proof-of-commitment 1.5.0 → 1.6.0

package/README.md

@@ -1,294 +1,103 @@
-# Proof of Commitment
+# proof-of-commitment
 
-[![Commitment Score](https://poc-backend.amdal-dev.workers.dev/badge/npm/proof-of-commitment)](https://getcommit.dev/audit?packages=proof-of-commitment)
+> Supply chain risk scorer for npm, PyPI, Cargo (Rust), and Go modules. Behavioral signals that can't be faked.
 
-> **Stars lie. Behavioral signals don't.**
-
-An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, and GitHub repos on **behavioral commitment** — signals that are harder to fake than stars, READMEs, or download counts.
-
-## The supply chain problem
-
-26 of the 91 npm packages with >10M weekly downloads have a **single npm publisher**. Together they account for over 3 billion downloads per week. `npm audit` doesn't surface this. Stars don't either.
-
-Four packages in a typical Node.js project are CRITICAL right now:
-- **chalk** — 413M downloads/week, **1 npm publisher**
-- **zod** — 163M downloads/week, **1 npm publisher** (30+ GitHub contributors)
-- **lodash** — 145M downloads/week, **1 npm publisher**
-- **axios** — 99M downloads/week, **1 npm publisher** (attacked March 30, 2026)
-
-They won't appear in your `package.json` either — but these are in almost every project:
-- **minimatch** — 562M downloads/week, **1 npm publisher**
-- **glob** — 333M downloads/week, **1 npm publisher**
-- **cross-spawn** — 190M downloads/week, **1 npm publisher**
-
-Behavioral signals surface this. Stars and READMEs don't.
-
-## Try it now
-
-**Terminal (zero install):**
-```bash
+```
 npx proof-of-commitment axios zod chalk
-# scan your own project:
-npx proof-of-commitment --file package.json
-# scan ALL transitive dependencies via lock file (finds the hidden CRITICAL packages):
-npx proof-of-commitment --file package-lock.json   # npm
-npx proof-of-commitment --file yarn.lock           # yarn
-npx proof-of-commitment --file pnpm-lock.yaml      # pnpm
-# pnpm monorepo — scans all workspace packages, deduplicates:
-npx proof-of-commitment --file pnpm-workspace.yaml  # pnpm workspaces
-# JSON output for CI/CD pipelines (exits 1 if CRITICAL found):
-npx proof-of-commitment --file package-lock.json --json | jq '.criticalCount'
-# PyPI too:
-npx proof-of-commitment --pypi litellm langchain requests
-# Cargo (Rust) via API:
-curl -s https://poc-backend.amdal-dev.workers.dev/api/audit \
-  -X POST -H "Content-Type: application/json" \
-  -d '{"packages":["serde","tokio","reqwest"],"ecosystem":"cargo"}'
 ```
 
-**Web demo (no install):** [getcommit.dev/audit](https://getcommit.dev/audit) — paste your packages, see risk scores in seconds.
-
-**MCP server (zero install):**
-
-```json
-{
-  "mcpServers": {
-    "proof-of-commitment": {
-      "type": "streamable-http",
-      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
-    }
-  }
-}
 ```
-
-Add to Claude Desktop, Cursor, Windsurf, or any MCP-compatible AI tool. Then ask:
-
-> "Audit my package.json for supply chain risk"
-> "Score axios, zod, chalk, lodash — which is highest risk?"
-> "Is vercel/ai actively maintained?"
-
-## GitHub Action
-
-Add supply chain auditing to any CI pipeline in 30 seconds — auto-detects packages from `package.json` or `requirements.txt`, **posts results as a PR comment**, writes to GitHub Step Summary, and optionally fails on CRITICAL packages.
-
-Use the dedicated action at [piiiico/commit-action](https://github.com/piiiico/commit-action):
-
-```yaml
-# .github/workflows/supply-chain.yml
-name: Supply Chain Audit
-on:
-  pull_request:
-    paths: ['package.json', 'package-lock.json', 'bun.lock']
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: piiiico/commit-action@v1
-        with:
-          fail-on-critical: true   # blocks merges on CRITICAL packages
-          comment-on-pr: true      # posts results as a PR comment
+──────────────────────────────────────────────────────────────────────────
+Package               Risk            Score    Publishers   Downloads     Age
+──────────────────────────────────────────────────────────────────────────
+axios                 🔴 CRITICAL      89       1            102.0M/wk     11.6y
+  ↳ 30+ GitHub contributors — publish-access concentration risk despite active community
+  └ longevity=25 momentum=25 releases=20 publishers=4 github=15
+zod                   🔴 CRITICAL      83       1            154.0M/wk     6.1y
+  ↳ 30+ GitHub contributors — publish-access concentration risk despite active community
+  └ longevity=25 momentum=25 releases=18 publishers=4 github=11
+chalk                 🔴 CRITICAL      75       1            414.6M/wk     12.7y
+  ↳ 30+ GitHub contributors — publish-access concentration risk despite active community
+  └ longevity=25 momentum=22 releases=13 publishers=4 github=11
+──────────────────────────────────────────────────────────────────────────
+
+⚠  3 CRITICAL packages found.
+   CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)
+   Full breakdown: https://getcommit.dev/audit?packages=axios,zod,chalk
 ```
 
-When `comment-on-pr: true` (default), the action automatically posts the audit table as a comment on the pull request — and **updates the same comment** on re-run, so you don't get comment spam. Reviewers see the risk table without leaving the PR.
+## What this does
 
-**Inputs:**
+`npm audit` finds *known* CVEs — vulnerabilities already catalogued in a database. This scores *structural risk before it becomes a CVE*.
 
-| Input | Default | Description |
-|-------|---------|-------------|
-| `packages` | _(auto)_ | Comma-separated package names (auto-detected from `package.json`/`requirements.txt` if not set) |
-| `packages-file` | _(auto)_ | Path to `package.json` or `requirements.txt` (default: auto-detect in workspace root) |
-| `fail-on-critical` | `true` | Fail the workflow if CRITICAL packages are found |
-| `max-packages` | `20` | Max packages to audit when auto-detecting |
-| `include-dev-dependencies` | `false` | Include `devDependencies` from `package.json` |
-| `comment-on-pr` | `true` | Post audit results as a PR comment (requires `pull-requests: write` permission) |
-| `api-key` | _(none)_ | [Commit Pro](https://getcommit.dev/pricing) API key — enables batch requests and 10K requests/month |
-| `api-url` | _(prod)_ | Override API endpoint (useful for self-hosting) |
+The axios attack on April 1st, 2026: `npm audit` showed zero issues beforehand. Proof of Commitment flagged axios as CRITICAL (1 npm publisher, 96M downloads/week) — the exact publish-access concentration profile that made it a high-value target.
 
-**Outputs:** `has-critical`, `critical-count`, `audit-summary` (markdown table, also written to Step Summary).
+**Score dimensions:**
+- **Longevity** (25 pts) — years in production
+- **Download Momentum** (25 pts) — weekly download trend
+- **Release Consistency** (20 pts) — days since last release
+- **Publisher Depth** (15 pts) — npm publish-access holders
+- **GitHub Backing** (15 pts) — organization/team support
 
-**Free vs Pro:** Without an API key, packages are audited one at a time (with delays to respect rate limits). With a Pro API key, all packages are audited in a single batch request — faster and with higher monthly limits.
+**CRITICAL** = sole npm publisher + >10M weekly downloads (publish-access concentration risk)
 
-Example PR comment / Step Summary output:
+## Usage
 
-```
-| Package | Risk        | Score | Publishers | Downloads/wk | Age   |
-|---------|-------------|-------|------------|--------------|-------|
-| chalk   | 🔴 CRITICAL | 75    | 1          | 380M         | 12.7y |
-| zod     | 🔴 CRITICAL | 83    | 1          | 133M         | 6.1y  |
-| axios   | 🔴 CRITICAL | 89    | 1          | 93M          | 11.6y |
-```
-
-## README Badges
-
-Add a Commit Trust badge to any npm package you maintain or depend on:
-
-```markdown
-![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/YOUR-PACKAGE)
-```
-
-Examples:
+```bash
+# Score npm packages
+npx proof-of-commitment axios zod chalk lodash express
 
-| Package | Badge URL |
-|---------|-----------|
-| chalk | `![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/chalk)` |
-| react | `![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/react)` |
-| express | `![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/express)` |
-| @babel/core | `![Commit Trust](https://poc-backend.amdal-dev.workers.dev/badge/@babel/core)` |
+# Score PyPI packages
+npx proof-of-commitment --pypi litellm langchain requests numpy
 
-Grades: 🟢 OK (75+) · 🟠 WARNING (40–74) · 🔴 CRITICAL (<40 or sole npm publisher with 10M+ weekly downloads)
+# Score Rust crates
+npx proof-of-commitment --cargo serde tokio reqwest
 
-Badges are cached 1 hour. No API key needed.
+# Score Go modules (full module path required — host/owner/repo)
+npx proof-of-commitment --golang github.com/gin-gonic/gin golang.org/x/net
 
-Also supports PyPI, Cargo, and the full ecosystem-specific format:
+# Auto-detect from manifest / lock / module file
+npx proof-of-commitment --file package.json       # npm
+npx proof-of-commitment --file package-lock.json  # full transitive
+npx proof-of-commitment --file requirements.txt   # PyPI
+npx proof-of-commitment --file Cargo.toml         # Rust direct deps
+npx proof-of-commitment --file go.mod             # Go direct + indirect
+npx proof-of-commitment --file go.sum             # Go full transitive set
 
-```markdown
-![commit score](https://poc-backend.amdal-dev.workers.dev/api/badge/npm/YOUR-PACKAGE)
-![commit score](https://poc-backend.amdal-dev.workers.dev/api/badge/pypi/YOUR-PACKAGE)
-![commit score](https://poc-backend.amdal-dev.workers.dev/api/badge/cargo/YOUR-CRATE)
+# Short alias
+npx poc axios zod chalk
 ```
 
-## REST API
+**Go modules note:** Go has no centralized download counter and no publisher registry. Scoring is GitHub-primary: longevity, release cadence, GitHub contributor count, OpenSSF Scorecard, and stars (popularity proxy). The "publishers" column in Go output shows GitHub push-access contributors — the closest equivalent to npm publishers.
 
-No API key. No install.
-
-```bash
-curl https://poc-backend.amdal-dev.workers.dev/api/audit \
-  -X POST \
-  -H "Content-Type: application/json" \
-  -d '{"packages": ["axios", "zod", "chalk", "lodash", "express"]}'
-```
+## Zero-install MCP server (for Claude, Cursor, Windsurf)
 
+Add to your AI tool's config:
 ```json
 {
-  "count": 5,
-  "results": [
-    {
-      "name": "chalk",
-      "ecosystem": "npm",
-      "score": 75,
-      "maintainers": 1,
-      "weeklyDownloads": 398397580,
-      "ageYears": 12.7,
-      "trend": "stable",
-      "riskFlags": ["CRITICAL"],
-      "scorecardScore": 3.6,        // null if no GitHub repo
-      "hasDangerousWorkflow": false  // null if no Scorecard data
-    },
-    ...
-  ]
+  "mcpServers": {
+    "proof-of-commitment": {
+      "type": "streamable-http",
+      "url": "https://poc-backend.amdal-dev.workers.dev/mcp"
+    }
+  }
 }
 ```
 
-## 8 MCP tools
-
-| Tool | Description |
-|------|-------------|
-| `audit_dependencies` | Batch risk audit for up to 20 npm/PyPI/Cargo packages |
-| `lookup_npm_package` | Single npm package behavioral profile |
-| `lookup_pypi_package` | Single PyPI package behavioral profile |
-| `lookup_cargo_crate` | Single Rust crate behavioral profile (crates.io) |
-| `lookup_github_repo` | GitHub repo commitment score (longevity, commit frequency, contributor depth) |
-| `lookup_business` | Norwegian business register — operating years, employees, financials |
-| `lookup_business_by_org` | Same, by org number |
-| `query_commitment` | Browser extension behavioral data (unique verified visitors, repeat rate) |
-
-## What the score measures
-
-Each package is scored 0–100 across:
-
-- **Longevity** — How long has the package existed? Abandoned packages get reactivated for attacks.
-- **Publisher depth** — Single npm publisher + millions of weekly downloads = the attack surface LiteLLM exploited. (Publisher = person with npm publish access, distinct from GitHub contributors.)
-- **Release consistency** — Regular releases signal active oversight. Long gaps = vulnerability accumulation.
-- **Download trend** — Growing packages attract more scrutiny (and attacks). Stable = lower profile.
-- **OpenSSF Scorecard** — Process security (code review enforcement, branch protection, CI/CD safety). Separate from behavioral signals. High Scorecard ≠ safe from credential theft attacks.
-
-> Both axios (8.1/10 Scorecard) and chalk (3.6/10 Scorecard) score CRITICAL on behavioral signals. They measure different attack surfaces — Scorecard catches process gaps, behavioral signals catch publisher concentration.
-
-**Risk flags:**
-- `CRITICAL` — single npm publisher + >10M weekly downloads (exact LiteLLM/axios attack profile)
-- `HIGH` — package <1yr old + rapid adoption
-- `WARN` — no release in 12+ months
-
-## Real data points
-
-```
-# packages you know about:
-chalk       — score 75, 1 publisher, 413M/week  ⚑ CRITICAL
-zod         — score 86, 1 publisher, 163M/week  ⚑ CRITICAL  (30+ GitHub contributors)
-lodash      — score 81, 1 publisher, 145M/week  ⚑ CRITICAL
-axios       — score 86, 1 publisher,  99M/week  ⚑ CRITICAL  (attacked Mar 30 2026)
-express     — score 90, 5 publishers, 95M/week
-
-# packages probably not in your package.json, definitely in your lock file:
-minimatch   — score 78, 1 publisher, 562M/week  ⚑ CRITICAL
-glob        — score 80, 1 publisher, 333M/week  ⚑ CRITICAL
-cross-spawn — score 72, 1 publisher, 190M/week  ⚑ CRITICAL
+Then ask: *"Audit the dependencies in my package.json"* or *"What's the risk profile of vercel/ai?"*
 
-# post-attack:
-litellm     — score 74, 1 publisher            ⚑ CRITICAL  (supply chain attack Mar 2026)
+## GitHub Action
 
-# Rust crates (new in v1.3.0):
-serde       — score 78, 1 owner,  13M/week  ⚑ CRITICAL  (dtolnay sole owner)
-tokio       — score 89, 2 owners, 10M/week
-reqwest     — score 85, 1 owner,   8M/week  ⚑ HIGH
+Posts audit results directly on your PR:
+```yaml
+- uses: piiiico/proof-of-commitment@main
+  with:
+    fail-on-critical: false
+    comment-on-pr: true
 ```
 
-## Why behavioral signals
-
-The LiteLLM attack (March 2026) and axios attack (March 30, 2026) followed the same pattern: stolen credentials → malicious package pushed → 97M+ machines exposed. Both packages scored CRITICAL by these metrics *before* the attacks.
+## Links
 
-Declarative signals (stars, README quality, CI badges) don't capture this risk. Behavioral commitment does.
-
-## Stack
-
-| Layer | Technology |
-|-------|-----------|
-| Backend | Cloudflare Workers + D1 |
-| MCP | Model Context Protocol SDK |
-| Data | npm registry, PyPI, crates.io, GitHub API, Brønnøysund (NO) |
-| Landing | Astro + Cloudflare Pages |
-
-## Roadmap
-
-Planned, not promised. The project is early-stage — contributions welcome on any of these.
-
-| Feature | Status | Notes |
-|---------|--------|-------|
-| **Cargo (Rust) registry support** | ✅ Live | MCP tool, REST API, badge endpoint — `ecosystem: "cargo"` |
-| **Go modules support** | Planned | pkg.go.dev API + GitHub backing score |
-| **Score breakdown visualization** | Planned | Chart component for the 5 dimensions on getcommit.dev/audit |
-| **`--json` flag for CLI** | ✅ Live | `npx proof-of-commitment --file package-lock.json --json \| jq '.criticalCount'` |
-| **pnpm workspace monorepo support** | ✅ Live | `--file pnpm-workspace.yaml` or auto-detected from `pnpm-lock.yaml` |
-| **Historical score tracking** | Planned | Trend charts — was this package getting riskier over time? |
-| **Org-level dashboards** | Planned | Aggregate risk view across all repos in a GitHub org |
-
-See [open issues](https://github.com/piiiico/proof-of-commitment/issues) for things you can help with today.
-
-## The broader vision
-
-Supply chain auditing is the first tool. The underlying primitive is a **commitment graph** — behavioral signals that replace content-based trust across any domain.
-
-When content is free to fake (reviews, stars, READMEs), commitment becomes the signal. A publisher who has shipped 847 releases over 12 years is a different kind of commitment than one who published once in 2023.
-
-The same logic applies to websites, businesses, and AI agents. Two card networks have independently named this gap: Mastercard Verifiable Intent §9.2 explicitly lists behavioral trust as "not covered." Visa TAP identifies agents without answering whether to trust them.
-
-Proof of Commitment is the trust layer they're pointing at.
-
-→ [getcommit.dev](https://getcommit.dev)
-
-## Run locally
-
-```bash
-bun install
-bun run dev:backend     # local server with SQLite
-bun run test:e2e        # E2E test with mock World ID
-```
-
-Deploy:
-```bash
-bun run deploy          # deploys to Cloudflare Workers
-```
+- **Web demo:** https://getcommit.dev/audit
+- **Live watchlist:** https://getcommit.dev/watchlist (top 25 npm packages by structural risk)
+- **GitHub:** https://github.com/piiiico/proof-of-commitment

package/index.js

@@ -87,12 +87,23 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
     const label = riskLabel(pkg.riskFlags, pkg.score);
     if (pkg.riskFlags && pkg.riskFlags.includes('CRITICAL')) criticalInDisplay++;
 
+    // Go modules have no download data — show "—" instead. The maintainers
+    // column for Go shows GitHub contributor count (the closest equivalent
+    // to publish access since Go has no centralized publisher concept).
+    const isGo = pkg.ecosystem === 'golang';
+    const dlDisplay = isGo
+      ? '—'
+      : fmtDownloads(pkg.weeklyDownloads || 0);
+    const maintDisplay = pkg.maintainers === 35
+      ? '30+'
+      : String(pkg.maintainers || '?');
+
     const row = [
       padEnd(pkg.name, COL.name),
       padEnd(clr(rc, label), COL.risk),
       padEnd(String(pkg.score), COL.score),
-      padEnd(String(pkg.maintainers || '?'), COL.maintainers),
-      padEnd(fmtDownloads(pkg.weeklyDownloads || 0), COL.downloads),
+      padEnd(maintDisplay, COL.maintainers),
+      padEnd(dlDisplay, COL.downloads),
       padEnd((pkg.ageYears || '?').toString().replace(/(\.\d).*/, '$1') + 'y', COL.age),
     ].join('  ');
 
@@ -104,13 +115,18 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
       console.log(clr(c.dim, `  ↳ ${ghCount} GitHub contributors — publish-access concentration risk despite active community`));
     }
 
-    // Score breakdown if available
+    // Score breakdown if available — keys differ across ecosystems
     if (pkg.scoreBreakdown) {
       const b = pkg.scoreBreakdown;
-      const breakdown = clr(c.dim,
-        `  └ longevity=${b.longevity} momentum=${b.downloadMomentum} ` +
-        `releases=${b.releaseConsistency} publishers=${b.maintainerDepth} github=${b.githubBacking}`
-      );
+      const breakdown = isGo
+        ? clr(c.dim,
+            `  └ longevity=${b.longevity} releases=${b.releaseConsistency} ` +
+            `contributors=${b.maintainerDepth} github=${b.githubBacking} stars=${b.popularityProxy}`
+          )
+        : clr(c.dim,
+            `  └ longevity=${b.longevity} momentum=${b.downloadMomentum} ` +
+            `releases=${b.releaseConsistency} publishers=${b.maintainerDepth} github=${b.githubBacking}`
+          );
       console.log(breakdown);
     }
   }
@@ -138,25 +154,33 @@ function printHelp() {
 ${clr(c.bold, 'proof-of-commitment')} — supply chain risk scorer
 
 ${clr(c.bold, 'Usage:')}
-  npx proof-of-commitment [packages...]         Score npm packages
-  npx proof-of-commitment --pypi [pkgs...]      Score PyPI packages
-  npx proof-of-commitment --file package.json   Audit direct dependencies
-  npx proof-of-commitment --file package-lock.json  Audit ALL dependencies (lock file)
-  npx proof-of-commitment --file yarn.lock      Audit from yarn lock file
-  npx proof-of-commitment --file pnpm-lock.yaml Audit from pnpm lock file
-  npx proof-of-commitment --file pnpm-workspace.yaml  Audit entire pnpm monorepo
-  npx proof-of-commitment --file requirements.txt  Audit Python packages
+  npx proof-of-commitment [packages...]              Score npm packages
+  npx proof-of-commitment --pypi [pkgs...]           Score PyPI packages
+  npx proof-of-commitment --cargo [crates...]        Score Rust crates
+  npx proof-of-commitment --golang [modules...]      Score Go modules (full path required)
+  npx proof-of-commitment --file package.json        Audit direct dependencies
+  npx proof-of-commitment --file package-lock.json   Audit ALL dependencies (lock file)
+  npx proof-of-commitment --file yarn.lock           Audit from yarn lock file
+  npx proof-of-commitment --file pnpm-lock.yaml      Audit from pnpm lock file
+  npx proof-of-commitment --file requirements.txt    Audit Python packages
+  npx proof-of-commitment --file Cargo.toml          Audit Rust direct dependencies
+  npx proof-of-commitment --file go.mod              Audit Go direct + indirect deps
+  npx proof-of-commitment --file go.sum              Audit Go full transitive set
 
 ${clr(c.bold, 'Options:')}
   --json        Output results as JSON (exits 1 if any CRITICAL found — useful in CI)
   --pypi        Score PyPI packages instead of npm
-  --file, -f    Read packages from package.json, lock file, pnpm-workspace.yaml, or requirements.txt
+  --cargo       Score Rust crates from crates.io
+  --golang      Score Go modules from proxy.golang.org (use full path: github.com/owner/repo)
+  --file, -f    Read packages from package.json, lock file, requirements.txt, Cargo.toml, or go.mod/go.sum
 
 ${clr(c.bold, 'Examples:')}
   npx proof-of-commitment axios zod chalk
   npx proof-of-commitment --pypi litellm langchain requests
-  npx proof-of-commitment --file package.json
+  npx proof-of-commitment --cargo serde tokio reqwest
+  npx proof-of-commitment --golang github.com/gin-gonic/gin golang.org/x/net
   npx proof-of-commitment --file package-lock.json   # scans ALL transitive deps
+  npx proof-of-commitment --file go.sum              # scans full Go module graph
   npx proof-of-commitment axios chalk --json | jq '.criticalCount'
 
 ${clr(c.bold, 'Score meaning:')}
@@ -166,7 +190,8 @@ ${clr(c.bold, 'Score meaning:')}
   🟡 GOOD      Score 60–74
   🟢 HEALTHY   Score 75+
 
-${clr(c.bold, 'Score dimensions:')} longevity · download momentum · release consistency · publisher depth · GitHub backing
+${clr(c.bold, 'Score dimensions (npm/PyPI/Cargo):')} longevity · download momentum · release consistency · publisher depth · GitHub backing
+${clr(c.bold, 'Score dimensions (Go):')} longevity · release consistency · maintainer depth · GitHub backing · stars (Go has no centralized download counter)
 
 ${clr(c.bold, 'Web:')}  ${WEB}
 ${clr(c.bold, 'MCP:')}  ${clr(c.dim, 'Add to Claude Desktop / Cursor for AI-assisted auditing')}
@@ -230,123 +255,11 @@ function parseLockPnpm(content) {
   return [...pkgs];
 }
 
-/**
- * Parse pnpm-workspace.yaml and resolve all workspace package dependencies.
- * Reads package.json from each workspace, merges deps, deduplicates.
- * Internal workspace packages are excluded from the audit list.
- */
-async function parsePnpmWorkspace(filePath) {
-  const fs = await import('fs');
-  const path = await import('path');
-  const content = fs.readFileSync(filePath, 'utf-8');
-  const dir = path.dirname(path.resolve(filePath));
-
-  // Parse packages list from YAML
-  // Format: "packages:\n  - 'apps/*'\n  - 'packages/*'"
-  const patterns = [];
-  const lines = content.split('\n');
-  let inPackages = false;
-  for (const line of lines) {
-    if (/^packages\s*:/.test(line)) { inPackages = true; continue; }
-    if (inPackages) {
-      if (/^\s+-/.test(line)) {
-        const pattern = line.replace(/^\s+-\s*/, '').replace(/['"]/g, '').trim();
-        if (pattern) patterns.push(pattern);
-      } else if (/^\S/.test(line) && line.trim()) {
-        inPackages = false;
-      }
-    }
-  }
-
-  if (patterns.length === 0) {
-    throw new Error('No workspace packages found in pnpm-workspace.yaml');
-  }
-
-  // Split into includes and excludes
-  const excludes = patterns.filter(p => p.startsWith('!')).map(p => p.slice(1));
-  const includes = patterns.filter(p => !p.startsWith('!'));
-
-  // Resolve patterns to directories containing package.json
-  const workspaceDirs = [];
-  for (const pattern of includes) {
-    if (pattern.endsWith('/*') || pattern.endsWith('/**')) {
-      // Glob: 'apps/*' -> list all subdirectories of apps/
-      const parentDir = path.join(dir, pattern.replace(/\/\*\*?$/, ''));
-      try {
-        const entries = fs.readdirSync(parentDir, { withFileTypes: true });
-        for (const entry of entries) {
-          if (entry.isDirectory()) {
-            const fullPath = path.join(parentDir, entry.name);
-            const isExcluded = excludes.some(ex => fullPath.includes(ex) || entry.name === ex);
-            if (!isExcluded) workspaceDirs.push(fullPath);
-          }
-        }
-      } catch { /* directory doesn't exist — skip */ }
-    } else {
-      // Direct path: 'packages/shared'
-      const fullPath = path.join(dir, pattern);
-      try {
-        fs.statSync(fullPath);
-        workspaceDirs.push(fullPath);
-      } catch { /* doesn't exist — skip */ }
-    }
-  }
-
-  // Collect workspace package names (to exclude from audit — they're internal)
-  const workspacePackageNames = new Set();
-  for (const wsDir of workspaceDirs) {
-    try {
-      const pkg = JSON.parse(fs.readFileSync(path.join(wsDir, 'package.json'), 'utf-8'));
-      if (pkg.name) workspacePackageNames.add(pkg.name);
-    } catch { /* no package.json — skip */ }
-  }
-
-  // Read root package.json + all workspace package.json files, merge deps
-  const allDeps = new Set();
-  let workspaceCount = 0;
-
-  // Root
-  try {
-    const rootPkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
-    if (rootPkg.dependencies) Object.keys(rootPkg.dependencies).forEach(d => allDeps.add(d));
-    if (rootPkg.devDependencies) Object.keys(rootPkg.devDependencies).forEach(d => allDeps.add(d));
-  } catch { /* no root package.json */ }
-
-  // Workspaces
-  for (const wsDir of workspaceDirs) {
-    try {
-      const pkg = JSON.parse(fs.readFileSync(path.join(wsDir, 'package.json'), 'utf-8'));
-      if (pkg.dependencies) Object.keys(pkg.dependencies).forEach(d => allDeps.add(d));
-      if (pkg.devDependencies) Object.keys(pkg.devDependencies).forEach(d => allDeps.add(d));
-      workspaceCount++;
-    } catch { /* no package.json in workspace dir */ }
-  }
-
-  // Remove internal workspace packages from audit list
-  for (const name of workspacePackageNames) {
-    allDeps.delete(name);
-  }
-
-  return {
-    packages: [...allDeps],
-    ecosystem: 'npm',
-    lockfile: false,
-    totalInFile: allDeps.size,
-    workspaceCount,
-  };
-}
-
 async function readPackagesFromFile(filePath) {
   const fs = await import('fs');
   const path = await import('path');
-  const basename = path.basename(filePath).toLowerCase();
-
-  // pnpm-workspace.yaml — monorepo workspace scanner
-  if (basename === 'pnpm-workspace.yaml' || basename === 'pnpm-workspace.yml') {
-    return parsePnpmWorkspace(filePath);
-  }
-
   const content = fs.readFileSync(filePath, 'utf-8');
+  const basename = path.basename(filePath).toLowerCase();
 
   // package-lock.json
   if (basename === 'package-lock.json') {
@@ -360,20 +273,8 @@ async function readPackagesFromFile(filePath) {
     return { packages: pkgs, ecosystem: 'npm', lockfile: true, totalInFile: pkgs.length };
   }
 
-  // pnpm-lock.yaml — also check for workspace file to give better detection
+  // pnpm-lock.yaml
   if (basename === 'pnpm-lock.yaml' || basename === 'pnpm-lock.yml') {
-    const dir = path.dirname(path.resolve(filePath));
-    const workspaceFile = path.join(dir, 'pnpm-workspace.yaml');
-    let hasWorkspace = false;
-    try { fs.statSync(workspaceFile); hasWorkspace = true; } catch {}
-
-    if (hasWorkspace) {
-      // Monorepo detected — use workspace-aware parsing
-      const result = await parsePnpmWorkspace(workspaceFile);
-      result.monorepoDetected = true;
-      return result;
-    }
-
     const pkgs = parseLockPnpm(content);
     return { packages: pkgs, ecosystem: 'npm', lockfile: true, totalInFile: pkgs.length };
   }
@@ -399,7 +300,106 @@ async function readPackagesFromFile(filePath) {
     return { packages: pkgs, ecosystem: 'pypi', lockfile: false };
   }
 
-  throw new Error(`Unsupported file: ${basename}. Supported: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, pnpm-workspace.yaml, requirements.txt`);
+  // Cargo.toml
+  if (basename === 'cargo.toml') {
+    // Crude TOML parse — extract [dependencies] section keys
+    const pkgs = parseCargoToml(content);
+    return { packages: pkgs, ecosystem: 'cargo', lockfile: false };
+  }
+
+  // go.mod — Go module file
+  if (basename === 'go.mod') {
+    const pkgs = parseGoMod(content);
+    return { packages: pkgs, ecosystem: 'golang', lockfile: false, totalInFile: pkgs.length };
+  }
+
+  // go.sum — Go module checksum file (lockfile-equivalent — captures full transitive set)
+  if (basename === 'go.sum') {
+    const pkgs = parseGoSum(content);
+    return { packages: pkgs, ecosystem: 'golang', lockfile: true, totalInFile: pkgs.length };
+  }
+
+  throw new Error(`Unsupported file: ${basename}. Supported: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Cargo.toml, go.mod, go.sum`);
+}
+
+/**
+ * Parse a Cargo.toml — extract direct deps from [dependencies] / [dev-dependencies].
+ * Crude — only handles the common "name = version" / "name = { ... }" lines under
+ * [dependencies] / [dev-dependencies]. Doesn't expand workspace members.
+ */
+function parseCargoToml(content) {
+  const pkgs = new Set();
+  const lines = content.split('\n');
+  let inDeps = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (line.startsWith('[')) {
+      inDeps = /^\[(dev-)?dependencies\]/.test(line);
+      continue;
+    }
+    if (!inDeps || !line || line.startsWith('#')) continue;
+    const match = line.match(/^([a-zA-Z0-9_-]+)\s*=/);
+    if (match) pkgs.add(match[1]);
+  }
+  return [...pkgs];
+}
+
+/**
+ * Parse a go.mod file — extract direct + indirect dependencies from require blocks.
+ * Format:
+ *   require (
+ *       github.com/gin-gonic/gin v1.9.1
+ *       golang.org/x/net v0.20.0 // indirect
+ *   )
+ *   require github.com/foo/bar v1.0.0
+ */
+function parseGoMod(content) {
+  const pkgs = new Set();
+  const lines = content.split('\n');
+  let inRequireBlock = false;
+
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith('//')) continue;
+
+    // Block-form require: "require ("
+    if (/^require\s*\(\s*$/.test(line)) {
+      inRequireBlock = true;
+      continue;
+    }
+    if (inRequireBlock && line === ')') {
+      inRequireBlock = false;
+      continue;
+    }
+
+    // Inside a block: "<modulepath> <version>" optionally followed by comments
+    if (inRequireBlock) {
+      const match = line.match(/^([^\s]+)\s+v[^\s]+/);
+      if (match) pkgs.add(match[1]);
+      continue;
+    }
+
+    // Single-line require: "require <modulepath> <version>"
+    const single = line.match(/^require\s+([^\s]+)\s+v[^\s]+/);
+    if (single) pkgs.add(single[1]);
+  }
+
+  return [...pkgs];
+}
+
+/**
+ * Parse a go.sum file — module path is the first column, version + suffix follow.
+ * Each module appears multiple times (once per artifact); dedupe.
+ */
+function parseGoSum(content) {
+  const pkgs = new Set();
+  for (const raw of content.split('\n')) {
+    const line = raw.trim();
+    if (!line) continue;
+    const match = line.match(/^([^\s]+)\s+v[^\s/]+/);
+    if (match) pkgs.add(match[1]);
+  }
+  return [...pkgs];
 }
 
 /**
@@ -465,6 +465,8 @@ async function main() {
     const a = args[i];
     if (a === '--pypi') { ecosystem = 'pypi'; i++; }
     else if (a === '--npm') { ecosystem = 'npm'; i++; }
+    else if (a === '--cargo') { ecosystem = 'cargo'; i++; }
+    else if (a === '--golang' || a === '--go') { ecosystem = 'golang'; i++; }
     else if (a === '--json') { jsonOutput = true; i++; }
     else if (a === '--file' || a === '-f') {
       filePath = args[++i];
@@ -484,14 +486,7 @@ async function main() {
       ecosystem = result.ecosystem;
       isLockfile = result.lockfile || false;
       totalInFile = result.totalInFile || packages.length;
-      if (result.workspaceCount) {
-        if (!jsonOutput) console.log(clr(c.dim, `Monorepo: ${result.workspaceCount} workspace${result.workspaceCount > 1 ? 's' : ''} → ${totalInFile} unique external dependencies (${ecosystem})`));
-        if (result.monorepoDetected && !jsonOutput) {
-          console.log(clr(c.dim, `  (auto-detected pnpm-workspace.yaml next to ${filePath})`));
-        }
-      } else {
-        if (!jsonOutput) console.log(clr(c.dim, `Detected ${totalInFile} packages from ${filePath} (${ecosystem})`));
-      }
+      if (!jsonOutput) console.log(clr(c.dim, `Detected ${totalInFile} packages from ${filePath} (${ecosystem})`));
     } catch (err) {
       console.error(`Error reading ${filePath}: ${err.message}`);
       process.exit(1);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.5.0",
-  "description": "Supply chain risk scorer for npm, PyPI, and Cargo packages — behavioral signals that can't be faked",
+  "version": "1.6.0",
+  "description": "Supply chain risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
   "type": "module",
   "bin": {
     "proof-of-commitment": "./index.js",
@@ -19,9 +19,9 @@
     "pypi",
     "cargo",
     "rust",
-    "pnpm",
-    "monorepo",
-    "workspace",
+    "golang",
+    "go",
+    "go-modules",
     "dependencies",
     "audit",
     "risk",