pmsec 2026.10.1 → 2026.10.5

package/README.md

@@ -25,7 +25,7 @@ uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pms
 | `pmsec --doctor` | Prints read-only path, ownership, and writability diagnostics. |
 | `pmsec --version` | Prints the version. |
 
-Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv,bundler,aube`, `--days N`,
+Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv,bundler,aube,composer`, `--days N`,
 `--force`, `--json`.
 
 Write failures include the target path and ownership hint. pmsec never escalates

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "pmsec",
-  "version": "2026.10.1",
+  "version": "2026.10.5",
   "publishConfig": {
     "access": "public"
   },
-  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, uv, and bundler.",
+  "description": "Zero-config install-time supply-chain hardening for npm, pnpm, yarn, bun, cargo, mise, uv, bundler, aube, and composer.",
   "homepage": "https://github.com/HikaruEgashira/pmsec#readme",
   "repository": {
     "type": "git",
@@ -43,6 +43,8 @@
     "cargo",
     "mise",
     "uv",
+    "bundler",
+    "composer",
     "pmsec"
   ]
 }

package/src/cli.mjs

@@ -11,8 +11,9 @@ import * as mise from "./tools/mise.mjs";
 import * as uv from "./tools/uv.mjs";
 import * as bundler from "./tools/bundler.mjs";
 import * as aube from "./tools/aube.mjs";
+import * as composer from "./tools/composer.mjs";
 
-const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv, bundler, aube];
+const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv, bundler, aube, composer];
 // Default cooldown for the hardening bundle. Override per-invocation with
 // `--days N`; the default tracks the safest value we'd recommend.
 const BUNDLE_DAYS = 1;
@@ -23,7 +24,7 @@ export const VERSION = JSON.parse(
 const USAGE = `pmsec [options]
 
 Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
-bun, cargo, mise, uv, bundler, aube. Default action enables every safe-by-default
+bun, cargo, mise, uv, bundler, aube, composer. Default action enables every safe-by-default
 key each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
 attestation re-verification, ...). No knobs.
 
@@ -31,7 +32,7 @@ Options:
   --check               Verify the bundle is in place (exit 1 if anything missing)
   --disable             Remove the hardening bundle from selected tools
   --doctor              Diagnose effective paths/owner/uid (read-only; for unattended-deployment debugging)
-  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv,bundler,aube)
+  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv,bundler,aube,composer)
   --days N              Override cooldown days (default 1)
   --force               Overwrite stricter existing cooldowns (otherwise enable is monotonic)
   --json                Emit JSON output
@@ -99,7 +100,7 @@ async function gatherStatus(targets, ctx) {
   return Promise.all(targets.map(async t => {
     const r = await t.read(ctx);
     return {
-      tool: t.name, key: t.key, path: r.path,
+      tool: t.name, key: r.key ?? t.key, path: r.path,
       configured: r.configured, days: r.days,
       extras: r.extras ?? [],
       warn: preflightWarn(t, ctx)

package/src/tools/cargo.mjs

@@ -1,55 +1,49 @@
 import { cargoConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { detectVersion, gte } from "../util/version.mjs";
 
 export const name = "cargo";
-export const key = "minimum-release-age";
-export const section = "install";
-export const docs = "https://rust-lang.github.io/rfcs/3801-package-cooldown.html";
+export const key = "global-min-publish-age";
+export const section = "registry";
+export const docs = "https://doc.rust-lang.org/nightly/cargo/reference/config.html#registryglobal-min-publish-age";
+export const minBin = [1, 100, 0];
 export const extras = [];
 
-// Stabilized resolver cooldown (cargo >= 1.100). It tracks `--days` like the
-// primary key, so it is handled here rather than as a fixed-value extra.
-const publishAge = { key: "global-min-publish-age", section: "registry" };
+// pmsec <= 2026.10.1 wrote this key, but cargo never supported it. Remove it
+// when we touch the file so users do not mistake it for an enforced setting.
+const legacy = { key: "minimum-release-age", section: "install" };
 
 export function path(ctx) { return cargoConfigPath(ctx.env, ctx.home); }
 
 function parseDays(value) {
   if (value === null) return null;
-  const m = value.match(/^"?\s*(\d+)\s*(d|days?|w|weeks?)\s*"?$/i);
+  const m = value.match(/^"?\s*(\d+)\s*(d|days?|w|weeks?|months?)\s*"?$/i);
   if (!m) return null;
   const n = Number(m[1]);
-  return /^(w|weeks?)$/i.test(m[2]) ? n * 7 : n;
+  if (/^(w|weeks?)$/i.test(m[2])) return n * 7;
+  if (/^(months?)$/i.test(m[2])) return n * 30;
+  return n;
 }
 
-function parsePublishAgeDays(value) {
-  if (value === null) return null;
-  const m = value.match(/^"\s*(\d+)\s*(days?|weeks?|months?)\s*"$/i);
-  if (!m) return null;
-  const n = Number(m[1]);
-  if (/^weeks?$/i.test(m[2])) return n * 7;
-  if (/^months?$/i.test(m[2])) return n * 30;
-  return n;
+export function preflight(ctx) {
+  const v = detectVersion("cargo", ["--version"], { env: ctx.env, overrideKey: "PMSEC_CARGO_VERSION" });
+  if (v === null) return { ok: true, message: null };
+  if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
+  return { ok: true, warn: true, version: v.raw, message: `cargo ${v.raw} < ${minBin.join(".")}: global-min-publish-age is silently ignored. Upgrade cargo to enforce the cooldown.` };
 }
 
 export async function read(ctx) {
   const p = path(ctx);
   const raw = await readSafe(p);
   const value = readKey(raw, key, { section });
-  const days = parseDays(value);
-  const cur = readKey(raw, publishAge.key, { section: publishAge.section });
-  const want = days ?? 1;
-  const curDays = parsePublishAgeDays(cur);
-  return {
-    path: p, configured: value, days,
-    extras: [{ key: publishAge.key, configured: cur, expected: `"${want} days"`, ok: curDays !== null && curDays >= want }],
-  };
+  return { path: p, configured: value, days: parseDays(value), extras: [] };
 }
 
 export async function write(days, ctx) {
   const p = path(ctx);
-  let text = setKey(await readSafe(p), key, `${key} = "${days}d"`, { section });
-  text = setKey(text, publishAge.key, `${publishAge.key} = "${days} days"`, { section: publishAge.section });
+  let text = setKey(await readSafe(p), key, `${key} = "${days} days"`, { section });
+  text = removeKey(text, legacy.key, { section: legacy.section }).text;
   await writeAtomic(p, text);
   return { path: p };
 }
@@ -58,8 +52,8 @@ export async function unset(ctx) {
   const p = path(ctx);
   const before = await readSafe(p);
   const cooldown = removeKey(before, key, { section });
-  const age = removeKey(cooldown.text, publishAge.key, { section: publishAge.section });
-  const removed = cooldown.removed || age.removed;
-  if (removed) await writeAtomic(p, age.text);
+  const old = removeKey(cooldown.text, legacy.key, { section: legacy.section });
+  const removed = cooldown.removed || old.removed;
+  if (removed) await writeAtomic(p, old.text);
   return { path: p, removed };
 }

package/src/tools/composer.mjs

@@ -0,0 +1,82 @@
+import { composerConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readJsonKey, setJsonKey, removeJsonKey } from "../util/jsonconf.mjs";
+
+export const name = "composer";
+export const key = "minimum-release-age";
+export const section = "config";
+export const docs = "https://getcomposer.org/doc/06-config.md#minimum-release-age";
+export const extras = [
+  { key: "allow-plugins", expected: "false", line: "false", path: ["config", "allow-plugins"] },
+  { key: "secure-http", expected: "true", line: "true", path: ["config", "secure-http"] },
+  { key: "disable-tls", expected: "false", line: "false", path: ["config", "disable-tls"] },
+  { key: "abandoned", expected: '"fail"', line: '"fail"', path: ["config", "audit", "abandoned"] },
+];
+
+// Composer is newer than most tools in the bundle; accept the shorter npm
+// spelling too so a config written by hand is still recognized.
+const PRIMARY_ALIASES = [key, "min-release-age", "minimum_release_age", "minimumReleaseAge"];
+
+export function path(ctx) { return composerConfigPath(ctx.env, ctx.home, ctx.platform); }
+
+function parseDays(value) {
+  if (value === null) return null;
+  const v = String(value).trim().replace(/^"|"$/g, "").trim();
+  const dur = v.match(/^(\d+)\s*(d|days?|w|weeks?)$/i);
+  if (dur) {
+    const n = Number(dur[1]);
+    return /^(w|weeks?)$/i.test(dur[2]) ? n * 7 : n;
+  }
+  if (!/^\d+$/.test(v)) return null;
+  const n = Number(v);
+  // Large values are seconds or minutes (the units Composer uses for its
+  // other time settings); small values are days.
+  if (n >= 86400) return Math.floor(n / 86400);
+  if (n >= 1440 && n % 1440 === 0) return n / 1440;
+  return n;
+}
+
+export async function read(ctx) {
+  const p = path(ctx);
+  const raw = await readSafe(p);
+  let configured = null;
+  for (const candidate of PRIMARY_ALIASES) {
+    const v = readJsonKey(raw, ["config", candidate]);
+    if (v !== null) { configured = v; break; }
+  }
+  return {
+    path: p, configured, days: parseDays(configured),
+    extras: extras.map(e => {
+      const cur = readJsonKey(raw, e.path);
+      const safeValues = e.safeValues ?? [e.expected];
+      return { key: e.key, configured: cur, expected: e.expected, ok: cur !== null && safeValues.includes(cur) };
+    }),
+  };
+}
+
+export async function write(days, ctx) {
+  const p = path(ctx);
+  let text = await readSafe(p);
+  text = setJsonKey(text, ["config", key], `${days}`);
+  for (const e of extras) text = setJsonKey(text, e.path, e.line);
+  await writeAtomic(p, text);
+  return { path: p };
+}
+
+export async function unset(ctx) {
+  const p = path(ctx);
+  let text = await readSafe(p);
+  let removed = false;
+  for (const candidate of PRIMARY_ALIASES) {
+    const r = removeJsonKey(text, ["config", candidate]);
+    text = r.text;
+    if (r.removed) removed = true;
+  }
+  for (const e of extras) {
+    const r = removeJsonKey(text, e.path);
+    text = r.text;
+    if (r.removed) removed = true;
+  }
+  if (removed) await writeAtomic(p, text);
+  return { path: p, removed };
+}

package/src/tools/pnpm.mjs

@@ -1,4 +1,4 @@
-import { pnpmRcPath } from "../util/paths.mjs";
+import { pnpmRcPath, pnpmConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readKey, setKey, removeKey } from "../util/lines.mjs";
 import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
@@ -8,21 +8,38 @@ export const name = "pnpm";
 export const key = "minimum-release-age";
 export const docs = "https://pnpm.io/settings#minimumreleaseage";
 export const minBin = [10, 6, 0];
+// pnpm >= 11 only reads pnpm-specific settings from the camelCase YAML config.
+// We keep writing the kebab-case rc file for pnpm 10 and mirror every setting
+// into config.yaml for pnpm 11+. `read()` switches files based on the detected
+// major version so `--check` validates the config the running pnpm actually
+// reads.
+const yamlKey = "minimumReleaseAge";
 // `defaultSinceMajor`: pnpm major version where the value became the default.
-// Once detected, an absent line in the rc file is still effectively in force,
-// so `read()` reports it as ok with `defaultEnforced: true`.
+// Once detected, an absent line in the active config is still effectively in
+// force, so `read()` reports it as ok with `defaultEnforced: true`.
 export const extras = [
-  { key: "trust-policy", expected: "no-downgrade", line: "trust-policy=no-downgrade" },
-  { key: "block-exotic-subdeps", expected: "true", line: "block-exotic-subdeps=true", defaultSinceMajor: 11 },
-  { key: "strict-dep-builds", expected: "true", line: "strict-dep-builds=true" },
-  { key: "verify-deps-before-run", expected: "error", line: "verify-deps-before-run=error" },
-  { key: "minimum-release-age-strict", expected: "true", line: "minimum-release-age-strict=true" },
-  { key: "dangerously-allow-all-builds", expected: "false", line: "dangerously-allow-all-builds=false" },
-  { key: "trust-lockfile", expected: "false", line: "trust-lockfile=false" },
-  { key: "minimum-release-age-ignore-missing-time", expected: "false", line: "minimum-release-age-ignore-missing-time=false" },
+  { key: "trust-policy", yamlKey: "trustPolicy", expected: "no-downgrade", line: "trust-policy=no-downgrade", yamlLine: "trustPolicy: no-downgrade" },
+  { key: "block-exotic-subdeps", yamlKey: "blockExoticSubdeps", expected: "true", line: "block-exotic-subdeps=true", yamlLine: "blockExoticSubdeps: true", defaultSinceMajor: 11 },
+  { key: "strict-dep-builds", yamlKey: "strictDepBuilds", expected: "true", line: "strict-dep-builds=true", yamlLine: "strictDepBuilds: true" },
+  { key: "verify-deps-before-run", yamlKey: "verifyDepsBeforeRun", expected: "error", line: "verify-deps-before-run=error", yamlLine: "verifyDepsBeforeRun: error" },
+  { key: "minimum-release-age-strict", yamlKey: "minimumReleaseAgeStrict", expected: "true", line: "minimum-release-age-strict=true", yamlLine: "minimumReleaseAgeStrict: true" },
+  { key: "dangerously-allow-all-builds", yamlKey: "dangerouslyAllowAllBuilds", expected: "false", line: "dangerously-allow-all-builds=false", yamlLine: "dangerouslyAllowAllBuilds: false" },
+  { key: "trust-lockfile", yamlKey: "trustLockfile", expected: "false", line: "trust-lockfile=false", yamlLine: "trustLockfile: false" },
+  { key: "minimum-release-age-ignore-missing-time", yamlKey: "minimumReleaseAgeIgnoreMissingTime", expected: "false", line: "minimum-release-age-ignore-missing-time=false", yamlLine: "minimumReleaseAgeIgnoreMissingTime: false" },
 ];
 
+function yamlExtras() {
+  return extras.map(e => ({
+    key: e.yamlKey,
+    expected: e.expected,
+    line: e.yamlLine,
+    sep: ":",
+    ...(e.defaultSinceMajor ? { defaultSinceMajor: e.defaultSinceMajor } : {}),
+  }));
+}
+
 export function path(ctx) { return pnpmRcPath(ctx.env, ctx.home, ctx.platform); }
+export function configPath(ctx) { return pnpmConfigPath(ctx.env, ctx.home, ctx.platform); }
 
 // Cache `pnpm --version` for the lifetime of the process. preflight() and
 // read() both want it; without memoization a single `pmsec check` spawns
@@ -37,6 +54,14 @@ function pnpmVersion(ctx) {
   return v;
 }
 
+function activeConfig(ctx) {
+  const v = pnpmVersion(ctx);
+  if (v && v.major >= 11) {
+    return { path: configPath(ctx), key: yamlKey, sep: ":", extras: yamlExtras() };
+  }
+  return { path: path(ctx), key, sep: "=", extras };
+}
+
 export function preflight(ctx) {
   const v = pnpmVersion(ctx);
   if (v === null) return { ok: true, message: null };
@@ -45,13 +70,13 @@ export function preflight(ctx) {
 }
 
 export async function read(ctx) {
-  const p = path(ctx);
-  const raw = await readSafe(p);
-  const value = readKey(raw, key);
+  const active = activeConfig(ctx);
+  const raw = await readSafe(active.path);
+  const value = readKey(raw, active.key, { sep: active.sep });
   const minutes = value === null ? null : Number(value);
   const v = pnpmVersion(ctx);
-  const defaults = new Map(extras.filter(x => x.defaultSinceMajor).map(x => [x.key, x.defaultSinceMajor]));
-  const evaluated = readExtras(raw, extras).map(e => {
+  const defaults = new Map(active.extras.filter(x => x.defaultSinceMajor).map(x => [x.key, x.defaultSinceMajor]));
+  const evaluated = readExtras(raw, active.extras).map(e => {
     const def = defaults.get(e.key);
     if (e.configured === null && def && v && v.major >= def) {
       return { ...e, ok: true, defaultEnforced: true };
@@ -59,7 +84,7 @@ export async function read(ctx) {
     return e;
   });
   return {
-    path: p, configured: value,
+    path: active.path, key: active.key, configured: value,
     days: minutes === null || Number.isNaN(minutes) ? null : Math.floor(minutes / (60 * 24)),
     extras: evaluated
   };
@@ -70,6 +95,11 @@ export async function write(days, ctx) {
   let text = setKey(await readSafe(p), key, `${key}=${days * 24 * 60}`);
   text = applyExtras(text, extras);
   await writeAtomic(p, text);
+
+  const cp = configPath(ctx);
+  let yaml = setKey(await readSafe(cp), yamlKey, `${yamlKey}: ${days * 24 * 60}`, { sep: ":" });
+  yaml = applyExtras(yaml, yamlExtras());
+  await writeAtomic(cp, yaml);
   return { path: p };
 }
 
@@ -78,7 +108,16 @@ export async function unset(ctx) {
   const before = await readSafe(p);
   const cooldown = removeKey(before, key);
   const ex = removeExtras(cooldown.text, extras);
-  const removed = cooldown.removed || ex.removed;
+  let removed = cooldown.removed || ex.removed;
   if (removed) await writeAtomic(p, ex.text);
+
+  const cp = configPath(ctx);
+  const yamlBefore = await readSafe(cp);
+  const yamlCooldown = removeKey(yamlBefore, yamlKey, { sep: ":" });
+  const yamlEx = removeExtras(yamlCooldown.text, yamlExtras());
+  if (yamlCooldown.removed || yamlEx.removed) {
+    removed = true;
+    await writeAtomic(cp, yamlEx.text);
+  }
   return { path: p, removed };
 }

package/src/util/jsonconf.mjs

@@ -0,0 +1,226 @@
+// Minimal line-oriented JSON object editor.
+//
+// Composer stores its user config as JSON. Pulling in a full JSON round-trip
+// would reorder/reformat unrelated keys (and the bash port has no JSON parser),
+// so pmsec edits the pretty-printed object in place instead. Only the shapes
+// pmsec needs are supported: objects of scalar members, one member per line.
+
+function normalizeLines(lines) {
+  const out = [];
+  for (const line of lines) {
+    let current = "", inString = false, escaped = false;
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (inString) {
+        current += ch;
+        if (escaped) escaped = false;
+        else if (ch === "\\") escaped = true;
+        else if (ch === '"') inString = false;
+        continue;
+      }
+      if (ch === '"') { inString = true; current += ch; continue; }
+      if (ch === "{" || ch === ",") {
+        current += ch;
+        if (line.slice(i + 1).trim() !== "") { out.push(current); current = ""; }
+      } else if (ch === "}") {
+        if (current.trim() !== "") { out.push(current); current = ""; }
+        current += ch;
+      } else {
+        current += ch;
+      }
+    }
+    if (current.trim() !== "" || out.length === 0) out.push(current);
+  }
+  return out;
+}
+
+function scanDepth(line, depth) {
+  let inString = false, escaped = false;
+  for (const ch of line) {
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') inString = false;
+    } else if (ch === '"') inString = true;
+    else if (ch === "{") depth++;
+    else if (ch === "}") depth--;
+  }
+  return depth;
+}
+
+function depthMaps(lines) {
+  const start = [], end = [];
+  let depth = 0;
+  for (const line of lines) {
+    start.push(depth);
+    depth = scanDepth(line, depth);
+    end.push(depth);
+  }
+  return { start, end };
+}
+
+function rootRange(lines, dm) {
+  let open = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].includes("{")) { open = i; break; }
+  }
+  if (open < 0) return null;
+  const base = dm.start[open];
+  const close = dm.end[open] === base
+    ? open
+    : (() => {
+        for (let i = open + 1; i < lines.length; i++) if (dm.end[i] === base) return i;
+        return -1;
+      })();
+  if (close < 0) return null;
+  return { open, close, start: open + 1, end: close, depth: base + 1 };
+}
+
+function findMember(lines, dm, range, key) {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(`^\\s*"${escaped}"\\s*:`);
+  for (let i = range.start; i < range.end; i++) {
+    if (dm.start[i] === range.depth && re.test(lines[i])) return i;
+  }
+  return -1;
+}
+
+function objectRange(lines, dm, path) {
+  let current = rootRange(lines, dm);
+  if (!current) return null;
+  for (const key of path) {
+    const idx = findMember(lines, dm, current, key);
+    if (idx < 0) return null;
+    let open = -1;
+    for (let i = idx; i < current.end; i++) {
+      if (lines[i].includes("{")) { open = i; break; }
+    }
+    if (open < 0) return null;
+    const base = dm.start[idx];
+    let close = -1;
+    if (dm.end[open] === base) close = open;
+    else for (let i = open + 1; i < current.end; i++) if (dm.end[i] === base) { close = i; break; }
+    if (close < 0) return null;
+    current = { open, close, start: open + 1, end: close, depth: base + 1 };
+  }
+  return current;
+}
+
+function indent(level) { return "  ".repeat(level); }
+
+function lastContentLine(lines, range) {
+  for (let i = range.end - 1; i >= range.start; i--) {
+    if (lines[i].trim() !== "") return i;
+  }
+  return -1;
+}
+
+function ensureComma(lines, range) {
+  const last = lastContentLine(lines, range);
+  if (last >= 0 && !/,\s*$/.test(lines[last])) lines[last] += ",";
+}
+
+function expandEmptyObject(lines, range) {
+  if (range.open !== range.close) return lines;
+  const line = lines[range.open];
+  const openIdx = line.indexOf("{");
+  const closeIdx = line.lastIndexOf("}");
+  if (openIdx < 0 || closeIdx < openIdx) return lines;
+  const head = line.slice(0, openIdx + 1);
+  const tail = line.slice(closeIdx + 1);
+  const level = range.depth - 1;
+  lines[range.open] = head;
+  lines.splice(range.open + 1, 0, `${indent(level)}}${tail}`);
+  return lines;
+}
+
+function insertObject(lines, parent, key) {
+  let dm = depthMaps(lines);
+  let range = objectRange(lines, dm, parent);
+  if (!range) return lines;
+  if (range.open === range.close) {
+    lines = expandEmptyObject(lines, range);
+    dm = depthMaps(lines);
+    range = objectRange(lines, dm, parent);
+    if (!range) return lines;
+  }
+  ensureComma(lines, range);
+  const level = range.depth;
+  const memberIndent = indent(level);
+  lines.splice(range.end, 0, `${memberIndent}"${key}": {`, `${memberIndent}}`);
+  return lines;
+}
+
+function ensureObject(lines, path) {
+  let dm = depthMaps(lines);
+  if (objectRange(lines, dm, path)) return lines;
+  if (path.length === 0) return ["{", "}"];
+  lines = ensureObject(lines, path.slice(0, -1));
+  lines = insertObject(lines, path.slice(0, -1), path[path.length - 1]);
+  return lines;
+}
+
+function setKeyInRange(lines, range, key, value) {
+  let dm = depthMaps(lines);
+  let idx = findMember(lines, dm, range, key);
+  const memberIndent = indent(range.depth);
+  if (idx >= 0) {
+    const m = lines[idx].match(/^(\s*"[^"]+"\s*:\s*)(.*?)(\s*,)?\s*$/);
+    const comma = m && m[3] ? "," : "";
+    lines[idx] = `${m ? m[1] : `${memberIndent}"${key}": `}${value}${comma}`;
+    return lines;
+  }
+  if (range.open === range.close) {
+    lines = expandEmptyObject(lines, range);
+    dm = depthMaps(lines);
+    range = { ...range, start: range.open + 1, end: range.open + 1, close: range.open + 1 };
+  }
+  ensureComma(lines, range);
+  lines.splice(range.end, 0, `${memberIndent}"${key}": ${value}`);
+  return lines;
+}
+
+export function readJsonKey(text, path) {
+  const lines = normalizeLines((text || "").split(/\r?\n/));
+  const dm = depthMaps(lines);
+  const range = objectRange(lines, dm, path.slice(0, -1));
+  if (!range) return null;
+  const idx = findMember(lines, dm, range, path[path.length - 1]);
+  if (idx < 0) return null;
+  const m = lines[idx].match(/^\s*"[^"]+"\s*:\s*(.*?)\s*,?\s*$/);
+  return m ? m[1] : null;
+}
+
+export function setJsonKey(text, path, value) {
+  let lines = text === "" ? ["{", "}"] : normalizeLines(text.replace(/\r?\n$/, "").split(/\r?\n/));
+  if (!rootRange(lines, depthMaps(lines))) lines = ["{", "}"];
+  lines = ensureObject(lines, path.slice(0, -1));
+  let dm = depthMaps(lines);
+  const range = objectRange(lines, dm, path.slice(0, -1));
+  if (!range) return text;
+  lines = setKeyInRange(lines, range, path[path.length - 1], value);
+  return lines.join("\n") + "\n";
+}
+
+export function removeJsonKey(text, path) {
+  const lines = text === "" ? [] : normalizeLines(text.replace(/\r?\n$/, "").split(/\r?\n/));
+  const dm = depthMaps(lines);
+  const range = objectRange(lines, dm, path.slice(0, -1));
+  if (!range) return { text, removed: false };
+  const idx = findMember(lines, dm, range, path[path.length - 1]);
+  if (idx < 0) return { text, removed: false };
+  lines.splice(idx, 1);
+  const dm2 = depthMaps(lines);
+  const range2 = objectRange(lines, dm2, path.slice(0, -1));
+  if (range2) {
+    const hasLater = (() => {
+      for (let i = idx; i < range2.end; i++) if (dm2.start[i] === range2.depth) return true;
+      return false;
+    })();
+    if (!hasLater) {
+      const prev = lastContentLine(lines, range2);
+      if (prev >= 0) lines[prev] = lines[prev].replace(/,\s*$/, "");
+    }
+  }
+  return { text: lines.join("\n") + (lines.length ? "\n" : ""), removed: true };
+}

package/src/util/paths.mjs

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 export function npmrcPath(env = process.env, home = homedir()) {
   return env.NPM_CONFIG_USERCONFIG || join(home, ".npmrc");
@@ -19,6 +19,14 @@ export function pnpmRcPath(env = process.env, home = homedir(), platform = proce
   return join(home, ".config", "pnpm", "rc");
 }
 
+// pnpm >= 11 reads pnpm-specific settings from config.yaml (camelCase) instead
+// of the registry/auth-only rc file. Keep it next to the rc path so custom
+// PMSEC_PNPM_CONFIG_FILE overrides remain self-contained.
+export function pnpmConfigPath(env = process.env, home = homedir(), platform = process.platform) {
+  if (env.PMSEC_PNPM_CONFIG_YAML) return env.PMSEC_PNPM_CONFIG_YAML;
+  return join(dirname(pnpmRcPath(env, home, platform)), "config.yaml");
+}
+
 export function uvConfigPath(env = process.env, home = homedir(), platform = process.platform) {
   if (env.UV_CONFIG_FILE) return env.UV_CONFIG_FILE;
   if (platform === "win32") {
@@ -70,3 +78,18 @@ export function aubeConfigPath(env = process.env, home = homedir(), platform = p
   const base = env.XDG_CONFIG_HOME || join(home, ".config");
   return join(base, "aube", "config.toml");
 }
+
+// Composer keeps its global config in $COMPOSER_HOME/config.json. The default
+// COMPOSER_HOME follows platform conventions (XDG on Unix, Application Support
+// on macOS, APPDATA on Windows), matching Composer's own resolution. An
+// explicit XDG_CONFIG_HOME wins on every non-Windows platform, including macOS.
+export function composerConfigPath(env = process.env, home = homedir(), platform = process.platform) {
+  if (env.COMPOSER_HOME) return join(env.COMPOSER_HOME, "config.json");
+  if (platform === "win32") {
+    const base = env.APPDATA || join(home, "AppData", "Roaming");
+    return join(base, "Composer", "config.json");
+  }
+  if (env.XDG_CONFIG_HOME) return join(env.XDG_CONFIG_HOME, "composer", "config.json");
+  if (platform === "darwin") return join(home, "Library", "Application Support", "composer", "config.json");
+  return join(home, ".config", "composer", "config.json");
+}