brainclaw 1.7.5 → 1.9.0

package/dist/core/security-extract.js

@@ -0,0 +1,189 @@
+import fs from 'node:fs';
+export function collectPackages(opts) {
+    const seen = new Set();
+    const out = [];
+    const push = (spec) => {
+        const trimmed = spec.trim();
+        if (!trimmed)
+            return;
+        // Skip local paths and URLs — they aren't registry packages.
+        if (isLocalOrUrl(trimmed))
+            return;
+        if (seen.has(trimmed))
+            return;
+        seen.add(trimmed);
+        out.push(trimmed);
+    };
+    if (opts.packages) {
+        for (const item of opts.packages.split(','))
+            push(item);
+    }
+    if (opts.requirements) {
+        for (const item of parseRequirementsFile(opts.requirements))
+            push(item);
+    }
+    if (opts.lockfile) {
+        for (const item of parseLockfile(opts.lockfile))
+            push(item);
+    }
+    return out;
+}
+/**
+ * Return true for arguments that look like a filesystem path or URL
+ * rather than a registry package name. Mirrors the heuristic the
+ * wrapper scripts use when intercepting install commands.
+ */
+export function isLocalOrUrl(spec) {
+    if (!spec)
+        return false;
+    if (spec === '.' || spec === '..')
+        return true;
+    if (spec.startsWith('./') || spec.startsWith('../'))
+        return true;
+    if (spec.startsWith('/'))
+        return true; // absolute POSIX path
+    if (/^[A-Za-z]:[\\/]/.test(spec))
+        return true; // Windows drive path
+    if (/^[a-z]+:\/\//.test(spec))
+        return true; // http(s)/git/file URLs
+    if (spec.startsWith('git+') || spec.startsWith('git@'))
+        return true;
+    if (spec.endsWith('.tar.gz') || spec.endsWith('.tgz') || spec.endsWith('.whl'))
+        return true;
+    return false;
+}
+/**
+ * Parse a pip requirements.txt file. Supports the subset of syntax that
+ * actually shows up in install gates:
+ *   - one spec per line; "name", "name==version", "name~=version"
+ *   - comments (#) and blank lines
+ *   - continuation lines with trailing backslash
+ *   - line options (-r/--requirement, -e/--editable, -i/--index-url, etc.)
+ *     are skipped, with -r/--requirement recursively included.
+ */
+export function parseRequirementsFile(filePath) {
+    const raw = readFileOrThrow(filePath, 'requirements file');
+    const out = [];
+    const lines = unfoldContinuations(raw).split(/\r?\n/);
+    for (const line of lines) {
+        const stripped = line.replace(/\s*#.*$/, '').trim();
+        if (!stripped)
+            continue;
+        if (stripped.startsWith('-r ') || stripped.startsWith('--requirement ')) {
+            // Recursive include — keep it bounded but useful.
+            const nested = stripped.replace(/^(-r|--requirement)\s+/, '').trim();
+            if (nested) {
+                try {
+                    out.push(...parseRequirementsFile(resolveSibling(filePath, nested)));
+                }
+                catch { /* missing nested file is non-fatal */ }
+            }
+            continue;
+        }
+        if (stripped.startsWith('-'))
+            continue; // -e, -i, --index-url, etc.
+        // Drop env-marker portion: "pkg==1.0 ; python_version>'3.7'"
+        const noMarker = stripped.split(';')[0].trim();
+        if (!noMarker)
+            continue;
+        // Strip extras: "pkg[extra1,extra2]==1.0"
+        const noExtras = noMarker.replace(/\[[^\]]*\]/g, '');
+        // Keep only "name" or "name==version" forms; reject URL/path specs and
+        // ranges we cannot translate to an exact spec ("~=", ">=", "<=", "<", ">", "!=", "===").
+        const exact = noExtras.match(/^([A-Za-z0-9._-]+)\s*==\s*([^\s,;]+)\s*$/);
+        if (exact) {
+            out.push(`${exact[1]}==${exact[2]}`);
+            continue;
+        }
+        const bare = noExtras.match(/^([A-Za-z0-9._-]+)\s*$/);
+        if (bare) {
+            out.push(bare[1]);
+            continue;
+        }
+        // For range specs, keep the name (range resolution is outside our scope).
+        const nameOnly = noExtras.match(/^([A-Za-z0-9._-]+)/);
+        if (nameOnly) {
+            out.push(nameOnly[1]);
+        }
+    }
+    return out;
+}
+/**
+ * Parse a lockfile to extract top-level direct-dependency package names.
+ * Supports:
+ *   - npm package-lock.json (v1, v2, v3): uses `packages[""].dependencies`
+ *     and `packages[""].devDependencies` when present (v2+), else falls
+ *     back to top-level `dependencies` (v1).
+ *   - npm shrinkwrap.json: same shape as package-lock.
+ *
+ * Transitive deps are deliberately excluded; the gate is for what the
+ * operator is asking to install, not the full resolved graph.
+ */
+export function parseLockfile(filePath) {
+    const raw = readFileOrThrow(filePath, 'lockfile');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse lockfile ${filePath}: ${err.message}`);
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return [];
+    const obj = parsed;
+    const out = [];
+    // npm package-lock v2+
+    const packages = obj['packages'];
+    if (packages && typeof packages === 'object') {
+        const root = packages[''];
+        if (root && typeof root === 'object') {
+            const deps = root['dependencies'];
+            const devDeps = root['devDependencies'];
+            collectLockDeps(deps, out);
+            collectLockDeps(devDeps, out);
+        }
+    }
+    // npm package-lock v1 fallback
+    if (out.length === 0) {
+        const deps = obj['dependencies'];
+        if (deps && typeof deps === 'object') {
+            for (const [name, meta] of Object.entries(deps)) {
+                const v = meta && typeof meta === 'object' ? meta['version'] : undefined;
+                out.push(typeof v === 'string' ? `${name}@${v}` : name);
+            }
+        }
+    }
+    return out;
+}
+function collectLockDeps(deps, out) {
+    if (!deps || typeof deps !== 'object')
+        return;
+    for (const [name, range] of Object.entries(deps)) {
+        if (typeof range === 'string' && /^\d/.test(range)) {
+            out.push(`${name}@${range}`);
+        }
+        else {
+            out.push(name);
+        }
+    }
+}
+function unfoldContinuations(raw) {
+    return raw.replace(/\\\r?\n/g, ' ');
+}
+function readFileOrThrow(p, label) {
+    try {
+        return fs.readFileSync(p, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Could not read ${label} at ${p}: ${err.message}`);
+    }
+}
+function resolveSibling(parent, nested) {
+    // Tolerate both absolute and relative includes without pulling in `node:path`.
+    if (nested.startsWith('/') || /^[A-Za-z]:[\\/]/.test(nested))
+        return nested;
+    const sep = parent.includes('\\') ? '\\' : '/';
+    const dir = parent.replace(/[\\/][^\\/]*$/, '');
+    return dir + sep + nested;
+}
+//# sourceMappingURL=security-extract.js.map

package/dist/core/security-guard.js

@@ -1,12 +1,21 @@
 /**
  * Generates brainclaw-guard wrapper scripts (bash + PowerShell) that intercept
- * npm/pip install commands and check packages via brainclaw check-security.
+ * npm/pip/pnpm/yarn install commands and check packages via
+ * brainclaw check-security.
+ *
+ * Mode is enforced by the CLI's exit code, not the wrapper:
+ *   exit 0 — pass (silent)
+ *   exit 1 — warn (printed; install continues)
+ *   exit 2 — block (printed; install aborted)
+ * In advisory mode the CLI never emits exit 2, so the wrapper never aborts.
+ * The wrapper therefore stays mode-agnostic — flipping advisory↔enforced is
+ * a config change, no regeneration required.
  */
 export function generateBashGuard(brainclawBin) {
     return `#!/usr/bin/env bash
 # brainclaw-guard — preinstall security gate
-# Generated by: brainclaw setup --security
-# Do not edit manually — regenerate with brainclaw setup --security
+# Generated by: brainclaw setup-security
+# Do not edit manually — regenerate with brainclaw setup-security
 
 BRAINCLAW_BIN="${brainclawBin}"
 ORIGINAL_CMD="\${BRAINCLAW_GUARD_ORIGINAL_CMD:-npm}"
@@ -14,21 +23,37 @@ ORIGINAL_CMD="\${BRAINCLAW_GUARD_ORIGINAL_CMD:-npm}"
 is_install_command() {
   for arg in "$@"; do
     case "$arg" in
-      install|add|i) return 0 ;;
-      -*)            continue  ;;
-      *)             break     ;;
+      install|add|i)       return 0 ;;
+      -*)                  continue  ;;
+      *)                   break     ;;
     esac
   done
   return 1
 }
 
+is_local_or_url() {
+  case "$1" in
+    .|..|./*|../*|/*|*:/*|git+*|git@*|*.tgz|*.tar.gz|*.whl) return 0 ;;
+  esac
+  case "$1" in
+    [A-Za-z]:[\\\\/]*) return 0 ;;
+  esac
+  return 1
+}
+
 extract_packages() {
   local packages=""
+  local req_file=""
   local skip_next=false
   local past_command=false
   for arg in "$@"; do
     if [ "$skip_next" = true ]; then
+      # The flag's value lands here; capture it for -r/--requirement.
+      case "$prev_flag" in
+        -r|--requirement) req_file="$arg" ;;
+      esac
       skip_next=false
+      prev_flag=""
       continue
     fi
     case "$arg" in
@@ -36,10 +61,16 @@ extract_packages() {
         past_command=true
         continue
         ;;
-      --save-dev|--save-peer|--save-optional|-D|-P|-O|-g|--global)
+      --save-dev|--save-peer|--save-optional|--save-exact|--save-prod|-D|-P|-O|-E|-S|-g|--global|--no-save|--user|--upgrade|-U|--break-system-packages|--no-deps|--pre|--force-reinstall|--ignore-installed)
         continue
         ;;
-      --registry|--prefix)
+      --registry|--prefix|--tag|--registry-url|--cache|--index-url|--extra-index-url|--find-links|--proxy|--cert|--client-cert|--trusted-host|--target|--root|--python|--platform|--abi|--implementation)
+        prev_flag="$arg"
+        skip_next=true
+        continue
+        ;;
+      -r|--requirement|-e|--editable|-c|--constraint)
+        prev_flag="$arg"
         skip_next=true
         continue
         ;;
@@ -48,6 +79,9 @@ extract_packages() {
         ;;
       *)
         if [ "$past_command" = true ]; then
+          if is_local_or_url "$arg"; then
+            continue
+          fi
           if [ -n "$packages" ]; then
             packages="$packages,$arg"
           else
@@ -57,28 +91,37 @@ extract_packages() {
         ;;
     esac
   done
-  echo "$packages"
+  printf '%s\\t%s' "$packages" "$req_file"
 }
 
 # Main logic
 if is_install_command "$@"; then
-  packages=$(extract_packages "$@")
-  if [ -n "$packages" ]; then
+  extracted=$(extract_packages "$@")
+  packages="\${extracted%%	*}"
+  req_file="\${extracted##*	}"
+
+  if [ -n "$packages" ] || [ -n "$req_file" ]; then
     ecosystem="npm"
     if [ "$ORIGINAL_CMD" = "pip" ] || [ "$ORIGINAL_CMD" = "pip3" ]; then
       ecosystem="pypi"
     fi
 
-    result=$("$BRAINCLAW_BIN" check-security --packages "$packages" --ecosystem "$ecosystem" --json 2>/dev/null)
+    args=(check-security --ecosystem "$ecosystem" --json)
+    if [ -n "$packages" ]; then args+=(--packages "$packages"); fi
+    if [ -n "$req_file" ]; then args+=(--requirements "$req_file"); fi
+
+    "$BRAINCLAW_BIN" "\${args[@]}" >/dev/null 2>&1
     exit_code=$?
 
     if [ $exit_code -eq 2 ]; then
-      echo "[brainclaw-guard] BLOCKED — supply chain risk detected" >&2
-      echo "[brainclaw-guard] Run: brainclaw check-security --packages \\"$packages\\" for details" >&2
+      echo "[brainclaw-guard] BLOCKED — supply chain risk detected (enforced mode)" >&2
+      details_pkgs="\${packages:-$req_file}"
+      echo "[brainclaw-guard] Details: $BRAINCLAW_BIN check-security --ecosystem $ecosystem --packages \\"$details_pkgs\\"" >&2
       exit 1
     elif [ $exit_code -eq 1 ]; then
-      echo "[brainclaw-guard] WARNING — potential supply chain risk" >&2
-      echo "[brainclaw-guard] Run: brainclaw check-security --packages \\"$packages\\" for details" >&2
+      echo "[brainclaw-guard] WARNING — potential supply chain risk (advisory or warn-threshold verdict)" >&2
+      details_pkgs="\${packages:-$req_file}"
+      echo "[brainclaw-guard] Details: $BRAINCLAW_BIN check-security --ecosystem $ecosystem --packages \\"$details_pkgs\\"" >&2
     fi
     # exit_code 0 = pass, continue silently
   fi
@@ -89,8 +132,8 @@ exec "$ORIGINAL_CMD" "$@"
 }
 export function generatePowerShellGuard(brainclawBin) {
     return `# brainclaw-guard — preinstall security gate (PowerShell)
-# Generated by: brainclaw setup --security
-# Do not edit manually — regenerate with brainclaw setup --security
+# Generated by: brainclaw setup-security
+# Do not edit manually — regenerate with brainclaw setup-security
 
 param([Parameter(ValueFromRemainingArguments)]$Args)
 
@@ -105,45 +148,80 @@ function Is-InstallCommand($arguments) {
     return $false
 }
 
+function Is-LocalOrUrl($arg) {
+    if ($arg -eq "." -or $arg -eq "..") { return $true }
+    if ($arg -match "^(\\./|\\.\\./|/)") { return $true }
+    if ($arg -match "^[A-Za-z]:[\\\\/]") { return $true }
+    if ($arg -match "^[a-z]+://") { return $true }
+    if ($arg -match "^(git\\+|git@)") { return $true }
+    if ($arg -match "\\.(tgz|tar\\.gz|whl)$") { return $true }
+    return $false
+}
+
 function Extract-Packages($arguments) {
     $packages = @()
+    $reqFile = ""
     $pastCommand = $false
     $skipNext = $false
+    $prevFlag = ""
     foreach ($arg in $arguments) {
-        if ($skipNext) { $skipNext = $false; continue }
+        if ($skipNext) {
+            if ($prevFlag -match "^(-r|--requirement)$") { $reqFile = $arg }
+            $skipNext = $false
+            $prevFlag = ""
+            continue
+        }
         if ($arg -match "^(install|add|i)$") { $pastCommand = $true; continue }
-        if ($arg -match "^--(registry|prefix)$") { $skipNext = $true; continue }
+        if ($arg -match "^(--save-dev|--save-peer|--save-optional|--save-exact|--save-prod|-D|-P|-O|-E|-S|-g|--global|--no-save|--user|--upgrade|-U|--break-system-packages|--no-deps|--pre|--force-reinstall|--ignore-installed)$") { continue }
+        if ($arg -match "^(--registry|--prefix|--tag|--registry-url|--cache|--index-url|--extra-index-url|--find-links|--proxy|--cert|--client-cert|--trusted-host|--target|--root|--python|--platform|--abi|--implementation)$") {
+            $prevFlag = $arg; $skipNext = $true; continue
+        }
+        if ($arg -match "^(-r|--requirement|-e|--editable|-c|--constraint)$") {
+            $prevFlag = $arg; $skipNext = $true; continue
+        }
         if ($arg -match "^-") { continue }
-        if ($pastCommand) { $packages += $arg }
+        if ($pastCommand) {
+            if (Is-LocalOrUrl $arg) { continue }
+            $packages += $arg
+        }
     }
-    return ($packages -join ",")
+    return [PSCustomObject]@{ Packages = ($packages -join ","); RequirementsFile = $reqFile }
 }
 
 if (Is-InstallCommand $Args) {
-    $packages = Extract-Packages $Args
-    if ($packages) {
+    $extracted = Extract-Packages $Args
+    $packages = $extracted.Packages
+    $reqFile = $extracted.RequirementsFile
+
+    if ($packages -or $reqFile) {
         $ecosystem = "npm"
         if ($OriginalCmd -match "^pip") { $ecosystem = "pypi" }
 
+        $cliArgs = @("check-security", "--ecosystem", $ecosystem, "--json")
+        if ($packages) { $cliArgs += @("--packages", $packages) }
+        if ($reqFile) { $cliArgs += @("--requirements", $reqFile) }
+
         try {
-            & $BrainclawBin check-security --packages $packages --ecosystem $ecosystem --json 2>$null | Out-Null
+            & $BrainclawBin @cliArgs *> $null
             $exitCode = $LASTEXITCODE
         } catch {
             $exitCode = 0
         }
 
+        $detailsPkgs = if ($packages) { $packages } else { $reqFile }
         if ($exitCode -eq 2) {
-            Write-Error "[brainclaw-guard] BLOCKED - supply chain risk detected"
-            Write-Error "[brainclaw-guard] Run: brainclaw check-security --packages \`"$packages\`" for details"
+            Write-Error "[brainclaw-guard] BLOCKED - supply chain risk detected (enforced mode)"
+            Write-Error "[brainclaw-guard] Details: $BrainclawBin check-security --ecosystem $ecosystem --packages \`"$detailsPkgs\`""
             exit 1
         } elseif ($exitCode -eq 1) {
-            Write-Warning "[brainclaw-guard] WARNING - potential supply chain risk"
-            Write-Warning "[brainclaw-guard] Run: brainclaw check-security --packages \`"$packages\`" for details"
+            Write-Warning "[brainclaw-guard] WARNING - potential supply chain risk (advisory or warn-threshold verdict)"
+            Write-Warning "[brainclaw-guard] Details: $BrainclawBin check-security --ecosystem $ecosystem --packages \`"$detailsPkgs\`""
         }
     }
 }
 
 & $OriginalCmd @Args
+exit $LASTEXITCODE
 `;
 }
 export function generatePipBashGuard(brainclawBin) {

package/dist/core/security-packages.js

@@ -0,0 +1,121 @@
+/**
+ * Canonical package matching for security allow/deny lists.
+ *
+ * Supports three entry forms:
+ *   "name"                 — bare name; matches any ecosystem
+ *   "ecosystem:name"       — ecosystem-scoped, any version
+ *   "ecosystem:name@version" — exact (ecosystem, name, version) pin
+ *
+ * Matching is exact on each component (no substring). Bare names match by
+ * package name only, which preserves backward compatibility with the MVP
+ * config while making the comparison precise instead of "purl.includes(d)".
+ */
+const ECOSYSTEMS = new Set(['npm', 'pypi']);
+/**
+ * Parse a package spec like "pkg", "pkg@1.0.0", "@scope/pkg",
+ * "@scope/pkg@1.0.0", or pip-style "pkg==1.0.0".
+ */
+export function parsePackageSpec(spec) {
+    const trimmed = spec.trim();
+    // pip-style "name==version"
+    const pipMatch = trimmed.match(/^([A-Za-z0-9._-]+)\s*==\s*([^\s,;]+)$/);
+    if (pipMatch) {
+        return { depname: pipMatch[1], version: pipMatch[2] };
+    }
+    // npm scoped: @scope/pkg or @scope/pkg@version
+    if (trimmed.startsWith('@')) {
+        const lastAt = trimmed.lastIndexOf('@');
+        if (lastAt > 0) {
+            return { depname: trimmed.slice(0, lastAt), version: trimmed.slice(lastAt + 1) || 'latest' };
+        }
+        return { depname: trimmed, version: 'latest' };
+    }
+    // pkg@version
+    if (trimmed.includes('@')) {
+        const idx = trimmed.indexOf('@');
+        return { depname: trimmed.slice(0, idx), version: trimmed.slice(idx + 1) || 'latest' };
+    }
+    return { depname: trimmed, version: 'latest' };
+}
+/**
+ * Parse an allow/deny list entry. Accepts:
+ *   "name"
+ *   "ecosystem:name"
+ *   "ecosystem:name@version"
+ * Whitespace tolerated. Unknown ecosystem prefixes are treated as bare
+ * names (so "lodash@1.0.0" still works as bare-name+version).
+ */
+export function parseListEntry(entry) {
+    const raw = entry;
+    const trimmed = entry.trim();
+    if (!trimmed) {
+        return { ecosystem: null, name: '', version: null, raw };
+    }
+    let ecosystem = null;
+    let remainder = trimmed;
+    // Only treat "<prefix>:" as ecosystem when <prefix> is a known ecosystem.
+    // This prevents misparsing of names that legitimately contain ":".
+    const colonIdx = trimmed.indexOf(':');
+    if (colonIdx > 0) {
+        const prefix = trimmed.slice(0, colonIdx).toLowerCase();
+        if (ECOSYSTEMS.has(prefix)) {
+            ecosystem = prefix;
+            remainder = trimmed.slice(colonIdx + 1);
+        }
+    }
+    // Now extract optional @version from remainder. Handle scoped names
+    // ("@scope/pkg") and pip "name==version" too.
+    const pipMatch = remainder.match(/^([A-Za-z0-9._-]+)\s*==\s*([^\s,;]+)$/);
+    if (pipMatch) {
+        return { ecosystem, name: pipMatch[1], version: pipMatch[2], raw };
+    }
+    if (remainder.startsWith('@')) {
+        const lastAt = remainder.lastIndexOf('@');
+        if (lastAt > 0) {
+            return {
+                ecosystem,
+                name: remainder.slice(0, lastAt),
+                version: remainder.slice(lastAt + 1) || null,
+                raw,
+            };
+        }
+        return { ecosystem, name: remainder, version: null, raw };
+    }
+    if (remainder.includes('@')) {
+        const idx = remainder.indexOf('@');
+        return {
+            ecosystem,
+            name: remainder.slice(0, idx),
+            version: remainder.slice(idx + 1) || null,
+            raw,
+        };
+    }
+    return { ecosystem, name: remainder, version: null, raw };
+}
+/**
+ * Returns true if (ecosystem, name, version) matches the parsed entry.
+ * Matching rules:
+ *  - entry.ecosystem null → any ecosystem
+ *  - entry.name must equal name exactly
+ *  - entry.version null → any version; otherwise exact equality with
+ *    "*" as a wildcard alias for "any version"
+ */
+export function matchesEntry(entry, ecosystem, name, version) {
+    if (entry.name === '')
+        return false;
+    if (entry.name !== name)
+        return false;
+    if (entry.ecosystem !== null && entry.ecosystem !== ecosystem)
+        return false;
+    if (entry.version !== null && entry.version !== '*' && entry.version !== version)
+        return false;
+    return true;
+}
+export function matchesAnyEntry(entries, ecosystem, name, version) {
+    for (const e of entries) {
+        if (matchesEntry(e, ecosystem, name, version))
+            return e;
+    }
+    return null;
+}
+//# sourceMappingURL=security-packages.js.map

package/dist/core/security-scoring.js

@@ -1,3 +1,27 @@
+import { matchesAnyEntry, parseListEntry } from './security-packages.js';
+/**
+ * Map an intrinsic verdict (pass/warn/block) to the effective decision under
+ * a given mode. In advisory mode, a block is downgraded to warn so the
+ * operator sees the issue but the wrapper does not abort the install.
+ */
+export function applyMode(decision, mode) {
+    if (mode === 'enforced')
+        return decision;
+    return decision === 'block' ? 'warn' : decision;
+}
+/**
+ * Map an effective decision to a CLI exit code.
+ *   pass  -> 0
+ *   warn  -> 1   (wrapper continues, but surfaces the warning)
+ *   block -> 2   (wrapper aborts the install)
+ */
+export function decisionExitCode(decision) {
+    if (decision === 'block')
+        return 2;
+    if (decision === 'warn')
+        return 1;
+    return 0;
+}
 const DEFAULT_WEIGHTS = {
     supply_chain: 0.35,
     vulnerability: 0.30,
@@ -11,8 +35,47 @@ const DEFAULT_THRESHOLDS = {
     supply_chain_block: 30,
     vulnerability_block: 20,
 };
+/**
+ * Normalize weights so they sum to 1.0. Without this, custom configs like
+ * `{ supply_chain: 1, vulnerability: 1 }` produce a composite that can
+ * exceed 100, making thresholds meaningless. If all weights are zero the
+ * defaults are used (degenerate config — fail open to the project default).
+ */
+export function normalizeWeights(weights) {
+    const merged = { ...DEFAULT_WEIGHTS, ...weights };
+    const sum = merged.supply_chain + merged.vulnerability + merged.quality + merged.maintenance + merged.license;
+    if (sum <= 0)
+        return { ...DEFAULT_WEIGHTS };
+    if (Math.abs(sum - 1) < 1e-9)
+        return merged;
+    return {
+        supply_chain: merged.supply_chain / sum,
+        vulnerability: merged.vulnerability / sum,
+        quality: merged.quality / sum,
+        maintenance: merged.maintenance / sum,
+        license: merged.license / sum,
+    };
+}
+/**
+ * Clamp thresholds to the [0,100] band and enforce the invariant
+ * `composite_warn <= composite_pass`. The CLI loader can call this so a
+ * mis-configured YAML never produces a "composite=60 → block when
+ * pass=50, warn=80" non-monotonic verdict.
+ */
+export function normalizeThresholds(thresholds) {
+    const t = { ...DEFAULT_THRESHOLDS, ...thresholds };
+    const clamp = (n) => Math.max(0, Math.min(100, n));
+    t.composite_pass = clamp(t.composite_pass);
+    t.composite_warn = clamp(t.composite_warn);
+    t.supply_chain_block = clamp(t.supply_chain_block);
+    t.vulnerability_block = clamp(t.vulnerability_block);
+    if (t.composite_warn > t.composite_pass) {
+        t.composite_warn = t.composite_pass;
+    }
+    return t;
+}
 export function computeComposite(scores, weights) {
-    const w = { ...DEFAULT_WEIGHTS, ...weights };
+    const w = normalizeWeights(weights);
     return Math.round((scores.supplyChain * w.supply_chain +
         scores.vulnerability * w.vulnerability +
         scores.quality * w.quality +
@@ -20,15 +83,18 @@ export function computeComposite(scores, weights) {
         scores.license * w.license) * 10) / 10;
 }
 export function evaluatePackage(scores, config) {
-    const thresholds = { ...DEFAULT_THRESHOLDS, ...config?.thresholds };
-    const weights = { ...DEFAULT_WEIGHTS, ...config?.weights };
+    const thresholds = normalizeThresholds(config?.thresholds);
+    const weights = normalizeWeights(config?.weights);
     const allowlist = config?.allowlist ?? [];
     const denylist = config?.denylist ?? [];
     const pkgName = scores.purl.replace(/^pkg:\w+\//, '');
     const ecosystem = scores.purl.startsWith('pkg:pypi') ? 'pypi' : 'npm';
     const reasons = [];
-    // Denylist check (exact match on package name)
-    if (denylist.some(d => pkgName === d || scores.purl.includes(d))) {
+    const parsedDeny = denylist.map(parseListEntry);
+    const parsedAllow = allowlist.map(parseListEntry);
+    // Denylist check — canonical (ecosystem, name, optional version) match.
+    const denyHit = matchesAnyEntry(parsedDeny, ecosystem, pkgName, scores.version);
+    if (denyHit) {
         return {
             package: pkgName,
             ecosystem,
@@ -36,11 +102,12 @@ export function evaluatePackage(scores, config) {
             scores,
             composite: 0,
             decision: 'block',
-            reasons: [`Package "${pkgName}" is on the denylist`],
+            reasons: [`Package "${pkgName}@${scores.version}" matches denylist entry "${denyHit.raw.trim()}"`],
         };
     }
-    // Allowlist check (skip scoring)
-    if (allowlist.some(a => pkgName === a || scores.purl.includes(a))) {
+    // Allowlist check — canonical match; skips scoring.
+    const allowHit = matchesAnyEntry(parsedAllow, ecosystem, pkgName, scores.version);
+    if (allowHit) {
         return {
             package: pkgName,
             ecosystem,
@@ -48,7 +115,7 @@ export function evaluatePackage(scores, config) {
             scores,
             composite: 100,
             decision: 'pass',
-            reasons: [`Package "${pkgName}" is on the allowlist`],
+            reasons: [`Package "${pkgName}@${scores.version}" matches allowlist entry "${allowHit.raw.trim()}"`],
         };
     }
     const composite = computeComposite(scores, weights);