pmsec 0.3.0

package/README.md

@@ -0,0 +1,53 @@
+# pmsec (Node)
+
+Cross-platform CLI that inspects and applies install-time cooldown settings
+(npm `min-release-age`, pnpm `minimum-release-age`, yarn `npmMinimalAgeGate`,
+bun `minimumReleaseAge`, cargo `minimum-release-age`, mise `minimum_release_age`,
+uv `exclude-newer`) so freshly-published, possibly-malicious packages can't
+land in your machine within hours of upload.
+
+## Install
+
+```bash
+npx pmsec check --min 7
+npx pmsec set 7
+npx pmsec unset
+```
+
+```bash
+uvx pmsec check --min 7
+uvx pmsec set 7
+uvx pmsec unset
+```
+
+If your environment already enforces cooldown (or routes through a proxy
+registry), bootstrap pmsec by overriding just for that call:
+
+```bash
+npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check
+uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
+```
+
+Zero runtime dependencies, ESM, requires Node 20+.
+
+## Commands
+
+| Command | Description |
+| --- | --- |
+| `pmsec check [--min N]` | Read each tool's config; exit 1 if any tool is below `N` days or unset. |
+| `pmsec set <DAYS>` | Write `DAYS`-day cooldown to every selected tool. Always proceeds; if the runtime is too old to honor the key, prints a `⚠` line under the success line. |
+| `pmsec unset` | Remove only the cooldown key from each config (other keys preserved). |
+
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--json`.
+
+When the target file is owned by another user (typical: `~/.npmrc` left
+root-owned by an old `sudo npm config set`), pmsec auto-runs
+`sudo chown $(id -u):$(id -g) <path>` and retries the write. You'll be
+prompted for your password once; subsequent runs need no escalation.
+
+See the [project README](https://github.com/HikaruEgashira/pmsec) for the
+full table of keys, units, paths, and environment overrides.
+
+## License
+
+MIT

package/bin/cli.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { run } from "../src/cli.mjs";
+process.exit(await run(process.argv.slice(2)));

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "pmsec",
+  "version": "0.3.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "Inspect and apply install-time cooldown (min-release-age / exclude-newer) for npm and uv.",
+  "homepage": "https://github.com/HikaruEgashira/pmsec#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HikaruEgashira/pmsec.git",
+    "directory": "node"
+  },
+  "bugs": {
+    "url": "https://github.com/HikaruEgashira/pmsec/issues"
+  },
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "pmsec": "./bin/cli.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test"
+  },
+  "keywords": [
+    "supply-chain",
+    "cooldown",
+    "min-release-age",
+    "exclude-newer",
+    "npm",
+    "uv",
+    "pmsec"
+  ]
+}

package/src/cli.mjs

@@ -0,0 +1,179 @@
+import { homedir } from "node:os";
+import * as npm from "./tools/npm.mjs";
+import * as pnpm from "./tools/pnpm.mjs";
+import * as yarn from "./tools/yarn.mjs";
+import * as bun from "./tools/bun.mjs";
+import * as cargo from "./tools/cargo.mjs";
+import * as mise from "./tools/mise.mjs";
+import * as uv from "./tools/uv.mjs";
+
+const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv];
+const DEFAULT_MIN = 7;
+
+const USAGE = `pmsec <command> [options]
+
+Commands:
+  check                 Inspect cooldown settings (exit 1 if any tool below --min)
+  set <DAYS>            Apply DAYS-day cooldown to all selected tools
+  unset                 Remove cooldown settings from selected tools
+
+Options:
+  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
+  --min DAYS            Minimum acceptable days for check (default ${DEFAULT_MIN})
+  --json                Emit JSON output
+  -h, --help            Show this help
+
+Examples:
+  npx pmsec check --min 7
+  npx pmsec set 7
+  npx pmsec unset --tool npm
+`;
+
+function parse(argv) {
+  const opts = { command: null, days: null, min: DEFAULT_MIN, json: false, only: null, help: false };
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h" || a === "--help") opts.help = true;
+    else if (a === "--json") opts.json = true;
+    else if (a === "--min") opts.min = Number(argv[++i]);
+    else if (a.startsWith("--min=")) opts.min = Number(a.slice(6));
+    else if (a === "--tool") opts.only = argv[++i].split(",");
+    else if (a.startsWith("--tool=")) opts.only = a.slice(7).split(",");
+    else if (a.startsWith("-")) throw new Error(`unknown flag: ${a}`);
+    else positional.push(a);
+  }
+  opts.command = positional[0] ?? null;
+  if (opts.command === "set") opts.days = Number(positional[1]);
+  return opts;
+}
+
+function selectTools(only) {
+  if (!only) return TOOLS;
+  const found = TOOLS.filter(t => only.includes(t.name));
+  const missing = only.filter(n => !TOOLS.some(t => t.name === n));
+  if (missing.length) throw new Error(`unknown tool(s): ${missing.join(",")}`);
+  return found;
+}
+
+function preflightWarn(t) {
+  if (typeof t.preflight !== "function") return null;
+  const pf = t.preflight();
+  return pf?.message ?? null;
+}
+
+async function gatherStatus(targets, env, home, platform) {
+  return Promise.all(targets.map(async t => {
+    const r = await t.read(env, home, platform);
+    return { tool: t.name, key: t.key, path: r.path, configured: r.configured, days: r.days, warn: preflightWarn(t) };
+  }));
+}
+
+function renderHuman(rows, min) {
+  const lines = [];
+  for (const r of rows) {
+    const status = r.days === null ? "MISSING" : r.days < min ? "STALE  " : "OK     ";
+    const value = r.configured ?? "(unset)";
+    const tail = r.warn ? `\n       ⚠ ${r.warn}` : "";
+    lines.push(`${status} ${r.tool.padEnd(4)} ${r.key} = ${value}  [${r.path}]${tail}`);
+  }
+  return lines.join("\n") + "\n";
+}
+
+async function runCheck(targets, { min, json }, env, home, platform, out, err) {
+  const rows = await gatherStatus(targets, env, home, platform);
+  const failing = rows.filter(r => r.days === null || r.days < min);
+  if (json) out.write(JSON.stringify({ min, rows, ok: failing.length === 0 }, null, 2) + "\n");
+  else out.write(renderHuman(rows, min));
+  if (failing.length) err.write(`pmsec: ${failing.length} tool(s) below ${min} days\n`);
+  return failing.length ? 1 : 0;
+}
+
+function shQuote(s) { return s ? `'${String(s).replace(/'/g, `'\\''`)}'` : ""; }
+
+function explainFsError(e, tool) {
+  if (e?.code === "EACCES" || e?.code === "EPERM") {
+    const p = e.path ?? "";
+    const q = shQuote(p);
+    return `${tool}: cannot write ${p} (${e.code}). Check file ownership: \`ls -la ${q}\` — if owned by root, run \`sudo chown -h $(id -u):$(id -g) ${q}\`.`;
+  }
+  if (e?.code === "EROFS") return `${tool}: ${e.path ?? ""} is on a read-only filesystem (EROFS).`;
+  return `${tool}: ${e?.message ?? e}`;
+}
+
+async function runSet(targets, days, json, env, home, platform, out, err) {
+  if (!Number.isInteger(days) || days <= 0) throw new Error(`set requires integer DAYS > 0`);
+  const results = [];
+  const failures = [];
+  const warnings = [];
+  for (const t of targets) {
+    const warn = preflightWarn(t);
+    if (warn) warnings.push({ tool: t.name, warn });
+    try {
+      const r = await t.write(days, env, home, platform);
+      results.push({ tool: t.name, path: r.path, days, ok: true, warn });
+    } catch (e) {
+      failures.push({ tool: t.name, error: explainFsError(e, t.name) });
+      results.push({ tool: t.name, path: e?.path ?? null, days, ok: false, error: explainFsError(e, t.name), warn });
+    }
+  }
+  if (json) out.write(JSON.stringify({ set: days, results, warnings, ok: failures.length === 0 }, null, 2) + "\n");
+  else for (const r of results) {
+    if (r.ok) {
+      const tail = r.warn ? `\n     ⚠ ${r.warn}` : "";
+      out.write(`set  ${r.tool.padEnd(4)} ${r.days} days  [${r.path}]${tail}\n`);
+    } else {
+      out.write(`FAIL ${r.tool.padEnd(4)} ${r.error}\n`);
+    }
+  }
+  for (const f of failures) err.write(`pmsec: ${f.error}\n`);
+  if (warnings.length) err.write(`pmsec: ${warnings.length} tool(s) configured but runtime may silently ignore the cooldown — see ⚠ above\n`);
+  return failures.length ? 1 : 0;
+}
+
+async function runUnset(targets, json, env, home, platform, out, err) {
+  const results = [];
+  const failures = [];
+  for (const t of targets) {
+    try {
+      const r = await t.unset(env, home, platform);
+      results.push({ tool: t.name, path: r.path, removed: r.removed, ok: true });
+    } catch (e) {
+      failures.push({ tool: t.name, error: explainFsError(e, t.name) });
+      results.push({ tool: t.name, path: e?.path ?? null, removed: false, ok: false, error: explainFsError(e, t.name) });
+    }
+  }
+  if (json) out.write(JSON.stringify({ results, ok: failures.length === 0 }, null, 2) + "\n");
+  else for (const r of results) {
+    if (!r.ok) out.write(`FAIL ${r.tool.padEnd(4)} ${r.error}\n`);
+    else out.write(`${r.removed ? "rm  " : "skip"} ${r.tool.padEnd(4)} [${r.path}]\n`);
+  }
+  for (const f of failures) err.write(`pmsec: ${f.error}\n`);
+  return failures.length ? 1 : 0;
+}
+
+export async function run(argv, {
+  env = process.env,
+  home = homedir(),
+  platform = process.platform,
+  out = process.stdout,
+  err = process.stderr,
+} = {}) {
+  let opts;
+  try { opts = parse(argv); }
+  catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
+  if (opts.help || !opts.command) { out.write(USAGE); return opts.help ? 0 : 2; }
+  let targets;
+  try { targets = selectTools(opts.only); }
+  catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
+  try {
+    if (opts.command === "check") return await runCheck(targets, opts, env, home, platform, out, err);
+    if (opts.command === "set") return await runSet(targets, opts.days, opts.json, env, home, platform, out, err);
+    if (opts.command === "unset") return await runUnset(targets, opts.json, env, home, platform, out, err);
+    err.write(`pmsec: unknown command "${opts.command}"\n`);
+    return 2;
+  } catch (e) {
+    err.write(`pmsec: ${e.message}\n`);
+    return 1;
+  }
+}

package/src/tools/bun.mjs

@@ -0,0 +1,43 @@
+import { bunConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
+
+export const name = "bun";
+export const key = "minimumReleaseAge";
+export const section = "install";
+export const docs = "https://bun.com/docs/runtime/bunfig#install";
+export const minBin = [1, 3, 0];
+
+export function path(env, home) { return bunConfigPath(env, home); }
+
+export function preflight() {
+  const v = detectVersion("bun");
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `bun ${v.raw} < ${minBin.join(".")}: minimumReleaseAge is silently ignored. Upgrade bun to enforce the cooldown.` };
+}
+
+export async function read(env, home) {
+  const p = path(env, home);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key, { section });
+  const seconds = value === null ? null : Number(value);
+  return { path: p, configured: value, days: seconds === null || Number.isNaN(seconds) ? null : Math.floor(seconds / 86400) };
+}
+
+export async function write(days, env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key} = ${days * 86400}`, { section });
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key, { section });
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/cargo.mjs

@@ -0,0 +1,41 @@
+import { cargoConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+
+export const name = "cargo";
+export const key = "minimum-release-age";
+export const section = "install";
+export const docs = "https://rust-lang.github.io/rfcs/3801-package-cooldown.html";
+
+export function path(env, home) { return cargoConfigPath(env, home); }
+
+function parseDays(value) {
+  if (value === null) return null;
+  const m = value.match(/^"?\s*(\d+)\s*(d|days?|w|weeks?)\s*"?$/i);
+  if (!m) return null;
+  const n = Number(m[1]);
+  return /^(w|weeks?)$/i.test(m[2]) ? n * 7 : n;
+}
+
+export async function read(env, home) {
+  const p = path(env, home);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key, { section });
+  return { path: p, configured: value, days: parseDays(value) };
+}
+
+export async function write(days, env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key} = "${days}d"`, { section });
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key, { section });
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/mise.mjs

@@ -0,0 +1,53 @@
+import { miseConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
+export const name = "mise";
+export const key = "minimum_release_age";
+export const section = "settings";
+export const docs = "https://mise.jdx.dev/configuration/settings.html#minimum_release_age";
+export const minBin = [2026, 4, 22];
+
+export function path(env, home, platform) { return miseConfigPath(env, home, platform); }
+
+export function preflight() {
+  const v = detectVersion("mise");
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `mise ${v.raw} < ${minBin.join(".")}: setting was named install_before before 2026.4.22 and minimum_release_age is silently ignored on older mise. Upgrade mise (\`mise self-update\`) to enforce the cooldown.` };
+}
+
+function parseDays(value) {
+  if (value === null) return null;
+  const m = value.match(/^"?\s*(\d+)\s*(d|days?|w|weeks?|m|months?|y|years?)\s*"?$/i);
+  if (!m) return null;
+  const n = Number(m[1]);
+  const unit = m[2].toLowerCase();
+  if (/^(w|weeks?)$/.test(unit)) return n * 7;
+  if (/^(m|months?)$/.test(unit)) return n * 30;
+  if (/^(y|years?)$/.test(unit)) return n * 365;
+  return n;
+}
+
+export async function read(env, home, platform) {
+  const p = path(env, home, platform);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key, { section });
+  return { path: p, configured: value, days: parseDays(value) };
+}
+
+export async function write(days, env, home, platform) {
+  const p = path(env, home, platform);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key} = "${days}d"`, { section });
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home, platform) {
+  const p = path(env, home, platform);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key, { section });
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/npm.mjs

@@ -0,0 +1,41 @@
+import { npmrcPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
+
+export const name = "npm";
+export const key = "min-release-age";
+export const docs = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age";
+export const minBin = [11, 10, 0];
+
+export function path(env, home) { return npmrcPath(env, home); }
+
+export function preflight() {
+  const v = detectVersion("npm");
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `npm ${v.raw} < ${minBin.join(".")}: min-release-age is silently ignored. Upgrade npm to enforce the cooldown.` };
+}
+
+export async function read(env, home) {
+  const p = path(env, home);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key);
+  return { path: p, configured: value, days: value === null ? null : Number(value) };
+}
+
+export async function write(days, env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key}=${days}`);
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key);
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/pnpm.mjs

@@ -0,0 +1,42 @@
+import { npmrcPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
+
+export const name = "pnpm";
+export const key = "minimum-release-age";
+export const docs = "https://pnpm.io/settings#minimumreleaseage";
+export const minBin = [10, 6, 0];
+
+export function path(env, home) { return npmrcPath(env, home); }
+
+export function preflight() {
+  const v = detectVersion("pnpm");
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `pnpm ${v.raw} < ${minBin.join(".")}: minimum-release-age is silently ignored. Upgrade pnpm to enforce the cooldown.` };
+}
+
+export async function read(env, home) {
+  const p = path(env, home);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key);
+  const minutes = value === null ? null : Number(value);
+  return { path: p, configured: value, days: minutes === null || Number.isNaN(minutes) ? null : Math.floor(minutes / (60 * 24)) };
+}
+
+export async function write(days, env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key}=${days * 24 * 60}`);
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key);
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/uv.mjs

@@ -0,0 +1,49 @@
+import { uvConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
+
+export const name = "uv";
+export const key = "exclude-newer";
+export const docs = "https://docs.astral.sh/uv/reference/settings/#exclude-newer";
+export const minBin = [0, 9, 17];
+
+export function path(env, home, platform) { return uvConfigPath(env, home, platform); }
+
+export function preflight() {
+  const v = detectVersion("uv");
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `uv ${v.raw} < ${minBin.join(".")}: writing exclude-newer = "N days" will break this uv until you \`uv self update\` (file will fail to parse).` };
+}
+
+function parseDays(value) {
+  if (value === null) return null;
+  const m = value.match(/^"\s*(\d+)\s*(day|days|d|week|weeks|w)\s*"$/i);
+  if (!m) return null;
+  const n = Number(m[1]);
+  return /^(week|weeks|w)$/i.test(m[2]) ? n * 7 : n;
+}
+
+export async function read(env, home, platform) {
+  const p = path(env, home, platform);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key);
+  return { path: p, configured: value, days: parseDays(value) };
+}
+
+export async function write(days, env, home, platform) {
+  const p = path(env, home, platform);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key} = "${days} days"`);
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home, platform) {
+  const p = path(env, home, platform);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key);
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/tools/yarn.mjs

@@ -0,0 +1,50 @@
+import { yarnrcPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
+
+export const name = "yarn";
+export const key = "npmMinimalAgeGate";
+export const docs = "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate";
+export const minBin = [4, 10, 0];
+const SEP = ":";
+
+export function path(env, home) { return yarnrcPath(env, home); }
+
+export function preflight() {
+  const v = detectVersion("yarn");
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `yarn ${v.raw} < ${minBin.join(".")}: npmMinimalAgeGate is silently ignored. Upgrade yarn (v4.10+) to enforce the cooldown.` };
+}
+
+function parseDays(value) {
+  if (value === null) return null;
+  const m = value.match(/^"?\s*(\d+)\s*(d|days?|w|weeks?)\s*"?$/i);
+  if (!m) return null;
+  const n = Number(m[1]);
+  return /^(w|weeks?)$/i.test(m[2]) ? n * 7 : n;
+}
+
+export async function read(env, home) {
+  const p = path(env, home);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key, { sep: SEP });
+  return { path: p, configured: value, days: parseDays(value) };
+}
+
+export async function write(days, env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const after = setKey(before, key, `${key}: "${days}d"`, { sep: SEP });
+  await writeAtomic(p, after);
+  return { path: p, before, after };
+}
+
+export async function unset(env, home) {
+  const p = path(env, home);
+  const before = await readSafe(p);
+  const { text: after, removed } = removeKey(before, key, { sep: SEP });
+  if (removed) await writeAtomic(p, after);
+  return { path: p, removed };
+}

package/src/util/io.mjs

@@ -0,0 +1,81 @@
+import { mkdir, readFile, writeFile, rename, lstat, unlink, open } from "node:fs/promises";
+import { dirname, resolve, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { homedir } from "node:os";
+
+export async function readSafe(path) {
+  try { return await readFile(path, "utf8"); }
+  catch (e) { if (e.code === "ENOENT") return ""; throw e; }
+}
+
+function isPermErr(e) { return e?.code === "EACCES" || e?.code === "EPERM"; }
+
+async function isSymlink(p) {
+  try { return (await lstat(p)).isSymbolicLink(); }
+  catch { return false; }
+}
+
+function underHome(p, home) {
+  const r = resolve(p);
+  const h = resolve(home);
+  return r === h || r.startsWith(h + sep);
+}
+
+function shellQuote(s) { return `'${String(s).replace(/'/g, `'\\''`)}'`; }
+
+async function reclaim(path, home, err) {
+  if (process.platform === "win32" || typeof process.getuid !== "function") return false;
+  if (!existsSync(path)) return false;
+  if (await isSymlink(path)) {
+    err.write(`pmsec: refusing to chown symlink ${path}; remove or replace it manually.\n`);
+    return false;
+  }
+  if (!underHome(path, home)) {
+    err.write(`pmsec: refusing to chown ${path} outside HOME (${home}); fix ownership manually.\n`);
+    return false;
+  }
+  err.write(`pmsec: ${path} not writable; running \`sudo chown -h $(id -u):$(id -g) ${shellQuote(path)}\`. You may be prompted for your password.\n`);
+  const r = spawnSync("sudo", ["chown", "-h", `${process.getuid()}:${process.getgid()}`, path], { stdio: "inherit" });
+  return r.status === 0;
+}
+
+async function atomicReplace(path, text) {
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  let fh;
+  try {
+    fh = await open(tmp, "wx", 0o600);
+    await fh.writeFile(text, "utf8");
+    try { await fh.sync(); } catch {}
+    await fh.close();
+    fh = null;
+    await rename(tmp, path);
+  } catch (e) {
+    if (fh) { try { await fh.close(); } catch {} }
+    try { await unlink(tmp); } catch {}
+    throw e;
+  }
+}
+
+export async function writeAtomic(path, text, { backup = true, home = homedir(), err = process.stderr } = {}) {
+  await mkdir(dirname(path), { recursive: true });
+  if (existsSync(path) && await isSymlink(path)) {
+    const e = new Error(`refusing to write through symlink ${path}`);
+    e.code = "ELOOP";
+    throw e;
+  }
+  if (backup && existsSync(path) && !existsSync(path + ".bak")) {
+    try { await atomicReplace(path + ".bak", await readFile(path, "utf8")); }
+    catch (e) {
+      const target = existsSync(path + ".bak") ? path + ".bak" : path;
+      if (!isPermErr(e) || !(await reclaim(target, home, err))) throw e;
+      await atomicReplace(path + ".bak", await readFile(path, "utf8"));
+    }
+  }
+  try { await atomicReplace(path, text); }
+  catch (e) {
+    if (!isPermErr(e) || !(await reclaim(path, home, err))) throw e;
+    await atomicReplace(path, text);
+  }
+}

package/src/util/lines.mjs

@@ -0,0 +1,86 @@
+const SECTION = /^\s*\[[^\]]+\]\s*$/;
+
+function entryKey(line, sep) {
+  const re = sep === ":" ? /^\s*([A-Za-z0-9_.\-]+)\s*:/ : /^\s*([A-Za-z0-9_.\-]+)\s*=/;
+  const m = line.match(re);
+  return m ? m[1] : null;
+}
+
+function rangeForSection(lines, section) {
+  if (!section) {
+    for (let i = 0; i < lines.length; i++) if (SECTION.test(lines[i])) return [0, i];
+    return [0, lines.length];
+  }
+  const header = `[${section}]`;
+  let start = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].trim() === header) { start = i + 1; break; }
+  }
+  if (start < 0) return null;
+  let end = lines.length;
+  for (let i = start; i < lines.length; i++) {
+    if (SECTION.test(lines[i])) { end = i; break; }
+  }
+  return [start, end];
+}
+
+function indexOfKey(lines, range, key, sep) {
+  for (let i = range[0]; i < range[1]; i++) if (entryKey(lines[i], sep) === key) return i;
+  return -1;
+}
+
+function indexOfFirstSection(lines) {
+  for (let i = 0; i < lines.length; i++) if (SECTION.test(lines[i])) return i;
+  return -1;
+}
+
+export function readKey(text, key, opts = {}) {
+  const sep = opts.sep || "=";
+  const section = opts.section || null;
+  const lines = text.split(/\r?\n/);
+  const range = rangeForSection(lines, section);
+  if (range === null) return null;
+  const i = indexOfKey(lines, range, key, sep);
+  if (i < 0) return null;
+  const re = sep === ":" ? /^\s*[A-Za-z0-9_.\-]+\s*:\s*(.*?)\s*$/ : /^\s*[A-Za-z0-9_.\-]+\s*=\s*(.*?)\s*$/;
+  const m = lines[i].match(re);
+  return m ? m[1] : null;
+}
+
+export function setKey(text, key, valueLine, opts = {}) {
+  const sep = opts.sep || "=";
+  const section = opts.section || null;
+  const trailing = text.endsWith("\n") || text === "";
+  const lines = text === "" ? [] : text.replace(/\r?\n$/, "").split(/\r?\n/);
+  let range = rangeForSection(lines, section);
+  if (range === null) {
+    if (lines.length && lines[lines.length - 1] !== "") lines.push("");
+    lines.push(`[${section}]`, valueLine);
+  } else {
+    const idx = indexOfKey(lines, range, key, sep);
+    if (idx >= 0) {
+      lines[idx] = valueLine;
+    } else if (section) {
+      lines.splice(range[0], 0, valueLine);
+    } else {
+      const firstSec = indexOfFirstSection(lines);
+      if (firstSec < 0) lines.push(valueLine);
+      else lines.splice(firstSec, 0, valueLine, "");
+    }
+  }
+  return lines.join("\n") + (trailing || lines.length ? "\n" : "");
+}
+
+export function removeKey(text, key, opts = {}) {
+  const sep = opts.sep || "=";
+  const section = opts.section || null;
+  const trailing = text.endsWith("\n");
+  const lines = text === "" ? [] : text.replace(/\r?\n$/, "").split(/\r?\n/);
+  const range = rangeForSection(lines, section);
+  if (range === null) return { text, removed: false };
+  const idx = indexOfKey(lines, range, key, sep);
+  if (idx < 0) return { text, removed: false };
+  lines.splice(idx, 1);
+  if (idx < lines.length && lines[idx] === "") lines.splice(idx, 1);
+  return { text: lines.join("\n") + (trailing && lines.length ? "\n" : ""), removed: true };
+}

package/src/util/paths.mjs

@@ -0,0 +1,39 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function npmrcPath(env = process.env, home = homedir()) {
+  return env.NPM_CONFIG_USERCONFIG || join(home, ".npmrc");
+}
+
+export function uvConfigPath(env = process.env, home = homedir(), platform = process.platform) {
+  if (env.UV_CONFIG_FILE) return env.UV_CONFIG_FILE;
+  if (platform === "win32") {
+    const base = env.APPDATA || join(home, "AppData", "Roaming");
+    return join(base, "uv", "uv.toml");
+  }
+  const base = env.XDG_CONFIG_HOME || join(home, ".config");
+  return join(base, "uv", "uv.toml");
+}
+
+export function bunConfigPath(env = process.env, home = homedir()) {
+  return env.BUN_CONFIG_FILE || join(home, ".bunfig.toml");
+}
+
+export function yarnrcPath(env = process.env, home = homedir()) {
+  return env.YARN_RC_FILENAME || join(home, ".yarnrc.yml");
+}
+
+export function cargoConfigPath(env = process.env, home = homedir()) {
+  if (env.CARGO_HOME) return join(env.CARGO_HOME, "config.toml");
+  return join(home, ".cargo", "config.toml");
+}
+
+export function miseConfigPath(env = process.env, home = homedir(), platform = process.platform) {
+  if (env.MISE_GLOBAL_CONFIG_FILE) return env.MISE_GLOBAL_CONFIG_FILE;
+  if (platform === "win32") {
+    const base = env.LOCALAPPDATA || join(home, "AppData", "Local");
+    return join(base, "mise", "config.toml");
+  }
+  const base = env.XDG_CONFIG_HOME || join(home, ".config");
+  return join(base, "mise", "config.toml");
+}

package/src/util/version.mjs

@@ -0,0 +1,19 @@
+import { spawnSync } from "node:child_process";
+
+export function detectVersion(bin, args = ["--version"]) {
+  try {
+    const res = spawnSync(bin, args, { encoding: "utf8" });
+    if (res.status !== 0) return null;
+    const m = (res.stdout || "").match(/(\d+)\.(\d+)\.(\d+)/);
+    if (!m) return null;
+    return { major: +m[1], minor: +m[2], patch: +m[3], raw: m[0] };
+  } catch { return null; }
+}
+
+export function gte(v, target) {
+  if (!v) return null;
+  const [a, b, c] = target;
+  if (v.major !== a) return v.major > a;
+  if (v.minor !== b) return v.minor > b;
+  return v.patch >= c;
+}