pmsec 2026.11.4 → 2026.11.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "2026.11.4",
+  "version": "2026.11.5",
   "publishConfig": {
     "access": "public"
   },

package/src/tools/composer.mjs

@@ -1,11 +1,18 @@
 import { composerConfigPath } from "../util/paths.mjs";
 import { readSafe, writeAtomic } from "../util/io.mjs";
 import { readJsonKey, setJsonKey, removeJsonKey } from "../util/jsonconf.mjs";
+import { buildPreflight } from "../util/version.mjs";
 
 export const name = "composer";
-export const key = "minimum-release-age";
+// Composer's cooldown lives under the unified policy block (Composer >= 2.11):
+//   { "config": { "policy": { "cooldown": { "period": "7 days" } } } }
+// `config.minimum-release-age` was never a Composer key; earlier pmsec
+// releases wrote it and Composer silently ignored it. It is removed on write.
+export const key = "policy.cooldown.period";
 export const section = "config";
-export const docs = "https://getcomposer.org/doc/06-config.md#minimum-release-age";
+export const docs = "https://getcomposer.org/doc/06-config.md#policy";
+export const minBin = [2, 11, 0];
+const COOLDOWN_PATH = ["config", "policy", "cooldown", "period"];
 export const extras = [
   { key: "allow-plugins", expected: "false", line: "false", path: ["config", "allow-plugins"] },
   { key: "secure-http", expected: "true", line: "true", path: ["config", "secure-http"] },
@@ -13,37 +20,34 @@ export const extras = [
   { key: "abandoned", expected: '"fail"', line: '"fail"', path: ["config", "audit", "abandoned"] },
 ];
 
-// Composer is newer than most tools in the bundle; accept the shorter npm
-// spelling too so a config written by hand is still recognized.
-const PRIMARY_ALIASES = [key, "min-release-age", "minimum_release_age", "minimumReleaseAge"];
+// Keys written by pmsec < 2026.11.5 that Composer never read.
+const LEGACY_KEYS = ["minimum-release-age", "min-release-age", "minimum_release_age", "minimumReleaseAge"];
 
 export function path(ctx) { return composerConfigPath(ctx.env, ctx.home, ctx.platform); }
 
+export const preflight = buildPreflight(name, minBin,
+  "config.policy.cooldown is silently ignored. Upgrade Composer to enforce the cooldown.");
+
+// Composer: "<n> second|minute|hour|day|week[s]", or an integer number of
+// seconds (a bare numeric string counts as seconds too). Partial days floor.
 function parseDays(value) {
   if (value === null) return null;
   const v = String(value).trim().replace(/^"|"$/g, "").trim();
-  const dur = v.match(/^(\d+)\s*(d|days?|w|weeks?)$/i);
+  const dur = v.match(/^(\d+)\s*(seconds?|minutes?|hours?|days?|weeks?)$/i);
   if (dur) {
     const n = Number(dur[1]);
-    return /^(w|weeks?)$/i.test(dur[2]) ? n * 7 : n;
+    const unit = dur[2].toLowerCase().replace(/s$/, "");
+    const secs = { second: 1, minute: 60, hour: 3600, day: 86400, week: 604800 }[unit];
+    return Math.floor((n * secs) / 86400);
   }
   if (!/^\d+$/.test(v)) return null;
-  const n = Number(v);
-  // Large values are seconds or minutes (the units Composer uses for its
-  // other time settings); small values are days.
-  if (n >= 86400) return Math.floor(n / 86400);
-  if (n >= 1440 && n % 1440 === 0) return n / 1440;
-  return n;
+  return Math.floor(Number(v) / 86400);
 }
 
 export async function read(ctx) {
   const p = path(ctx);
   const raw = await readSafe(p);
-  let configured = null;
-  for (const candidate of PRIMARY_ALIASES) {
-    const v = readJsonKey(raw, ["config", candidate]);
-    if (v !== null) { configured = v; break; }
-  }
+  const configured = readJsonKey(raw, COOLDOWN_PATH);
   return {
     path: p, configured, days: parseDays(configured),
     extras: extras.map(e => {
@@ -54,10 +58,21 @@ export async function read(ctx) {
   };
 }
 
+function dropLegacy(text) {
+  let removed = false;
+  for (const k of LEGACY_KEYS) {
+    const r = removeJsonKey(text, ["config", k]);
+    text = r.text;
+    if (r.removed) removed = true;
+  }
+  return { text, removed };
+}
+
 export async function write(days, ctx) {
   const p = path(ctx);
   let text = await readSafe(p);
-  text = setJsonKey(text, ["config", key], `${days}`);
+  text = dropLegacy(text).text;
+  text = setJsonKey(text, COOLDOWN_PATH, `"${days} days"`);
   for (const e of extras) text = setJsonKey(text, e.path, e.line);
   await writeAtomic(p, text);
   return { path: p };
@@ -67,11 +82,10 @@ export async function unset(ctx) {
   const p = path(ctx);
   let text = await readSafe(p);
   let removed = false;
-  for (const candidate of PRIMARY_ALIASES) {
-    const r = removeJsonKey(text, ["config", candidate]);
-    text = r.text;
-    if (r.removed) removed = true;
-  }
+  const r0 = removeJsonKey(text, COOLDOWN_PATH);
+  text = r0.text; removed = r0.removed;
+  const r1 = dropLegacy(text);
+  text = r1.text; removed = removed || r1.removed;
   for (const e of extras) {
     const r = removeJsonKey(text, e.path);
     text = r.text;

package/src/tools/npm.mjs

@@ -10,8 +10,8 @@ export const docs = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release
 export const minBin = [11, 10, 0];
 export const extras = [
   { key: "audit-level", expected: "high", line: "audit-level=high" },
-  { key: "allow-git", expected: "root", line: "allow-git=root", safeValues: ["none", "root"] },
-  { key: "allow-remote", expected: "root", line: "allow-remote=root", safeValues: ["none", "root"] },
+  { key: "allow-git", expected: "none", line: "allow-git=none" },
+  { key: "allow-remote", expected: "none", line: "allow-remote=none" },
   { key: "allow-file", expected: "root", line: "allow-file=root", safeValues: ["none", "root"] },
   { key: "allow-directory", expected: "root", line: "allow-directory=root", safeValues: ["none", "root"] },
   { key: "strict-allow-scripts", expected: "true", line: "strict-allow-scripts=true" },

package/src/tools/uv.mjs

@@ -7,7 +7,9 @@ import { buildPreflight } from "../util/version.mjs";
 export const name = "uv";
 export const key = "exclude-newer";
 export const docs = "https://docs.astral.sh/uv/reference/settings/#exclude-newer";
-export const minBin = [0, 9, 17];
+// 0.9.17 added relative exclude-newer; the [audit] table only parses from 0.11.3
+// (verified against released binaries: 0.11.2 rejects it, 0.11.3 accepts it).
+export const minBin = [0, 11, 3];
 export const extras = [
   { key: "index-strategy", expected: '"first-index"', line: 'index-strategy = "first-index"' },
   { key: "malware-check", expected: "true", line: "malware-check = true", section: "audit" },
@@ -16,7 +18,7 @@ export const extras = [
 export function path(ctx) { return uvConfigPath(ctx.env, ctx.home, ctx.platform); }
 
 export const preflight = buildPreflight(name, minBin,
-  "writing exclude-newer = \"N days\" will break this uv until you `uv self update` (file will fail to parse).");
+  "the written uv.toml (relative exclude-newer and the [audit] table) will not parse on this uv and every uv command will fail until you `uv self update`.");
 
 function parseDays(value) {
   if (value === null) return null;

package/src/util/paths.mjs

@@ -1,5 +1,6 @@
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute } from "node:path";
+import { existsSync } from "node:fs";
 
 export function npmrcPath(env = process.env, home = homedir()) {
   return env.NPM_CONFIG_USERCONFIG || join(home, ".npmrc");
@@ -37,8 +38,12 @@ export function uvConfigPath(env = process.env, home = homedir(), platform = pro
   return join(base, "uv", "uv.toml");
 }
 
+// bun reads $XDG_CONFIG_HOME/.bunfig.toml *instead of* $HOME/.bunfig.toml
+// whenever XDG_CONFIG_HOME is set to an absolute path.
 export function bunConfigPath(env = process.env, home = homedir()) {
-  return env.BUN_CONFIG_FILE || join(home, ".bunfig.toml");
+  if (env.BUN_CONFIG_FILE) return env.BUN_CONFIG_FILE;
+  if (env.XDG_CONFIG_HOME && isAbsolute(env.XDG_CONFIG_HOME)) return join(env.XDG_CONFIG_HOME, ".bunfig.toml");
+  return join(home, ".bunfig.toml");
 }
 
 export function yarnrcPath(env = process.env, home = homedir()) {
@@ -83,13 +88,24 @@ export function aubeConfigPath(env = process.env, home = homedir(), platform = p
 // COMPOSER_HOME follows platform conventions (XDG on Unix, Application Support
 // on macOS, APPDATA on Windows), matching Composer's own resolution. An
 // explicit XDG_CONFIG_HOME wins on every non-Windows platform, including macOS.
+// Mirrors Composer's Factory::getHomeDir: COMPOSER_HOME, else %APPDATA%/Composer
+// on Windows, else (when any XDG_* variable is set or /etc/xdg exists) the
+// first existing of $XDG_CONFIG_HOME/composer and ~/.composer, defaulting to
+// the XDG one; without XDG, ~/.composer. Composer never uses Application
+// Support on macOS.
 export function composerConfigPath(env = process.env, home = homedir(), platform = process.platform) {
   if (env.COMPOSER_HOME) return join(env.COMPOSER_HOME, "config.json");
   if (platform === "win32") {
     const base = env.APPDATA || join(home, "AppData", "Roaming");
     return join(base, "Composer", "config.json");
   }
-  if (env.XDG_CONFIG_HOME) return join(env.XDG_CONFIG_HOME, "composer", "config.json");
-  if (platform === "darwin") return join(home, "Library", "Application Support", "composer", "config.json");
-  return join(home, ".config", "composer", "config.json");
+  // The /etc/xdg probe describes the host, so it only applies when the
+  // requested platform is the host platform (tests pass foreign platforms).
+  const useXdg = Object.keys(env).some(k => k.startsWith("XDG_"))
+    || (platform === process.platform && existsSync("/etc/xdg"));
+  const dirs = [];
+  if (useXdg) dirs.push(join(env.XDG_CONFIG_HOME || join(home, ".config"), "composer"));
+  dirs.push(join(home, ".composer"));
+  const dir = dirs.find(d => existsSync(d)) ?? dirs[0];
+  return join(dir, "config.json");
 }