depsentinel 0.1.5 → 0.1.7

package/dist/cli.js

@@ -53,13 +53,13 @@ export function createCli() {
         const context = options.json
             ? {
                 publishesToNpm: true,
-                publishFromCi: true,
-                usesOidcTrustedPublisher: false
+                usesOidcTrustedPublisher: false,
+                usesDevContainer: false
             }
             : {
                 publishesToNpm: await askYesNo("Does this project publish packages to npm?", false),
-                publishFromCi: await askYesNo("Does this project publish from CI?", true),
-                usesOidcTrustedPublisher: await askYesNo("Does npm publish use OIDC Trusted Publisher?", false)
+                usesOidcTrustedPublisher: await askYesNo("Does npm publish use OIDC Trusted Publisher?", false),
+                usesDevContainer: await askYesNo("Does this project use Dev Containers for local development?", false)
             };
         const result = runInit({
             preset: options.preset,

package/dist/commands/fix.js

@@ -56,7 +56,7 @@ function collectFixPlans(cwd) {
         pkgDirty = true;
     }
     if (pkgDirty) {
-        plans.push(planSafeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n"));
+        plans.push(planSafeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", { backupOnUpdate: false }));
     }
     // Bunfig
     if (facts.packageManager === "bun") {

package/dist/commands/init.js

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { applySafePlan, planSafeFile } from "../core/safe-write.js";
 import { detectProjectFacts } from "../core/detector.js";
@@ -20,6 +21,26 @@ function buildNpmRc() {
         ""
     ].join("\n");
 }
+function mergeNpmRc(existing) {
+    const lines = existing.split(/\r?\n/);
+    const keys = new Map();
+    for (let i = 0; i < lines.length; i += 1) {
+        const m = lines[i]?.match(/^\s*([a-zA-Z0-9-]+)\s*=\s*(.*)\s*$/);
+        if (m)
+            keys.set(m[1], i);
+    }
+    const required = [
+        ["ignore-scripts", "true"],
+        ["allow-git", "none"],
+        ["min-release-age", "3"]
+    ];
+    for (const [key, value] of required) {
+        if (!keys.has(key)) {
+            lines.push(`${key}=${value}`);
+        }
+    }
+    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+}
 function buildPnpmWorkspace() {
     return [
         "packages:",
@@ -37,6 +58,36 @@ function buildPnpmWorkspace() {
         ""
     ].join("\n");
 }
+function mergePnpmWorkspace(existing) {
+    const lines = existing.split(/\r?\n/);
+    const has = (k) => lines.some((line) => line.trim().startsWith(`${k}:`));
+    if (!has("minimumReleaseAge"))
+        lines.push("minimumReleaseAge: 43200");
+    if (!has("trustPolicy"))
+        lines.push("trustPolicy: no-downgrade");
+    if (!has("blockExoticSubdeps"))
+        lines.push("blockExoticSubdeps: true");
+    if (!has("strictDepBuilds"))
+        lines.push("strictDepBuilds: true");
+    const allowIdx = lines.findIndex((line) => line.trim() === "allowBuilds:");
+    if (allowIdx === -1) {
+        lines.push("allowBuilds:");
+        lines.push("  esbuild: true");
+        lines.push("  rolldown: true");
+        lines.push("  unrs-resolver: true");
+    }
+    else {
+        const addAllow = (pkg) => {
+            const exists = lines.some((line) => line.trim().startsWith(`${pkg}:`));
+            if (!exists)
+                lines.splice(allowIdx + 1, 0, `  ${pkg}: true`);
+        };
+        addAllow("esbuild");
+        addAllow("rolldown");
+        addAllow("unrs-resolver");
+    }
+    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+}
 function buildBunfig() {
     return [
         "[install]",
@@ -106,17 +157,19 @@ export function runInit(options = {}) {
     const facts = detectProjectFacts(cwd);
     const context = options.context ?? {
         publishesToNpm: true,
-        publishFromCi: true,
-        usesOidcTrustedPublisher: false
+        usesOidcTrustedPublisher: false,
+        usesDevContainer: false
     };
     const planned = [
         planSafeFile(path.join(cwd, "depsentinel.json"), `${buildDepsentinelConfig(preset, context)}\n`),
-        planSafeFile(path.join(cwd, ".npmrc"), buildNpmRc()),
+        planSafeFile(path.join(cwd, ".npmrc"), existsSync(path.join(cwd, ".npmrc")) ? mergeNpmRc(readFileSync(path.join(cwd, ".npmrc"), "utf8")) : buildNpmRc(), { backupOnUpdate: false }),
         planSafeFile(path.join(cwd, ".npmignore"), buildNpmIgnore()),
         planSafeFile(path.join(cwd, ".github", "workflows", "depsentinel-ci.yml"), `${buildCiWorkflow()}\n`)
     ];
     if (facts.packageManager === "pnpm" || facts.packageManager === "unknown") {
-        planned.push(planSafeFile(path.join(cwd, "pnpm-workspace.yaml"), buildPnpmWorkspace()));
+        planned.push(planSafeFile(path.join(cwd, "pnpm-workspace.yaml"), existsSync(path.join(cwd, "pnpm-workspace.yaml"))
+            ? mergePnpmWorkspace(readFileSync(path.join(cwd, "pnpm-workspace.yaml"), "utf8"))
+            : buildPnpmWorkspace(), { backupOnUpdate: false }));
     }
     if (facts.packageManager === "bun") {
         planned.push(planSafeFile(path.join(cwd, "bunfig.toml"), buildBunfig()));

package/dist/core/doctor-checks.js

@@ -44,7 +44,7 @@ export function collectDiagnoses(rootDir, facts) {
         checkEnvPlaintext(rootDir),
         checkNpxHardening(),
         checkNpm2fa(context),
-        checkDevContainer(rootDir),
+        checkDevContainer(rootDir, context),
         checkNodeModulesGitignored(rootDir)
     ];
 }
@@ -77,12 +77,12 @@ function checkMixedLockfiles(rootDir, facts) {
 function readProjectContext(rootDir) {
     const configPath = path.join(rootDir, "depsentinel.json");
     const parsed = readJsonSafe(configPath, {
-        context: { publishesToNpm: true, publishFromCi: true, usesOidcTrustedPublisher: false }
+        context: { publishesToNpm: true, usesOidcTrustedPublisher: false, usesDevContainer: false }
     });
     return {
         publishesToNpm: parsed.context?.publishesToNpm ?? true,
-        publishFromCi: parsed.context?.publishFromCi ?? true,
-        usesOidcTrustedPublisher: parsed.context?.usesOidcTrustedPublisher ?? false
+        usesOidcTrustedPublisher: parsed.context?.usesOidcTrustedPublisher ?? false,
+        usesDevContainer: parsed.context?.usesDevContainer ?? false
     };
 }
 function checkNpmRc(rootDir) {
@@ -173,8 +173,8 @@ function checkLockfileCommitted(rootDir) {
     return skip("ci.lockfile-committed.manual", "ci", "Verify lockfile committed", "Use `git ls-files package-lock.json` to confirm your lockfile is committed.", "Run `git add package-lock.json && git commit -m \"chore: add lockfile\"`.");
 }
 function checkCiProvenance(rootDir, context) {
-    if (!context.publishesToNpm || !context.publishFromCi) {
-        return skip("ci.provenance.not-applicable", "ci", "Publish provenance not required", "Project context says npm publishing from CI is disabled.", "Set `context.publishesToNpm=true` and `context.publishFromCi=true` if you start publishing from CI.");
+    if (!context.publishesToNpm) {
+        return skip("ci.provenance.not-applicable", "ci", "Publish provenance not required", "Project context says npm publishing is disabled.", "Set `context.publishesToNpm=true` in depsentinel.json if this changes.");
     }
     const workflowsDir = path.join(rootDir, ".github", "workflows");
     if (!existsSync(workflowsDir))
@@ -238,7 +238,10 @@ function checkNpm2fa(context) {
     }
     return skip("maintainer.2fa.manual", "maintainer", "Verify npm account 2FA", "Accounts without 2FA are vulnerable to credential theft and package takeover.", "Run `npm profile enable-2fa auth-and-writes` to enable 2FA for your npm account.");
 }
-function checkDevContainer(rootDir) {
+function checkDevContainer(rootDir, context) {
+    if (!context.usesDevContainer) {
+        return skip("maintainer.devcontainer.not-required", "maintainer", "Dev Container not required by project context", "Project context says Dev Containers are not part of local development workflow.", "Set `context.usesDevContainer=true` in depsentinel.json if you adopt Dev Containers.");
+    }
     const devContainerPath = path.join(rootDir, ".devcontainer", "devcontainer.json");
     if (existsSync(devContainerPath))
         return pass("maintainer.devcontainer.present", "maintainer", "Dev Container configured");

package/dist/core/safe-write.js

@@ -9,7 +9,7 @@ function nextBackupPath(filePath) {
     }
     return candidate;
 }
-export function planSafeFile(filePath, content) {
+export function planSafeFile(filePath, content, options = {}) {
     if (!existsSync(filePath)) {
         return { path: filePath, content, status: "create" };
     }
@@ -21,7 +21,7 @@ export function planSafeFile(filePath, content) {
         path: filePath,
         content,
         status: "update",
-        backupPath: nextBackupPath(filePath)
+        backupPath: options.backupOnUpdate === false ? undefined : nextBackupPath(filePath)
     };
 }
 export function applySafePlan(plan, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depsentinel",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "JS/TS supply-chain hardening CLI — scan, secure, and enforce dependency policies",
   "license": "MIT",
   "author": "depsentinel contributors",