proof-of-commitment 1.1.0 → 1.3.0

package/index.js

@@ -140,11 +140,17 @@ ${clr(c.bold, 'Usage:')}
   npx proof-of-commitment --file pnpm-lock.yaml Audit from pnpm lock file
   npx proof-of-commitment --file requirements.txt  Audit Python packages
 
+${clr(c.bold, 'Options:')}
+  --json        Output results as JSON (exits 1 if any CRITICAL found — useful in CI)
+  --pypi        Score PyPI packages instead of npm
+  --file, -f    Read packages from package.json, lock file, or requirements.txt
+
 ${clr(c.bold, 'Examples:')}
   npx proof-of-commitment axios zod chalk
   npx proof-of-commitment --pypi litellm langchain requests
   npx proof-of-commitment --file package.json
   npx proof-of-commitment --file package-lock.json   # scans ALL transitive deps
+  npx proof-of-commitment axios chalk --json | jq '.criticalCount'
 
 ${clr(c.bold, 'Score meaning:')}
   🔴 CRITICAL  Sole maintainer + >10M downloads/wk (high-value attack target)
@@ -321,12 +327,14 @@ async function main() {
   let filePath = null;
   let isLockfile = false;
   let totalInFile = 0;
+  let jsonOutput = false;
 
   let i = 0;
   while (i < args.length) {
     const a = args[i];
     if (a === '--pypi') { ecosystem = 'pypi'; i++; }
     else if (a === '--npm') { ecosystem = 'npm'; i++; }
+    else if (a === '--json') { jsonOutput = true; i++; }
     else if (a === '--file' || a === '-f') {
       filePath = args[++i];
       i++;
@@ -345,7 +353,7 @@ async function main() {
       ecosystem = result.ecosystem;
       isLockfile = result.lockfile || false;
       totalInFile = result.totalInFile || packages.length;
-      console.log(clr(c.dim, `Detected ${totalInFile} packages from ${filePath} (${ecosystem})`));
+      if (!jsonOutput) console.log(clr(c.dim, `Detected ${totalInFile} packages from ${filePath} (${ecosystem})`));
     } catch (err) {
       console.error(`Error reading ${filePath}: ${err.message}`);
       process.exit(1);
@@ -363,7 +371,7 @@ async function main() {
 
   if (packages.length <= 20) {
     // Single batch — existing behavior
-    process.stdout.write(clr(c.dim, `Scoring ${packages.length} ${ecosystem} package${packages.length > 1 ? 's' : ''}...`));
+    if (!jsonOutput) process.stdout.write(clr(c.dim, `Scoring ${packages.length} ${ecosystem} package${packages.length > 1 ? 's' : ''}...`));
 
     try {
       const res = await fetch(API, {
@@ -383,12 +391,12 @@ async function main() {
     }
 
     const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
-    process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
+    if (!jsonOutput) process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
 
   } else {
     // Multi-batch for lock files
     const batches = Math.ceil(packages.length / 20);
-    process.stdout.write(clr(c.dim, `Scanning ${packages.length} packages (${batches} batches in parallel)...`));
+    if (!jsonOutput) process.stdout.write(clr(c.dim, `Scanning ${packages.length} packages (${batches} batches in parallel)...`));
 
     let lastPct = 0;
     try {
@@ -407,24 +415,46 @@ async function main() {
     }
 
     const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
-    process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
+    if (!jsonOutput) process.stdout.write(clr(c.dim, ` done in ${elapsed}s\n`));
+
+    // JSON output: emit all results with summary
+    if (jsonOutput) {
+      const criticalCount = allResults.filter(r => r.riskFlags?.includes('CRITICAL')).length;
+      console.log(JSON.stringify({
+        totalScanned: allResults.length,
+        criticalCount,
+        results: allResults,
+      }, null, 2));
+      process.exit(criticalCount > 0 ? 1 : 0);
+    }
 
     // For lock files: show top 25 highest-risk packages
     const MAX_DISPLAY = 25;
     const displayed = allResults.slice(0, MAX_DISPLAY);
-    const criticalCount = allResults.filter(r => r.riskFlags?.includes('CRITICAL')).length;
-    const highRiskCount = allResults.filter(r => !r.riskFlags?.includes('CRITICAL') && r.score < 40).length;
-
     const criticalTotal = allResults.filter(r => r.riskFlags?.includes('CRITICAL')).length;
     printTable(displayed, { totalScanned: allResults.length, totalCritical: criticalTotal, lockfile: true });
     return;
   }
 
   if (!allResults || allResults.length === 0) {
-    console.log('No results returned. Check package names and try again.');
+    if (jsonOutput) {
+      console.log(JSON.stringify({ totalScanned: 0, criticalCount: 0, results: [] }, null, 2));
+    } else {
+      console.log('No results returned. Check package names and try again.');
+    }
     process.exit(0);
   }
 
+  if (jsonOutput) {
+    const criticalCount = allResults.filter(r => r.riskFlags?.includes('CRITICAL')).length;
+    console.log(JSON.stringify({
+      totalScanned: allResults.length,
+      criticalCount,
+      results: allResults,
+    }, null, 2));
+    process.exit(criticalCount > 0 ? 1 : 0);
+  }
+
   printTable(allResults);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Supply chain risk scorer for npm and PyPI packages — behavioral signals that can't be faked",
   "type": "module",
   "bin": {