metaharness 0.4.10 → 0.4.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit-cmd.d.ts.map +1 -1
- package/dist/audit-cmd.js +46 -1
- package/dist/audit-cmd.js.map +1 -1
- package/dist/meta-proxy.d.ts +1 -1
- package/dist/meta-proxy.js +1 -1
- package/dist/sbom-cmd.d.ts.map +1 -1
- package/dist/sbom-cmd.js +32 -5
- package/dist/sbom-cmd.js.map +1 -1
- package/package.json +1 -1
package/dist/audit-cmd.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-cmd.d.ts","sourceRoot":"","sources":["../src/audit-cmd.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAIjE,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,
|
|
1
|
+
{"version":3,"file":"audit-cmd.d.ts","sourceRoot":"","sources":["../src/audit-cmd.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAIjE,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2KxE"}
|
package/dist/audit-cmd.js
CHANGED
|
@@ -105,11 +105,52 @@ export async function auditCmd(args) {
|
|
|
105
105
|
const counts = parsed.metadata?.vulnerabilities ?? {};
|
|
106
106
|
const levelIdx = LEVELS.indexOf(level);
|
|
107
107
|
const failCount = LEVELS.slice(levelIdx).reduce((s, l) => s + (counts[l] ?? 0), 0);
|
|
108
|
-
|
|
108
|
+
// npm's `metadata.vulnerabilities` object carries a `total` key alongside
|
|
109
|
+
// the per-severity keys — summing Object.values() double-counts it. Sum
|
|
110
|
+
// only the known severities.
|
|
111
|
+
const total = LEVELS.reduce((s, l) => s + (counts[l] ?? 0), 0);
|
|
109
112
|
const offenders = Object.entries(parsed.vulnerabilities ?? {})
|
|
110
113
|
.filter(([, v]) => LEVELS.indexOf(v.severity) >= levelIdx)
|
|
111
114
|
.map(([name, v]) => ({ name, severity: v.severity, advisory: v.via?.[0]?.title ?? null }));
|
|
112
115
|
const code = failCount === 0 ? 0 : 1;
|
|
116
|
+
// iter: `--omit=dev` is the default (matches the standard two-tier CI
|
|
117
|
+
// pattern — gate on prod, report on everything), but a bare "PASS: 0
|
|
118
|
+
// advisories" gave no signal that devDependencies were excluded from the
|
|
119
|
+
// count at all, even when they carry a critical advisory. devDependencies
|
|
120
|
+
// execute during npm ci/test/build (CI/build-time attack surface — see
|
|
121
|
+
// the 2026 node-ipc and Shai-Hulud npm supply-chain incidents, both of
|
|
122
|
+
// which exfiltrated CI credentials via compromised build-time packages)
|
|
123
|
+
// so a silent PASS here can look cleaner than the real dependency tree
|
|
124
|
+
// is. Surface the suppressed count without changing default pass/fail
|
|
125
|
+
// semantics — a second `npm audit` scoped to metadata only, best-effort.
|
|
126
|
+
let suppressed = null;
|
|
127
|
+
if (!includeDev) {
|
|
128
|
+
try {
|
|
129
|
+
const allArgs = ['audit', '--json', `--audit-level=${level}`];
|
|
130
|
+
// Like the primary call above: `npm audit` exits non-zero once
|
|
131
|
+
// advisories at-or-above --audit-level exist, but still writes the
|
|
132
|
+
// real report JSON to stdout — that's the expected, common case here
|
|
133
|
+
// (it's exactly why the primary call has its own catch), so pull
|
|
134
|
+
// stdout from the rejection instead of discarding it.
|
|
135
|
+
let allStdout;
|
|
136
|
+
try {
|
|
137
|
+
const r = await execFile(npmCmd, process.platform === 'win32'
|
|
138
|
+
? ['/d', '/s', '/c', 'npm', ...allArgs] : allArgs, { cwd: dir, maxBuffer: 1024 * 1024 * 16, windowsHide: true });
|
|
139
|
+
allStdout = r.stdout;
|
|
140
|
+
}
|
|
141
|
+
catch (e) {
|
|
142
|
+
allStdout = e.stdout ?? '';
|
|
143
|
+
}
|
|
144
|
+
const allParsed = JSON.parse(allStdout);
|
|
145
|
+
const allCounts = allParsed.metadata?.vulnerabilities ?? {};
|
|
146
|
+
const allTotal = LEVELS.reduce((s, l) => s + (allCounts[l] ?? 0), 0);
|
|
147
|
+
const allFailCount = LEVELS.slice(levelIdx).reduce((s, l) => s + (allCounts[l] ?? 0), 0);
|
|
148
|
+
if (allTotal >= total && allFailCount >= failCount) {
|
|
149
|
+
suppressed = { total: allTotal - total, atLevelOrAbove: allFailCount - failCount };
|
|
150
|
+
}
|
|
151
|
+
}
|
|
152
|
+
catch { /* best-effort disclosure only — never fails the command */ }
|
|
153
|
+
}
|
|
113
154
|
if (bundle) {
|
|
114
155
|
return {
|
|
115
156
|
code,
|
|
@@ -123,11 +164,15 @@ export async function auditCmd(args) {
|
|
|
123
164
|
offenders,
|
|
124
165
|
failCount,
|
|
125
166
|
exitCode: code,
|
|
167
|
+
...(suppressed ? { devDependenciesSuppressed: suppressed } : {}),
|
|
126
168
|
}, null, 2)],
|
|
127
169
|
};
|
|
128
170
|
}
|
|
129
171
|
lines.push(` total advisories: ${total}`);
|
|
130
172
|
lines.push(` per severity: ${LEVELS.map(l => `${l}=${counts[l] ?? 0}`).join(', ')}`);
|
|
173
|
+
if (suppressed && (suppressed.total > 0 || suppressed.atLevelOrAbove > 0)) {
|
|
174
|
+
lines.push(` devDependencies not counted: ${suppressed.total} advisories (${suppressed.atLevelOrAbove} at ${level}+) — re-run with --include-dev to see them`);
|
|
175
|
+
}
|
|
131
176
|
if (failCount === 0) {
|
|
132
177
|
lines.push(` PASS: 0 advisories at ${level}+`);
|
|
133
178
|
return { code: 0, lines };
|
package/dist/audit-cmd.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-cmd.js","sourceRoot":"","sources":["../src/audit-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,oEAAoE;AACpE,0CAA0C;AAE1C,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAIvC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClD,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAa,CAAC,mBAAmB,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aACpG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAC/E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,6BAA6B,GAAG,kDAAkD,CAAC,CAAC;QAC/F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5C,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC;IAEZ,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE;YAC1C,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,GAAQ,IAAI,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;4BACrB,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAChD,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;4BAC5C,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;yBACzC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;iBACb,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAClG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,8CAA8C,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,
|
|
1
|
+
{"version":3,"file":"audit-cmd.js","sourceRoot":"","sources":["../src/audit-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,oEAAoE;AACpE,0CAA0C;AAE1C,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAIvC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClD,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAa,CAAC,mBAAmB,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aACpG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAC/E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,6BAA6B,GAAG,kDAAkD,CAAC,CAAC;QAC/F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5C,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC;IAEZ,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE;YAC1C,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,GAAQ,IAAI,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;4BACrB,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAChD,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;4BAC5C,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;yBACzC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;iBACb,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAClG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,8CAA8C,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,0EAA0E;IAC1E,wEAAwE;IACxE,6BAA6B;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAM,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;SAChE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAE,CAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;SAClE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAG,CAAS,CAAC,QAAQ,EAAE,QAAQ,EAAG,CAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,IAAI,UAAU,GAAqD,IAAI,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;YAC9D,+DAA+D;YAC/D,mEAAmE;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,sDAAsD;YACtD,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAC3D,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EACjD,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;YACvB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,SAAS,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YAC7B,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,QAAQ,IAAI,KAAK,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;gBACnD,UAAU,GAAG,EAAE,KAAK,EAAE,QAAQ,GAAG,KAAK,EAAE,cAAc,EAAE,YAAY,GAAG,SAAS,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,MAAM,EAAE,CAAC;oBACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,UAAU,EAAE,GAAG;oBACf,KAAK;oBACL,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,SAAS;oBACT,QAAQ,EAAE,IAAI;oBACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,kCAAkC,UAAU,CAAC,KAAK,gBAAgB,UAAU,CAAC,cAAc,OAAO,KAAK,4CAA4C,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,2BAA2B,KAAK,GAAG,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,kBAAkB,KAAK,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}
|
package/dist/meta-proxy.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export declare const META_PROXY_VERSION = "0.7.
|
|
1
|
+
export declare const META_PROXY_VERSION = "0.7.5";
|
|
2
2
|
export declare const META_PROXY_RELEASE_BASE = "https://github.com/cognitum-one/meta-proxy-dist/releases/download";
|
|
3
3
|
/** The release signing key, pinned in the client rather than fetched from GitHub. */
|
|
4
4
|
export declare const META_PROXY_SIGNING_PUBKEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=\n-----END PUBLIC KEY-----\n";
|
package/dist/meta-proxy.js
CHANGED
|
@@ -12,7 +12,7 @@ import { createHash, createHmac, createPublicKey, verify as verifySignature } fr
|
|
|
12
12
|
import { chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, openSync, readSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
|
|
13
13
|
import { homedir } from 'node:os';
|
|
14
14
|
import { basename, join } from 'node:path';
|
|
15
|
-
export const META_PROXY_VERSION = '0.7.
|
|
15
|
+
export const META_PROXY_VERSION = '0.7.5';
|
|
16
16
|
export const META_PROXY_RELEASE_BASE = 'https://github.com/cognitum-one/meta-proxy-dist/releases/download';
|
|
17
17
|
/** The release signing key, pinned in the client rather than fetched from GitHub. */
|
|
18
18
|
export const META_PROXY_SIGNING_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
|
package/dist/sbom-cmd.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sbom-cmd.d.ts","sourceRoot":"","sources":["../src/sbom-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"sbom-cmd.d.ts","sourceRoot":"","sources":["../src/sbom-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAyEjE,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgFvE"}
|
package/dist/sbom-cmd.js
CHANGED
|
@@ -17,13 +17,18 @@ function spdxId(prefix, name, version) {
|
|
|
17
17
|
}
|
|
18
18
|
function packagesFromLock(lock, includeDev) {
|
|
19
19
|
if (!lock?.packages)
|
|
20
|
-
return [];
|
|
20
|
+
return { packages: [], excludedDevCount: 0 };
|
|
21
21
|
const out = [];
|
|
22
|
+
let excludedDevCount = 0;
|
|
22
23
|
for (const [path, pkg] of Object.entries(lock.packages)) {
|
|
23
24
|
if (!path || path === '')
|
|
24
25
|
continue;
|
|
25
|
-
if (
|
|
26
|
-
|
|
26
|
+
if (pkg.dev === true) {
|
|
27
|
+
if (!includeDev) {
|
|
28
|
+
excludedDevCount++;
|
|
29
|
+
continue;
|
|
30
|
+
}
|
|
31
|
+
}
|
|
27
32
|
if (pkg.peer === true || pkg.optional === true)
|
|
28
33
|
continue;
|
|
29
34
|
const name = pkg.name ?? path.split('node_modules/').pop();
|
|
@@ -44,7 +49,7 @@ function packagesFromLock(lock, includeDev) {
|
|
|
44
49
|
}],
|
|
45
50
|
});
|
|
46
51
|
}
|
|
47
|
-
return out;
|
|
52
|
+
return { packages: out, excludedDevCount };
|
|
48
53
|
}
|
|
49
54
|
function packagesFromManifest(pkg) {
|
|
50
55
|
const deps = pkg.dependencies ?? {};
|
|
@@ -83,17 +88,36 @@ export async function sbomCmd(args) {
|
|
|
83
88
|
const lockPath = join(dir, 'package-lock.json');
|
|
84
89
|
let packages;
|
|
85
90
|
let source;
|
|
91
|
+
let excludedDevCount = 0;
|
|
86
92
|
if (existsSync(lockPath)) {
|
|
87
93
|
const lock = JSON.parse(await readFile(lockPath, 'utf-8'));
|
|
88
|
-
|
|
94
|
+
const fromLock = packagesFromLock(lock, includeDev);
|
|
95
|
+
packages = fromLock.packages;
|
|
96
|
+
excludedDevCount = fromLock.excludedDevCount;
|
|
89
97
|
source = 'package-lock.json';
|
|
90
98
|
}
|
|
91
99
|
else {
|
|
92
100
|
packages = packagesFromManifest(pkg);
|
|
101
|
+
// No lockfile to introspect per-package `dev` flags — approximate the
|
|
102
|
+
// excluded count from the manifest's own devDependencies block so the
|
|
103
|
+
// disclosure below still fires instead of silently under-reporting.
|
|
104
|
+
if (!includeDev)
|
|
105
|
+
excludedDevCount = Object.keys(pkg.devDependencies ?? {}).length;
|
|
93
106
|
source = 'package.json dependencies (no lockfile — versions are range strings)';
|
|
94
107
|
}
|
|
95
108
|
lines.push(` source: ${source}`);
|
|
96
109
|
lines.push(` packages: ${packages.length}`);
|
|
110
|
+
// iter: a reader of the default (no --include-dev) SBOM had no way to tell
|
|
111
|
+
// whether the harness simply has no dev dependencies, or whether some were
|
|
112
|
+
// silently dropped — unlike CycloneDX, which tags dev-scope components
|
|
113
|
+
// `scope: excluded` instead of omitting them outright. devDependencies run
|
|
114
|
+
// during npm ci/test/build (CI/build-time attack surface — e.g. the 2026
|
|
115
|
+
// node-ipc and Shai-Hulud npm supply-chain incidents exfiltrated CI
|
|
116
|
+
// credentials via compromised build-time packages) even though they never
|
|
117
|
+
// ship to production, so their exclusion is worth surfacing, not hiding.
|
|
118
|
+
if (!includeDev && excludedDevCount > 0) {
|
|
119
|
+
lines.push(` dev-scope excluded: ${excludedDevCount} package(s) — re-run with --include-dev for a build/CI-time-complete SBOM`);
|
|
120
|
+
}
|
|
97
121
|
if (validateOnly) {
|
|
98
122
|
lines.push(' --validate-only — shape OK, not writing output');
|
|
99
123
|
return { code: 0, lines };
|
|
@@ -108,6 +132,9 @@ export async function sbomCmd(args) {
|
|
|
108
132
|
created: new Date(0).toISOString(),
|
|
109
133
|
creators: [`Tool: harness sbom (iter 51)`],
|
|
110
134
|
licenseListVersion: '3.20',
|
|
135
|
+
...(!includeDev && excludedDevCount > 0 ? {
|
|
136
|
+
comment: `${excludedDevCount} devDependency package(s) excluded from this SBOM (scope: dev). Re-run with --include-dev for a build/CI-time-complete SBOM.`,
|
|
137
|
+
} : {}),
|
|
111
138
|
},
|
|
112
139
|
packages,
|
|
113
140
|
};
|
package/dist/sbom-cmd.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sbom-cmd.js","sourceRoot":"","sources":["../src/sbom-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,wDAAwD;AAExD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC3D,OAAO,WAAW,MAAM,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAS,EAAE,UAAmB;IACtD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"sbom-cmd.js","sourceRoot":"","sources":["../src/sbom-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,wDAAwD;AAExD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC3D,OAAO,WAAW,MAAM,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAS,EAAE,UAAmB;IACtD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IAClE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QACnC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAAC,gBAAgB,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,SAAS;QACpC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;YACxC,IAAI;YACJ,WAAW,EAAE,GAAG,CAAC,OAAO;YACxB,gBAAgB,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;YAC/C,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;YAC9E,aAAa,EAAE,aAAa;YAC5B,YAAY,EAAE,CAAC;oBACb,iBAAiB,EAAE,iBAAiB;oBACpC,aAAa,EAAE,MAAM;oBACrB,gBAAgB,EAAE,WAAW,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;iBACnD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAQ;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,OAAO,CAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACxD,sEAAsE;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC;YACpC,IAAI;YACJ,WAAW,EAAE,OAAO;YACpB,gBAAgB,EAAE,aAAa;YAC/B,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,aAAa;YAC9B,aAAa,EAAE,aAAsB;YACrC,YAAY,EAAE,CAAC;oBACb,iBAAiB,EAAE,iBAA0B;oBAC7C,aAAa,EAAE,MAAe;oBAC9B,gBAAgB,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE;iBAC/C,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAa,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,iCAAiC,CAAC,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,IAAI,QAAmB,CAAC;IACxB,IAAI,MAAc,CAAC;IACnB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC7C,MAAM,GAAG,mBAAmB,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,IAAI,CAAC,UAAU;YAAE,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAClF,MAAM,GAAG,sEAAsE,CAAC;IAClF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,CAAC,UAAU,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,2EAA2E,CAAC,CAAC;IACnI,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,OAAO;QACrC,iBAAiB,EAAE,mCAAmC,GAAG,CAAC,IAAI,SAAS,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACrJ,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAClC,QAAQ,EAAE,CAAC,8BAA8B,CAAC;YAC1C,kBAAkB,EAAE,MAAM;YAC1B,GAAG,CAAC,CAAC,UAAU,IAAI,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO,EAAE,GAAG,gBAAgB,8HAA8H;aAC3J,CAAC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ;KACT,CAAC;IAEF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "metaharness",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.12",
|
|
4
4
|
"description": "MetaHarness — mint a custom AI agent harness from any repo. Browser Studio + `npx metaharness` CLI. Runs on Claude Code, Codex, pi.dev, Hermes, OpenClaw, RVM, Prime Agent.",
|
|
5
5
|
"homepage": "https://github.com/ruvnet/agent-harness-generator",
|
|
6
6
|
"repository": {
|