pmsec 0.4.1 → 0.5.1

package/README.md

@@ -1,23 +1,22 @@
 # pmsec (Node)
 
-Cross-platform CLI that inspects and applies install-time cooldown settings
-(npm `min-release-age`, pnpm `minimum-release-age`, yarn `npmMinimalAgeGate`,
-bun `minimumReleaseAge`, cargo `minimum-release-age`, mise `minimum_release_age`,
-uv `exclude-newer`) so freshly-published, possibly-malicious packages can't
-land in your machine within hours of upload.
+Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun,
+cargo, mise, and uv. One command flips on every safe-by-default knob each
+package manager exposes — install cooldown, signature trust policy, lockfile
+re-verification, build-script attestation, and more.
 
 ## Install
 
 ```bash
-npx pmsec check --min 7
-npx pmsec set 7
-npx pmsec unset
+npx pmsec enable
+npx pmsec check
+npx pmsec disable
 ```
 
 ```bash
-uvx pmsec check --min 7
-uvx pmsec set 7
-uvx pmsec unset
+uvx pmsec enable
+uvx pmsec check
+uvx pmsec disable
 ```
 
 If your environment already enforces cooldown (or routes through a proxy
@@ -28,18 +27,18 @@ npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check
 uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
 ```
 
-Zero-config install-time supply-chain hardening (cooldown + audit-level + trust-policy + …) across npm, pnpm, yarn, bun, cargo, mise, uv. Zero runtime dependencies, ESM, requires Node 22+.
+Zero runtime dependencies, ESM, requires Node 22+.
 
 ## Commands
 
 | Command | Description |
 | --- | --- |
-| `pmsec check [--min N]` | Read each tool's config; exit 1 if any tool is below `N` days or unset. |
-| `pmsec set <DAYS>` | Write `DAYS`-day cooldown to every selected tool. Always proceeds; if the runtime is too old to honor the key, prints a `⚠` line under the success line. |
-| `pmsec unset` | Remove only the cooldown key from each config (other keys preserved). |
+| `pmsec enable` | Write the hardening bundle (3-day cooldown + per-tool extras) to every selected tool's user config. |
+| `pmsec check` | Read each tool's config; exit 1 if any row is missing or below the bundled value. |
+| `pmsec disable` | Remove every key the bundle set; other keys in the file are preserved. |
 | `pmsec --version` | Print the installed pmsec version. |
 
-Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--json`.
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 3-day default), `--json`.
 
 When the target file is owned by another user (typical: `~/.npmrc` left
 root-owned by an old `sudo npm config set`), the write fails with `EACCES`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -9,7 +9,9 @@ import * as mise from "./tools/mise.mjs";
 import * as uv from "./tools/uv.mjs";
 
 const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv];
-const DEFAULT_MIN = 7;
+// Default cooldown for the hardening bundle. Override per-invocation with
+// `--days N`; the default tracks the safest value we'd recommend.
+const BUNDLE_DAYS = 3;
 export const VERSION = JSON.parse(
   readFileSync(new URL("../package.json", import.meta.url), "utf8")
 ).version;
@@ -17,45 +19,52 @@ export const VERSION = JSON.parse(
 const USAGE = `pmsec <command> [options]
 
 Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
-bun, cargo, mise, uv. Each \`set\` writes the cooldown plus every safe-by-
-default key the tool exposes (audit-level, trust-policy, hardened mode,
-attestation re-verification, ...).
+bun, cargo, mise, uv. \`set\` flips on every safe-by-default key each
+tool exposes (cooldown, audit-level, trust-policy, hardened mode,
+attestation re-verification, ...). No knobs.
 
 Commands:
-  check                 Inspect hardening state (exit 1 if cooldown < --min or any extra unset)
-  set <DAYS>            Apply DAYS-day cooldown + the hardening bundle to all selected tools
-  unset                 Remove the cooldown + hardening bundle from selected tools
+  enable                Apply the hardening bundle to all selected tools
+  disable               Remove the hardening bundle from selected tools
+  check                 Verify the bundle is in place (exit 1 if anything missing)
 
 Options:
   --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
-  --min DAYS            Minimum acceptable days for check (default ${DEFAULT_MIN})
+  --days N              Override cooldown days (default 3)
   --json                Emit JSON output
   -V, --version         Show version
   -h, --help            Show this help
 
 Examples:
-  npx pmsec check --min 7
-  npx pmsec set 7
-  npx pmsec unset --tool npm
+  npx pmsec enable
+  npx pmsec enable --days 7
+  npx pmsec check
+  npx pmsec disable --tool npm
 `;
 
+function parseDays(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) throw new Error(`--days must be a positive integer (got "${raw}")`);
+  return n;
+}
+
 function parse(argv) {
-  const opts = { command: null, days: null, min: DEFAULT_MIN, json: false, only: null, help: false, version: false };
+  const opts = { command: null, json: false, only: null, days: BUNDLE_DAYS, help: false, version: false };
   const positional = [];
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "-h" || a === "--help") opts.help = true;
     else if (a === "-V" || a === "--version") opts.version = true;
     else if (a === "--json") opts.json = true;
-    else if (a === "--min") opts.min = Number(argv[++i]);
-    else if (a.startsWith("--min=")) opts.min = Number(a.slice(6));
     else if (a === "--tool") opts.only = argv[++i].split(",");
     else if (a.startsWith("--tool=")) opts.only = a.slice(7).split(",");
+    else if (a === "--days") opts.days = parseDays(argv[++i]);
+    else if (a.startsWith("--days=")) opts.days = parseDays(a.slice(7));
     else if (a.startsWith("-")) throw new Error(`unknown flag: ${a}`);
     else positional.push(a);
   }
   opts.command = positional[0] ?? null;
-  if (opts.command === "set") opts.days = Number(positional[1]);
+  if (positional.length > 1) throw new Error(`unexpected argument: ${positional[1]}`);
   return opts;
 }
 
@@ -101,15 +110,15 @@ function renderHuman(rows, min) {
   return lines.join("\n") + "\n";
 }
 
-async function runCheck(targets, { min, json }, env, home, platform, out, err) {
+async function runCheck(targets, { json, days }, env, home, platform, out, err) {
   const rows = await gatherStatus(targets, env, home, platform);
-  const failingPrimary = rows.filter(r => r.days === null || r.days < min);
+  const failingPrimary = rows.filter(r => r.days === null || r.days < days);
   const failingExtras = rows.flatMap(r => r.extras.filter(e => !e.ok));
   const ok = failingPrimary.length === 0 && failingExtras.length === 0;
-  if (json) out.write(JSON.stringify({ min, rows, ok }, null, 2) + "\n");
-  else out.write(renderHuman(rows, min));
-  if (failingPrimary.length) err.write(`pmsec: ${failingPrimary.length} tool(s) below ${min} days\n`);
-  if (failingExtras.length) err.write(`pmsec: ${failingExtras.length} hardening setting(s) not at safe value\n`);
+  if (json) out.write(JSON.stringify({ bundleDays: days, rows, ok }, null, 2) + "\n");
+  else out.write(renderHuman(rows, days));
+  if (failingPrimary.length) err.write(`pmsec: ${failingPrimary.length} tool(s) below ${days} days — run \`pmsec enable\`\n`);
+  if (failingExtras.length) err.write(`pmsec: ${failingExtras.length} hardening setting(s) not at safe value — run \`pmsec enable\`\n`);
   return ok ? 0 : 1;
 }
 
@@ -125,11 +134,7 @@ function explainFsError(e, tool) {
   return `${tool}: ${e?.message ?? e}`;
 }
 
-async function runSet(targets, days, json, env, home, platform, out, err) {
-  if (!Number.isInteger(days) || days <= 0) {
-    err.write(`pmsec: set requires integer DAYS > 0\n`);
-    return 2;
-  }
+async function runEnable(targets, json, days, env, home, platform, out, err) {
   const results = [];
   const failures = [];
   const warnings = [];
@@ -137,20 +142,26 @@ async function runSet(targets, days, json, env, home, platform, out, err) {
     const warn = preflightWarn(t);
     if (warn) warnings.push({ tool: t.name, warn });
     try {
-      const r = await t.write(days, env, home, platform);
-      results.push({ tool: t.name, path: r.path, days, ok: true, warn });
+      const current = await t.read(env, home, platform);
+      const currentDays = current.days ?? 0;
+      const effective = Math.max(currentDays, days);
+      const kept = currentDays >= days && currentDays > 0;
+      const r = await t.write(effective, env, home, platform);
+      results.push({ tool: t.name, path: r.path, days: effective, requested: days, kept, ok: true, warn });
     } catch (e) {
       failures.push({ tool: t.name, error: explainFsError(e, t.name) });
-      results.push({ tool: t.name, path: e?.path ?? null, days, ok: false, error: explainFsError(e, t.name), warn });
+      results.push({ tool: t.name, path: e?.path ?? null, days, requested: days, kept: false, ok: false, error: explainFsError(e, t.name), warn });
     }
   }
-  if (json) out.write(JSON.stringify({ set: days, results, warnings, ok: failures.length === 0 }, null, 2) + "\n");
+  if (json) out.write(JSON.stringify({ enabled: true, bundleDays: days, results, warnings, ok: failures.length === 0 }, null, 2) + "\n");
   else for (const r of results) {
     if (r.ok) {
+      const action = r.kept ? "keep   " : "enable ";
+      const note = r.kept ? `  (kept existing ${r.days}d ≥ ${r.requested}d)` : "";
       const tail = r.warn ? `\n     ⚠ ${r.warn}` : "";
-      out.write(`set  ${r.tool.padEnd(4)} ${r.days} days  [${r.path}]${tail}\n`);
+      out.write(`${action} ${r.tool.padEnd(4)} [${r.path}]${note}${tail}\n`);
     } else {
-      out.write(`FAIL ${r.tool.padEnd(4)} ${r.error}\n`);
+      out.write(`FAIL    ${r.tool.padEnd(4)} ${r.error}\n`);
     }
   }
   for (const f of failures) err.write(`pmsec: ${f.error}\n`);
@@ -158,7 +169,7 @@ async function runSet(targets, days, json, env, home, platform, out, err) {
   return failures.length ? 1 : 0;
 }
 
-async function runUnset(targets, json, env, home, platform, out, err) {
+async function runDisable(targets, json, env, home, platform, out, err) {
   const results = [];
   const failures = [];
   for (const t of targets) {
@@ -172,8 +183,8 @@ async function runUnset(targets, json, env, home, platform, out, err) {
   }
   if (json) out.write(JSON.stringify({ results, ok: failures.length === 0 }, null, 2) + "\n");
   else for (const r of results) {
-    if (!r.ok) out.write(`FAIL ${r.tool.padEnd(4)} ${r.error}\n`);
-    else out.write(`${r.removed ? "rm  " : "skip"} ${r.tool.padEnd(4)} [${r.path}]\n`);
+    if (!r.ok) out.write(`FAIL    ${r.tool.padEnd(4)} ${r.error}\n`);
+    else out.write(`${r.removed ? "disable " : "skip    "} ${r.tool.padEnd(4)} [${r.path}]\n`);
   }
   for (const f of failures) err.write(`pmsec: ${f.error}\n`);
   return failures.length ? 1 : 0;
@@ -196,8 +207,8 @@ export async function run(argv, {
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
   try {
     if (opts.command === "check") return await runCheck(targets, opts, env, home, platform, out, err);
-    if (opts.command === "set") return await runSet(targets, opts.days, opts.json, env, home, platform, out, err);
-    if (opts.command === "unset") return await runUnset(targets, opts.json, env, home, platform, out, err);
+    if (opts.command === "enable") return await runEnable(targets, opts.json, opts.days, env, home, platform, out, err);
+    if (opts.command === "disable") return await runDisable(targets, opts.json, env, home, platform, out, err);
     err.write(`pmsec: unknown command "${opts.command}"\n`);
     return 2;
   } catch (e) {