pmsec 0.5.1 → 0.6.0

package/README.md

@@ -38,7 +38,7 @@ Zero runtime dependencies, ESM, requires Node 22+.
 | `pmsec disable` | Remove every key the bundle set; other keys in the file are preserved. |
 | `pmsec --version` | Print the installed pmsec version. |
 
-Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 3-day default), `--json`.
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 3-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`.
 
 When the target file is owned by another user (typical: `~/.npmrc` left
 root-owned by an old `sudo npm config set`), the write fails with `EACCES`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -31,6 +31,7 @@ Commands:
 Options:
   --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
   --days N              Override cooldown days (default 3)
+  --force               Overwrite stricter existing cooldowns (otherwise enable is monotonic)
   --json                Emit JSON output
   -V, --version         Show version
   -h, --help            Show this help
@@ -38,6 +39,7 @@ Options:
 Examples:
   npx pmsec enable
   npx pmsec enable --days 7
+  npx pmsec enable --days 1 --force
   npx pmsec check
   npx pmsec disable --tool npm
 `;
@@ -49,13 +51,14 @@ function parseDays(raw) {
 }
 
 function parse(argv) {
-  const opts = { command: null, json: false, only: null, days: BUNDLE_DAYS, help: false, version: false };
+  const opts = { command: null, json: false, only: null, days: BUNDLE_DAYS, force: false, help: false, version: false };
   const positional = [];
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "-h" || a === "--help") opts.help = true;
     else if (a === "-V" || a === "--version") opts.version = true;
     else if (a === "--json") opts.json = true;
+    else if (a === "--force") opts.force = true;
     else if (a === "--tool") opts.only = argv[++i].split(",");
     else if (a.startsWith("--tool=")) opts.only = a.slice(7).split(",");
     else if (a === "--days") opts.days = parseDays(argv[++i]);
@@ -102,8 +105,8 @@ function renderHuman(rows, min) {
     const tail = r.warn ? `\n       ⚠ ${r.warn}` : "";
     lines.push(`${status} ${r.tool.padEnd(4)} ${r.key} = ${value}  [${r.path}]${tail}`);
     for (const e of r.extras) {
-      const exStatus = e.configured === null ? "MISSING" : e.ok ? "OK     " : "STALE  ";
-      const exValue = e.configured ?? "(unset)";
+      const exStatus = e.ok ? "OK     " : e.configured === null ? "MISSING" : "STALE  ";
+      const exValue = e.defaultEnforced ? `(default — runtime enforces ${e.expected})` : (e.configured ?? "(unset)");
       lines.push(`${exStatus} ${r.tool.padEnd(4)} ${e.key} = ${exValue}  [${r.path}]`);
     }
   }
@@ -134,7 +137,7 @@ function explainFsError(e, tool) {
   return `${tool}: ${e?.message ?? e}`;
 }
 
-async function runEnable(targets, json, days, env, home, platform, out, err) {
+async function runEnable(targets, json, days, force, env, home, platform, out, err) {
   const results = [];
   const failures = [];
   const warnings = [];
@@ -142,15 +145,19 @@ async function runEnable(targets, json, days, env, home, platform, out, err) {
     const warn = preflightWarn(t);
     if (warn) warnings.push({ tool: t.name, warn });
     try {
-      const current = await t.read(env, home, platform);
-      const currentDays = current.days ?? 0;
-      const effective = Math.max(currentDays, days);
-      const kept = currentDays >= days && currentDays > 0;
+      let effective = days;
+      let kept = false;
+      if (!force) {
+        const current = await t.read(env, home, platform);
+        const currentDays = current.days ?? 0;
+        effective = Math.max(currentDays, days);
+        kept = currentDays >= days && currentDays > 0;
+      }
       const r = await t.write(effective, env, home, platform);
-      results.push({ tool: t.name, path: r.path, days: effective, requested: days, kept, ok: true, warn });
+      results.push({ tool: t.name, path: r.path, days: effective, requested: days, kept, forced: force, ok: true, warn });
     } catch (e) {
       failures.push({ tool: t.name, error: explainFsError(e, t.name) });
-      results.push({ tool: t.name, path: e?.path ?? null, days, requested: days, kept: false, ok: false, error: explainFsError(e, t.name), warn });
+      results.push({ tool: t.name, path: e?.path ?? null, days, requested: days, kept: false, forced: force, ok: false, error: explainFsError(e, t.name), warn });
     }
   }
   if (json) out.write(JSON.stringify({ enabled: true, bundleDays: days, results, warnings, ok: failures.length === 0 }, null, 2) + "\n");
@@ -207,7 +214,7 @@ export async function run(argv, {
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
   try {
     if (opts.command === "check") return await runCheck(targets, opts, env, home, platform, out, err);
-    if (opts.command === "enable") return await runEnable(targets, opts.json, opts.days, env, home, platform, out, err);
+    if (opts.command === "enable") return await runEnable(targets, opts.json, opts.days, opts.force, env, home, platform, out, err);
     if (opts.command === "disable") return await runDisable(targets, opts.json, env, home, platform, out, err);
     err.write(`pmsec: unknown command "${opts.command}"\n`);
     return 2;

package/src/tools/pnpm.mjs

@@ -8,15 +8,22 @@ export const name = "pnpm";
 export const key = "minimum-release-age";
 export const docs = "https://pnpm.io/settings#minimumreleaseage";
 export const minBin = [10, 6, 0];
+// `defaultSinceMajor`: pnpm major version where the value became the default.
+// Once detected, an absent line in `.npmrc` is still effectively in force, so
+// `read()` reports it as ok with `defaultEnforced: true`.
 export const extras = [
   { key: "trust-policy", expected: "no-downgrade", line: "trust-policy=no-downgrade" },
-  { key: "block-exotic-subdeps", expected: "true", line: "block-exotic-subdeps=true" }
+  { key: "block-exotic-subdeps", expected: "true", line: "block-exotic-subdeps=true", defaultSinceMajor: 11 }
 ];
 
 export function path(env, home) { return npmrcPath(env, home); }
 
-export function preflight() {
-  const v = detectVersion("pnpm");
+function pnpmVersion(env) {
+  return detectVersion("pnpm", ["--version"], { env, overrideKey: "PMSEC_PNPM_VERSION" });
+}
+
+export function preflight(env) {
+  const v = pnpmVersion(env);
   if (v === null) return { ok: true, message: null };
   if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
   return { ok: true, warn: true, version: v.raw, message: `pnpm ${v.raw} < ${minBin.join(".")}: minimum-release-age is silently ignored. Upgrade pnpm to enforce the cooldown.` };
@@ -27,10 +34,19 @@ export async function read(env, home) {
   const raw = await readSafe(p);
   const value = readKey(raw, key);
   const minutes = value === null ? null : Number(value);
+  const v = pnpmVersion(env);
+  const defaults = new Map(extras.filter(x => x.defaultSinceMajor).map(x => [x.key, x.defaultSinceMajor]));
+  const evaluated = readExtras(raw, extras).map(e => {
+    const def = defaults.get(e.key);
+    if (e.configured === null && def && v && v.major >= def) {
+      return { ...e, ok: true, defaultEnforced: true };
+    }
+    return e;
+  });
   return {
     path: p, configured: value,
     days: minutes === null || Number.isNaN(minutes) ? null : Math.floor(minutes / (60 * 24)),
-    extras: readExtras(raw, extras)
+    extras: evaluated
   };
 }
 

package/src/util/version.mjs

@@ -1,12 +1,27 @@
 import { spawnSync } from "node:child_process";
 
-export function detectVersion(bin, args = ["--version"]) {
+function parseSemver(s) {
+  const m = String(s || "").match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!m) return null;
+  return { major: +m[1], minor: +m[2], patch: +m[3], raw: m[0] };
+}
+
+// `env[overrideKey]` ("X.Y.Z" or "none") forces the result without spawning the
+// real binary — used by tests to make pnpm 11 default-enforcement behavior
+// deterministic regardless of what's installed locally.
+export function detectVersion(bin, args = ["--version"], { env, overrideKey } = {}) {
+  if (env && overrideKey) {
+    const o = env[overrideKey];
+    if (o === "none") return null;
+    if (o) {
+      const p = parseSemver(o);
+      if (p) return p;
+    }
+  }
   try {
     const res = spawnSync(bin, args, { encoding: "utf8" });
     if (res.status !== 0) return null;
-    const m = (res.stdout || "").match(/(\d+)\.(\d+)\.(\d+)/);
-    if (!m) return null;
-    return { major: +m[1], minor: +m[2], patch: +m[3], raw: m[0] };
+    return parseSemver(res.stdout);
   } catch { return null; }
 }