pmsec 2026.11.3 → 2026.11.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "2026.11.3",
+  "version": "2026.11.5",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -188,8 +188,10 @@ function runDoctor(targets, json, ctx, out) {
     platform: ctx.platform,
     uid, euid, username,
     home: ctx.home,
-    pmsecHome: ctx.env.PMSEC_HOME ?? null,
-    pmsecHomeSource: ctx.env.PMSEC_HOME ? "PMSEC_HOME" : "HOME",
+    // This port resolves paths from HOME only; PMSEC_HOME is a bash/powershell
+    // feature (it needs the root->owner chown handback those ports implement).
+    pmsecHome: null,
+    pmsecHomeSource: "HOME",
     tools,
     ok: okFlag,
   };
@@ -201,7 +203,7 @@ function runDoctor(targets, json, ctx, out) {
   out.write(`  platform   : ${ctx.platform}\n`);
   if (isPosix) out.write(`  uid/euid   : ${uid}/${euid}${username ? ` (${username})` : ""}\n`);
   out.write(`  HOME       : ${ctx.home}\n`);
-  out.write(`  PMSEC_HOME : ${ctx.env.PMSEC_HOME ?? "(unset — using HOME)"}\n\n`);
+  out.write(`  PMSEC_HOME : (not supported by this port — using HOME)\n\n`);
   for (const t of tools) {
     const flag = t.parentWritable ? "ok    " : "BLOCK ";
     const ownerSuffix = t.exists && t.owner !== null ? ` (uid=${t.owner})` : "";
@@ -299,6 +301,9 @@ export async function run(argv, {
   try { targets = selectTools(opts.only); }
   catch (e) { err.write(`pmsec: ${e.message}\n`); return 2; }
   const ctx = { env, home, platform };
+  if (env.PMSEC_HOME) {
+    err.write(`pmsec: PMSEC_HOME is ignored by the node port; paths resolve from HOME (${home}). Use the bash port for root-context redirection.\n`);
+  }
   try {
     if (opts.mode === "check") return await runCheck(targets, opts, ctx, out, err);
     if (opts.mode === "disable") return await runDisable(targets, opts.json, ctx, out, err);

package/src/tools/composer.mjs

@@ -1,11 +1,18 @@
 import { composerConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readJsonKey, setJsonKey, removeJsonKey } from "../util/jsonconf.mjs";
+import { buildPreflight } from "../util/version.mjs";
 
 export const name = "composer";
-export const key = "minimum-release-age";
+// Composer's cooldown lives under the unified policy block (Composer >= 2.11):
+//   { "config": { "policy": { "cooldown": { "period": "7 days" } } } }
+// `config.minimum-release-age` was never a Composer key; earlier pmsec
+// releases wrote it and Composer silently ignored it. It is removed on write.
+export const key = "policy.cooldown.period";
 export const section = "config";
-export const docs = "https://getcomposer.org/doc/06-config.md#minimum-release-age";
+export const docs = "https://getcomposer.org/doc/06-config.md#policy";
+export const minBin = [2, 11, 0];
+const COOLDOWN_PATH = ["config", "policy", "cooldown", "period"];
 export const extras = [
   { key: "allow-plugins", expected: "false", line: "false", path: ["config", "allow-plugins"] },
   { key: "secure-http", expected: "true", line: "true", path: ["config", "secure-http"] },
@@ -13,37 +20,34 @@ export const extras = [
   { key: "abandoned", expected: '"fail"', line: '"fail"', path: ["config", "audit", "abandoned"] },
 ];
 
-// Composer is newer than most tools in the bundle; accept the shorter npm
-// spelling too so a config written by hand is still recognized.
-const PRIMARY_ALIASES = [key, "min-release-age", "minimum_release_age", "minimumReleaseAge"];
+// Keys written by pmsec < 2026.11.5 that Composer never read.
+const LEGACY_KEYS = ["minimum-release-age", "min-release-age", "minimum_release_age", "minimumReleaseAge"];
 
 export function path(ctx) { return composerConfigPath(ctx.env, ctx.home, ctx.platform); }
 
+export const preflight = buildPreflight(name, minBin,
+  "config.policy.cooldown is silently ignored. Upgrade Composer to enforce the cooldown.");
+
+// Composer: "<n> second|minute|hour|day|week[s]", or an integer number of
+// seconds (a bare numeric string counts as seconds too). Partial days floor.
 function parseDays(value) {
   if (value === null) return null;
   const v = String(value).trim().replace(/^"|"$/g, "").trim();
-  const dur = v.match(/^(\d+)\s*(d|days?|w|weeks?)$/i);
+  const dur = v.match(/^(\d+)\s*(seconds?|minutes?|hours?|days?|weeks?)$/i);
   if (dur) {
     const n = Number(dur[1]);
-    return /^(w|weeks?)$/i.test(dur[2]) ? n * 7 : n;
+    const unit = dur[2].toLowerCase().replace(/s$/, "");
+    const secs = { second: 1, minute: 60, hour: 3600, day: 86400, week: 604800 }[unit];
+    return Math.floor((n * secs) / 86400);
   }
   if (!/^\d+$/.test(v)) return null;
-  const n = Number(v);
-  // Large values are seconds or minutes (the units Composer uses for its
-  // other time settings); small values are days.
-  if (n >= 86400) return Math.floor(n / 86400);
-  if (n >= 1440 && n % 1440 === 0) return n / 1440;
-  return n;
+  return Math.floor(Number(v) / 86400);
 }
 
 export async function read(ctx) {
   const p = path(ctx);
   const raw = await readSafe(p);
-  let configured = null;
-  for (const candidate of PRIMARY_ALIASES) {
-    const v = readJsonKey(raw, ["config", candidate]);
-    if (v !== null) { configured = v; break; }
-  }
+  const configured = readJsonKey(raw, COOLDOWN_PATH);
   return {
     path: p, configured, days: parseDays(configured),
     extras: extras.map(e => {
@@ -54,10 +58,21 @@ export async function read(ctx) {
   };
 }
 
+function dropLegacy(text) {
+  let removed = false;
+  for (const k of LEGACY_KEYS) {
+    const r = removeJsonKey(text, ["config", k]);
+    text = r.text;
+    if (r.removed) removed = true;
+  }
+  return { text, removed };
+}
+
 export async function write(days, ctx) {
   const p = path(ctx);
   let text = await readSafe(p);
-  text = setJsonKey(text, ["config", key], `${days}`);
+  text = dropLegacy(text).text;
+  text = setJsonKey(text, COOLDOWN_PATH, `"${days} days"`);
   for (const e of extras) text = setJsonKey(text, e.path, e.line);
   await writeAtomic(p, text);
   return { path: p };
@@ -67,11 +82,10 @@ export async function unset(ctx) {
   const p = path(ctx);
   let text = await readSafe(p);
   let removed = false;
-  for (const candidate of PRIMARY_ALIASES) {
-    const r = removeJsonKey(text, ["config", candidate]);
-    text = r.text;
-    if (r.removed) removed = true;
-  }
+  const r0 = removeJsonKey(text, COOLDOWN_PATH);
+  text = r0.text; removed = r0.removed;
+  const r1 = dropLegacy(text);
+  text = r1.text; removed = removed || r1.removed;
   for (const e of extras) {
     const r = removeJsonKey(text, e.path);
     text = r.text;

package/src/tools/npm.mjs

@@ -10,8 +10,8 @@ export const docs = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release
 export const minBin = [11, 10, 0];
 export const extras = [
   { key: "audit-level", expected: "high", line: "audit-level=high" },
-  { key: "allow-git", expected: "root", line: "allow-git=root", safeValues: ["none", "root"] },
-  { key: "allow-remote", expected: "root", line: "allow-remote=root", safeValues: ["none", "root"] },
+  { key: "allow-git", expected: "none", line: "allow-git=none" },
+  { key: "allow-remote", expected: "none", line: "allow-remote=none" },
   { key: "allow-file", expected: "root", line: "allow-file=root", safeValues: ["none", "root"] },
   { key: "allow-directory", expected: "root", line: "allow-directory=root", safeValues: ["none", "root"] },
   { key: "strict-allow-scripts", expected: "true", line: "strict-allow-scripts=true" },
@@ -29,9 +29,11 @@ export async function read(ctx) {
   const p = path(ctx);
   const raw = await readSafe(p);
   const value = readKey(raw, key);
+  // npm stores whole days. Anything else is reported as unparseable (null) so
+  // `--check` fails instead of letting NaN slip past the `< days` comparison.
   return {
     path: p, configured: value,
-    days: value === null ? null : Number(value),
+    days: value !== null && /^\d+$/.test(value) ? Number(value) : null,
     extras: readExtras(raw, extras)
   };
 }

package/src/tools/uv.mjs

@@ -7,7 +7,9 @@ import { buildPreflight } from "../util/version.mjs";
 export const name = "uv";
 export const key = "exclude-newer";
 export const docs = "https://docs.astral.sh/uv/reference/settings/#exclude-newer";
-export const minBin = [0, 9, 17];
+// 0.9.17 added relative exclude-newer; the [audit] table only parses from 0.11.3
+// (verified against released binaries: 0.11.2 rejects it, 0.11.3 accepts it).
+export const minBin = [0, 11, 3];
 export const extras = [
   { key: "index-strategy", expected: '"first-index"', line: 'index-strategy = "first-index"' },
   { key: "malware-check", expected: "true", line: "malware-check = true", section: "audit" },
@@ -16,7 +18,7 @@ export const extras = [
 export function path(ctx) { return uvConfigPath(ctx.env, ctx.home, ctx.platform); }
 
 export const preflight = buildPreflight(name, minBin,
-  "writing exclude-newer = \"N days\" will break this uv until you `uv self update` (file will fail to parse).");
+  "the written uv.toml (relative exclude-newer and the [audit] table) will not parse on this uv and every uv command will fail until you `uv self update`.");
 
 function parseDays(value) {
   if (value === null) return null;

package/src/util/io.mjs

@@ -1,45 +1,26 @@
-import { mkdir, readFile, writeFile, rename, lstat, unlink, open } from "node:fs/promises";
-import { dirname, resolve, sep } from "node:path";
+import { mkdir, readFile, rename, lstat, unlink, open } from "node:fs/promises";
+import { dirname } from "node:path";
 import { existsSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { homedir } from "node:os";
 
 export async function readSafe(path) {
   // Editors on Windows may prepend a BOM; it would hide the first header or key.
-  try { return (await readFile(path, "utf8")).replace(/^\uFEFF/, ""); }
+  try { return (await readFile(path, "utf8")).replace(/^/, ""); }
   catch (e) { if (e.code === "ENOENT") return ""; throw e; }
 }
 
-function isPermErr(e) { return e?.code === "EACCES" || e?.code === "EPERM"; }
-
 async function isSymlink(p) {
   try { return (await lstat(p)).isSymbolicLink(); }
   catch { return false; }
 }
 
-function underHome(p, home) {
-  const r = resolve(p);
-  const h = resolve(home);
-  return r === h || r.startsWith(h + sep);
-}
-
 export function shellQuote(s) { return `'${String(s).replace(/'/g, `'\\''`)}'`; }
 
-async function reclaim(path, home, err) {
-  if (process.platform === "win32" || typeof process.getuid !== "function") return false;
-  if (!existsSync(path)) return false;
-  if (await isSymlink(path)) {
-    err.write(`pmsec: refusing to chown symlink ${path}; remove or replace it manually.\n`);
-    return false;
-  }
-  if (!underHome(path, home)) {
-    err.write(`pmsec: refusing to chown ${path} outside HOME (${home}); fix ownership manually.\n`);
-    return false;
-  }
-  err.write(`pmsec: ${path} not writable; running \`sudo chown -h $(id -u):$(id -g) ${shellQuote(path)}\`. You may be prompted for your password.\n`);
-  const r = spawnSync("sudo", ["chown", "-h", `${process.getuid()}:${process.getgid()}`, path], { stdio: "inherit" });
-  return r.status === 0;
+function symlinkError(what, p) {
+  const e = new Error(`refusing to write ${what} through symlink ${p}`);
+  e.code = "ELOOP";
+  e.path = p;
+  return e;
 }
 
 async function atomicReplace(path, text) {
@@ -59,24 +40,18 @@ async function atomicReplace(path, text) {
   }
 }
 
-export async function writeAtomic(path, text, { backup = true, home = homedir(), err = process.stderr } = {}) {
+// Permission errors propagate to the caller, which prints a chown hint. pmsec
+// never escalates privileges itself: an unwritable config under HOME is an
+// operator decision (or a symptom worth seeing), not something to sudo past.
+export async function writeAtomic(path, text, { backup = true } = {}) {
   await mkdir(dirname(path), { recursive: true });
-  if (existsSync(path) && await isSymlink(path)) {
-    const e = new Error(`refusing to write through symlink ${path}`);
-    e.code = "ELOOP";
-    throw e;
-  }
-  if (backup && existsSync(path) && !existsSync(path + ".bak")) {
-    try { await atomicReplace(path + ".bak", await readFile(path, "utf8")); }
-    catch (e) {
-      const target = existsSync(path + ".bak") ? path + ".bak" : path;
-      if (!isPermErr(e) || !(await reclaim(target, home, err))) throw e;
-      await atomicReplace(path + ".bak", await readFile(path, "utf8"));
-    }
-  }
-  try { await atomicReplace(path, text); }
-  catch (e) {
-    if (!isPermErr(e) || !(await reclaim(path, home, err))) throw e;
-    await atomicReplace(path, text);
+  if (existsSync(path) && await isSymlink(path)) throw symlinkError("config", path);
+  const bak = path + ".bak";
+  if (backup && existsSync(path) && !existsSync(bak)) {
+    // A dangling symlink fails existsSync; rename() would replace the link
+    // itself, but refuse anyway so a planted link is visible, not silently clobbered.
+    if (await isSymlink(bak)) throw symlinkError("backup", bak);
+    await atomicReplace(bak, await readFile(path, "utf8"));
   }
+  await atomicReplace(path, text);
 }

package/src/util/paths.mjs

@@ -1,5 +1,6 @@
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute } from "node:path";
+import { existsSync } from "node:fs";
 
 export function npmrcPath(env = process.env, home = homedir()) {
   return env.NPM_CONFIG_USERCONFIG || join(home, ".npmrc");
@@ -37,8 +38,12 @@ export function uvConfigPath(env = process.env, home = homedir(), platform = pro
   return join(base, "uv", "uv.toml");
 }
 
+// bun reads $XDG_CONFIG_HOME/.bunfig.toml *instead of* $HOME/.bunfig.toml
+// whenever XDG_CONFIG_HOME is set to an absolute path.
 export function bunConfigPath(env = process.env, home = homedir()) {
-  return env.BUN_CONFIG_FILE || join(home, ".bunfig.toml");
+  if (env.BUN_CONFIG_FILE) return env.BUN_CONFIG_FILE;
+  if (env.XDG_CONFIG_HOME && isAbsolute(env.XDG_CONFIG_HOME)) return join(env.XDG_CONFIG_HOME, ".bunfig.toml");
+  return join(home, ".bunfig.toml");
 }
 
 export function yarnrcPath(env = process.env, home = homedir()) {
@@ -83,13 +88,24 @@ export function aubeConfigPath(env = process.env, home = homedir(), platform = p
 // COMPOSER_HOME follows platform conventions (XDG on Unix, Application Support
 // on macOS, APPDATA on Windows), matching Composer's own resolution. An
 // explicit XDG_CONFIG_HOME wins on every non-Windows platform, including macOS.
+// Mirrors Composer's Factory::getHomeDir: COMPOSER_HOME, else %APPDATA%/Composer
+// on Windows, else (when any XDG_* variable is set or /etc/xdg exists) the
+// first existing of $XDG_CONFIG_HOME/composer and ~/.composer, defaulting to
+// the XDG one; without XDG, ~/.composer. Composer never uses Application
+// Support on macOS.
 export function composerConfigPath(env = process.env, home = homedir(), platform = process.platform) {
   if (env.COMPOSER_HOME) return join(env.COMPOSER_HOME, "config.json");
   if (platform === "win32") {
     const base = env.APPDATA || join(home, "AppData", "Roaming");
     return join(base, "Composer", "config.json");
   }
-  if (env.XDG_CONFIG_HOME) return join(env.XDG_CONFIG_HOME, "composer", "config.json");
-  if (platform === "darwin") return join(home, "Library", "Application Support", "composer", "config.json");
-  return join(home, ".config", "composer", "config.json");
+  // The /etc/xdg probe describes the host, so it only applies when the
+  // requested platform is the host platform (tests pass foreign platforms).
+  const useXdg = Object.keys(env).some(k => k.startsWith("XDG_"))
+    || (platform === process.platform && existsSync("/etc/xdg"));
+  const dirs = [];
+  if (useXdg) dirs.push(join(env.XDG_CONFIG_HOME || join(home, ".config"), "composer"));
+  dirs.push(join(home, ".composer"));
+  const dir = dirs.find(d => existsSync(d)) ?? dirs[0];
+  return join(dir, "config.json");
 }