pmsec 0.11.0 → 0.14.0

package/README.md

@@ -1,7 +1,7 @@
 # pmsec (Node)
 
 Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun,
-cargo, mise, and uv. One command flips on every safe-by-default knob each
+cargo, mise, uv, and bundler. One command flips on every safe-by-default knob each
 package manager exposes — install cooldown, signature trust policy, lockfile
 re-verification, build-script attestation, and more.
 
@@ -38,7 +38,7 @@ Zero runtime dependencies, ESM, requires Node 22+.
 | `pmsec --disable` | Remove every key the bundle set; other keys in the file are preserved. |
 | `pmsec --version` | Print the installed pmsec version. |
 
-Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 1-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`. `--check` and `--disable` are mutually exclusive.
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv,bundler`, `--days N` (override the 1-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`. `--check` and `--disable` are mutually exclusive.
 
 When the target file is owned by another user (typical: `~/.npmrc` left
 root-owned by an old `sudo npm config set`), the write fails with `EACCES`

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "pmsec",
-  "version": "0.11.0",
+  "version": "0.14.0",
   "publishConfig": {
     "access": "public"
   },
-  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, and uv.",
+  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, uv, and bundler.",
   "homepage": "https://github.com/HikaruEgashira/pmsec#readme",
   "repository": {
     "type": "git",

package/src/cli.mjs

@@ -9,8 +9,9 @@ import * as bun from "./tools/bun.mjs";
 import * as cargo from "./tools/cargo.mjs";
 import * as mise from "./tools/mise.mjs";
 import * as uv from "./tools/uv.mjs";
+import * as bundler from "./tools/bundler.mjs";
 
-const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv];
+const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv, bundler];
 // Default cooldown for the hardening bundle. Override per-invocation with
 // `--days N`; the default tracks the safest value we'd recommend.
 const BUNDLE_DAYS = 1;
@@ -21,15 +22,15 @@ export const VERSION = JSON.parse(
 const USAGE = `pmsec [options]
 
 Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
-bun, cargo, mise, uv. Default action enables every safe-by-default key
-each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
+bun, cargo, mise, uv, bundler. Default action enables every safe-by-default
+key each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
 attestation re-verification, ...). No knobs.
 
 Options:
   --check               Verify the bundle is in place (exit 1 if anything missing)
   --disable             Remove the hardening bundle from selected tools
-  --doctor              Diagnose effective paths/owner/uid (read-only; for MDM debugging)
-  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
+  --doctor              Diagnose effective paths/owner/uid (read-only; for unattended-deployment debugging)
+  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv,bundler)
   --days N              Override cooldown days (default 1)
   --force               Overwrite stricter existing cooldowns (otherwise enable is monotonic)
   --json                Emit JSON output
@@ -135,9 +136,9 @@ async function runCheck(targets, { json, days }, ctx, out, err) {
 
 // `pmsec doctor` runs read-only and reports the same path resolution that
 // enable/check/disable would do, plus identity (uid/euid) and parent-dir
-// writability — the smallest set of facts an MDM operator needs to diagnose
-// "pmsec ran but wrote to nowhere" (root's $HOME) or "wrote a file no one can
-// read" (chown failed under SIP/SELinux). Never mutates the filesystem.
+// writability — the smallest set of facts an operator needs to diagnose
+// "pmsec ran but wrote to nowhere" (root's $HOME) or "wrote a file no one
+// can read" (chown failed under SIP/SELinux). Never mutates the filesystem.
 function probePath(p, uid) {
   const parent = dirname(p);
   let exists = false, writable = false, parentExists = false, owner = null;

package/src/tools/bun.mjs

@@ -1,6 +1,7 @@
 import { bunConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
 import { buildPreflight } from "../util/version.mjs";
 
 export const name = "bun";
@@ -8,7 +9,9 @@ export const key = "minimumReleaseAge";
 export const section = "install";
 export const docs = "https://bun.com/docs/runtime/bunfig#install";
 export const minBin = [1, 3, 0];
-export const extras = [];
+export const extras = [
+  { key: "ignoreScripts", expected: "true", line: "ignoreScripts = true", section },
+];
 
 export function path(ctx) { return bunConfigPath(ctx.env, ctx.home); }
 
@@ -20,12 +23,17 @@ export async function read(ctx) {
   const raw = await readSafe(p);
   const value = readKey(raw, key, { section });
   const seconds = value === null ? null : Number(value);
-  return { path: p, configured: value, days: seconds === null || Number.isNaN(seconds) ? null : Math.floor(seconds / 86400), extras: [] };
+  return {
+    path: p, configured: value,
+    days: seconds === null || Number.isNaN(seconds) ? null : Math.floor(seconds / 86400),
+    extras: readExtras(raw, extras),
+  };
 }
 
 export async function write(days, ctx) {
   const p = path(ctx);
-  const text = setKey(await readSafe(p), key, `${key} = ${days * 86400}`, { section });
+  let text = setKey(await readSafe(p), key, `${key} = ${days * 86400}`, { section });
+  text = applyExtras(text, extras);
   await writeAtomic(p, text);
   return { path: p };
 }
@@ -33,7 +41,9 @@ export async function write(days, ctx) {
 export async function unset(ctx) {
   const p = path(ctx);
   const before = await readSafe(p);
-  const { text: after, removed } = removeKey(before, key, { section });
-  if (removed) await writeAtomic(p, after);
+  const cooldown = removeKey(before, key, { section });
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
   return { path: p, removed };
 }

package/src/tools/bundler.mjs

@@ -0,0 +1,46 @@
+import { bundleConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { buildPreflight } from "../util/version.mjs";
+
+export const name = "bundler";
+export const key = "BUNDLE_COOLDOWN";
+export const docs = "https://bundler.io/man/bundle-config.1.html";
+export const minBin = [4, 0, 13];
+export const extras = [];
+const SEP = ":";
+
+export function path(ctx) { return bundleConfigPath(ctx.env, ctx.home); }
+
+export const preflight = buildPreflight(name, minBin,
+  "BUNDLE_COOLDOWN is silently ignored. Upgrade bundler (v4.0.13+) to enforce the cooldown.");
+
+// bundler stores the cooldown as a plain integer number of days, quoted in the
+// YAML config (e.g. `BUNDLE_COOLDOWN: "7"`). Accept it with or without quotes.
+function parseDays(value) {
+  if (value === null) return null;
+  const m = value.match(/^"?\s*(\d+)\s*"?$/);
+  return m ? Number(m[1]) : null;
+}
+
+export async function read(ctx) {
+  const p = path(ctx);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key, { sep: SEP });
+  return { path: p, configured: value, days: parseDays(value), extras: [] };
+}
+
+export async function write(days, ctx) {
+  const p = path(ctx);
+  const text = setKey(await readSafe(p), key, `${key}: "${days}"`, { sep: SEP });
+  await writeAtomic(p, text);
+  return { path: p };
+}
+
+export async function unset(ctx) {
+  const p = path(ctx);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key, { sep: SEP });
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/mise.mjs

@@ -9,7 +9,8 @@ export const section = "settings";
 export const docs = "https://mise.jdx.dev/configuration/settings.html#minimum_release_age";
 export const minBin = [2026, 4, 22];
 export const extras = [
-  { key: "paranoid", expected: "true", line: "paranoid = true", section }
+  { key: "paranoid", expected: "true", line: "paranoid = true", section },
+  { key: "gpg_verify", expected: "true", line: "gpg_verify = true", section },
 ];
 
 export function path(ctx) { return miseConfigPath(ctx.env, ctx.home, ctx.platform); }

package/src/tools/npm.mjs

@@ -9,7 +9,11 @@ export const key = "min-release-age";
 export const docs = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age";
 export const minBin = [11, 10, 0];
 export const extras = [
-  { key: "audit-level", expected: "high", line: "audit-level=high" }
+  { key: "audit-level", expected: "high", line: "audit-level=high" },
+  { key: "allow-git", expected: "root", line: "allow-git=root" },
+  { key: "allow-remote", expected: "root", line: "allow-remote=root" },
+  { key: "allow-file", expected: "root", line: "allow-file=root" },
+  { key: "allow-directory", expected: "root", line: "allow-directory=root" },
 ];
 
 export function path(ctx) { return npmrcPath(ctx.env, ctx.home); }

package/src/tools/uv.mjs

@@ -1,13 +1,16 @@
 import { uvConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
 import { buildPreflight } from "../util/version.mjs";
 
 export const name = "uv";
 export const key = "exclude-newer";
 export const docs = "https://docs.astral.sh/uv/reference/settings/#exclude-newer";
 export const minBin = [0, 9, 17];
-export const extras = [];
+export const extras = [
+  { key: "index-strategy", expected: '"first-index"', line: 'index-strategy = "first-index"' },
+];
 
 export function path(ctx) { return uvConfigPath(ctx.env, ctx.home, ctx.platform); }
 
@@ -26,12 +29,13 @@ export async function read(ctx) {
   const p = path(ctx);
   const raw = await readSafe(p);
   const value = readKey(raw, key);
-  return { path: p, configured: value, days: parseDays(value), extras: [] };
+  return { path: p, configured: value, days: parseDays(value), extras: readExtras(raw, extras) };
 }
 
 export async function write(days, ctx) {
   const p = path(ctx);
-  const text = setKey(await readSafe(p), key, `${key} = "${days} days"`);
+  let text = setKey(await readSafe(p), key, `${key} = "${days} days"`);
+  text = applyExtras(text, extras);
   await writeAtomic(p, text);
   return { path: p };
 }
@@ -39,7 +43,9 @@ export async function write(days, ctx) {
 export async function unset(ctx) {
   const p = path(ctx);
   const before = await readSafe(p);
-  const { text: after, removed } = removeKey(before, key);
-  if (removed) await writeAtomic(p, after);
+  const cooldown = removeKey(before, key);
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
   return { path: p, removed };
 }

package/src/tools/yarn.mjs

@@ -10,7 +10,8 @@ export const docs = "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate"
 export const minBin = [4, 10, 0];
 const SEP = ":";
 export const extras = [
-  { key: "enableHardenedMode", expected: "true", line: "enableHardenedMode: true", sep: SEP }
+  { key: "enableHardenedMode", expected: "true", line: "enableHardenedMode: true", sep: SEP },
+  { key: "enableScripts", expected: "false", line: "enableScripts: false", sep: SEP }
 ];
 
 export function path(ctx) { return yarnrcPath(ctx.env, ctx.home); }

package/src/util/paths.mjs

@@ -42,6 +42,15 @@ export function cargoConfigPath(env = process.env, home = homedir()) {
   return join(home, ".cargo", "config.toml");
 }
 
+// Bundler's global config. BUNDLE_USER_CONFIG points at the file directly;
+// BUNDLE_USER_HOME points at the home dir (config lives at <home>/config).
+// Both default to ~/.bundle, matching bundler's own resolution order.
+export function bundleConfigPath(env = process.env, home = homedir()) {
+  if (env.BUNDLE_USER_CONFIG) return env.BUNDLE_USER_CONFIG;
+  if (env.BUNDLE_USER_HOME) return join(env.BUNDLE_USER_HOME, "config");
+  return join(home, ".bundle", "config");
+}
+
 export function miseConfigPath(env = process.env, home = homedir(), platform = process.platform) {
   if (env.MISE_GLOBAL_CONFIG_FILE) return env.MISE_GLOBAL_CONFIG_FILE;
   if (platform === "win32") {

package/src/util/version.mjs

@@ -34,8 +34,9 @@ export function gte(v, target) {
 }
 
 export function buildPreflight(name, minBin, suffix) {
-  return () => {
-    const v = detectVersion(name);
+  const overrideKey = `PMSEC_${name.toUpperCase()}_VERSION`;
+  return (ctx) => {
+    const v = detectVersion(name, ["--version"], { env: ctx?.env, overrideKey });
     if (v === null) return { ok: true, message: null };
     if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
     return { ok: true, warn: true, version: v.raw,