI,SAVD,MAAM,KAAG,MAUW,CAAC;AACrC,eAAO,MAAM,OAAO,SAXJ,MAAM,KAAG,MAWc,CAAC;AACxC,eAAO,MAAM,IAAI,SAZD,MAAM,KAAG,MAYW,CAAC;AACrC,eAAO,MAAM,KAAK,SAbF,MAAM,KAAG,MAaY,CAAC;AACtC,eAAO,MAAM,IAAI,SAdD,MAAM,KAAG,MAcW,CAAC;AAGrC,eAAO,MAAM,IAAI,SAjBD,MAAM,KAAG,MAiBU,CAAC;AACpC,eAAO,MAAM,GAAG,SAlBA,MAAM,KAAG,MAkBS,CAAC;AACnC,eAAO,MAAM,MAAM,SAnBH,MAAM,KAAG,MAmBY,CAAC;AACtC,eAAO,MAAM,SAAS,SApBN,MAAM,KAAG,MAoBe,CAAC;AAGzC,eAAO,MAAM,KAAK,SAvBF,MAAM,KAAG,MAuBU,CAAC;AAGpC,eAAO,MAAM,SAAS,SA1BN,MAAM,KAAG,MA0BgB,CAAC;AAC1C,eAAO,MAAM,WAAW,SA3BR,MAAM,KAAG,MA2BkB,CAAC;AAC5C,eAAO,MAAM,YAAY,SA5BT,MAAM,KAAG,MA4BmB,CAAC;AAC7C,eAAO,MAAM,UAAU,SA7BP,MAAM,KAAG,MA6BiB,CAAC;AAC3C,eAAO,MAAM,UAAU,SA9BP,MAAM,KAAG,MA8BiB,CAAC;AAG3C,eAAO,MAAM,KAAK,SAjCF,MAAM,KAAG,MAiCY,CAAC;AACtC,eAAO,MAAM,OAAO,SAlCJ,MAAM,KAAG,MAkCc,CAAC;AACxC,eAAO,MAAM,QAAQ,SAnCL,MAAM,KAAG,MAmCe,CAAC;AAGzC,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,WAAiB,CAAC;AACnD,eAAO,MAAM,SAAS,GAAI,GAAG,MAAM,WAAmB,CAAC;AACvD,eAAO,MAAM,UAAU,GAAI,GAAG,MAAM,WAAoB,CAAC;AACzD,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,WAAkB,CAAC;AACrD,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,WAAkB,CAAC"}

package/dist/utils/colors.js

@@ -0,0 +1,54 @@
+/**
+ * ShieldPM — Terminal color helpers (zero dependencies)
+ * Simple ANSI escape code wrapper, no chalk needed.
+ */
+const isColorSupported = () => {
+    if (process.env.NO_COLOR !== undefined)
+        return false;
+    if (process.env.FORCE_COLOR !== undefined)
+        return true;
+    if (!process.stdout.isTTY)
+        return false;
+    return true;
+};
+const enabled = isColorSupported();
+const wrap = (open, close) => {
+    return (text) => {
+        if (!enabled)
+            return text;
+        return `\x1b[${open}m${text}\x1b[${close}m`;
+    };
+};
+// Foreground colors
+export const red = wrap('31', '39');
+export const green = wrap('32', '39');
+export const yellow = wrap('33', '39');
+export const blue = wrap('34', '39');
+export const magenta = wrap('35', '39');
+export const cyan = wrap('36', '39');
+export const white = wrap('37', '39');
+export const gray = wrap('90', '39');
+// Styles
+export const bold = wrap('1', '22');
+export const dim = wrap('2', '22');
+export const italic = wrap('3', '23');
+export const underline = wrap('4', '24');
+// Reset
+export const reset = wrap('0', '0');
+// Bright variants
+export const redBright = wrap('91', '39');
+export const greenBright = wrap('92', '39');
+export const yellowBright = wrap('93', '39');
+export const blueBright = wrap('94', '39');
+export const cyanBright = wrap('96', '39');
+// Background colors
+export const bgRed = wrap('41', '49');
+export const bgGreen = wrap('42', '49');
+export const bgYellow = wrap('43', '49');
+// Composable: bold + color
+export const boldRed = (t) => bold(red(t));
+export const boldGreen = (t) => bold(green(t));
+export const boldYellow = (t) => bold(yellow(t));
+export const boldCyan = (t) => bold(cyan(t));
+export const boldBlue = (t) => bold(blue(t));
+//# sourceMappingURL=colors.js.map

package/dist/utils/colors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"colors.js","sourceRoot":"","sources":["../../src/utils/colors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,gBAAgB,GAAG,GAAY,EAAE;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;AAEnC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;IAC3C,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,GAAG,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,oBAAoB;AACpB,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAErC,SAAS;AACT,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEzC,QAAQ;AACR,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEpC,kBAAkB;AAClB,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAE3C,oBAAoB;AACpB,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAEzC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/utils/logger.d.ts

@@ -0,0 +1,26 @@
+/**
+ * ShieldPM — Logger with levels and colored output
+ */
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent';
+export declare function setLogLevel(level: LogLevel): void;
+export declare function getLogLevel(): LogLevel;
+export declare function debug(...args: unknown[]): void;
+export declare function info(...args: unknown[]): void;
+export declare function warn(...args: unknown[]): void;
+export declare function error(...args: unknown[]): void;
+export declare function success(...args: unknown[]): void;
+export declare function header(text: string): void;
+export declare function table(rows: [string, string][]): void;
+export declare const log: {
+    debug: typeof debug;
+    info: typeof info;
+    warn: typeof warn;
+    error: typeof error;
+    success: typeof success;
+    header: typeof header;
+    table: typeof table;
+    setLevel: typeof setLogLevel;
+    getLevel: typeof getLogLevel;
+};
+export default log;
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAYtE,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAEjD;AAED,wBAAgB,WAAW,IAAI,QAAQ,CAEtC;AAUD,wBAAgB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAG9C;AAED,wBAAgB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAG7C;AAED,wBAAgB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAG7C;AAED,wBAAgB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAG9C;AAED,wBAAgB,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAGhD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKzC;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI,CAMpD;AAED,eAAO,MAAM,GAAG;;;;;;;;;;CAUf,CAAC;AAEF,eAAe,GAAG,CAAC"}

package/dist/utils/logger.js

@@ -0,0 +1,77 @@
+/**
+ * ShieldPM — Logger with levels and colored output
+ */
+import { red, green, yellow, cyan, dim, bold, boldRed, boldGreen, boldYellow } from './colors.js';
+const LEVEL_PRIORITY = {
+    debug: 0,
+    info: 1,
+    warn: 2,
+    error: 3,
+    silent: 4,
+};
+let currentLevel = 'info';
+export function setLogLevel(level) {
+    currentLevel = level;
+}
+export function getLogLevel() {
+    return currentLevel;
+}
+function shouldLog(level) {
+    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[currentLevel];
+}
+function timestamp() {
+    return dim(new Date().toISOString().slice(11, 19));
+}
+export function debug(...args) {
+    if (!shouldLog('debug'))
+        return;
+    console.log(dim('[debug]'), timestamp(), ...args);
+}
+export function info(...args) {
+    if (!shouldLog('info'))
+        return;
+    console.log(cyan('i'), ...args);
+}
+export function warn(...args) {
+    if (!shouldLog('warn'))
+        return;
+    console.warn(boldYellow('!'), yellow('warn'), ...args);
+}
+export function error(...args) {
+    if (!shouldLog('error'))
+        return;
+    console.error(boldRed('x'), red('error'), ...args);
+}
+export function success(...args) {
+    if (!shouldLog('info'))
+        return;
+    console.log(boldGreen('\u2713'), green(args.map(String).join(' ')));
+}
+export function header(text) {
+    if (!shouldLog('info'))
+        return;
+    console.log();
+    console.log(bold(cyan(`  ${text}`)));
+    console.log(dim('  ' + '\u2500'.repeat(text.length + 2)));
+}
+export function table(rows) {
+    if (!shouldLog('info'))
+        return;
+    const maxKey = Math.max(...rows.map(([k]) => k.length));
+    for (const [key, value] of rows) {
+        console.log(`  ${dim(key.padEnd(maxKey))}  ${value}`);
+    }
+}
+export const log = {
+    debug,
+    info,
+    warn,
+    error,
+    success,
+    header,
+    table,
+    setLevel: setLogLevel,
+    getLevel: getLogLevel,
+};
+export default log;
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIlG,MAAM,cAAc,GAA6B;IAC/C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,IAAI,YAAY,GAAa,MAAM,CAAC;AAEpC,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,IAAe;IACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO;IAChC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAG,IAAe;IACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAG,IAAe;IACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,IAAe;IACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAG,IAAe;IACxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/B,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAwB;IAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,eAAe,GAAG,CAAC"}

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@cyberhub/shieldpm",
+  "version": "0.1.0",
+  "description": "Runtime-aware package firewall for Node.js — sandbox, monitor, and enforce least-privilege on every npm dependency",
+  "license": "MIT",
+  "author": "Nrupak Shah",
+  "repository": { "type": "git", "url": "https://github.com/nrupaks/shieldpm" },
+  "bin": { "shieldpm": "./dist/cli.js" },
+  "main": "./dist/index.js",
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/cli.ts",
+    "test": "vitest",
+    "lint": "eslint src/"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "tsx": "^4.0.0",
+    "vitest": "^3.0.0",
+    "@types/node": "^22.0.0"
+  }
+}