pmsec 0.3.0 → 0.4.1

package/README.md

@@ -28,7 +28,7 @@ npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check
 uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
 ```
 
-Zero runtime dependencies, ESM, requires Node 20+.
+Zero-config install-time supply-chain hardening (cooldown + audit-level + trust-policy + …) across npm, pnpm, yarn, bun, cargo, mise, uv. Zero runtime dependencies, ESM, requires Node 22+.
 
 ## Commands
 
@@ -37,13 +37,14 @@ Zero runtime dependencies, ESM, requires Node 20+.
 | `pmsec check [--min N]` | Read each tool's config; exit 1 if any tool is below `N` days or unset. |
 | `pmsec set <DAYS>` | Write `DAYS`-day cooldown to every selected tool. Always proceeds; if the runtime is too old to honor the key, prints a `⚠` line under the success line. |
 | `pmsec unset` | Remove only the cooldown key from each config (other keys preserved). |
+| `pmsec --version` | Print the installed pmsec version. |
 
 Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--json`.
 
 When the target file is owned by another user (typical: `~/.npmrc` left
-root-owned by an old `sudo npm config set`), pmsec auto-runs
-`sudo chown $(id -u):$(id -g) <path>` and retries the write. You'll be
-prompted for your password once; subsequent runs need no escalation.
+root-owned by an old `sudo npm config set`), the write fails with `EACCES`
+and pmsec prints the exact `chown` command needed to restore ownership —
+re-run after applying it. pmsec never escalates privileges itself.
 
 See the [project README](https://github.com/HikaruEgashira/pmsec) for the
 full table of keys, units, paths, and environment overrides.

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "pmsec",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "publishConfig": {
     "access": "public"
   },
-  "description": "Inspect and apply install-time cooldown (min-release-age / exclude-newer) for npm and uv.",
+  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, and uv.",
   "homepage": "https://github.com/HikaruEgashira/pmsec#readme",
   "repository": {
     "type": "git",
@@ -17,7 +17,7 @@
   "type": "module",
   "license": "MIT",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "bin": {
     "pmsec": "./bin/cli.mjs"
@@ -36,6 +36,11 @@
     "min-release-age",
     "exclude-newer",
     "npm",
+    "pnpm",
+    "yarn",
+    "bun",
+    "cargo",
+    "mise",
     "uv",
     "pmsec"
   ]

package/src/cli.mjs

@@ -1,4 +1,5 @@
 import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
 import * as npm from "./tools/npm.mjs";
 import * as pnpm from "./tools/pnpm.mjs";
 import * as yarn from "./tools/yarn.mjs";
@@ -9,18 +10,27 @@ import * as uv from "./tools/uv.mjs";
 
 const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv];
 const DEFAULT_MIN = 7;
+export const VERSION = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8")
+).version;
 
 const USAGE = `pmsec <command> [options]
 
+Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
+bun, cargo, mise, uv. Each \`set\` writes the cooldown plus every safe-by-
+default key the tool exposes (audit-level, trust-policy, hardened mode,
+attestation re-verification, ...).
+
 Commands:
-  check                 Inspect cooldown settings (exit 1 if any tool below --min)
-  set <DAYS>            Apply DAYS-day cooldown to all selected tools
-  unset                 Remove cooldown settings from selected tools
+  check                 Inspect hardening state (exit 1 if cooldown < --min or any extra unset)
+  set <DAYS>            Apply DAYS-day cooldown + the hardening bundle to all selected tools
+  unset                 Remove the cooldown + hardening bundle from selected tools
 
 Options:
   --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
   --min DAYS            Minimum acceptable days for check (default ${DEFAULT_MIN})
   --json                Emit JSON output
+  -V, --version         Show version
   -h, --help            Show this help
 
 Examples:
@@ -30,11 +40,12 @@ Examples:
 `;
 
 function parse(argv) {
-  const opts = { command: null, days: null, min: DEFAULT_MIN, json: false, only: null, help: false };
+  const opts = { command: null, days: null, min: DEFAULT_MIN, json: false, only: null, help: false, version: false };
   const positional = [];
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "-h" || a === "--help") opts.help = true;
+    else if (a === "-V" || a === "--version") opts.version = true;
     else if (a === "--json") opts.json = true;
     else if (a === "--min") opts.min = Number(argv[++i]);
     else if (a.startsWith("--min=")) opts.min = Number(a.slice(6));
@@ -65,7 +76,12 @@ function preflightWarn(t) {
 async function gatherStatus(targets, env, home, platform) {
   return Promise.all(targets.map(async t => {
     const r = await t.read(env, home, platform);
-    return { tool: t.name, key: t.key, path: r.path, configured: r.configured, days: r.days, warn: preflightWarn(t) };
+    return {
+      tool: t.name, key: t.key, path: r.path,
+      configured: r.configured, days: r.days,
+      extras: r.extras ?? [],
+      warn: preflightWarn(t)
+    };
   }));
 }
 
@@ -76,17 +92,25 @@ function renderHuman(rows, min) {
     const value = r.configured ?? "(unset)";
     const tail = r.warn ? `\n       ⚠ ${r.warn}` : "";
     lines.push(`${status} ${r.tool.padEnd(4)} ${r.key} = ${value}  [${r.path}]${tail}`);
+    for (const e of r.extras) {
+      const exStatus = e.configured === null ? "MISSING" : e.ok ? "OK     " : "STALE  ";
+      const exValue = e.configured ?? "(unset)";
+      lines.push(`${exStatus} ${r.tool.padEnd(4)} ${e.key} = ${exValue}  [${r.path}]`);
+    }
   }
   return lines.join("\n") + "\n";
 }
 
 async function runCheck(targets, { min, json }, env, home, platform, out, err) {
   const rows = await gatherStatus(targets, env, home, platform);
-  const failing = rows.filter(r => r.days === null || r.days < min);
-  if (json) out.write(JSON.stringify({ min, rows, ok: failing.length === 0 }, null, 2) + "\n");
+  const failingPrimary = rows.filter(r => r.days === null || r.days < min);
+  const failingExtras = rows.flatMap(r => r.extras.filter(e => !e.ok));
+  const ok = failingPrimary.length === 0 && failingExtras.length === 0;
+  if (json) out.write(JSON.stringify({ min, rows, ok }, null, 2) + "\n");
   else out.write(renderHuman(rows, min));
-  if (failing.length) err.write(`pmsec: ${failing.length} tool(s) below ${min} days\n`);
-  return failing.length ? 1 : 0;
+  if (failingPrimary.length) err.write(`pmsec: ${failingPrimary.length} tool(s) below ${min} days\n`);
+  if (failingExtras.length) err.write(`pmsec: ${failingExtras.length} hardening setting(s) not at safe value\n`);
+  return ok ? 0 : 1;
 }
 
 function shQuote(s) { return s ? `'${String(s).replace(/'/g, `'\\''`)}'` : ""; }
@@ -102,7 +126,10 @@ function explainFsError(e, tool) {
 }
 
 async function runSet(targets, days, json, env, home, platform, out, err) {
-  if (!Number.isInteger(days) || days <= 0) throw new Error(`set requires integer DAYS > 0`);
+  if (!Number.isInteger(days) || days <= 0) {
+    err.write(`pmsec: set requires integer DAYS > 0\n`);
+    return 2;
+  }
   const results = [];
   const failures = [];
   const warnings = [];
@@ -162,6 +189,7 @@ export async function run(argv, {
   let opts;
   try { opts = parse(argv); }
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
+  if (opts.version) { out.write(`pmsec ${VERSION}\n`); return 0; }
   if (opts.help || !opts.command) { out.write(USAGE); return opts.help ? 0 : 2; }
   let targets;
   try { targets = selectTools(opts.only); }

package/src/tools/bun.mjs

@@ -8,6 +8,7 @@ export const key = "minimumReleaseAge";
 export const section = "install";
 export const docs = "https://bun.com/docs/runtime/bunfig#install";
 export const minBin = [1, 3, 0];
+export const extras = [];
 
 export function path(env, home) { return bunConfigPath(env, home); }
 
@@ -23,7 +24,7 @@ export async function read(env, home) {
   const raw = await readSafe(p);
   const value = readKey(raw, key, { section });
   const seconds = value === null ? null : Number(value);
-  return { path: p, configured: value, days: seconds === null || Number.isNaN(seconds) ? null : Math.floor(seconds / 86400) };
+  return { path: p, configured: value, days: seconds === null || Number.isNaN(seconds) ? null : Math.floor(seconds / 86400), extras: [] };
 }
 
 export async function write(days, env, home) {

package/src/tools/cargo.mjs

@@ -6,6 +6,7 @@ export const name = "cargo";
 export const key = "minimum-release-age";
 export const section = "install";
 export const docs = "https://rust-lang.github.io/rfcs/3801-package-cooldown.html";
+export const extras = [];
 
 export function path(env, home) { return cargoConfigPath(env, home); }
 
@@ -21,7 +22,7 @@ export async function read(env, home) {
   const p = path(env, home);
   const raw = await readSafe(p);
   const value = readKey(raw, key, { section });
-  return { path: p, configured: value, days: parseDays(value) };
+  return { path: p, configured: value, days: parseDays(value), extras: [] };
 }
 
 export async function write(days, env, home) {

package/src/tools/mise.mjs

@@ -1,12 +1,16 @@
 import { miseConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
 import { detectVersion, gte } from "../util/version.mjs";
 export const name = "mise";
 export const key = "minimum_release_age";
 export const section = "settings";
 export const docs = "https://mise.jdx.dev/configuration/settings.html#minimum_release_age";
 export const minBin = [2026, 4, 22];
+export const extras = [
+  { key: "paranoid", expected: "true", line: "paranoid = true", section }
+];
 
 export function path(env, home, platform) { return miseConfigPath(env, home, platform); }
 
@@ -33,13 +37,17 @@ export async function read(env, home, platform) {
   const p = path(env, home, platform);
   const raw = await readSafe(p);
   const value = readKey(raw, key, { section });
-  return { path: p, configured: value, days: parseDays(value) };
+  return {
+    path: p, configured: value, days: parseDays(value),
+    extras: readExtras(raw, extras)
+  };
 }
 
 export async function write(days, env, home, platform) {
   const p = path(env, home, platform);
   const before = await readSafe(p);
-  const after = setKey(before, key, `${key} = "${days}d"`, { section });
+  let after = setKey(before, key, `${key} = "${days}d"`, { section });
+  after = applyExtras(after, extras);
   await writeAtomic(p, after);
   return { path: p, before, after };
 }
@@ -47,7 +55,9 @@ export async function write(days, env, home, platform) {
 export async function unset(env, home, platform) {
   const p = path(env, home, platform);
   const before = await readSafe(p);
-  const { text: after, removed } = removeKey(before, key, { section });
-  if (removed) await writeAtomic(p, after);
+  const cooldown = removeKey(before, key, { section });
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
   return { path: p, removed };
 }

package/src/tools/npm.mjs

@@ -1,12 +1,16 @@
 import { npmrcPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
 import { detectVersion, gte } from "../util/version.mjs";
 
 export const name = "npm";
 export const key = "min-release-age";
 export const docs = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age";
 export const minBin = [11, 10, 0];
+export const extras = [
+  { key: "audit-level", expected: "high", line: "audit-level=high" }
+];
 
 export function path(env, home) { return npmrcPath(env, home); }
 
@@ -21,13 +25,18 @@ export async function read(env, home) {
   const p = path(env, home);
   const raw = await readSafe(p);
   const value = readKey(raw, key);
-  return { path: p, configured: value, days: value === null ? null : Number(value) };
+  return {
+    path: p, configured: value,
+    days: value === null ? null : Number(value),
+    extras: readExtras(raw, extras)
+  };
 }
 
 export async function write(days, env, home) {
   const p = path(env, home);
   const before = await readSafe(p);
-  const after = setKey(before, key, `${key}=${days}`);
+  let after = setKey(before, key, `${key}=${days}`);
+  after = applyExtras(after, extras);
   await writeAtomic(p, after);
   return { path: p, before, after };
 }
@@ -35,7 +44,9 @@ export async function write(days, env, home) {
 export async function unset(env, home) {
   const p = path(env, home);
   const before = await readSafe(p);
-  const { text: after, removed } = removeKey(before, key);
-  if (removed) await writeAtomic(p, after);
+  const cooldown = removeKey(before, key);
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
   return { path: p, removed };
 }

package/src/tools/pnpm.mjs

@@ -1,12 +1,17 @@
 import { npmrcPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
 import { detectVersion, gte } from "../util/version.mjs";
 
 export const name = "pnpm";
 export const key = "minimum-release-age";
 export const docs = "https://pnpm.io/settings#minimumreleaseage";
 export const minBin = [10, 6, 0];
+export const extras = [
+  { key: "trust-policy", expected: "no-downgrade", line: "trust-policy=no-downgrade" },
+  { key: "block-exotic-subdeps", expected: "true", line: "block-exotic-subdeps=true" }
+];
 
 export function path(env, home) { return npmrcPath(env, home); }
 
@@ -22,13 +27,18 @@ export async function read(env, home) {
   const raw = await readSafe(p);
   const value = readKey(raw, key);
   const minutes = value === null ? null : Number(value);
-  return { path: p, configured: value, days: minutes === null || Number.isNaN(minutes) ? null : Math.floor(minutes / (60 * 24)) };
+  return {
+    path: p, configured: value,
+    days: minutes === null || Number.isNaN(minutes) ? null : Math.floor(minutes / (60 * 24)),
+    extras: readExtras(raw, extras)
+  };
 }
 
 export async function write(days, env, home) {
   const p = path(env, home);
   const before = await readSafe(p);
-  const after = setKey(before, key, `${key}=${days * 24 * 60}`);
+  let after = setKey(before, key, `${key}=${days * 24 * 60}`);
+  after = applyExtras(after, extras);
   await writeAtomic(p, after);
   return { path: p, before, after };
 }
@@ -36,7 +46,9 @@ export async function write(days, env, home) {
 export async function unset(env, home) {
   const p = path(env, home);
   const before = await readSafe(p);
-  const { text: after, removed } = removeKey(before, key);
-  if (removed) await writeAtomic(p, after);
+  const cooldown = removeKey(before, key);
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
   return { path: p, removed };
 }

package/src/tools/uv.mjs

@@ -7,6 +7,7 @@ export const name = "uv";
 export const key = "exclude-newer";
 export const docs = "https://docs.astral.sh/uv/reference/settings/#exclude-newer";
 export const minBin = [0, 9, 17];
+export const extras = [];
 
 export function path(env, home, platform) { return uvConfigPath(env, home, platform); }
 
@@ -29,7 +30,7 @@ export async function read(env, home, platform) {
   const p = path(env, home, platform);
   const raw = await readSafe(p);
   const value = readKey(raw, key);
-  return { path: p, configured: value, days: parseDays(value) };
+  return { path: p, configured: value, days: parseDays(value), extras: [] };
 }
 
 export async function write(days, env, home, platform) {

package/src/tools/yarn.mjs

@@ -1,6 +1,7 @@
 import { yarnrcPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
 import { detectVersion, gte } from "../util/version.mjs";
 
 export const name = "yarn";
@@ -8,6 +9,9 @@ export const key = "npmMinimalAgeGate";
 export const docs = "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate";
 export const minBin = [4, 10, 0];
 const SEP = ":";
+export const extras = [
+  { key: "enableHardenedMode", expected: "true", line: "enableHardenedMode: true", sep: SEP }
+];
 
 export function path(env, home) { return yarnrcPath(env, home); }
 
@@ -30,13 +34,17 @@ export async function read(env, home) {
   const p = path(env, home);
   const raw = await readSafe(p);
   const value = readKey(raw, key, { sep: SEP });
-  return { path: p, configured: value, days: parseDays(value) };
+  return {
+    path: p, configured: value, days: parseDays(value),
+    extras: readExtras(raw, extras)
+  };
 }
 
 export async function write(days, env, home) {
   const p = path(env, home);
   const before = await readSafe(p);
-  const after = setKey(before, key, `${key}: "${days}d"`, { sep: SEP });
+  let after = setKey(before, key, `${key}: "${days}d"`, { sep: SEP });
+  after = applyExtras(after, extras);
   await writeAtomic(p, after);
   return { path: p, before, after };
 }
@@ -44,7 +52,9 @@ export async function write(days, env, home) {
 export async function unset(env, home) {
   const p = path(env, home);
   const before = await readSafe(p);
-  const { text: after, removed } = removeKey(before, key, { sep: SEP });
-  if (removed) await writeAtomic(p, after);
+  const cooldown = removeKey(before, key, { sep: SEP });
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
   return { path: p, removed };
 }

package/src/util/extras.mjs

@@ -0,0 +1,32 @@
+// Per-tool "extras" are fixed-value hardening keys written alongside the main
+// cooldown key on `set`, removed on `unset`, and validated on `check`.
+// Each entry: { key, expected, line, sep?, section? } — `line` is the verbatim
+// text to write (handles per-format quoting/typing); `expected` is the bare
+// value compared against readKey output.
+import { readKey, setKey, removeKey } from "./lines.mjs";
+
+export function readExtras(raw, extras) {
+  return extras.map(e => {
+    const cur = readKey(raw, e.key, { sep: e.sep, section: e.section });
+    return { key: e.key, configured: cur, expected: e.expected, ok: cur === e.expected };
+  });
+}
+
+export function applyExtras(text, extras) {
+  let out = text;
+  for (const e of extras) {
+    out = setKey(out, e.key, e.line, { sep: e.sep, section: e.section });
+  }
+  return out;
+}
+
+export function removeExtras(text, extras) {
+  let out = text;
+  let removed = false;
+  for (const e of extras) {
+    const r = removeKey(out, e.key, { sep: e.sep, section: e.section });
+    if (r.removed) removed = true;
+    out = r.text;
+  }
+  return { text: out, removed };
+}