forged-cli 0.3.0 → 0.3.2

package/bin/forged.js

@@ -12,6 +12,7 @@ const [,, command, ...args] = process.argv;
 const commands = {
   readme:  'Generate a README.md for the current project',
   scan:    'Audit dependencies for typosquats, bad scripts, and suspicious binaries',
+  gen:     'Generate passwords, secrets, PINs, and UUIDs',
   init:    'Scaffold a new dev environment',
   new:     'Create a new project with GitHub setup',
   install: 'Install Forged into an existing shell config',
@@ -42,6 +43,12 @@ if (command === 'readme') {
   process.exit(0);
 }
 
+if (command === 'gen') {
+  const { genCommand } = await import('../src/commands/gen.js');
+  await genCommand(args);
+  process.exit(0);
+}
+
 if (command === 'scan') {
   const { scanCommand } = await import('../src/commands/scan.js');
   const { resolve } = await import('path');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forged-cli",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "A complete dev environment toolkit — shell, workflows, and project scaffolding in one install.",
   "keywords": [
     "cli",
@@ -22,7 +22,7 @@
   },
   "type": "module",
   "bin": {
-    "forged": "./bin/forged.js"
+    "forged": "bin/forged.js"
   },
   "engines": {
     "node": ">=18"

package/src/commands/gen.js

@@ -0,0 +1,102 @@
+import { randomBytes, randomUUID } from 'crypto';
+
+const green  = '\x1b[32m';
+const yellow = '\x1b[33m';
+const red    = '\x1b[31m';
+const blue   = '\x1b[34m';
+const bold   = '\x1b[1m';
+const reset  = '\x1b[0m';
+const dim    = '\x1b[2m';
+
+const UPPER   = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+const LOWER   = 'abcdefghijklmnopqrstuvwxyz';
+const DIGITS  = '0123456789';
+const SYMBOLS = '!@#$%^&*()-_=+[]{}|;:,.<>?';
+const SAFE    = '-_';
+
+function randomChar(charset) {
+  return charset[randomBytes(1)[0] % charset.length];
+}
+
+function generatePassword(length, safe = false) {
+  const symbols = safe ? SAFE : SYMBOLS;
+  const charset = UPPER + LOWER + DIGITS + symbols;
+  const required = [
+    randomChar(UPPER),
+    randomChar(LOWER),
+    randomChar(DIGITS),
+    randomChar(symbols),
+  ];
+  const rest = Array.from({ length: length - required.length }, () => randomChar(charset));
+  const all = [...required, ...rest];
+  for (let i = all.length - 1; i > 0; i--) {
+    const j = randomBytes(1)[0] % (i + 1);
+    [all[i], all[j]] = [all[j], all[i]];
+  }
+  return all.join('');
+}
+
+function colorize(password) {
+  return password.split('').map(char => {
+    if (/[0-9]/.test(char))      return `${yellow}${char}${reset}`;
+    if (/[^a-zA-Z0-9]/.test(char)) return `${red}${char}${reset}`;
+    return char;
+  }).join('');
+}
+
+function generatePin(length) {
+  return Array.from({ length }, () => randomBytes(1)[0] % 10).join('');
+}
+
+export async function genCommand(args) {
+  const sub    = args[0];
+  const safe   = args.includes('--safe') || args.includes('--ascii');
+  const lenArg = args.find(a => /^(-l=|--length=)/.test(a));
+  const length = lenArg ? parseInt(lenArg.split('=')[1]) : null;
+
+  if (!sub || sub === 'help') {
+    console.log(`
+  ${bold}forged gen${reset} — generate secure credentials
+
+  ${dim}Usage:${reset}
+    forged gen pass              Secure password ${dim}(default 20 chars)${reset}
+    forged gen pass --safe       ASCII-only, no symbols — safe for routers
+    forged gen secret            32-byte hex — JWT secrets, API keys
+    forged gen pin               6-digit numeric PIN
+    forged gen uuid              UUID v4
+
+  ${dim}Options:${reset}
+    --length=N, -l=N             Custom length (pass, pin)
+    --safe, --ascii              Letters + numbers only
+    `);
+    return;
+  }
+
+  if (sub === 'pass') {
+    const len = length ?? 20;
+    if (len < 4) { console.log(`  ${red}Length must be at least 4${reset}`); return; }
+    const pass = generatePassword(len, safe);
+    console.log(`\n  ${bold}Password${reset}  ${colorize(pass)}`);
+    if (safe) console.log(`  ${dim}ASCII-safe — router/device friendly${reset}`);
+    console.log();
+    return;
+  }
+
+  if (sub === 'secret') {
+    console.log(`\n  ${bold}Secret${reset}    ${green}${randomBytes(32).toString('hex')}${reset}\n`);
+    return;
+  }
+
+  if (sub === 'pin') {
+    const len = length ?? 6;
+    console.log(`\n  ${bold}PIN${reset}       ${yellow}${generatePin(len)}${reset}\n`);
+    return;
+  }
+
+  if (sub === 'uuid') {
+    console.log(`\n  ${bold}UUID${reset}      ${blue}${randomUUID()}${reset}\n`);
+    return;
+  }
+
+  console.log(`  ${red}Unknown:${reset} '${sub}' — run ${bold}forged gen help${reset}`);
+}

package/src/utils/trustedPublishers.js

@@ -15,6 +15,34 @@ export const TRUSTED_COMMUNITY = new Set([
   'ulisesgascon', 'formidablelabs',
   'blakeembrey', 'wesleytodd', 'danez', 'domenic', 'panva', 'joshuakgoldberg',
   'matteo.collina', 'rvagg',
+  // React-Bootstrap / @restart team
+  'kytsang', 'monastic.panic',
+  // Chart.js core
+  'etimberg',
+  // commander contributor
+  'abetomo',
+  // isomorphic-fetch (Financial Times official org)
+  'financial-times',
+  // webpack core team
+  'evilebottnawi',
+  // mass transfer from shinnn — all legitimate
+  'stevemao',
+  // TC39 delegate, took over ESLint packages from nzakas
+  'michaelficarra',
+  // raf maintainer
+  'cmtegner',
+  // known React developer, react-text-mask
+  'browniefed',
+  // perfect-scrollbar current maintainer
+  'mattonit',
+  // Mapbox internal npm account rotation
+  'mapbox-npm-01', 'mapbox-npm-03',
+  // Prettier automated release bot (replaced fisker)
+  'prettier-bot',
+  // Sequelize current maintainer (replaced sdepold, original creator)
+  'wikirik',
+  // Meta/React Native core team (replaced zertosh on v8-compile-cache)
+  'yungsters',
 ]);
 
 export function classifyPublisherChange(from, to) {