depsentinel 0.1.6 → 0.1.7

package/dist/cli.js

@@ -53,13 +53,13 @@ export function createCli() {
         const context = options.json
             ? {
                 publishesToNpm: true,
-                publishFromCi: true,
-                usesOidcTrustedPublisher: false
+                usesOidcTrustedPublisher: false,
+                usesDevContainer: false
             }
             : {
                 publishesToNpm: await askYesNo("Does this project publish packages to npm?", false),
-                publishFromCi: await askYesNo("Does this project publish from CI?", true),
-                usesOidcTrustedPublisher: await askYesNo("Does npm publish use OIDC Trusted Publisher?", false)
+                usesOidcTrustedPublisher: await askYesNo("Does npm publish use OIDC Trusted Publisher?", false),
+                usesDevContainer: await askYesNo("Does this project use Dev Containers for local development?", false)
             };
         const result = runInit({
             preset: options.preset,

package/dist/commands/init.js

@@ -157,8 +157,8 @@ export function runInit(options = {}) {
     const facts = detectProjectFacts(cwd);
     const context = options.context ?? {
         publishesToNpm: true,
-        publishFromCi: true,
-        usesOidcTrustedPublisher: false
+        usesOidcTrustedPublisher: false,
+        usesDevContainer: false
     };
     const planned = [
         planSafeFile(path.join(cwd, "depsentinel.json"), `${buildDepsentinelConfig(preset, context)}\n`),

package/dist/core/doctor-checks.js

@@ -44,7 +44,7 @@ export function collectDiagnoses(rootDir, facts) {
         checkEnvPlaintext(rootDir),
         checkNpxHardening(),
         checkNpm2fa(context),
-        checkDevContainer(rootDir),
+        checkDevContainer(rootDir, context),
         checkNodeModulesGitignored(rootDir)
     ];
 }
@@ -77,12 +77,12 @@ function checkMixedLockfiles(rootDir, facts) {
 function readProjectContext(rootDir) {
     const configPath = path.join(rootDir, "depsentinel.json");
     const parsed = readJsonSafe(configPath, {
-        context: { publishesToNpm: true, publishFromCi: true, usesOidcTrustedPublisher: false }
+        context: { publishesToNpm: true, usesOidcTrustedPublisher: false, usesDevContainer: false }
     });
     return {
         publishesToNpm: parsed.context?.publishesToNpm ?? true,
-        publishFromCi: parsed.context?.publishFromCi ?? true,
-        usesOidcTrustedPublisher: parsed.context?.usesOidcTrustedPublisher ?? false
+        usesOidcTrustedPublisher: parsed.context?.usesOidcTrustedPublisher ?? false,
+        usesDevContainer: parsed.context?.usesDevContainer ?? false
     };
 }
 function checkNpmRc(rootDir) {
@@ -173,8 +173,8 @@ function checkLockfileCommitted(rootDir) {
     return skip("ci.lockfile-committed.manual", "ci", "Verify lockfile committed", "Use `git ls-files package-lock.json` to confirm your lockfile is committed.", "Run `git add package-lock.json && git commit -m \"chore: add lockfile\"`.");
 }
 function checkCiProvenance(rootDir, context) {
-    if (!context.publishesToNpm || !context.publishFromCi) {
-        return skip("ci.provenance.not-applicable", "ci", "Publish provenance not required", "Project context says npm publishing from CI is disabled.", "Set `context.publishesToNpm=true` and `context.publishFromCi=true` if you start publishing from CI.");
+    if (!context.publishesToNpm) {
+        return skip("ci.provenance.not-applicable", "ci", "Publish provenance not required", "Project context says npm publishing is disabled.", "Set `context.publishesToNpm=true` in depsentinel.json if this changes.");
     }
     const workflowsDir = path.join(rootDir, ".github", "workflows");
     if (!existsSync(workflowsDir))
@@ -238,7 +238,10 @@ function checkNpm2fa(context) {
     }
     return skip("maintainer.2fa.manual", "maintainer", "Verify npm account 2FA", "Accounts without 2FA are vulnerable to credential theft and package takeover.", "Run `npm profile enable-2fa auth-and-writes` to enable 2FA for your npm account.");
 }
-function checkDevContainer(rootDir) {
+function checkDevContainer(rootDir, context) {
+    if (!context.usesDevContainer) {
+        return skip("maintainer.devcontainer.not-required", "maintainer", "Dev Container not required by project context", "Project context says Dev Containers are not part of local development workflow.", "Set `context.usesDevContainer=true` in depsentinel.json if you adopt Dev Containers.");
+    }
     const devContainerPath = path.join(rootDir, ".devcontainer", "devcontainer.json");
     if (existsSync(devContainerPath))
         return pass("maintainer.devcontainer.present", "maintainer", "Dev Container configured");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depsentinel",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "JS/TS supply-chain hardening CLI — scan, secure, and enforce dependency policies",
   "license": "MIT",
   "author": "depsentinel contributors",