pmsec 0.9.0 → 0.11.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Hikaru Egashira
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -8,37 +8,37 @@ re-verification, build-script attestation, and more.
 ## Install
 
 ```bash
-npx pmsec enable
-npx pmsec check
-npx pmsec disable
+npx pmsec
+npx pmsec --check
+npx pmsec --disable
 ```
 
 ```bash
-uvx pmsec enable
-uvx pmsec check
-uvx pmsec disable
+uvx pmsec
+uvx pmsec --check
+uvx pmsec --disable
 ```
 
 If your environment already enforces cooldown (or routes through a proxy
 registry), bootstrap pmsec by overriding just for that call:
 
 ```bash
-npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check
-uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
+npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec --check
+uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec --check
 ```
 
 Zero runtime dependencies, ESM, requires Node 22+.
 
-## Commands
+## Usage
 
-| Command | Description |
+| Invocation | Description |
 | --- | --- |
-| `pmsec enable` | Write the hardening bundle (3-day cooldown + per-tool extras) to every selected tool's user config. |
-| `pmsec check` | Read each tool's config; exit 1 if any row is missing or below the bundled value. |
-| `pmsec disable` | Remove every key the bundle set; other keys in the file are preserved. |
+| `pmsec` | Default action: write the hardening bundle (1-day cooldown + per-tool extras) to every selected tool's user config. |
+| `pmsec --check` | Read each tool's config; exit 1 if any row is missing or below the bundled value. |
+| `pmsec --disable` | Remove every key the bundle set; other keys in the file are preserved. |
 | `pmsec --version` | Print the installed pmsec version. |
 
-Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 3-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`.
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--days N` (override the 1-day default), `--force` (overwrite stricter existing cooldowns; default is monotonic), `--json`. `--check` and `--disable` are mutually exclusive.
 
 When the target file is owned by another user (typical: `~/.npmrc` left
 root-owned by an old `sudo npm config set`), the write fails with `EACCES`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "publishConfig": {
     "access": "public"
   },
@@ -25,6 +25,7 @@
   "files": [
     "bin",
     "src",
+    "LICENSE",
     "README.md"
   ],
   "scripts": {

package/src/cli.mjs

@@ -1,5 +1,6 @@
-import { homedir } from "node:os";
-import { readFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { readFileSync, accessSync, constants as fsConstants, statSync } from "node:fs";
+import { dirname } from "node:path";
 import { shellQuote } from "./util/io.mjs";
 import * as npm from "./tools/npm.mjs";
 import * as pnpm from "./tools/pnpm.mjs";
@@ -17,19 +18,17 @@ export const VERSION = JSON.parse(
   readFileSync(new URL("../package.json", import.meta.url), "utf8")
 ).version;
 
-const USAGE = `pmsec <command> [options]
+const USAGE = `pmsec [options]
 
 Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
-bun, cargo, mise, uv. \`set\` flips on every safe-by-default key each
-tool exposes (cooldown, audit-level, trust-policy, hardened mode,
+bun, cargo, mise, uv. Default action enables every safe-by-default key
+each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
 attestation re-verification, ...). No knobs.
 
-Commands:
-  enable                Apply the hardening bundle to all selected tools
-  disable               Remove the hardening bundle from selected tools
-  check                 Verify the bundle is in place (exit 1 if anything missing)
-
 Options:
+  --check               Verify the bundle is in place (exit 1 if anything missing)
+  --disable             Remove the hardening bundle from selected tools
+  --doctor              Diagnose effective paths/owner/uid (read-only; for MDM debugging)
   --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv)
   --days N              Override cooldown days (default 1)
   --force               Overwrite stricter existing cooldowns (otherwise enable is monotonic)
@@ -38,11 +37,11 @@ Options:
   -h, --help            Show this help
 
 Examples:
-  npx pmsec enable
-  npx pmsec enable --days 7
-  npx pmsec enable --days 1 --force
-  npx pmsec check
-  npx pmsec disable --tool npm
+  npx pmsec
+  npx pmsec --days 7
+  npx pmsec --days 1 --force
+  npx pmsec --check
+  npx pmsec --disable --tool npm
 `;
 
 function parseDays(raw) {
@@ -52,7 +51,13 @@ function parseDays(raw) {
 }
 
 function parse(argv) {
-  const opts = { command: null, json: false, only: null, days: BUNDLE_DAYS, force: false, help: false, version: false };
+  const opts = { mode: "enable", json: false, only: null, days: BUNDLE_DAYS, force: false, help: false, version: false };
+  let modeSet = false;
+  const setMode = (m) => {
+    if (modeSet && opts.mode !== m) throw new Error(`--check, --disable, and --doctor are mutually exclusive`);
+    opts.mode = m;
+    modeSet = true;
+  };
   const positional = [];
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -60,6 +65,9 @@ function parse(argv) {
     else if (a === "-V" || a === "--version") opts.version = true;
     else if (a === "--json") opts.json = true;
     else if (a === "--force") opts.force = true;
+    else if (a === "--check") setMode("check");
+    else if (a === "--disable") setMode("disable");
+    else if (a === "--doctor") setMode("doctor");
     else if (a === "--tool") opts.only = argv[++i].split(",");
     else if (a.startsWith("--tool=")) opts.only = a.slice(7).split(",");
     else if (a === "--days") opts.days = parseDays(argv[++i]);
@@ -67,8 +75,7 @@ function parse(argv) {
     else if (a.startsWith("-")) throw new Error(`unknown flag: ${a}`);
     else positional.push(a);
   }
-  opts.command = positional[0] ?? null;
-  if (positional.length > 1) throw new Error(`unexpected argument: ${positional[1]}`);
+  if (positional.length) throw new Error(`unexpected argument: ${positional[0]}`);
   return opts;
 }
 
@@ -121,11 +128,91 @@ async function runCheck(targets, { json, days }, ctx, out, err) {
   const ok = failingPrimary.length === 0 && failingExtras.length === 0;
   if (json) out.write(JSON.stringify({ bundleDays: days, rows, ok }, null, 2) + "\n");
   else out.write(renderHuman(rows, days));
-  if (failingPrimary.length) err.write(`pmsec: ${failingPrimary.length} tool(s) below ${days} days — run \`pmsec enable\`\n`);
-  if (failingExtras.length) err.write(`pmsec: ${failingExtras.length} hardening setting(s) not at safe value — run \`pmsec enable\`\n`);
+  if (failingPrimary.length) err.write(`pmsec: ${failingPrimary.length} tool(s) below ${days} days — run \`pmsec\`\n`);
+  if (failingExtras.length) err.write(`pmsec: ${failingExtras.length} hardening setting(s) not at safe value — run \`pmsec\`\n`);
   return ok ? 0 : 1;
 }
 
+// `pmsec doctor` runs read-only and reports the same path resolution that
+// enable/check/disable would do, plus identity (uid/euid) and parent-dir
+// writability — the smallest set of facts an MDM operator needs to diagnose
+// "pmsec ran but wrote to nowhere" (root's $HOME) or "wrote a file no one can
+// read" (chown failed under SIP/SELinux). Never mutates the filesystem.
+function probePath(p, uid) {
+  const parent = dirname(p);
+  let exists = false, writable = false, parentExists = false, owner = null;
+  try { accessSync(p, fsConstants.F_OK); exists = true; } catch {}
+  if (exists) {
+    try { accessSync(p, fsConstants.W_OK); writable = true; } catch {}
+    try {
+      const st = statSync(p);
+      // Only POSIX uids are meaningful; on win32 st.uid is 0 and ignored downstream.
+      owner = uid === null ? null : st.uid;
+    } catch {}
+  }
+  try { accessSync(parent, fsConstants.F_OK); parentExists = true; } catch {}
+  // Walk up to the deepest existing ancestor — pmsec runs mkdir -p, so what
+  // matters is whether that ancestor is writable, not the literal parent.
+  let probe = parent, ancestor = null;
+  while (probe && probe !== dirname(probe)) {
+    try { accessSync(probe, fsConstants.F_OK); ancestor = probe; break; } catch {}
+    probe = dirname(probe);
+  }
+  let parentWritable = false;
+  if (ancestor) {
+    try { accessSync(ancestor, fsConstants.W_OK); parentWritable = true; } catch {}
+  }
+  return { path: p, parent, exists, writable, parentExists, parentWritable, owner };
+}
+
+function runDoctor(targets, json, ctx, out) {
+  const isPosix = ctx.platform !== "win32" && typeof process.getuid === "function";
+  const uid = isPosix ? process.getuid() : null;
+  const euid = isPosix && typeof process.geteuid === "function" ? process.geteuid() : uid;
+  let username = null;
+  try { username = userInfo().username; } catch {}
+  const tools = targets.map(t => {
+    const p = t.path(ctx);
+    const probe = probePath(p, uid);
+    return { tool: t.name, key: t.key, ...probe };
+  });
+  // doctor.ok is intentionally narrow: the parent directory must be writable
+  // by the running uid. Everything else is informational.
+  const okFlag = tools.every(t => t.parentWritable);
+  const report = {
+    doctor: true,
+    version: VERSION,
+    platform: ctx.platform,
+    uid, euid, username,
+    home: ctx.home,
+    pmsecHome: ctx.env.PMSEC_HOME ?? null,
+    pmsecHomeSource: ctx.env.PMSEC_HOME ? "PMSEC_HOME" : "HOME",
+    tools,
+    ok: okFlag,
+  };
+  if (json) {
+    out.write(JSON.stringify(report, null, 2) + "\n");
+    return okFlag ? 0 : 1;
+  }
+  out.write(`pmsec ${VERSION}  doctor\n`);
+  out.write(`  platform   : ${ctx.platform}\n`);
+  if (isPosix) out.write(`  uid/euid   : ${uid}/${euid}${username ? ` (${username})` : ""}\n`);
+  out.write(`  HOME       : ${ctx.home}\n`);
+  out.write(`  PMSEC_HOME : ${ctx.env.PMSEC_HOME ?? "(unset — using HOME)"}\n\n`);
+  for (const t of tools) {
+    const flag = t.parentWritable ? "ok    " : "BLOCK ";
+    const ownerSuffix = t.exists && t.owner !== null ? ` (uid=${t.owner})` : "";
+    out.write(`${flag} ${t.tool.padEnd(4)} ${t.path}${ownerSuffix}\n`);
+    if (!t.parentWritable) {
+      // Only surface noise when there's a real problem. "parent missing but
+      // mkdir -p can fix it" is the common case and isn't worth a line.
+      out.write(`         no writable ancestor for ${t.parent}\n`);
+    }
+  }
+  if (!okFlag) out.write(`\npmsec doctor: at least one parent directory is not writable as uid ${uid ?? "(non-POSIX)"}.\n`);
+  return okFlag ? 0 : 1;
+}
+
 function explainFsError(e, tool) {
   if (e?.code === "EACCES" || e?.code === "EPERM") {
     const p = e.path ?? "";
@@ -204,17 +291,16 @@ export async function run(argv, {
   try { opts = parse(argv); }
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
   if (opts.version) { out.write(`pmsec ${VERSION}\n`); return 0; }
-  if (opts.help || !opts.command) { out.write(USAGE); return opts.help ? 0 : 2; }
+  if (opts.help) { out.write(USAGE); return 0; }
   let targets;
   try { targets = selectTools(opts.only); }
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
   const ctx = { env, home, platform };
   try {
-    if (opts.command === "check") return await runCheck(targets, opts, ctx, out, err);
-    if (opts.command === "enable") return await runEnable(targets, opts.json, opts.days, opts.force, ctx, out, err);
-    if (opts.command === "disable") return await runDisable(targets, opts.json, ctx, out, err);
-    err.write(`pmsec: unknown command "${opts.command}"\n`);
-    return 2;
+    if (opts.mode === "check") return await runCheck(targets, opts, ctx, out, err);
+    if (opts.mode === "disable") return await runDisable(targets, opts.json, ctx, out, err);
+    if (opts.mode === "doctor") return runDoctor(targets, opts.json, ctx, out);
+    return await runEnable(targets, opts.json, opts.days, opts.force, ctx, out, err);
   } catch (e) {
     err.write(`pmsec: ${e.message}\n`);
     return 1;