proof-of-commitment 1.0.0 → 1.2.0

package/index.js

@@ -23,7 +23,6 @@ const c = {
 };
 
 const NO_COLOR = process.env.NO_COLOR || !process.stdout.isTTY;
-const col = NO_COLOR ? () => '' : (code) => code;
 
 function clr(code, text) {
   if (NO_COLOR) return text;
@@ -57,7 +56,7 @@ function padEnd(str, len) {
   return str + ' '.repeat(Math.max(0, len - visible.length));
 }
 
-function printTable(results) {
+function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
   const COL = {
     name: 20, risk: 14, score: 7, maintainers: 12, downloads: 12, age: 8,
   };
@@ -74,15 +73,19 @@ function printTable(results) {
   const divider = '─'.repeat(COL.name + COL.risk + COL.score + COL.maintainers + COL.downloads + COL.age + 10);
 
   console.log('\n' + divider);
+  if (lockfile && totalScanned && results.length < totalScanned) {
+    console.log(clr(c.dim, `  Top ${results.length} highest-risk of ${totalScanned} packages scanned`));
+    console.log(divider);
+  }
   console.log(header);
   console.log(divider);
 
-  let criticalCount = 0;
+  let criticalInDisplay = 0;
 
   for (const pkg of results) {
     const rc = riskColor(pkg.riskFlags, pkg.score);
     const label = riskLabel(pkg.riskFlags, pkg.score);
-    if (pkg.riskFlags && pkg.riskFlags.includes('CRITICAL')) criticalCount++;
+    if (pkg.riskFlags && pkg.riskFlags.includes('CRITICAL')) criticalInDisplay++;
 
     const row = [
       padEnd(pkg.name, COL.name),
@@ -108,13 +111,19 @@ function printTable(results) {
 
   console.log(divider);
 
-  if (criticalCount > 0) {
-    console.log('\n' + clr(c.red + c.bold, `⚠  ${criticalCount} CRITICAL package${criticalCount > 1 ? 's' : ''} found.`));
+  const effectiveCritical = totalCritical !== undefined ? totalCritical : criticalInDisplay;
+  if (effectiveCritical > 0) {
+    const suffix = totalScanned ? ` (in ${totalScanned} packages scanned)` : '';
+    console.log('\n' + clr(c.red + c.bold, `⚠  ${effectiveCritical} CRITICAL package${effectiveCritical > 1 ? 's' : ''} found${suffix}.`));
     console.log(clr(c.dim, '   CRITICAL = sole maintainer + >10M weekly downloads (high-value attack target)'));
-    console.log(clr(c.dim, `   Full breakdown: ${WEB}?packages=${results.map(r => r.name).join(',')}`));
   } else {
-    console.log('\n' + clr(c.green, '✓  No CRITICAL packages found.'));
+    const suffix = totalScanned ? ` (${totalScanned} packages scanned)` : '';
+    console.log('\n' + clr(c.green, `✓  No CRITICAL packages found${suffix}.`));
   }
+
+  // Always show the web URL with top critical packages first
+  const topPkgs = results.slice(0, 10).map(r => r.name).join(',');
+  console.log(clr(c.dim, `\n🔗 Web view: ${WEB}?packages=${encodeURIComponent(topPkgs)}`));
   console.log();
 }
 
@@ -123,15 +132,19 @@ function printHelp() {
 ${clr(c.bold, 'proof-of-commitment')} — supply chain risk scorer
 
 ${clr(c.bold, 'Usage:')}
-  npx proof-of-commitment [packages...]     Score npm packages
-  npx proof-of-commitment --pypi [pkgs...]  Score PyPI packages
-  npx proof-of-commitment --file <path>     Auto-detect from package.json / requirements.txt
+  npx proof-of-commitment [packages...]         Score npm packages
+  npx proof-of-commitment --pypi [pkgs...]      Score PyPI packages
+  npx proof-of-commitment --file package.json   Audit direct dependencies
+  npx proof-of-commitment --file package-lock.json  Audit ALL dependencies (lock file)
+  npx proof-of-commitment --file yarn.lock      Audit from yarn lock file
+  npx proof-of-commitment --file pnpm-lock.yaml Audit from pnpm lock file
+  npx proof-of-commitment --file requirements.txt  Audit Python packages
 
 ${clr(c.bold, 'Examples:')}
   npx proof-of-commitment axios zod chalk
   npx proof-of-commitment --pypi litellm langchain requests
   npx proof-of-commitment --file package.json
-  npx proof-of-commitment --file requirements.txt
+  npx proof-of-commitment --file package-lock.json   # scans ALL transitive deps
 
 ${clr(c.bold, 'Score meaning:')}
   🔴 CRITICAL  Sole maintainer + >10M downloads/wk (high-value attack target)
@@ -147,33 +160,152 @@ ${clr(c.bold, 'MCP:')}  ${clr(c.dim, 'Add to Claude Desktop / Cursor for AI-assi
   `);
 }
 
+/**
+ * Parse package-lock.json (npm lockfileVersion 2 or 3)
+ * Returns all package names found in the lock file.
+ */
+function parseLockNpm(content) {
+  const lock = JSON.parse(content);
+  const pkgs = new Set();
+
+  if (lock.packages) {
+    // lockfileVersion 2+: keys are "node_modules/pkg" or "node_modules/@scope/pkg"
+    for (const key of Object.keys(lock.packages)) {
+      if (!key || key === '') continue; // root package
+      // Strip "node_modules/" prefix, handle nested paths like "node_modules/foo/node_modules/bar"
+      const parts = key.split('node_modules/');
+      const pkgPath = parts[parts.length - 1];
+      if (pkgPath) pkgs.add(pkgPath);
+    }
+  } else if (lock.dependencies) {
+    // lockfileVersion 1: flat dependencies object
+    for (const name of Object.keys(lock.dependencies)) {
+      pkgs.add(name);
+    }
+  }
+
+  return [...pkgs];
+}
+
+/**
+ * Parse yarn.lock (v1 format)
+ * Returns all unique package names.
+ */
+function parseLockYarn(content) {
+  const pkgs = new Set();
+  // Each block starts with "name@version:" or "name@range1, name@range2:"
+  const headerRe = /^"?(@?[^@\s"]+)@/gm;
+  let match;
+  while ((match = headerRe.exec(content)) !== null) {
+    pkgs.add(match[1]);
+  }
+  return [...pkgs];
+}
+
+/**
+ * Parse pnpm-lock.yaml (v6+)
+ * Returns all unique package names.
+ */
+function parseLockPnpm(content) {
+  const pkgs = new Set();
+  // packages section has entries like "  /chalk@5.3.0:" or "  chalk@5.3.0:"
+  const pkgRe = /^\s+\/?(@?[^@\s/]+(?:\/[^@\s]+)?)@/gm;
+  let match;
+  while ((match = pkgRe.exec(content)) !== null) {
+    pkgs.add(match[1]);
+  }
+  return [...pkgs];
+}
+
 async function readPackagesFromFile(filePath) {
   const fs = await import('fs');
   const path = await import('path');
   const content = fs.readFileSync(filePath, 'utf-8');
   const basename = path.basename(filePath).toLowerCase();
 
-  if (basename === 'package.json' || filePath.endsWith('.json')) {
+  // package-lock.json
+  if (basename === 'package-lock.json') {
+    const pkgs = parseLockNpm(content);
+    return { packages: pkgs, ecosystem: 'npm', lockfile: true, totalInFile: pkgs.length };
+  }
+
+  // yarn.lock
+  if (basename === 'yarn.lock') {
+    const pkgs = parseLockYarn(content);
+    return { packages: pkgs, ecosystem: 'npm', lockfile: true, totalInFile: pkgs.length };
+  }
+
+  // pnpm-lock.yaml
+  if (basename === 'pnpm-lock.yaml' || basename === 'pnpm-lock.yml') {
+    const pkgs = parseLockPnpm(content);
+    return { packages: pkgs, ecosystem: 'npm', lockfile: true, totalInFile: pkgs.length };
+  }
+
+  // package.json
+  if (basename === 'package.json') {
     const pkg = JSON.parse(content);
     const deps = {
       ...pkg.dependencies,
       ...pkg.devDependencies,
     };
-    return { packages: Object.keys(deps).slice(0, 20), ecosystem: 'npm' };
+    return { packages: Object.keys(deps), ecosystem: 'npm', lockfile: false };
   }
 
+  // requirements.txt
   if (basename === 'requirements.txt' || filePath.endsWith('.txt')) {
     const pkgs = content
       .split('\n')
       .map(l => l.trim())
       .filter(l => l && !l.startsWith('#'))
       .map(l => l.replace(/[>=<!\s].*/,'').trim())
-      .filter(Boolean)
-      .slice(0, 20);
-    return { packages: pkgs, ecosystem: 'pypi' };
+      .filter(Boolean);
+    return { packages: pkgs, ecosystem: 'pypi', lockfile: false };
   }
 
-  throw new Error(`Unsupported file: ${filePath}. Use package.json or requirements.txt`);
+  throw new Error(`Unsupported file: ${basename}. Supported: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt`);
+}
+
+/**
+ * Audit packages in batches of 20, in parallel.
+ * Returns all results sorted by risk score (highest risk first).
+ */
+async function auditBatched(packages, ecosystem, { onProgress } = {}) {
+  const BATCH_SIZE = 20;
+  const batches = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+    batches.push(packages.slice(i, i + BATCH_SIZE));
+  }
+
+  let completed = 0;
+  const results = await Promise.all(
+    batches.map(async (batch) => {
+      const res = await fetch(API, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ packages: batch, ecosystem }),
+      });
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`API error ${res.status}: ${text}`);
+      }
+      const data = await res.json();
+      completed += batch.length;
+      if (onProgress) onProgress(completed, packages.length);
+      return data.results || [];
+    })
+  );
+
+  const all = results.flat();
+
+  // Sort: CRITICAL first, then by score ascending (lower score = higher risk)
+  all.sort((a, b) => {
+    const aCrit = a.riskFlags?.includes('CRITICAL') ? 1 : 0;
+    const bCrit = b.riskFlags?.includes('CRITICAL') ? 1 : 0;
+    if (aCrit !== bCrit) return bCrit - aCrit;
+    return (a.score || 100) - (b.score || 100);
+  });
+
+  return all;
 }
 
 async function main() {
@@ -187,6 +319,8 @@ async function main() {
   let ecosystem = 'npm';
   let packages = [];
   let filePath = null;
+  let isLockfile = false;
+  let totalInFile = 0;
 
   let i = 0;
   while (i < args.length) {
@@ -209,7 +343,9 @@ async function main() {
       const result = await readPackagesFromFile(filePath);
       packages = result.packages;
       ecosystem = result.ecosystem;
-      console.log(clr(c.dim, `Detected ${packages.length} packages from ${filePath} (${ecosystem})`));
+      isLockfile = result.lockfile || false;
+      totalInFile = result.totalInFile || packages.length;
+      console.log(clr(c.dim, `Detected ${totalInFile} packages from ${filePath} (${ecosystem})`));
     } catch (err) {
       console.error(`Error reading ${filePath}: ${err.message}`);
       process.exit(1);
@@ -221,41 +357,75 @@ async function main() {
     process.exit(1);
   }
 
-  if (packages.length > 20) {
-    console.warn(clr(c.yellow, `Warning: truncating to first 20 packages (got ${packages.length})`));
-    packages = packages.slice(0, 20);
-  }
+  const t0 = Date.now();
 
-  const pkgList = packages.join(', ');
-  process.stdout.write(clr(c.dim, `Scoring ${packages.length} ${ecosystem} package${packages.length > 1 ? 's' : ''}...`));
+  let allResults;
 
-  const t0 = Date.now();
-  let data;
-  try {
-    const res = await fetch(API, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ packages, ecosystem }),
-    });
-    if (!res.ok) {
-      const text = await res.text();
-      throw new Error(`API error ${res.status}: ${text}`);
+  if (packages.length <= 20) {
+    // Single batch — existing behavior
+    process.stdout.write(clr(c.dim, `Scoring ${packages.length} ${ecosystem} package${packages.length > 1 ? 's' : ''}...`));
+
+    try {
+      const res = await fetch(API, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ packages, ecosystem }),
+      });
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`API error ${res.status}: ${text}`);
+      }
+      const data = await res.json();
+      allResults = data.results || [];
+    } catch (err) {
+      console.error(`\nError: ${err.message}`);
+      process.exit(1);
     }
-    data = await res.json();
-  } catch (err) {
-    console.error(`\nError: ${err.message}`);
-    process.exit(1);
-  }
 
-  const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
-  process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
+    const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
+    process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
+
+  } else {
+    // Multi-batch for lock files
+    const batches = Math.ceil(packages.length / 20);
+    process.stdout.write(clr(c.dim, `Scanning ${packages.length} packages (${batches} batches in parallel)...`));
+
+    let lastPct = 0;
+    try {
+      allResults = await auditBatched(packages, ecosystem, {
+        onProgress: (done, total) => {
+          const pct = Math.round((done / total) * 100);
+          if (pct >= lastPct + 20) {
+            process.stdout.write(clr(c.dim, ` ${pct}%`));
+            lastPct = pct;
+          }
+        }
+      });
+    } catch (err) {
+      console.error(`\nError: ${err.message}`);
+      process.exit(1);
+    }
+
+    const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
+    process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
+
+    // For lock files: show top 25 highest-risk packages
+    const MAX_DISPLAY = 25;
+    const displayed = allResults.slice(0, MAX_DISPLAY);
+    const criticalCount = allResults.filter(r => r.riskFlags?.includes('CRITICAL')).length;
+    const highRiskCount = allResults.filter(r => !r.riskFlags?.includes('CRITICAL') && r.score < 40).length;
+
+    const criticalTotal = allResults.filter(r => r.riskFlags?.includes('CRITICAL')).length;
+    printTable(displayed, { totalScanned: allResults.length, totalCritical: criticalTotal, lockfile: true });
+    return;
+  }
 
-  if (!data.results || data.results.length === 0) {
+  if (!allResults || allResults.length === 0) {
     console.log('No results returned. Check package names and try again.');
     process.exit(0);
   }
 
-  printTable(data.results);
+  printTable(allResults);
 }
 
 main().catch(err => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Supply chain risk scorer for npm and PyPI packages — behavioral signals that can't be faked",
   "type": "module",
   "bin": {