pmsec 0.10.0 → 0.13.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Hikaru Egashira
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,7 +1,7 @@
 # pmsec (Node)
 
 Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun,
-cargo, mise, and uv. One command flips on every safe-by-default knob each
+cargo, mise, uv, and bundler. One command flips on every safe-by-default knob each
 package manager exposes — install cooldown, signature trust policy, lockfile
 re-verification, build-script attestation, and more.
 
@@ -38,7 +38,7 @@ Zero runtime dependencies, ESM, requires Node 22+.
 | `pmsec --disable` | Remove every key the bundle set; other keys in the file are preserved. |
 | `pmsec --version` | Print the installed pmsec version. |
 
-Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 1-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`. `--check` and `--disable` are mutually exclusive.
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv,bundler`, `--days N` (override the 1-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`. `--check` and `--disable` are mutually exclusive.
 
 When the target file is owned by another user (typical: `~/.npmrc` left
 root-owned by an old `sudo npm config set`), the write fails with `EACCES`

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "pmsec",
-  "version": "0.10.0",
+  "version": "0.13.0",
   "publishConfig": {
     "access": "public"
   },
-  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, and uv.",
+  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, uv, and bundler.",
   "homepage": "https://github.com/HikaruEgashira/pmsec#readme",
   "repository": {
     "type": "git",
@@ -25,6 +25,7 @@
   "files": [
     "bin",
     "src",
+    "LICENSE",
     "README.md"
   ],
   "scripts": {

package/src/cli.mjs

@@ -1,5 +1,6 @@
-import { homedir } from "node:os";
-import { readFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { readFileSync, accessSync, constants as fsConstants, statSync } from "node:fs";
+import { dirname } from "node:path";
 import { shellQuote } from "./util/io.mjs";
 import * as npm from "./tools/npm.mjs";
 import * as pnpm from "./tools/pnpm.mjs";
@@ -8,8 +9,9 @@ import * as bun from "./tools/bun.mjs";
 import * as cargo from "./tools/cargo.mjs";
 import * as mise from "./tools/mise.mjs";
 import * as uv from "./tools/uv.mjs";
+import * as bundler from "./tools/bundler.mjs";
 
-const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv];
+const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv, bundler];
 // Default cooldown for the hardening bundle. Override per-invocation with
 // `--days N`; the default tracks the safest value we'd recommend.
 const BUNDLE_DAYS = 1;
@@ -20,14 +22,15 @@ export const VERSION = JSON.parse(
 const USAGE = `pmsec [options]
 
 Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
-bun, cargo, mise, uv. Default action enables every safe-by-default key
-each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
+bun, cargo, mise, uv, bundler. Default action enables every safe-by-default
+key each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
 attestation re-verification, ...). No knobs.
 
 Options:
   --check               Verify the bundle is in place (exit 1 if anything missing)
   --disable             Remove the hardening bundle from selected tools
-  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
+  --doctor              Diagnose effective paths/owner/uid (read-only; for unattended-deployment debugging)
+  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv,bundler)
   --days N              Override cooldown days (default 1)
   --force               Overwrite stricter existing cooldowns (otherwise enable is monotonic)
   --json                Emit JSON output
@@ -52,7 +55,7 @@ function parse(argv) {
   const opts = { mode: "enable", json: false, only: null, days: BUNDLE_DAYS, force: false, help: false, version: false };
   let modeSet = false;
   const setMode = (m) => {
-    if (modeSet && opts.mode !== m) throw new Error(`--check and --disable are mutually exclusive`);
+    if (modeSet && opts.mode !== m) throw new Error(`--check, --disable, and --doctor are mutually exclusive`);
     opts.mode = m;
     modeSet = true;
   };
@@ -65,6 +68,7 @@ function parse(argv) {
     else if (a === "--force") opts.force = true;
     else if (a === "--check") setMode("check");
     else if (a === "--disable") setMode("disable");
+    else if (a === "--doctor") setMode("doctor");
     else if (a === "--tool") opts.only = argv[++i].split(",");
     else if (a.startsWith("--tool=")) opts.only = a.slice(7).split(",");
     else if (a === "--days") opts.days = parseDays(argv[++i]);
@@ -130,6 +134,86 @@ async function runCheck(targets, { json, days }, ctx, out, err) {
   return ok ? 0 : 1;
 }
 
+// `pmsec doctor` runs read-only and reports the same path resolution that
+// enable/check/disable would do, plus identity (uid/euid) and parent-dir
+// writability — the smallest set of facts an operator needs to diagnose
+// "pmsec ran but wrote to nowhere" (root's $HOME) or "wrote a file no one
+// can read" (chown failed under SIP/SELinux). Never mutates the filesystem.
+function probePath(p, uid) {
+  const parent = dirname(p);
+  let exists = false, writable = false, parentExists = false, owner = null;
+  try { accessSync(p, fsConstants.F_OK); exists = true; } catch {}
+  if (exists) {
+    try { accessSync(p, fsConstants.W_OK); writable = true; } catch {}
+    try {
+      const st = statSync(p);
+      // Only POSIX uids are meaningful; on win32 st.uid is 0 and ignored downstream.
+      owner = uid === null ? null : st.uid;
+    } catch {}
+  }
+  try { accessSync(parent, fsConstants.F_OK); parentExists = true; } catch {}
+  // Walk up to the deepest existing ancestor — pmsec runs mkdir -p, so what
+  // matters is whether that ancestor is writable, not the literal parent.
+  let probe = parent, ancestor = null;
+  while (probe && probe !== dirname(probe)) {
+    try { accessSync(probe, fsConstants.F_OK); ancestor = probe; break; } catch {}
+    probe = dirname(probe);
+  }
+  let parentWritable = false;
+  if (ancestor) {
+    try { accessSync(ancestor, fsConstants.W_OK); parentWritable = true; } catch {}
+  }
+  return { path: p, parent, exists, writable, parentExists, parentWritable, owner };
+}
+
+function runDoctor(targets, json, ctx, out) {
+  const isPosix = ctx.platform !== "win32" && typeof process.getuid === "function";
+  const uid = isPosix ? process.getuid() : null;
+  const euid = isPosix && typeof process.geteuid === "function" ? process.geteuid() : uid;
+  let username = null;
+  try { username = userInfo().username; } catch {}
+  const tools = targets.map(t => {
+    const p = t.path(ctx);
+    const probe = probePath(p, uid);
+    return { tool: t.name, key: t.key, ...probe };
+  });
+  // doctor.ok is intentionally narrow: the parent directory must be writable
+  // by the running uid. Everything else is informational.
+  const okFlag = tools.every(t => t.parentWritable);
+  const report = {
+    doctor: true,
+    version: VERSION,
+    platform: ctx.platform,
+    uid, euid, username,
+    home: ctx.home,
+    pmsecHome: ctx.env.PMSEC_HOME ?? null,
+    pmsecHomeSource: ctx.env.PMSEC_HOME ? "PMSEC_HOME" : "HOME",
+    tools,
+    ok: okFlag,
+  };
+  if (json) {
+    out.write(JSON.stringify(report, null, 2) + "\n");
+    return okFlag ? 0 : 1;
+  }
+  out.write(`pmsec ${VERSION}  doctor\n`);
+  out.write(`  platform   : ${ctx.platform}\n`);
+  if (isPosix) out.write(`  uid/euid   : ${uid}/${euid}${username ? ` (${username})` : ""}\n`);
+  out.write(`  HOME       : ${ctx.home}\n`);
+  out.write(`  PMSEC_HOME : ${ctx.env.PMSEC_HOME ?? "(unset — using HOME)"}\n\n`);
+  for (const t of tools) {
+    const flag = t.parentWritable ? "ok    " : "BLOCK ";
+    const ownerSuffix = t.exists && t.owner !== null ? ` (uid=${t.owner})` : "";
+    out.write(`${flag} ${t.tool.padEnd(4)} ${t.path}${ownerSuffix}\n`);
+    if (!t.parentWritable) {
+      // Only surface noise when there's a real problem. "parent missing but
+      // mkdir -p can fix it" is the common case and isn't worth a line.
+      out.write(`         no writable ancestor for ${t.parent}\n`);
+    }
+  }
+  if (!okFlag) out.write(`\npmsec doctor: at least one parent directory is not writable as uid ${uid ?? "(non-POSIX)"}.\n`);
+  return okFlag ? 0 : 1;
+}
+
 function explainFsError(e, tool) {
   if (e?.code === "EACCES" || e?.code === "EPERM") {
     const p = e.path ?? "";
@@ -216,6 +300,7 @@ export async function run(argv, {
   try {
     if (opts.mode === "check") return await runCheck(targets, opts, ctx, out, err);
     if (opts.mode === "disable") return await runDisable(targets, opts.json, ctx, out, err);
+    if (opts.mode === "doctor") return runDoctor(targets, opts.json, ctx, out);
     return await runEnable(targets, opts.json, opts.days, opts.force, ctx, out, err);
   } catch (e) {
     err.write(`pmsec: ${e.message}\n`);

package/src/tools/bundler.mjs

@@ -0,0 +1,46 @@
+import { bundleConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { buildPreflight } from "../util/version.mjs";
+
+export const name = "bundler";
+export const key = "BUNDLE_COOLDOWN";
+export const docs = "https://bundler.io/man/bundle-config.1.html";
+export const minBin = [4, 0, 13];
+export const extras = [];
+const SEP = ":";
+
+export function path(ctx) { return bundleConfigPath(ctx.env, ctx.home); }
+
+export const preflight = buildPreflight(name, minBin,
+  "BUNDLE_COOLDOWN is silently ignored. Upgrade bundler (v4.0.13+) to enforce the cooldown.");
+
+// bundler stores the cooldown as a plain integer number of days, quoted in the
+// YAML config (e.g. `BUNDLE_COOLDOWN: "7"`). Accept it with or without quotes.
+function parseDays(value) {
+  if (value === null) return null;
+  const m = value.match(/^"?\s*(\d+)\s*"?$/);
+  return m ? Number(m[1]) : null;
+}
+
+export async function read(ctx) {
+  const p = path(ctx);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key, { sep: SEP });
+  return { path: p, configured: value, days: parseDays(value), extras: [] };
+}
+
+export async function write(days, ctx) {
+  const p = path(ctx);
+  const text = setKey(await readSafe(p), key, `${key}: "${days}"`, { sep: SEP });
+  await writeAtomic(p, text);
+  return { path: p };
+}
+
+export async function unset(ctx) {
+  const p = path(ctx);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key, { sep: SEP });
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/npm.mjs

@@ -9,7 +9,9 @@ export const key = "min-release-age";
 export const docs = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age";
 export const minBin = [11, 10, 0];
 export const extras = [
-  { key: "audit-level", expected: "high", line: "audit-level=high" }
+  { key: "audit-level", expected: "high", line: "audit-level=high" },
+  { key: "allow-git", expected: "root", line: "allow-git=root" },
+  { key: "allow-remote", expected: "root", line: "allow-remote=root" }
 ];
 
 export function path(ctx) { return npmrcPath(ctx.env, ctx.home); }

package/src/tools/yarn.mjs

@@ -10,7 +10,8 @@ export const docs = "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate"
 export const minBin = [4, 10, 0];
 const SEP = ":";
 export const extras = [
-  { key: "enableHardenedMode", expected: "true", line: "enableHardenedMode: true", sep: SEP }
+  { key: "enableHardenedMode", expected: "true", line: "enableHardenedMode: true", sep: SEP },
+  { key: "enableScripts", expected: "false", line: "enableScripts: false", sep: SEP }
 ];
 
 export function path(ctx) { return yarnrcPath(ctx.env, ctx.home); }

package/src/util/paths.mjs

@@ -42,6 +42,15 @@ export function cargoConfigPath(env = process.env, home = homedir()) {
   return join(home, ".cargo", "config.toml");
 }
 
+// Bundler's global config. BUNDLE_USER_CONFIG points at the file directly;
+// BUNDLE_USER_HOME points at the home dir (config lives at <home>/config).
+// Both default to ~/.bundle, matching bundler's own resolution order.
+export function bundleConfigPath(env = process.env, home = homedir()) {
+  if (env.BUNDLE_USER_CONFIG) return env.BUNDLE_USER_CONFIG;
+  if (env.BUNDLE_USER_HOME) return join(env.BUNDLE_USER_HOME, "config");
+  return join(home, ".bundle", "config");
+}
+
 export function miseConfigPath(env = process.env, home = homedir(), platform = process.platform) {
   if (env.MISE_GLOBAL_CONFIG_FILE) return env.MISE_GLOBAL_CONFIG_FILE;
   if (platform === "win32") {

package/src/util/version.mjs

@@ -34,8 +34,9 @@ export function gte(v, target) {
 }
 
 export function buildPreflight(name, minBin, suffix) {
-  return () => {
-    const v = detectVersion(name);
+  const overrideKey = `PMSEC_${name.toUpperCase()}_VERSION`;
+  return (ctx) => {
+    const v = detectVersion(name, ["--version"], { env: ctx?.env, overrideKey });
     if (v === null) return { ok: true, message: null };
     if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
     return { ok: true, warn: true, version: v.raw,