gestate 1.0.0__py3-none-any.whl

gestate/__init__.py

@@ -0,0 +1,3 @@
+"""Configure package managers with a minimum release age."""
+
+__version__ = "1.0.0"

gestate/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

gestate/cli.py

@@ -0,0 +1,713 @@
+"""Rich-formatted CLI orchestrator."""
+
+import argparse
+import shutil
+import subprocess
+import sys
+
+from rich.console import Console
+from rich.panel import Panel
+from rich.prompt import Confirm, IntPrompt, Prompt
+from rich.table import Table
+from rich.text import Text
+
+from .config import (
+    remove_deno_alias,
+    remove_uv_env_export,
+    set_bunfig_min_age,
+    set_deno_alias,
+    set_uv_exclude_newer,
+    unset_bunfig_min_age,
+    unset_uv_exclude_newer,
+)
+from .detect import (
+    bunfig_path,
+    detect_profile,
+    detect_tools,
+    uv_config_path,
+    yarn_major,
+)
+from .status import (
+    bun_current,
+    deno_current_alias,
+    npm_current,
+    pip_current,
+    pnpm_current,
+    uv_current,
+    yarn_current,
+)
+
+console = Console()
+
+WHY_INTRO = (
+    "Malicious package versions are usually caught and yanked within days. "
+    "Refusing fresh versions blocks most supply-chain attacks.\n\n"
+    "[bold]gestate[/] sets a minimum release age across your installed "
+    "package managers."
+)
+
+TOOL_ORDER = ["npm", "pnpm", "yarn", "bun", "deno", "pip", "uv"]
+FILE_BASED = {"bun", "deno", "uv"}
+DENO_OUR_PREFIX = "alias deno='command deno --minimum-dependency-age="
+
+TOOL_META = {
+    "npm": {
+        "kind": "CLI config",
+        "config": "~/.npmrc (user)",
+        "key": "min-release-age",
+        "unit": "days",
+        "set": "npm config set min-release-age=<N> --location=user",
+        "revert": "npm config delete min-release-age --location=user",
+    },
+    "pnpm": {
+        "kind": "CLI config",
+        "config": "global pnpm config",
+        "key": "minimumReleaseAge",
+        "unit": "minutes (= days × 1440)",
+        "set": "pnpm config set minimumReleaseAge <N×1440> --global",
+        "revert": "pnpm config delete minimumReleaseAge --global",
+    },
+    "yarn": {
+        "kind": "CLI config (yarn 4.10+)",
+        "config": "~/.yarnrc.yml",
+        "key": "npmMinimalAgeGate",
+        "unit": "minutes (= days × 1440)",
+        "set": "yarn config set --home npmMinimalAgeGate <N×1440>",
+        "revert": "yarn config unset --home npmMinimalAgeGate",
+    },
+    "bun": {
+        "kind": "TOML file",
+        "config": "~/.bunfig.toml",
+        "key": "[install] minimumReleaseAge",
+        "unit": "seconds (= days × 86400)",
+        "set": "parse TOML, set install.minimumReleaseAge = <N×86400>, re-emit",
+        "revert": "remove key (and [install] table if empty); delete file if empty",
+    },
+    "deno": {
+        "kind": "shell-profile alias",
+        "config": "~/.zshrc, ~/.bashrc, or ~/.profile",
+        "key": "alias deno=…",
+        "unit": "ISO 8601 duration (P<N>D)",
+        "set": "alias deno='command deno --minimum-dependency-age=P<N>D'",
+        "revert": "remove our alias line (leaves foreign aliases alone)",
+    },
+    "pip": {
+        "kind": "CLI config",
+        "config": "user pip config",
+        "key": "global.uploaded-prior-to",
+        "unit": "ISO 8601 duration (P<N>D)",
+        "set": "pip config set global.uploaded-prior-to P<N>D",
+        "revert": "pip config unset global.uploaded-prior-to",
+    },
+    "uv": {
+        "kind": "TOML file",
+        "config": "~/.config/uv/uv.toml",
+        "key": "exclude-newer",
+        "unit": "relative duration string ('N days')",
+        "set": 'parse TOML, set exclude-newer = "<N> days", re-emit',
+        "revert": "remove key; delete file if empty",
+    },
+}
+
+
+def _plain() -> bool:
+    return not console.is_terminal
+
+
+def _strip_markup(value: str) -> str:
+    return Text.from_markup(value).plain
+
+
+def targets_for(days: int) -> dict[str, tuple[str, str]]:
+    """Map tool → (target_value, target_display) for the given delay in days."""
+    mins = days * 1440
+    secs = days * 86400
+    return {
+        "npm": (str(days), f"min-release-age={days}"),
+        "pnpm": (str(mins), f"minimumReleaseAge={mins}"),
+        "yarn": (str(mins), f"npmMinimalAgeGate={mins}"),
+        "bun": (str(secs), f"minimumReleaseAge={secs}"),
+        "deno": (f"P{days}D", f"--minimum-dependency-age=P{days}D"),
+        "pip": (f"P{days}D", f"global.uploaded-prior-to=P{days}D"),
+        "uv": (f"{days} days", f'exclude-newer = "{days} days"'),
+    }
+
+
+def _read_current(tool: str) -> str | None:
+    if tool == "npm":
+        return npm_current()
+    if tool == "pnpm":
+        return pnpm_current()
+    if tool == "yarn":
+        return yarn_current()
+    if tool == "bun":
+        return bun_current(bunfig_path())
+    if tool == "deno":
+        return deno_current_alias(detect_profile())
+    if tool == "pip":
+        return pip_current()
+    if tool == "uv":
+        return uv_current(uv_config_path())
+    return None
+
+
+def _current_label(
+    tool: str,
+    tools: dict[str, bool],
+    currents: dict[str, str | None],
+    yarn_supported: bool,
+) -> str:
+    if not tools.get(tool):
+        return "[dim]not installed[/]"
+    if tool == "yarn" and not yarn_supported:
+        return "[yellow]yarn <4.10 (unsupported)[/]"
+    if currents[tool] is None:
+        return "[dim]unset[/]"
+    return currents[tool]
+
+
+def _print_current(
+    tools: dict[str, bool],
+    currents: dict[str, str | None],
+    yarn_supported: bool = True,
+) -> None:
+    if _plain():
+        print("Current:")
+        for tool in TOOL_ORDER:
+            label = _strip_markup(_current_label(tool, tools, currents, yarn_supported))
+            print(f"  {tool:<6} {label}")
+        return
+    table = Table(title="Current release-age settings", header_style="bold yellow")
+    table.add_column("Tool", style="cyan")
+    table.add_column("Current")
+    for tool in TOOL_ORDER:
+        table.add_row(tool, _current_label(tool, tools, currents, yarn_supported))
+    console.print(table)
+
+
+def build_rows(
+    tools: dict[str, bool],
+    currents: dict[str, str | None],
+    targets: dict[str, tuple[str, str]],
+    scope: str,
+    yarn_supported: bool = True,
+) -> list[tuple[str, str, str, bool]]:
+    """Build (tool, current_display, action_display, needs_apply) rows."""
+    rows = []
+    for tool in TOOL_ORDER:
+        target_val, target_disp = targets[tool]
+        installed = tools.get(tool, False)
+        current = currents.get(tool)
+
+        if not installed:
+            if scope == "all" and tool in FILE_BASED:
+                rows.append(
+                    (
+                        tool,
+                        "[dim]not installed[/]",
+                        f"[cyan]pre-configure[/] {target_disp}",
+                        True,
+                    )
+                )
+            else:
+                rows.append((tool, "[dim]not installed[/]", "[dim]skip[/]", False))
+            continue
+
+        if tool == "yarn" and not yarn_supported:
+            rows.append(
+                (tool, "[yellow]yarn <4.10 (unsupported)[/]", "[dim]skip[/]", False)
+            )
+            continue
+
+        if tool == "deno":
+            if current is None:
+                rows.append(
+                    (tool, "[dim]unset[/]", f"[green]set[/] {target_disp}", True)
+                )
+            elif not current.startswith(DENO_OUR_PREFIX):
+                rows.append((tool, current, "[red]conflict[/] — merge manually", False))
+            elif f"minimum-dependency-age={target_val}'" in current:
+                rows.append((tool, current, "[dim]already set[/]", False))
+            else:
+                rows.append((tool, current, f"[yellow]replace[/] → {target_val}", True))
+            continue
+
+        if current is None:
+            rows.append((tool, "[dim]unset[/]", f"[green]set[/] {target_disp}", True))
+        elif current == target_val:
+            rows.append((tool, current, "[dim]already set[/]", False))
+        else:
+            rows.append((tool, current, f"[yellow]replace[/] → {target_val}", True))
+    return rows
+
+
+def _print_plan(
+    rows: list[tuple[str, str, str, bool]], *, title: str = "Proposed changes"
+) -> None:
+    if _plain():
+        print(f"{title}:")
+        for tool, current, action, _ in rows:
+            print(f"  {tool:<6} {_strip_markup(current):<28} {_strip_markup(action)}")
+        return
+    table = Table(title=title, header_style="bold yellow")
+    table.add_column("Tool", style="cyan")
+    table.add_column("Current")
+    table.add_column("Action")
+    for tool, current, action, _ in rows:
+        table.add_row(tool, current, action)
+    console.print(table)
+
+
+def _apply_npm(days: int) -> None:
+    subprocess.run(
+        ["npm", "config", "set", f"min-release-age={days}", "--location=user"],
+        check=True,
+    )
+
+
+def _apply_pnpm(days: int) -> None:
+    subprocess.run(
+        ["pnpm", "config", "set", "minimumReleaseAge", str(days * 1440), "--global"],
+        check=True,
+    )
+
+
+def _apply_yarn(days: int) -> None:
+    subprocess.run(
+        ["yarn", "config", "set", "--home", "npmMinimalAgeGate", str(days * 1440)],
+        check=True,
+    )
+
+
+def _apply_pip(days: int) -> None:
+    pip = "pip" if shutil.which("pip") else "pip3"
+    subprocess.run(
+        [pip, "config", "set", "global.uploaded-prior-to", f"P{days}D"],
+        check=True,
+        capture_output=True,
+    )
+
+
+def _run(failures: list[str], tool: str, action) -> None:
+    try:
+        action()
+    except subprocess.CalledProcessError as exc:
+        failures.append(tool)
+        stderr = (
+            (exc.stderr or b"").decode(errors="replace")
+            if isinstance(exc.stderr, bytes)
+            else (exc.stderr or "")
+        )
+        tail = (
+            stderr.strip().splitlines()[-1]
+            if stderr.strip()
+            else f"exit {exc.returncode}"
+        )
+        console.print(f"[red]{tool}[/] failed: {tail}")
+    except OSError as exc:
+        failures.append(tool)
+        console.print(f"[red]{tool}[/] failed: {exc}")
+
+
+def _revert_npm() -> None:
+    subprocess.run(
+        ["npm", "config", "delete", "min-release-age", "--location=user"], check=True
+    )
+
+
+def _revert_pnpm() -> None:
+    subprocess.run(
+        ["pnpm", "config", "delete", "minimumReleaseAge", "--global"], check=True
+    )
+
+
+def _revert_yarn() -> None:
+    subprocess.run(
+        ["yarn", "config", "unset", "--home", "npmMinimalAgeGate"], check=True
+    )
+
+
+def _revert_pip() -> None:
+    pip = "pip" if shutil.which("pip") else "pip3"
+    subprocess.run(
+        [pip, "config", "unset", "global.uploaded-prior-to"],
+        check=True,
+        capture_output=True,
+    )
+
+
+def build_revert_rows(
+    tools: dict[str, bool],
+    currents: dict[str, str | None],
+    yarn_supported: bool = True,
+) -> list[tuple[str, str, str, bool]]:
+    """Build (tool, current_display, action_display, needs_apply) rows for revert."""
+    cli_tools = {"npm", "pnpm", "yarn", "pip"}
+    rows = []
+    for tool in TOOL_ORDER:
+        current = currents.get(tool)
+        installed = tools.get(tool, False)
+
+        if tool == "yarn" and installed and not yarn_supported:
+            rows.append(
+                (tool, "[yellow]yarn <4.10 (unsupported)[/]", "[dim]skip[/]", False)
+            )
+            continue
+
+        if tool in cli_tools:
+            if not installed:
+                rows.append((tool, "[dim]not installed[/]", "[dim]skip[/]", False))
+            elif current is None:
+                rows.append((tool, "[dim]unset[/]", "[dim]skip[/]", False))
+            else:
+                rows.append((tool, current, f"[yellow]unset[/] (was {current})", True))
+            continue
+
+        if tool == "deno":
+            if current is None:
+                rows.append((tool, "[dim]no alias[/]", "[dim]skip[/]", False))
+            elif current.startswith(DENO_OUR_PREFIX):
+                rows.append((tool, current, "[yellow]remove alias[/]", True))
+            else:
+                rows.append(
+                    (tool, current, "[red]foreign alias[/] — leave alone", False)
+                )
+            continue
+
+        # bun, uv — file-based, act regardless of binary presence
+        if current is None:
+            rows.append((tool, "[dim]unset[/]", "[dim]skip[/]", False))
+        else:
+            rows.append((tool, current, f"[yellow]remove[/] (was {current})", True))
+    return rows
+
+
+def _read_currents(tools: dict[str, bool]) -> dict[str, str | None]:
+    """Read each tool's current value. File-based tools read regardless of binary presence."""
+    out: dict[str, str | None] = {}
+    for tool in TOOL_ORDER:
+        if tool in FILE_BASED or tools.get(tool):
+            out[tool] = _read_current(tool)
+        else:
+            out[tool] = None
+    return out
+
+
+def _do_revert(
+    tools: dict[str, bool],
+    yarn_ok: bool,
+    currents: dict[str, str | None],
+    *,
+    confirm: bool = True,
+) -> int:
+    rows = build_revert_rows(tools, currents, yarn_supported=yarn_ok)
+    _print_plan(rows, title="Revert plan")
+
+    pending = {r[0] for r in rows if r[3]}
+    if not pending:
+        console.print("\n[bold green]Nothing to revert.[/]")
+        return 0
+
+    if confirm and not Confirm.ask(f"\nRevert {len(pending)} setting(s)?"):
+        console.print("[red]Aborted.[/]")
+        return 1
+
+    console.print()
+    failures: list[str] = []
+
+    if "npm" in pending:
+        _run(
+            failures,
+            "npm",
+            lambda: (_revert_npm(), console.print("[green]npm[/] unset")),
+        )
+    if "pnpm" in pending:
+        _run(
+            failures,
+            "pnpm",
+            lambda: (_revert_pnpm(), console.print("[green]pnpm[/] unset")),
+        )
+    if "yarn" in pending:
+        _run(
+            failures,
+            "yarn",
+            lambda: (_revert_yarn(), console.print("[green]yarn[/] unset")),
+        )
+    if "bun" in pending:
+        bunfig = bunfig_path()
+
+        def _bun() -> None:
+            unset_bunfig_min_age(bunfig)
+            msg = "removed" if not bunfig.exists() else "key removed"
+            console.print(f"[green]bun[/] {msg} ({bunfig})")
+
+        _run(failures, "bun", _bun)
+    if "deno" in pending:
+        profile = detect_profile()
+
+        def _deno() -> None:
+            state = remove_deno_alias(profile)
+            if state == "removed":
+                console.print(
+                    f"[green]deno[/] alias removed from {profile} (backup at {profile}.bak)"
+                )
+            else:
+                console.print(f"[yellow]deno[/] {state}")
+
+        _run(failures, "deno", _deno)
+    if "pip" in pending:
+        _run(
+            failures,
+            "pip",
+            lambda: (_revert_pip(), console.print("[green]pip[/] unset")),
+        )
+    if "uv" in pending:
+        uv_cfg = uv_config_path()
+
+        def _uv() -> None:
+            unset_uv_exclude_newer(uv_cfg)
+            msg = "removed" if not uv_cfg.exists() else "key removed"
+            console.print(f"[green]uv[/] {msg} ({uv_cfg})")
+
+        _run(failures, "uv", _uv)
+
+    if failures:
+        console.print(f"\n[bold red]Finished with errors:[/] {', '.join(failures)}")
+        return 1
+    console.print("\n[bold green]Reverted.[/]")
+    return 0
+
+
+def _do_set(
+    tools: dict[str, bool],
+    yarn_ok: bool,
+    currents: dict[str, str | None],
+    *,
+    days: int | None = None,
+    scope: str | None = None,
+    confirm: bool = True,
+) -> int:
+    if days is None:
+        days = IntPrompt.ask("Minimum release age (days)", default=3)
+    if days < 1:
+        console.print("[red]Days must be ≥ 1.[/]")
+        return 1
+
+    if scope is None:
+        scope = Prompt.ask(
+            "Apply to", choices=["installed", "all"], default="installed"
+        )
+
+    targets = targets_for(days)
+    rows = build_rows(tools, currents, targets, scope, yarn_supported=yarn_ok)
+
+    console.print()
+    _print_plan(rows)
+
+    pending = {r[0] for r in rows if r[3]}
+    if not pending:
+        console.print("\n[bold green]Nothing to change.[/]")
+        return 0
+
+    pending_in_order = [r[0] for r in rows if r[3]]
+    console.print(
+        f"\n[dim italic]Will apply a {days}-day minimum release age to: "
+        + ", ".join(pending_in_order)
+        + "[/]"
+    )
+    if confirm and not Confirm.ask(f"Apply {len(pending)} change(s)?"):
+        console.print("[red]Aborted. No changes made.[/]")
+        return 1
+
+    console.print()
+    failures: list[str] = []
+
+    if "npm" in pending:
+        _run(
+            failures,
+            "npm",
+            lambda: (_apply_npm(days), console.print("[green]npm[/] configured")),
+        )
+    if "pnpm" in pending:
+        _run(
+            failures,
+            "pnpm",
+            lambda: (_apply_pnpm(days), console.print("[green]pnpm[/] configured")),
+        )
+    if "yarn" in pending:
+        _run(
+            failures,
+            "yarn",
+            lambda: (_apply_yarn(days), console.print("[green]yarn[/] configured")),
+        )
+    if "bun" in pending:
+        bunfig = bunfig_path()
+        _run(
+            failures,
+            "bun",
+            lambda: (
+                set_bunfig_min_age(bunfig, days * 86400),
+                console.print(f"[green]bun[/] configured ({bunfig})"),
+            ),
+        )
+    if "deno" in pending:
+        profile = detect_profile()
+
+        def _deno() -> None:
+            state = set_deno_alias(profile, f"P{days}D")
+            if state == "added":
+                console.print(
+                    f"[green]deno[/] alias added to {profile} — reload shell to activate"
+                )
+            elif state == "updated":
+                console.print(
+                    f"[green]deno[/] alias updated in {profile} (backup at {profile}.bak) — reload shell"
+                )
+            else:
+                console.print(f"[yellow]deno[/] {state}")
+
+        _run(failures, "deno", _deno)
+    if "pip" in pending:
+        _run(
+            failures,
+            "pip",
+            lambda: (_apply_pip(days), console.print("[green]pip[/] configured")),
+        )
+    if "uv" in pending:
+        uv_cfg = uv_config_path()
+
+        def _uv() -> None:
+            set_uv_exclude_newer(uv_cfg, f"{days} days")
+            console.print(f"[green]uv[/] configured ({uv_cfg})")
+            profile = detect_profile()
+            if remove_uv_env_export(profile):
+                console.print(
+                    f"[green]uv[/] removed stale UV_EXCLUDE_NEWER from {profile} (backup at {profile}.bak)"
+                )
+
+        _run(failures, "uv", _uv)
+
+    if failures:
+        console.print(f"\n[bold red]Finished with errors:[/] {', '.join(failures)}")
+        return 1
+    console.print("\n[bold green]Done.[/] Protected against fresh package versions.")
+    return 0
+
+
+def _do_explain(tool: str) -> int:
+    meta = TOOL_META[tool]
+    current = _read_current(tool)
+    current_text = current if current is not None else "(unset)"
+
+    if _plain():
+        print(f"{tool} ({meta['kind']})")
+        print(f"  config:  {meta['config']}")
+        print(f"  key:     {meta['key']}")
+        print(f"  unit:    {meta['unit']}")
+        print(f"  current: {current_text}")
+        print(f"  set:     {meta['set']}")
+        print(f"  revert:  {meta['revert']}")
+        return 0
+
+    console.print(f"\n[bold cyan]{tool}[/]  [dim]({meta['kind']})[/]")
+    console.print(f"  [bold]config[/]:  {meta['config']}")
+    console.print(f"  [bold]key[/]:     {meta['key']}  [dim]({meta['unit']})[/]")
+    console.print(
+        "  [bold]current[/]: "
+        + (current_text if current is not None else "[dim](unset)[/]")
+    )
+    console.print(f"  [bold]set[/]:     [dim]{meta['set']}[/]")
+    console.print(f"  [bold]revert[/]:  [dim]{meta['revert']}[/]")
+    return 0
+
+
+def _main() -> int:
+    parser = argparse.ArgumentParser(
+        prog="gestate",
+        description="Configure package managers with a minimum release age.",
+    )
+    sub = parser.add_subparsers(dest="command", metavar="<command>")
+
+    set_p = sub.add_parser(
+        "set", help="Set a minimum release age and apply (non-interactive)."
+    )
+    set_p.add_argument("days", type=int, help="Minimum release age in days.")
+    set_p.add_argument(
+        "--all",
+        action="store_true",
+        help="Also pre-configure file-based tools (bun, deno, uv) when their binary is missing.",
+    )
+
+    sub.add_parser("revert", help="Remove gestate's settings (non-interactive).")
+
+    explain_p = sub.add_parser(
+        "explain",
+        help="Show how a tool's setting is configured and what gestate does to it.",
+    )
+    explain_p.add_argument("tool", choices=TOOL_ORDER)
+
+    args = parser.parse_args()
+
+    if args.command == "explain":
+        return _do_explain(args.tool)
+
+    if args.command is None and not sys.stdin.isatty():
+        console.print(
+            "[red]No TTY detected.[/] Run [bold]gestate set <days>[/] or "
+            "[bold]gestate revert[/] for non-interactive use."
+        )
+        return 2
+
+    with console.status("[bold blue]Scanning package managers..."):
+        tools = detect_tools()
+        yarn_ok = (yarn_major() or 0) >= 4
+        currents = _read_currents(tools)
+
+    if args.command == "set":
+        if args.days < 1:
+            console.print("[red]days must be ≥ 1[/]")
+            return 1
+        scope = "all" if args.all else "installed"
+        return _do_set(
+            tools,
+            yarn_ok,
+            currents,
+            days=args.days,
+            scope=scope,
+            confirm=False,
+        )
+
+    if args.command == "revert":
+        return _do_revert(tools, yarn_ok, currents, confirm=False)
+
+    _print_current(tools, currents, yarn_supported=yarn_ok)
+
+    if all(currents[t] is None for t in TOOL_ORDER):
+        console.print()
+        console.print(
+            Panel(WHY_INTRO, title="Why minimum release age?", border_style="cyan")
+        )
+
+    console.print(
+        "\n[dim italic]Nothing has changed yet — you'll see a full plan and be asked "
+        "to confirm before anything is applied.[/]"
+    )
+
+    action = Prompt.ask("Action", choices=["set", "revert", "quit"], default="set")
+    if action == "quit":
+        return 0
+    if action == "revert":
+        return _do_revert(tools, yarn_ok, currents)
+    return _do_set(tools, yarn_ok, currents)
+
+
+def main() -> int:
+    try:
+        return _main()
+    except (KeyboardInterrupt, EOFError):
+        console.print("\n[red]Aborted.[/]")
+        return 130
+
+
+if __name__ == "__main__":
+    sys.exit(main())

gestate/config.py

@@ -0,0 +1,135 @@
+"""Config-file editors. Pure functions over given paths — no subprocess, no globals."""
+
+import re
+import tomllib
+from pathlib import Path
+
+import tomli_w
+
+_DENO_OUR_LINE = re.compile(
+    r"^alias deno='command deno --minimum-dependency-age=[^']+'$",
+    re.MULTILINE,
+)
+
+
+def _load(path: Path) -> dict:
+    if not path.exists():
+        return {}
+    with path.open("rb") as f:
+        return tomllib.load(f)
+
+
+def _dump(path: Path, data: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("wb") as f:
+        tomli_w.dump(data, f)
+
+
+def set_bunfig_min_age(path: Path, seconds: int) -> bool:
+    data = _load(path)
+    install = data.setdefault("install", {})
+    if install.get("minimumReleaseAge") == seconds:
+        return False
+    install["minimumReleaseAge"] = seconds
+    _dump(path, data)
+    return True
+
+
+def set_uv_exclude_newer(path: Path, value: str) -> bool:
+    data = _load(path)
+    if data.get("exclude-newer") == value:
+        return False
+    data["exclude-newer"] = value
+    _dump(path, data)
+    return True
+
+
+def remove_uv_env_export(profile: Path) -> bool:
+    """Strip stale UV_EXCLUDE_NEWER exports from a shell profile, saving a `.bak`."""
+    if not profile.exists():
+        return False
+    original = profile.read_text()
+    kept = [
+        line
+        for line in original.splitlines(keepends=True)
+        if "UV_EXCLUDE_NEWER" not in line
+    ]
+    new = "".join(kept)
+    if new == original:
+        return False
+    profile.with_name(profile.name + ".bak").write_text(original)
+    profile.write_text(new)
+    return True
+
+
+def unset_bunfig_min_age(path: Path) -> bool:
+    if not path.exists():
+        return False
+    data = _load(path)
+    install = data.get("install", {})
+    if "minimumReleaseAge" not in install:
+        return False
+    del install["minimumReleaseAge"]
+    if not install:
+        del data["install"]
+    if not data:
+        path.unlink()
+    else:
+        _dump(path, data)
+    return True
+
+
+def unset_uv_exclude_newer(path: Path) -> bool:
+    if not path.exists():
+        return False
+    data = _load(path)
+    if "exclude-newer" not in data:
+        return False
+    del data["exclude-newer"]
+    if not data:
+        path.unlink()
+    else:
+        _dump(path, data)
+    return True
+
+
+def remove_deno_alias(profile: Path) -> str:
+    """Remove gestate's deno alias if present. Returns 'removed', 'absent', or 'foreign'."""
+    if not profile.exists():
+        return "absent"
+    text = profile.read_text()
+    line_matcher = re.compile(
+        r"^alias deno='command deno --minimum-dependency-age=[^']+'$"
+    )
+    lines = text.splitlines(keepends=True)
+    kept = [line for line in lines if not line_matcher.match(line.rstrip("\n"))]
+    if len(kept) == len(lines):
+        return "foreign" if any("alias deno=" in line for line in lines) else "absent"
+    profile.with_name(profile.name + ".bak").write_text(text)
+    profile.write_text("".join(kept))
+    return "removed"
+
+
+def set_deno_alias(profile: Path, age: str) -> str:
+    """Ensure deno alias enforces --minimum-dependency-age=<age>.
+
+    Returns 'added' (no prior alias), 'present' (already at target), 'updated'
+    (overwrote our prior alias with a different age), or 'conflict' (refused to
+    clobber a user-authored deno alias of a different shape).
+    """
+    line = f"alias deno='command deno --minimum-dependency-age={age}'"
+    existing = profile.read_text() if profile.exists() else ""
+    if line in existing:
+        return "present"
+    if _DENO_OUR_LINE.search(existing):
+        profile.with_name(profile.name + ".bak").write_text(existing)
+        profile.write_text(_DENO_OUR_LINE.sub(line, existing))
+        return "updated"
+    if "alias deno=" in existing:
+        return "conflict"
+    profile.parent.mkdir(parents=True, exist_ok=True)
+    if profile.exists():
+        profile.with_name(profile.name + ".bak").write_text(existing)
+    sep = "" if not existing or existing.endswith("\n") else "\n"
+    profile.write_text(existing + sep + line + "\n")
+    return "added"

gestate/detect.py

@@ -0,0 +1,60 @@
+"""Locate installed package managers and their config destinations."""
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+
+def have(cmd: str) -> bool:
+    return shutil.which(cmd) is not None
+
+
+def yarn_major() -> int | None:
+    if not have("yarn"):
+        return None
+    try:
+        result = subprocess.run(
+            ["yarn", "--version"], capture_output=True, text=True, check=True, timeout=5
+        )
+    except (
+        subprocess.CalledProcessError,
+        FileNotFoundError,
+        subprocess.TimeoutExpired,
+    ):
+        return None
+    try:
+        return int(result.stdout.strip().split(".")[0])
+    except (ValueError, IndexError):
+        return None
+
+
+def detect_tools() -> dict[str, bool]:
+    return {
+        "npm": have("npm"),
+        "pnpm": have("pnpm"),
+        "yarn": have("yarn"),
+        "bun": have("bun") or (Path.home() / ".bun" / "bin" / "bun").exists(),
+        "deno": have("deno"),
+        "pip": have("pip") or have("pip3"),
+        "uv": have("uv"),
+    }
+
+
+def detect_profile() -> Path:
+    shell = os.environ.get("SHELL", "")
+    home = Path.home()
+    if "zsh" in shell:
+        return home / ".zshrc"
+    if "bash" in shell:
+        return home / ".bashrc"
+    return home / ".profile"
+
+
+def uv_config_path() -> Path:
+    base = Path(os.environ.get("XDG_CONFIG_HOME", str(Path.home() / ".config")))
+    return base / "uv" / "uv.toml"
+
+
+def bunfig_path() -> Path:
+    return Path.home() / ".bunfig.toml"

gestate/status.py

@@ -0,0 +1,68 @@
+"""Read current release-age config for each supported tool."""
+
+import subprocess
+import tomllib
+from pathlib import Path
+
+
+def _cli_get(cmd: list[str]) -> str | None:
+    try:
+        result = subprocess.run(
+            cmd, capture_output=True, text=True, check=True, timeout=10
+        )
+    except (
+        subprocess.CalledProcessError,
+        FileNotFoundError,
+        subprocess.TimeoutExpired,
+    ):
+        return None
+    value = result.stdout.strip()
+    if not value or value in {"undefined", "null"}:
+        return None
+    return value
+
+
+def npm_current() -> str | None:
+    return _cli_get(["npm", "config", "get", "min-release-age", "--location=user"])
+
+
+def pnpm_current() -> str | None:
+    return _cli_get(["pnpm", "config", "get", "minimumReleaseAge", "--global"])
+
+
+def yarn_current() -> str | None:
+    return _cli_get(["yarn", "config", "get", "--home", "npmMinimalAgeGate"])
+
+
+def pip_current() -> str | None:
+    return _cli_get(["pip", "config", "get", "global.uploaded-prior-to"]) or _cli_get(
+        ["pip3", "config", "get", "global.uploaded-prior-to"]
+    )
+
+
+def bun_current(path: Path) -> str | None:
+    if not path.exists():
+        return None
+    with path.open("rb") as f:
+        data = tomllib.load(f)
+    val = data.get("install", {}).get("minimumReleaseAge")
+    return None if val is None else str(val)
+
+
+def uv_current(path: Path) -> str | None:
+    if not path.exists():
+        return None
+    with path.open("rb") as f:
+        data = tomllib.load(f)
+    val = data.get("exclude-newer")
+    return None if val is None else str(val)
+
+
+def deno_current_alias(profile: Path) -> str | None:
+    """Return the existing `alias deno=…` line if any, else None."""
+    if not profile.exists():
+        return None
+    for line in profile.read_text().splitlines():
+        if line.startswith("alias deno="):
+            return line
+    return None

gestate-1.0.0.dist-info/METADATA

@@ -0,0 +1,89 @@
+Metadata-Version: 2.4
+Name: gestate
+Version: 1.0.0
+Summary: Set a minimum release age on local package managers to defend against zero-day supply chain attacks.
+Author-email: Lincoln Loop <chris@lincolnloop.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: bun,cooldown,deno,npm,pip,pnpm,security,supply-chain,uv,yarn
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: System :: Installation/Setup
+Requires-Python: >=3.11
+Requires-Dist: rich>=13
+Requires-Dist: tomli-w>=1.0
+Description-Content-Type: text/markdown
+
+# gestate
+
+Set a minimum release age on local package managers so installs ignore versions younger than `N` days. Most malicious packages are caught and yanked within days of publishing; refusing fresh versions blocks the bulk of supply-chain attacks.
+
+## Run
+
+```
+uvx gestate                  # interactive
+uvx gestate set 3            # 3-day minimum, installed tools only
+uvx gestate set 3 --all      # also pre-configure file-based tools (bun, deno, uv)
+uvx gestate revert           # remove gestate's settings
+uvx gestate explain bun      # show how one tool's setting is stored
+```
+
+Interactive mode always shows a plan and asks for explicit confirmation before touching anything. The subcommands skip the confirm — meant for scripts, not your daily shell. Running with no subcommand outside a TTY exits with an error.
+
+Plain text output is used when stdout isn't a terminal (no Rich tables/colors).
+
+## What it sets
+
+| Tool | Where | Key (unit) |
+|---|---|---|
+| npm  | `~/.npmrc`               | `min-release-age` (days) |
+| pnpm | global pnpm config       | `minimumReleaseAge` (minutes) |
+| yarn | `~/.yarnrc.yml` (4.10+)  | `npmMinimalAgeGate` (minutes) |
+| bun  | `~/.bunfig.toml`         | `[install] minimumReleaseAge` (seconds) |
+| deno | shell profile            | `alias deno='command deno --minimum-dependency-age=P<N>D'` |
+| pip  | user pip config          | `global.uploaded-prior-to` (`P<N>D`) |
+| uv   | `~/.config/uv/uv.toml`   | `exclude-newer` (`"N days"`) |
+
+`gestate explain <tool>` prints that tool's current value and the exact mechanism `set` / `revert` use.
+
+Scope:
+- default — only configure installed tools
+- `--all` — also pre-write config files for `bun`, `deno`, `uv` even if they aren't installed yet
+
+## Revert
+
+`uvx gestate revert` removes everything gestate set:
+
+- CLI tools — `config delete` / `config unset`
+- `bun` / `uv` — remove the key; delete the file if it was the only key
+- `deno` — remove our alias line; leave foreign `alias deno=` lines alone
+
+Backups (`.bak`) are written next to any edited shell-profile or TOML file.
+
+## Allowlists
+
+If you publish packages of your own and want them exempt from the delay, see [docs/allowlists.md](docs/allowlists.md). Most managers support an exclude list; npm and pip don't yet.
+
+## Caveats
+
+- **yarn**: 4.10+ only. Older yarn is detected and skipped.
+- **deno**: no global config exists; the shell alias only covers interactive shells. For CI, pass `--minimum-dependency-age=P<N>D` to `deno install`/`deno update`, or commit a project `deno.json` with `"minimumDependencyAge": "P<N>D"`.
+- **npm exclude**: tracked in [npm/cli#8994](https://github.com/npm/cli/issues/8994).
+- **pip exclude**: none — `global.uploaded-prior-to` is global only.
+
+For PR-creation guards (Dependabot, Renovate) and adjacent layers, see [docs/complementary.md](docs/complementary.md).
+
+## Development
+
+```
+uv sync
+uv run pytest
+```
+
+Requires Python 3.11+, macOS or Linux.

gestate-1.0.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+gestate/__init__.py,sha256=uP_rMF2ZwuDbsqgyIckv1XFW8JWOzff5LhPOLZtyzsw,84
+gestate/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
+gestate/cli.py,sha256=4p2aW_kJmdR4FTQt01PIL9QhbcRSFwtKwp9EeQ4PZNA,22211
+gestate/config.py,sha256=K8pPb4CBkXvXuU3nY2pcxpQcu72zp6Hh62YjC1osZPs,4069
+gestate/detect.py,sha256=bor6vuWIkNAcOPKOruJ6jh_yB38u1ztSEp_8QCs8_jQ,1471
+gestate/status.py,sha256=Bn4jFnPJGC48Lx_zzbI3ZTwy-NBeSoLm9jZDOJz8rn8,1893
+gestate-1.0.0.dist-info/METADATA,sha256=2RQ52ngPsJzNZecbEyDsLjRNz1mGxAAVj-ahf0FmDsk,3801
+gestate-1.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+gestate-1.0.0.dist-info/entry_points.txt,sha256=S9-YSwV4TOvElMdL7q-0ihe3Ice43ny-fGFkvFMS98U,45
+gestate-1.0.0.dist-info/licenses/LICENSE,sha256=edx5WcdHn3GVcmqqARstuhSXu0FPqx7qBqDFc2YgbMY,1069
+gestate-1.0.0.dist-info/RECORD,,

gestate-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

gestate-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+gestate = gestate.cli:main

gestate-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lincoln Loop
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.