pmsec 2026.11.2 → 2026.11.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "2026.11.2",
+  "version": "2026.11.4",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -188,8 +188,10 @@ function runDoctor(targets, json, ctx, out) {
     platform: ctx.platform,
     uid, euid, username,
     home: ctx.home,
-    pmsecHome: ctx.env.PMSEC_HOME ?? null,
-    pmsecHomeSource: ctx.env.PMSEC_HOME ? "PMSEC_HOME" : "HOME",
+    // This port resolves paths from HOME only; PMSEC_HOME is a bash/powershell
+    // feature (it needs the root->owner chown handback those ports implement).
+    pmsecHome: null,
+    pmsecHomeSource: "HOME",
     tools,
     ok: okFlag,
   };
@@ -201,7 +203,7 @@ function runDoctor(targets, json, ctx, out) {
   out.write(`  platform   : ${ctx.platform}\n`);
   if (isPosix) out.write(`  uid/euid   : ${uid}/${euid}${username ? ` (${username})` : ""}\n`);
   out.write(`  HOME       : ${ctx.home}\n`);
-  out.write(`  PMSEC_HOME : ${ctx.env.PMSEC_HOME ?? "(unset — using HOME)"}\n\n`);
+  out.write(`  PMSEC_HOME : (not supported by this port — using HOME)\n\n`);
   for (const t of tools) {
     const flag = t.parentWritable ? "ok    " : "BLOCK ";
     const ownerSuffix = t.exists && t.owner !== null ? ` (uid=${t.owner})` : "";
@@ -299,6 +301,9 @@ export async function run(argv, {
   try { targets = selectTools(opts.only); }
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
   const ctx = { env, home, platform };
+  if (env.PMSEC_HOME) {
+    err.write(`pmsec: PMSEC_HOME is ignored by the node port; paths resolve from HOME (${home}). Use the bash port for root-context redirection.\n`);
+  }
   try {
     if (opts.mode === "check") return await runCheck(targets, opts, ctx, out, err);
     if (opts.mode === "disable") return await runDisable(targets, opts.json, ctx, out, err);

package/src/tools/npm.mjs

@@ -29,9 +29,11 @@ export async function read(ctx) {
   const p = path(ctx);
   const raw = await readSafe(p);
   const value = readKey(raw, key);
+  // npm stores whole days. Anything else is reported as unparseable (null) so
+  // `--check` fails instead of letting NaN slip past the `< days` comparison.
   return {
     path: p, configured: value,
-    days: value === null ? null : Number(value),
+    days: value !== null && /^\d+$/.test(value) ? Number(value) : null,
     extras: readExtras(raw, extras)
   };
 }

package/src/util/io.mjs

@@ -1,44 +1,26 @@
-import { mkdir, readFile, writeFile, rename, lstat, unlink, open } from "node:fs/promises";
-import { dirname, resolve, sep } from "node:path";
+import { mkdir, readFile, rename, lstat, unlink, open } from "node:fs/promises";
+import { dirname } from "node:path";
 import { existsSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { homedir } from "node:os";
 
 export async function readSafe(path) {
-  try { return await readFile(path, "utf8"); }
+  // Editors on Windows may prepend a BOM; it would hide the first header or key.
+  try { return (await readFile(path, "utf8")).replace(/^/, ""); }
   catch (e) { if (e.code === "ENOENT") return ""; throw e; }
 }
 
-function isPermErr(e) { return e?.code === "EACCES" || e?.code === "EPERM"; }
-
 async function isSymlink(p) {
   try { return (await lstat(p)).isSymbolicLink(); }
   catch { return false; }
 }
 
-function underHome(p, home) {
-  const r = resolve(p);
-  const h = resolve(home);
-  return r === h || r.startsWith(h + sep);
-}
-
 export function shellQuote(s) { return `'${String(s).replace(/'/g, `'\\''`)}'`; }
 
-async function reclaim(path, home, err) {
-  if (process.platform === "win32" || typeof process.getuid !== "function") return false;
-  if (!existsSync(path)) return false;
-  if (await isSymlink(path)) {
-    err.write(`pmsec: refusing to chown symlink ${path}; remove or replace it manually.\n`);
-    return false;
-  }
-  if (!underHome(path, home)) {
-    err.write(`pmsec: refusing to chown ${path} outside HOME (${home}); fix ownership manually.\n`);
-    return false;
-  }
-  err.write(`pmsec: ${path} not writable; running \`sudo chown -h $(id -u):$(id -g) ${shellQuote(path)}\`. You may be prompted for your password.\n`);
-  const r = spawnSync("sudo", ["chown", "-h", `${process.getuid()}:${process.getgid()}`, path], { stdio: "inherit" });
-  return r.status === 0;
+function symlinkError(what, p) {
+  const e = new Error(`refusing to write ${what} through symlink ${p}`);
+  e.code = "ELOOP";
+  e.path = p;
+  return e;
 }
 
 async function atomicReplace(path, text) {
@@ -58,24 +40,18 @@ async function atomicReplace(path, text) {
   }
 }
 
-export async function writeAtomic(path, text, { backup = true, home = homedir(), err = process.stderr } = {}) {
+// Permission errors propagate to the caller, which prints a chown hint. pmsec
+// never escalates privileges itself: an unwritable config under HOME is an
+// operator decision (or a symptom worth seeing), not something to sudo past.
+export async function writeAtomic(path, text, { backup = true } = {}) {
   await mkdir(dirname(path), { recursive: true });
-  if (existsSync(path) && await isSymlink(path)) {
-    const e = new Error(`refusing to write through symlink ${path}`);
-    e.code = "ELOOP";
-    throw e;
-  }
-  if (backup && existsSync(path) && !existsSync(path + ".bak")) {
-    try { await atomicReplace(path + ".bak", await readFile(path, "utf8")); }
-    catch (e) {
-      const target = existsSync(path + ".bak") ? path + ".bak" : path;
-      if (!isPermErr(e) || !(await reclaim(target, home, err))) throw e;
-      await atomicReplace(path + ".bak", await readFile(path, "utf8"));
-    }
-  }
-  try { await atomicReplace(path, text); }
-  catch (e) {
-    if (!isPermErr(e) || !(await reclaim(path, home, err))) throw e;
-    await atomicReplace(path, text);
+  if (existsSync(path) && await isSymlink(path)) throw symlinkError("config", path);
+  const bak = path + ".bak";
+  if (backup && existsSync(path) && !existsSync(bak)) {
+    // A dangling symlink fails existsSync; rename() would replace the link
+    // itself, but refuse anyway so a planted link is visible, not silently clobbered.
+    if (await isSymlink(bak)) throw symlinkError("backup", bak);
+    await atomicReplace(bak, await readFile(path, "utf8"));
   }
+  await atomicReplace(path, text);
 }

package/src/util/lines.mjs

@@ -12,14 +12,17 @@ function headerName(line) {
   return m ? m[1].split(".").map(p => unquote(p.trim())).join(".") : null;
 }
 
+// YAML nests by indentation, so only unindented `key:` lines are top-level.
+function indentRe(sep) { return sep === ":" ? "^" : String.raw`^\s*`; }
+
 function entryKey(line, sep) {
-  const m = line.match(new RegExp(String.raw`^\s*${KEY}\s*${sep}`));
+  const m = line.match(new RegExp(String.raw`${indentRe(sep)}${KEY}\s*${sep}`));
   return m ? unquote(m[1]) : null;
 }
 
 // Value after the separator with any trailing comment removed.
 function entryValue(line, sep) {
-  const m = line.match(new RegExp(String.raw`^\s*${KEY}\s*${sep}\s*(.*?)\s*$`));
+  const m = line.match(new RegExp(String.raw`${indentRe(sep)}${KEY}\s*${sep}\s*(.*?)\s*$`));
   if (!m) return null;
   const v = m[2];
   const close = { '"': '"', "'": "'", "{": "}" }[v[0]];
@@ -30,6 +33,20 @@ function entryValue(line, sep) {
   return v.replace(/\s+#.*$/, "");
 }
 
+// Copy of `lines` with the body of TOML multi-line strings blanked, so text
+// inside them is never taken for a header or key. Indices stay aligned.
+function scanView(lines) {
+  let open = null;
+  return lines.map(line => {
+    const inside = open !== null;
+    for (const m of line.matchAll(/"""|'''/g)) {
+      if (open === null) open = m[0];
+      else if (open === m[0]) open = null;
+    }
+    return inside ? "" : line;
+  });
+}
+
 function rangeForSection(lines, section) {
   if (!section) {
     for (let i = 0; i < lines.length; i++) if (SECTION.test(lines[i])) return [0, i];
@@ -54,7 +71,17 @@ function indexOfKey(lines, range, key, sep) {
 
 // TOML forbids `a.b = x` under [s] when [s.a] exists or `a` is an inline table,
 // so target the subtable, or report the inline-table line to edit in place.
+// A table defined at the root through dotted keys (`s.k = v`) or an inline
+// table (`s = { ... }`) cannot also get a [s] header, so keep editing it there.
 function resolve(lines, key, sep, section) {
+  if (section && sep === "=" && rangeForSection(lines, section) === null) {
+    const [, end] = rangeForSection(lines, null);
+    for (let i = 0; i < end; i++) {
+      const k = entryKey(lines[i], sep) || "";
+      if (k.startsWith(`${section}.`)) return { key: `${section}.${key}`, section: null };
+      if (k === section && (entryValue(lines[i], sep) || "").startsWith("{")) return { key, section: null, inline: i, head: section };
+    }
+  }
   if (section && sep === "=" && key.includes(".")) {
     const dot = key.indexOf(".");
     const head = key.slice(0, dot), rest = key.slice(dot + 1);
@@ -87,7 +114,7 @@ function indexOfFirstSection(lines) {
 
 export function readKey(text, key, opts = {}) {
   const sep = opts.sep || "=";
-  const lines = text.split(/\r?\n/);
+  const lines = scanView(text.split(/\r?\n/));
   const r = resolve(lines, key, sep, opts.section || null);
   if (r.inline !== undefined) {
     const pair = inlinePairs(lines[r.inline]).find(p => entryKey(p, sep) === r.key);
@@ -103,7 +130,8 @@ export function setKey(text, key, valueLine, opts = {}) {
   const sep = opts.sep || "=";
   const trailing = text.endsWith("\n") || text === "";
   const lines = text === "" ? [] : text.replace(/\r?\n$/, "").split(/\r?\n/);
-  const r = resolve(lines, key, sep, opts.section || null);
+  const scan = scanView(lines);
+  const r = resolve(scan, key, sep, opts.section || null);
   const section = r.section;
   if (r.key !== key) valueLine = r.key + valueLine.slice(key.length);
   if (r.inline !== undefined) {
@@ -114,19 +142,21 @@ export function setKey(text, key, valueLine, opts = {}) {
     return lines.join("\n") + "\n";
   }
   key = r.key;
-  let range = rangeForSection(lines, section);
+  let range = rangeForSection(scan, section);
   if (range === null) {
     if (lines.length && lines[lines.length - 1] !== "") lines.push("");
     lines.push(`[${section}]`, valueLine);
   } else {
-    const idx = indexOfKey(lines, range, key, sep);
+    const idx = indexOfKey(scan, range, key, sep);
     if (idx >= 0) {
       lines[idx] = valueLine;
     } else if (section) {
       lines.splice(range[0], 0, valueLine);
     } else {
-      const firstSec = indexOfFirstSection(lines);
+      const firstSec = indexOfFirstSection(scan);
+      // Reuse the blank line that already separates the root keys from the first table.
       if (firstSec < 0) lines.push(valueLine);
+      else if (firstSec > 0 && lines[firstSec - 1] === "") lines.splice(firstSec - 1, 0, valueLine);
       else lines.splice(firstSec, 0, valueLine, "");
     }
   }
@@ -137,7 +167,8 @@ export function removeKey(text, key, opts = {}) {
   const sep = opts.sep || "=";
   const trailing = text.endsWith("\n");
   const lines = text === "" ? [] : text.replace(/\r?\n$/, "").split(/\r?\n/);
-  const r = resolve(lines, key, sep, opts.section || null);
+  const scan = scanView(lines);
+  const r = resolve(scan, key, sep, opts.section || null);
   if (r.inline !== undefined) {
     const pairs = inlinePairs(lines[r.inline]);
     const kept = pairs.filter(p => entryKey(p, sep) !== r.key);
@@ -145,9 +176,9 @@ export function removeKey(text, key, opts = {}) {
     lines[r.inline] = inlineLine(lines[r.inline], r.head, kept);
     return { text: lines.join("\n") + (trailing ? "\n" : ""), removed: true };
   }
-  const range = rangeForSection(lines, r.section);
+  const range = rangeForSection(scan, r.section);
   if (range === null) return { text, removed: false };
-  const idx = indexOfKey(lines, range, r.key, sep);
+  const idx = indexOfKey(scan, range, r.key, sep);
   if (idx < 0) return { text, removed: false };
   lines.splice(idx, 1);
   if (idx < lines.length && lines[idx] === "") lines.splice(idx, 1);