forged-cli 0.4.3 → 0.6.0

package/README.md

@@ -45,7 +45,7 @@ forged readme
 - **Known malware** — checked against [OSV.dev](https://osv.dev), including OpenSSF `MAL-` reports and GitHub malware advisories (CWE-506)
 - **Brand-new versions** — flags versions published in the last 72 hours, the window when hijacked releases usually go unnoticed (packages that routinely release every week or two, like `caniuse-lite`, are skipped)
 - **Tarball integrity** — lockfile hashes vs. the npm registry
-- **Publisher changes** — flags a version whose publisher has never released this package before. Returning maintainers, known teams, and moves to npm trusted publishing are suppressed; security-critical packages like `jsonwebtoken` and `bcrypt` are always flagged for review
+- **Publisher changes** — flags a version whose publisher has never released this package before. Returning maintainers, known teams, and moves to npm trusted publishing are suppressed. A new publisher is **auto-verified** when the evidence holds up (see below); otherwise it's flagged as needing review. Security-critical packages like `jsonwebtoken` and `bcrypt` are always flagged for review, with the evidence attached
 - **Typosquats** — names one or two characters away from popular packages (one for short names, so `tsx` isn't mistaken for `nx`)
 - **Suspicious install scripts** — `curl | sh`, `eval`, base64 decoding and similar
 
@@ -55,11 +55,39 @@ Summary: 0 error(s), 1 warning(s), 39 suppressed
   ℹ  Checked 760 packages against OSV.dev known-malware database
 ```
 
+### Publisher auto-verify
+
+Most publisher changes are ordinary maintainer rotations. Before flagging one, the scanner checks for evidence the new publisher belongs:
+
+| Signal | Strength | Check |
+|--------|----------|-------|
+| Provenance | strong | The release carries a signed npm provenance attestation |
+| Prior maintainer | strong | The publisher was already a maintainer on the previous version |
+| Repo contributor | medium | The publisher's npm name is a contributor to the package's GitHub repo |
+| Org email | weak | The publisher's email domain matches the repo owner (`@auth0.com` → `auth0/…`) |
+| Trusted co-maintainer | weak | A known trusted publisher also maintains the package |
+
+One strong signal, or a medium plus a weak one, verifies the change. Weak signals alone never do. The contributor check calls the GitHub API: set `GITHUB_TOKEN` or log in with `gh` for 5,000 requests/hour instead of 60. If GitHub can't be reached the signal is skipped, not counted against the publisher.
+
+```
+  ⚠  jsonwebtoken@9.0.3: Publisher changed from "charlesrea" to "julien.wollscheid" — security-critical package, review this release (email domain matches the repo owner)
+  ~  react-native-web@0.21.3: Publisher changed from "necolas" to "zoontek" — verified: contributor to the GitHub repo; co-maintains with a trusted publisher
+```
+
 | Flag | Description |
 |------|-------------|
-| `--verbose`, `-v` | Show suppressed maintainer rotations |
+| `--verbose`, `-v` | Show suppressed maintainer rotations and verified publishers |
 | `--report` | Save findings to `forged-report.json` |
 | `--report-md` | Save findings to `forged-report.md` |
+| `--changed` | Skip if `package.json` + lockfile match a scan from the last 7 days (rescans weekly anyway — new malware advisories land even when your lockfile doesn't change) |
+| `--quiet`, `-q` | Print nothing unless something is flagged, then one line — for shell hooks |
+
+**Scan on `cd`:** `--changed --quiet` is cheap enough to run every time you enter a project (≈50ms when unchanged). A zsh example:
+
+```zsh
+_forged_autoscan() { [[ -f package-lock.json ]] && { forged scan --changed --quiet & } 2>/dev/null }
+chpwd_functions+=(_forged_autoscan)
+```
 
 **In CI:** `forged scan` exits with code `1` when it finds errors (malware, integrity mismatches, dangerous scripts), so it can fail a build:
 
@@ -96,11 +124,11 @@ These are advertised in `forged help` and currently print "coming soon":
 
 | Command | Plan |
 |---------|------|
-| `forged init` | Set up a modular zsh environment — plugins, hooks, project auto-detection, and a GitHub dashboard |
+| `forged init` | Guided setup of a modular zsh environment — plugins, hooks, project auto-detection, and the GitHub workflow (Ctrl+G: issue → branch → commit → PR, project boards, label and template pickers) |
 | `forged new` | Create a new project with GitHub setup |
 | `forged install` | Add Forged to an existing shell config |
 
-Want them today? They're running in my [dotfiles](https://github.com/bkness/dotfiles).
+Want them today? Everything above, including the full GitHub workflow, already runs in my [dotfiles](https://github.com/bkness/dotfiles) — `forged init` will package it.
 
 ---
 

package/bin/forged.js

@@ -38,6 +38,9 @@ ${Object.entries(planned).map(([cmd, desc]) => `    ${cmd.padEnd(10)} ${desc}`).
 
   Scan options:
     forged scan [path] [--verbose|-v] [--report|--report-md]
+                       [--changed] [--quiet|-q]
+    --changed  skip if package.json + lockfile match a scan from the last 7 days
+    --quiet    print nothing unless something is flagged (for shell hooks)
     Exits 1 when errors are found, so it can fail a CI job.
   `);
   process.exit(0);
@@ -66,11 +69,14 @@ if (command === 'scan') {
   const report       = args.includes('--report') || args.includes('--report-md');
   const reportFormat = args.includes('--report-md') ? 'markdown' : 'json';
   const verbose      = args.includes('--verbose') || args.includes('-v');
+  const changed      = args.includes('--changed');
+  const quiet        = args.includes('--quiet') || args.includes('-q');
   // Any dash-prefixed arg is a flag, not the path (so `-v` isn't scanned as a dir)
   const pathArg      = args.find(a => !a.startsWith('-'));
   const targetPath   = pathArg ? resolve(pathArg) : process.cwd();
-  const findings     = await scanCommand(targetPath, { report, reportFormat, verbose });
-  process.exit(findings?.errors.length ? 1 : 0);
+  const findings     = await scanCommand(targetPath, { report, reportFormat, verbose, changed, quiet });
+  const errorCount   = findings?.skipped ? findings.errorCount : findings?.errors.length;
+  process.exit(errorCount ? 1 : 0);
 }
 
 if (planned[command]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forged-cli",
-  "version": "0.4.3",
+  "version": "0.6.0",
   "description": "A complete dev environment toolkit — shell, workflows, and project scaffolding in one install.",
   "keywords": [
     "cli",
@@ -29,9 +29,15 @@
   },
   "scripts": {
     "start": "node bin/forged.js",
-    "test": "node --test"
+    "test": "node --test",
+    "lint": "eslint ."
   },
   "dependencies": {
     "inquirer": "^13.4.2"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.11.0",
+    "globals": "^17.12.0"
   }
 }

package/src/commands/readme.js

@@ -1,5 +1,5 @@
 import { createRequire } from 'module';
-import { writeFile, mkdir } from 'fs/promises';
+import { writeFile } from 'fs/promises';
 import { resolve } from 'path';
 import { detectProjectInfo } from '../utils/detectProject.js';
 import { generateMarkdown } from '../utils/generateMarkdown.js';

package/src/commands/scan.js

@@ -1,11 +1,11 @@
 import { readFileSync, existsSync, readdirSync, lstatSync, writeFileSync } from 'fs';
-import { createHash } from 'crypto';
 import { join, basename } from 'path';
 import { homedir } from 'os';
 import { isSuspiciousName } from '../utils/levenshtein.js';
 import { POPULAR_PACKAGES } from '../utils/popularPackages.js';
 import { verifyTarballIntegrity } from '../utils/verifyIntegrity.js';
 import { queryOsv } from '../utils/osv.js';
+import { previousResult, recordResult } from '../utils/scanState.js';
 
 const green  = '\x1b[32m';
 const yellow = '\x1b[33m';
@@ -112,10 +112,14 @@ function saveMarkdownReport(reportPath, data) {
 }
 
 export async function scanCommand(cwd = process.cwd(), opts = {}) {
-  const { report, reportFormat = 'json', verbose = false } = opts;
+  const { report, reportFormat = 'json', verbose = false, changed = false, quiet = false } = opts;
 
-  console.log(`\n${bold}⚒  Forged Scanner${reset}`);
-  console.log(`   Scanning: ${cwd}\n`);
+  // --quiet: no output unless something is flagged (for shell hooks)
+  const log   = quiet ? () => {} : console.log;
+  const write = quiet ? () => {} : (text) => process.stdout.write(text);
+
+  log(`\n${bold}⚒  Forged Scanner${reset}`);
+  log(`   Scanning: ${cwd}\n`);
 
   const findings = { warnings: [], errors: [], info: [], suppressed: [] };
   let packagesVerified = 0;
@@ -126,9 +130,20 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
   // Not a Node project: nothing to scan. Return before writing the scan
   // cache, so the dotfiles badge keeps the last real result.
   if (!existsSync(join(cwd, 'package.json'))) {
-    console.log(`${yellow}ℹ  No package.json here — not a Node project, nothing to scan.${reset}\n`);
+    log(`${yellow}ℹ  No package.json here — not a Node project, nothing to scan.${reset}\n`);
     return null;
   }
+
+  // --changed: skip when package.json + lockfile match a recent scan
+  if (changed) {
+    const prev = previousResult(cwd);
+    if (prev) {
+      log(`${green}✔  Unchanged since the scan on ${prev.scannedAt.slice(0, 10)} — skipped ` +
+          `(${prev.errors} error(s), ${prev.warnings} warning(s)).${reset}\n`);
+      return { skipped: true, errorCount: prev.errors, warningCount: prev.warnings };
+    }
+  }
+
   if (error) findings.errors.push({ message: error });
 
   // 2. Dangerous scripts
@@ -157,16 +172,16 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
   }
 
   // 4. Tarball integrity verification
-  process.stdout.write('   Verifying tarball integrity');
+  write('   Verifying tarball integrity');
   const { error: integrityError, findings: integrityFindings, total, packages } = await verifyTarballIntegrity(
     cwd,
     (checked, t) => {
       if (checked % 10 === 0 || checked === t) {
-        process.stdout.write(`\r   Verifying tarball integrity (${checked}/${t})...`);
+        write(`\r   Verifying tarball integrity (${checked}/${t})...`);
       }
     }
   );
-  process.stdout.write('\n');
+  write('\n');
 
   if (integrityError) {
     findings.warnings.push({ message: integrityError });
@@ -212,50 +227,58 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
 
   // Print results
   if (findings.errors.length === 0 && findings.warnings.length === 0) {
-    console.log(`${green}✔  No issues found. Looks clean.${reset}\n`);
+    log(`${green}✔  No issues found. Looks clean.${reset}\n`);
   } else {
     if (findings.errors.length > 0) {
-      console.log(`${red}${bold}ERRORS (${findings.errors.length}):${reset}`);
+      log(`${red}${bold}ERRORS (${findings.errors.length}):${reset}`);
       for (const e of findings.errors) {
         const label = e.package ? `${e.package}@${e.version}: ` : '';
-        console.log(`  ${red}✖${reset}  ${label}${e.message}`);
+        log(`  ${red}✖${reset}  ${label}${e.message}`);
         if (e.detail) {
-          console.log(`       locked:   ${e.detail.locked}`);
-          console.log(`       registry: ${e.detail.registry}`);
+          log(`       locked:   ${e.detail.locked}`);
+          log(`       registry: ${e.detail.registry}`);
         }
       }
-      console.log();
+      log();
     }
 
     if (findings.warnings.length > 0) {
-      console.log(`${yellow}${bold}WARNINGS (${findings.warnings.length}):${reset}`);
+      log(`${yellow}${bold}WARNINGS (${findings.warnings.length}):${reset}`);
       for (const w of findings.warnings) {
         const label = w.package ? `${w.package}@${w.version}: ` : '';
-        console.log(`  ${yellow}⚠${reset}  ${label}${w.message}`);
+        log(`  ${yellow}⚠${reset}  ${label}${w.message}`);
       }
-      console.log();
+      log();
     }
   }
 
   // Verbose: show suppressed trusted rotations
   if (verbose && findings.suppressed.length > 0) {
-    console.log(`${bold}SUPPRESSED — trusted, returning, or trusted-publishing publishers:${reset}`);
+    log(`${bold}SUPPRESSED — trusted, verified, returning, or trusted-publishing publishers:${reset}`);
     for (const s of findings.suppressed) {
-      console.log(`  ${green}~${reset}  ${s.package}@${s.version}: ${s.message}`);
+      log(`  ${green}~${reset}  ${s.package}@${s.version}: ${s.message}`);
     }
-    console.log();
+    log();
   }
 
   if (findings.info.length > 0) {
-    for (const i of findings.info) console.log(`  ${green}ℹ${reset}  ${i}`);
+    for (const i of findings.info) log(`  ${green}ℹ${reset}  ${i}`);
   }
   if (findings.suppressed.length > 0) {
     const note = verbose ? '' : '  (run with --verbose to see them)';
-    console.log(`  ${green}ℹ${reset}  ${findings.suppressed.length} publisher change(s) suppressed${note}`);
+    log(`  ${green}ℹ${reset}  ${findings.suppressed.length} publisher change(s) suppressed${note}`);
   }
-  console.log();
+  log();
+
+  log(`${bold}Summary:${reset} ${findings.errors.length} error(s), ${findings.warnings.length} warning(s), ${findings.suppressed.length} suppressed\n`);
 
-  console.log(`${bold}Summary:${reset} ${findings.errors.length} error(s), ${findings.warnings.length} warning(s), ${findings.suppressed.length} suppressed\n`);
+  recordResult(cwd, findings);
+
+  if (quiet && (findings.errors.length || findings.warnings.length)) {
+    const color = findings.errors.length ? red : yellow;
+    console.log(`${color}⚒  forged: ${findings.errors.length} error(s), ${findings.warnings.length} warning(s) ` +
+                `in ${basename(cwd)} — run \`forged scan\` for details${reset}`);
+  }
 
   // Write local scan cache — dotfiles reads this to push telemetry
   const flagged = [
@@ -303,7 +326,7 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
       saveJsonReport(reportFile, reportData);
     }
 
-    console.log(`${green}✔  Report saved: ${reportFile}${reset}\n`);
+    log(`${green}✔  Report saved: ${reportFile}${reset}\n`);
   }
 
   return findings;

package/src/utils/detectProject.js

@@ -1,6 +1,6 @@
 import { execSync } from 'child_process';
 import { existsSync, readFileSync } from 'fs';
-import { basename, resolve } from 'path';
+import { basename } from 'path';
 
 export function detectProjectInfo() {
   const cwd = process.cwd();

package/src/utils/scanState.js

@@ -0,0 +1,51 @@
+import { createHash } from 'crypto';
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+
+// An unchanged project still gets rescanned after this long: new malware
+// advisories land on OSV even when the lockfile doesn't move.
+export const RESCAN_DAYS = 7;
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+const statePath = () => join(homedir(), '.forged-scan-state.json');
+
+// package.json is part of the fingerprint too — the install-script check reads it
+export function fingerprint(cwd) {
+  const hash = createHash('sha256');
+  for (const file of ['package.json', 'package-lock.json']) {
+    const path = join(cwd, file);
+    hash.update(`${file}\0`);
+    if (existsSync(path)) hash.update(readFileSync(path));
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
+function readState() {
+  try {
+    return JSON.parse(readFileSync(statePath(), 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+// The last result for this project if nothing changed since and it's recent
+// enough to trust, else null (→ scan again)
+export function previousResult(cwd, now = Date.now()) {
+  const entry = readState()[cwd];
+  if (!entry || entry.fingerprint !== fingerprint(cwd)) return null;
+  if (now - Date.parse(entry.scannedAt) > RESCAN_DAYS * DAY_MS) return null;
+  return entry;
+}
+
+export function recordResult(cwd, findings, now = Date.now()) {
+  const state = readState();
+  state[cwd] = {
+    fingerprint: fingerprint(cwd),
+    scannedAt: new Date(now).toISOString(),
+    errors: findings.errors.length,
+    warnings: findings.warnings.length,
+  };
+  writeFileSync(statePath(), JSON.stringify(state, null, 2), 'utf8');
+}

package/src/utils/verifyIntegrity.js

@@ -3,6 +3,12 @@ import { join } from 'path';
 import { publisherChangeSeverity } from './trustedPublishers.js';
 import { hoursSincePublish, isRoutineRelease, FRESH_HOURS } from './freshness.js';
 import { previousVersion } from './semver.js';
+import {
+  collectRegistryEvidence,
+  fetchContributors,
+  judgeEvidence,
+  parseGithubRepo,
+} from './verifyPublisher.js';
 
 // Fetch registry metadata with a simple in-memory cache to avoid duplicate requests
 const registryCache = new Map();
@@ -137,18 +143,44 @@ export async function verifyTarballIntegrity(cwd, onProgress) {
             v !== meta.version &&
             registryMeta.versions[v]?._npmUser?.name === currPublisher &&
             Date.parse(registryMeta.time?.[v]) < publishedAt);
-          const { type, reason } = publisherChangeSeverity({
+          let { type, reason } = publisherChangeSeverity({
             pkg: name, from: prevPublisher, to: currPublisher, returning,
           });
+          let verification = null;
+          if (reason === 'new' || reason === 'review') {
+            const registryEvidence = collectRegistryEvidence({
+              registryMeta,
+              version: meta.version,
+              prevVersion,
+              publisher: currPublisher,
+            });
+
+            const gh = parseGithubRepo(versionData.repository?.url);
+            let contributor = null;
+            if (gh) {
+              const logins = await fetchContributors(gh.owner, gh.repo);
+              contributor = logins ? logins.has(currPublisher.toLowerCase()) : null;
+            }
+
+            verification = judgeEvidence({ ...registryEvidence, contributor });
+
+            if (reason === 'new' && verification.verified) {
+              type = 'info';
+              reason = 'verified';
+            }
+          }
+
+          const evidence = verification?.reasons.length ? ` (${verification.reasons.join('; ')})` : '';
           const change = `Publisher changed from "${prevPublisher}" to "${currPublisher}"`;
           const message = {
-            review:    `${change} — security-critical package, review this release`,
+            review:    `${change} — security-critical package, review this release${evidence}`,
+            verified: `${change} — verified: ${verification?.reasons.join('; ')}`,
             oidc:      `Moved from "${prevPublisher}" to npm trusted publishing (GitHub Actions)`,
             returning: `${change} (returning maintainer)`,
             trusted:   `${change} (trusted publisher)`,
-            new:       `${change} — first release by this account`,
+            new:       `${change} — first release by this account, needs review${evidence}`,
           }[reason];
-          findings.push({ type, package: name, version: meta.version, message });
+          findings.push({ type, package: name, version: meta.version, message, verification });
         }
       }
     }));

package/src/utils/verifyPublisher.js

@@ -0,0 +1,135 @@
+import { execFileSync } from 'child_process';
+import { NPM_TEAM, TRUSTED_COMMUNITY } from './trustedPublishers.js';
+
+export function parseGithubRepo(url) {
+  if (!url || typeof url !== 'string') return null;
+
+  const normalized = url
+    .replace(/^git\+/, '')
+    .replace(/^git:/, 'https:')
+    .trim();
+
+  const m = normalized.match(
+    /(?:https?:\/\/|git@|ssh:\/\/git@)?github\.com[:/]+([^/]+)\/([^/#]+?)(?:\.git)?(?:[/?#].*)?$/i,
+  );
+
+  return m ? { owner: m[1], repo: m[2] } : null;
+}
+
+export function collectRegistryEvidence({
+  registryMeta,
+  version,
+  prevVersion,
+  publisher,
+}) {
+  const curr = registryMeta?.versions?.[version] ?? {};
+  const prev = registryMeta?.versions?.[prevVersion] ?? {};
+
+  const provenance = !!curr.dist?.attestations?.provenance;
+
+  const prevMaintainers = Array.isArray(prev.maintainers)
+    ? prev.maintainers
+    : [];
+  const currMaintainers = Array.isArray(curr.maintainers)
+    ? curr.maintainers
+    : [];
+
+  const priorMaintainer = prevMaintainers.some((m) => {
+    const name = typeof m === 'string' ? m : m?.name;
+    return name === publisher;
+  });
+
+  const email = curr?._npmUser?.email ?? curr?.publisher?.email ?? null;
+  const owner =
+    parseGithubRepo(curr?.repository?.url ?? prev?.repository?.url ?? null)
+      ?.owner ?? null;
+  const orgEmail =
+    !!email &&
+    !!owner &&
+    email.toLowerCase().split('@')?.[1]?.split('.')?.[0]?.toLowerCase() ===
+      owner.toLowerCase();
+
+  const trustedCoMaintainer = currMaintainers.some((m) => {
+    const name = typeof m === 'string' ? m : m?.name;
+    if (!name || name === publisher) return false;
+    return NPM_TEAM.has(name) || TRUSTED_COMMUNITY.has(name);
+  });
+
+  return { provenance, priorMaintainer, orgEmail, trustedCoMaintainer };
+}
+
+// GITHUB_TOKEN if set, else the gh CLI's token, else none (60 req/hr).
+// Looked up once per run — spawning gh for every repo adds up.
+let cachedToken;
+function githubToken() {
+  if (cachedToken !== undefined) return cachedToken;
+  cachedToken = process.env.GITHUB_TOKEN || readGhToken();
+  return cachedToken;
+}
+
+function readGhToken() {
+  try {
+    return execFileSync('gh', ['auth', 'token'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+const contributorCache = new Map();
+
+// → Set of lowercase GitHub logins (top 100 contributors), or null if unknown
+export async function fetchContributors(owner, repo, fetchImpl = fetch) {
+  const key = `${owner}/${repo}`.toLowerCase();
+  if (contributorCache.has(key)) return contributorCache.get(key);
+
+  let result;
+  const token = githubToken();
+  const headers = { accept: 'application/vnd.github+json' };
+  if (token) headers.authorization = `Bearer ${token}`;
+
+  try {
+    const res = await fetchImpl(
+      `https://api.github.com/repos/${owner}/${repo}/contributors?per_page=100`,
+      { headers },
+    );
+
+    if (!res.ok) {
+      result = null;
+    } else {
+      const data = await res.json();
+      result = new Set((Array.isArray(data) ? data : []).map((c) => String(c?.login || '').toLowerCase()).filter(Boolean));
+    }
+  } catch {
+    result = null;
+  }
+
+  contributorCache.set(key, result);
+  return result;
+}
+
+const SIGNALS = {
+  provenance: { weight: 'strong', label: 'signed provenance from the package repo' },
+  priorMaintainer: { weight: 'strong', label: 'already a maintainer before this release' },
+  contributor: { weight: 'medium', label: 'contributor to the GitHub repo' },
+  orgEmail: { weight: 'weak', label: 'email domain matches the repo owner' },
+  trustedCoMaintainer: { weight: 'weak', label: 'co-maintains with a trusted publisher' },
+};
+
+// evidence: collectRegistryEvidence(...) plus contributor: true | false | null
+// → { verified, reasons: [labels of the signals present] }
+export function judgeEvidence(evidence) {
+  const present = Object.keys(SIGNALS).filter((key) => evidence?.[key] === true);
+  const count = (weight) => present.filter((key) => SIGNALS[key].weight === weight).length;
+
+  const strong = count('strong');
+  const medium = count('medium');
+  const weak = count('weak');
+
+  const verified = strong >= 1 || (medium >= 1 && weak >= 1);
+  const reasons = present.map((key) => SIGNALS[key].label);
+
+  return { verified, reasons };
+}