proof-of-commitment 1.34.0 → 1.36.0

package/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * proof-of-commitment CLI v1.34.0
+ * proof-of-commitment CLI v1.36.0
  * Scores npm/PyPI/Cargo/Go packages on behavioral commitment signals.
  * Usage: npx proof-of-commitment [packages...] [options]
  */
@@ -491,6 +491,7 @@ function formatSarif(results, { filePath, ecosystem, version } = {}) {
         weeklyDownloads: pkg.weeklyDownloads,
         ageYears: pkg.ageYears,
         hasProvenance: pkg.hasProvenance || false,
+        hasStagedPublishing: pkg.hasStagedPublishing ?? null,
         riskFlags: pkg.riskFlags || [],
       },
     });
@@ -621,6 +622,15 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
       console.log(clr(c.dim, `  ↳ ${ghCount} GitHub contributors — publish-access concentration risk despite active community`));
     }
 
+    // Show Staged Publishing status for CRITICAL npm packages
+    if (hasCritical(pkg.riskFlags) && (pkg.ecosystem || 'npm') === 'npm') {
+      if (pkg.hasStagedPublishing) {
+        console.log(clr(c.green, `  🛡️ Staged Publishing — compromised token can't push to latest`));
+      } else if (pkg.hasStagedPublishing === false) {
+        console.log(clr(c.dim, `  ↳ No Staged Publishing — npm stage publish would add a 2FA gate`));
+      }
+    }
+
     // Recently compromised warning
     if (pkg.compromised) {
       const atk = pkg.compromised;
@@ -642,6 +652,12 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
           );
       console.log(breakdown);
     }
+
+    // Show WARN-level risk flags inline (dormant publishers, stale releases, etc.)
+    const warnFlags = (pkg.riskFlags || []).filter(f => f.startsWith('WARN:'));
+    for (const flag of warnFlags) {
+      console.log(clr(c.yellow, `  ⚠ ${flag}`));
+    }
   }
 
   console.log(divider);
@@ -1011,7 +1027,7 @@ async function inlineSignup(results, opts = {}) {
 
 function printHelp() {
   console.log(`
-${clr(c.bold, 'proof-of-commitment')} v1.34.0 — supply chain risk scorer
+${clr(c.bold, 'proof-of-commitment')} v1.36.0 — supply chain risk scorer
 
 ${clr(c.bold, 'Usage:')}
   npx proof-of-commitment                            Auto-detect manifest in current dir
@@ -3037,10 +3053,12 @@ async function main() {
     if (jsonOutput) {
       const criticalCount = allResults.filter(r => hasCritical(r.riskFlags)).length;
       const provenanceCount = allResults.filter(r => r.hasProvenance).length;
+      const stagedPublishingCount = allResults.filter(r => r.hasStagedPublishing === true).length;
       console.log(JSON.stringify({
         totalScanned: allResults.length,
         criticalCount,
         provenanceCount,
+        stagedPublishingCount,
         failOn,
         rateLimited: !!batchRescue,
         results: allResults,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.34.0",
+  "version": "1.36.0",
   "mcpName": "io.github.piiiico/proof-of-commitment",
   "description": "Supply chain security risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
   "type": "module",