pmsec 0.2.2__tar.gz → 0.4.0__tar.gz

{pmsec-0.2.2 → pmsec-0.4.0}/.gitignore

@@ -8,3 +8,4 @@ dist/
 build/
 *.egg-info/
 .pytest_cache/
+.claude/

{pmsec-0.2.2 → pmsec-0.4.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: pmsec
-Version: 0.2.2
-Summary: Inspect and apply install-time cooldown (min-release-age / exclude-newer) for npm and uv.
+Version: 0.4.0
+Summary: Inspect and apply install-time cooldown for npm, pnpm, yarn, bun, cargo, mise, and uv.
 Project-URL: Homepage, https://github.com/HikaruEgashira/pmsec
 Project-URL: Repository, https://github.com/HikaruEgashira/pmsec
 Project-URL: Issues, https://github.com/HikaruEgashira/pmsec/issues
 Author-email: Hikaru Egashira <ai@egahika.dev>
 License: MIT
-Keywords: cooldown,exclude-newer,min-release-age,npm,pmsec,supply-chain,uv
+Keywords: bun,cargo,cooldown,exclude-newer,min-release-age,mise,npm,pmsec,pnpm,supply-chain,uv,yarn
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 
@@ -27,9 +27,9 @@ uvx pmsec unset
 ```
 
 ```bash
-npx @hikae/pmsec check --min 7
-npx @hikae/pmsec set 7
-npx @hikae/pmsec unset
+npx pmsec check --min 7
+npx pmsec set 7
+npx pmsec unset
 ```
 
 If your environment already enforces cooldown (or routes through a proxy
@@ -37,7 +37,7 @@ index), bootstrap pmsec by overriding just for that call:
 
 ```bash
 uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
-npx --registry=https://registry.npmjs.org/ --min-release-age=0 @hikae/pmsec check
+npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check
 ```
 
 ## Supported tools
@@ -49,8 +49,9 @@ npm, pnpm, yarn 4+, bun, cargo (RFC #3801), mise, uv
 | Command | Description |
 | --- | --- |
 | `pmsec check [--min N]` | Read each tool's config; exit 1 if any tool is below `N` days or unset |
-| `pmsec set <DAYS> [--force]` | Write `DAYS`-day cooldown to every selected tool |
+| `pmsec set <DAYS>` | Write `DAYS`-day cooldown to every selected tool |
 | `pmsec unset` | Remove only the cooldown key from each config (other keys preserved) |
+| `pmsec --version` | Print the installed pmsec version |
 
 Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--json`.
 

{pmsec-0.2.2 → pmsec-0.4.0}/README.md

@@ -14,9 +14,9 @@ uvx pmsec unset
 ```
 
 ```bash
-npx @hikae/pmsec check --min 7
-npx @hikae/pmsec set 7
-npx @hikae/pmsec unset
+npx pmsec check --min 7
+npx pmsec set 7
+npx pmsec unset
 ```
 
 If your environment already enforces cooldown (or routes through a proxy
@@ -24,7 +24,7 @@ index), bootstrap pmsec by overriding just for that call:
 
 ```bash
 uvx --index https://pypi.org/simple --exclude-newer-package pmsec=2099-01-01 pmsec check
-npx --registry=https://registry.npmjs.org/ --min-release-age=0 @hikae/pmsec check
+npx --registry=https://registry.npmjs.org/ --min-release-age=0 pmsec check
 ```
 
 ## Supported tools
@@ -36,8 +36,9 @@ npm, pnpm, yarn 4+, bun, cargo (RFC #3801), mise, uv
 | Command | Description |
 | --- | --- |
 | `pmsec check [--min N]` | Read each tool's config; exit 1 if any tool is below `N` days or unset |
-| `pmsec set <DAYS> [--force]` | Write `DAYS`-day cooldown to every selected tool |
+| `pmsec set <DAYS>` | Write `DAYS`-day cooldown to every selected tool |
 | `pmsec unset` | Remove only the cooldown key from each config (other keys preserved) |
+| `pmsec --version` | Print the installed pmsec version |
 
 Options: `--tool npm,pnpm,yarn,bun,cargo,mise,uv`, `--json`.
 

{pmsec-0.2.2 → pmsec-0.4.0}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "pmsec"
-version = "0.2.2"
-description = "Inspect and apply install-time cooldown (min-release-age / exclude-newer) for npm and uv."
+version = "0.4.0"
+description = "Inspect and apply install-time cooldown for npm, pnpm, yarn, bun, cargo, mise, and uv."
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Hikaru Egashira", email = "ai@egahika.dev" }]
-keywords = ["supply-chain", "cooldown", "min-release-age", "exclude-newer", "npm", "uv", "pmsec"]
+keywords = ["supply-chain", "cooldown", "min-release-age", "exclude-newer", "npm", "pnpm", "yarn", "bun", "cargo", "mise", "uv", "pmsec"]
 
 [project.urls]
 Homepage = "https://github.com/HikaruEgashira/pmsec"

pmsec-0.4.0/src/pmsec/__init__.py

@@ -0,0 +1,8 @@
+from importlib.metadata import PackageNotFoundError, version as _pkg_version
+
+try:
+    __version__ = _pkg_version("pmsec")
+except PackageNotFoundError:
+    __version__ = "0.4.0"
+
+__all__ = ["cli", "__version__"]

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/cli.py

@@ -6,6 +6,7 @@ import shlex
 import sys
 from pathlib import Path
 
+from pmsec import __version__
 from pmsec.tools import bun, cargo, mise, npm, pnpm, uv, yarn
 from pmsec.util.paths import current_platform
 
@@ -27,6 +28,7 @@ def _parser() -> argparse.ArgumentParser:
         epilog=USAGE_EPILOG,
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
+    p.add_argument("-V", "--version", action="version", version=f"pmsec {__version__}")
     sub = p.add_subparsers(dest="command", required=True)
 
     common = argparse.ArgumentParser(add_help=False)
@@ -67,7 +69,9 @@ def _gather(targets, env, home, platform):
     rows = []
     for t in targets:
         r = t.read(env, home, platform)
-        rows.append({"tool": t.NAME, "key": t.KEY, "warn": _preflight_warn(t), **r})
+        row = {"tool": t.NAME, "key": t.KEY, "warn": _preflight_warn(t), **r}
+        row.setdefault("extras", [])
+        rows.append(row)
     return rows
 
 
@@ -83,20 +87,31 @@ def _render_human(rows, min_days):
         out.append(f"{status} {r['tool']:<4} {r['key']} = {r['configured'] or '(unset)'}  [{r['path']}]")
         if r.get("warn"):
             out.append(f"       ⚠ {r['warn']}")
+        for e in r.get("extras", []):
+            if e["configured"] is None:
+                ex_status = "MISSING"
+            elif e["ok"]:
+                ex_status = "OK     "
+            else:
+                ex_status = "STALE  "
+            out.append(f"{ex_status} {r['tool']:<4} {e['key']} = {e['configured'] or '(unset)'}  [{r['path']}]")
     return "\n".join(out) + "\n"
 
 
 def _check(args, targets, env, home, platform, out, err):
     rows = _gather(targets, env, home, platform)
-    failing = [r for r in rows if r["days"] is None or r["days"] < args.min]
+    failing_primary = [r for r in rows if r["days"] is None or r["days"] < args.min]
+    failing_extras = [e for r in rows for e in r.get("extras", []) if not e["ok"]]
+    ok = not failing_primary and not failing_extras
     if args.json:
-        out.write(json.dumps({"min": args.min, "rows": rows, "ok": not failing}, indent=2) + "\n")
+        out.write(json.dumps({"min": args.min, "rows": rows, "ok": ok}, indent=2) + "\n")
     else:
         out.write(_render_human(rows, args.min))
-    if failing:
-        err.write(f"pmsec: {len(failing)} tool(s) below {args.min} days\n")
-        return 1
-    return 0
+    if failing_primary:
+        err.write(f"pmsec: {len(failing_primary)} tool(s) below {args.min} days\n")
+    if failing_extras:
+        err.write(f"pmsec: {len(failing_extras)} hardening setting(s) not at safe value\n")
+    return 0 if ok else 1
 
 
 def _explain_fs_error(exc: BaseException, tool: str) -> str:
@@ -116,7 +131,8 @@ def _explain_fs_error(exc: BaseException, tool: str) -> str:
 
 def _set(args, targets, env, home, platform, out, err):
     if args.days <= 0:
-        raise SystemExit("pmsec: set requires DAYS > 0")
+        err.write("pmsec: set requires integer DAYS > 0\n")
+        return 2
     results = []
     failures = []
     warnings = []

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/bun.py

@@ -12,6 +12,7 @@ KEY = "minimumReleaseAge"
 SECTION = "install"
 DOCS = "https://bun.com/docs/runtime/bunfig#install"
 MIN_BIN = (1, 3, 0)
+EXTRAS: list[dict] = []
 
 
 def path(env: dict[str, str], home: Path, platform: str) -> Path:
@@ -42,7 +43,7 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
         except ValueError:
             seconds = None
     days = None if seconds is None else seconds // 86400
-    return {"path": str(p), "configured": value, "days": days}
+    return {"path": str(p), "configured": value, "days": days, "extras": []}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/cargo.py

@@ -11,6 +11,7 @@ NAME = "cargo"
 KEY = "minimum-release-age"
 SECTION = "install"
 DOCS = "https://rust-lang.github.io/rfcs/3801-package-cooldown.html"
+EXTRAS: list[dict] = []
 
 
 def path(env: dict[str, str], home: Path, platform: str) -> Path:
@@ -31,7 +32,7 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     raw = p.read_text("utf-8") if p.exists() else ""
     value = read_key(raw, KEY, section=SECTION)
-    return {"path": str(p), "configured": value, "days": _parse_days(value)}
+    return {"path": str(p), "configured": value, "days": _parse_days(value), "extras": []}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/mise.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import re
 from pathlib import Path
 
+from pmsec.util.extras import apply_extras, read_extras, remove_extras
 from pmsec.util.io import write_atomic
 from pmsec.util.lines import read_key, remove_key, set_key
 from pmsec.util.paths import mise_config_path
@@ -13,6 +14,9 @@ KEY = "minimum_release_age"
 SECTION = "settings"
 DOCS = "https://mise.jdx.dev/configuration/settings.html#minimum_release_age"
 MIN_BIN = (2026, 4, 22)
+EXTRAS = [
+    {"key": "paranoid", "expected": "true", "line": "paranoid = true", "section": SECTION},
+]
 
 
 def preflight() -> dict:
@@ -59,13 +63,14 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     raw = p.read_text("utf-8") if p.exists() else ""
     value = read_key(raw, KEY, section=SECTION)
-    return {"path": str(p), "configured": value, "days": _parse_days(value)}
+    return {"path": str(p), "configured": value, "days": _parse_days(value), "extras": read_extras(raw, EXTRAS)}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     before = p.read_text("utf-8") if p.exists() else ""
     after = set_key(before, KEY, f'{KEY} = "{days}d"', section=SECTION)
+    after = apply_extras(after, EXTRAS)
     write_atomic(p, after)
     return {"path": str(p), "before": before, "after": after}
 
@@ -75,7 +80,9 @@ def unset(env: dict[str, str], home: Path, platform: str) -> dict:
     if not p.exists():
         return {"path": str(p), "removed": False}
     before = p.read_text("utf-8")
-    after, removed = remove_key(before, KEY, section=SECTION)
+    after, removed_cooldown = remove_key(before, KEY, section=SECTION)
+    after, removed_extras = remove_extras(after, EXTRAS)
+    removed = removed_cooldown or removed_extras
     if removed:
         write_atomic(p, after)
     return {"path": str(p), "removed": removed}

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/npm.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from pathlib import Path
 
+from pmsec.util.extras import apply_extras, read_extras, remove_extras
 from pmsec.util.io import write_atomic
 from pmsec.util.lines import read_key, remove_key, set_key
 from pmsec.util.paths import npmrc_path
@@ -11,6 +12,9 @@ NAME = "npm"
 KEY = "min-release-age"
 DOCS = "https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age"
 MIN_BIN = (11, 10, 0)
+EXTRAS = [
+    {"key": "audit-level", "expected": "high", "line": "audit-level=high"},
+]
 
 
 def preflight() -> dict:
@@ -35,13 +39,14 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
     raw = p.read_text("utf-8") if p.exists() else ""
     value = read_key(raw, KEY)
     days = None if value is None else int(value)
-    return {"path": str(p), "configured": value, "days": days}
+    return {"path": str(p), "configured": value, "days": days, "extras": read_extras(raw, EXTRAS)}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     before = p.read_text("utf-8") if p.exists() else ""
     after = set_key(before, KEY, f"{KEY}={days}")
+    after = apply_extras(after, EXTRAS)
     write_atomic(p, after)
     return {"path": str(p), "before": before, "after": after}
 
@@ -51,7 +56,9 @@ def unset(env: dict[str, str], home: Path, platform: str) -> dict:
     if not p.exists():
         return {"path": str(p), "removed": False}
     before = p.read_text("utf-8")
-    after, removed = remove_key(before, KEY)
+    after, removed_cooldown = remove_key(before, KEY)
+    after, removed_extras = remove_extras(after, EXTRAS)
+    removed = removed_cooldown or removed_extras
     if removed:
         write_atomic(p, after)
     return {"path": str(p), "removed": removed}

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/pnpm.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from pathlib import Path
 
+from pmsec.util.extras import apply_extras, read_extras, remove_extras
 from pmsec.util.io import write_atomic
 from pmsec.util.lines import read_key, remove_key, set_key
 from pmsec.util.paths import npmrc_path
@@ -11,6 +12,10 @@ NAME = "pnpm"
 KEY = "minimum-release-age"
 DOCS = "https://pnpm.io/settings#minimumreleaseage"
 MIN_BIN = (10, 6, 0)
+EXTRAS = [
+    {"key": "trust-policy", "expected": "no-downgrade", "line": "trust-policy=no-downgrade"},
+    {"key": "block-exotic-subdeps", "expected": "true", "line": "block-exotic-subdeps=true"},
+]
 
 
 def path(env: dict[str, str], home: Path, platform: str) -> Path:
@@ -41,13 +46,14 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
         except ValueError:
             minutes = None
     days = None if minutes is None else minutes // (60 * 24)
-    return {"path": str(p), "configured": value, "days": days}
+    return {"path": str(p), "configured": value, "days": days, "extras": read_extras(raw, EXTRAS)}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     before = p.read_text("utf-8") if p.exists() else ""
     after = set_key(before, KEY, f"{KEY}={days * 24 * 60}")
+    after = apply_extras(after, EXTRAS)
     write_atomic(p, after)
     return {"path": str(p), "before": before, "after": after}
 
@@ -57,7 +63,9 @@ def unset(env: dict[str, str], home: Path, platform: str) -> dict:
     if not p.exists():
         return {"path": str(p), "removed": False}
     before = p.read_text("utf-8")
-    after, removed = remove_key(before, KEY)
+    after, removed_cooldown = remove_key(before, KEY)
+    after, removed_extras = remove_extras(after, EXTRAS)
+    removed = removed_cooldown or removed_extras
     if removed:
         write_atomic(p, after)
     return {"path": str(p), "removed": removed}

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/uv.py

@@ -12,6 +12,7 @@ NAME = "uv"
 KEY = "exclude-newer"
 DOCS = "https://docs.astral.sh/uv/reference/settings/#exclude-newer"
 MIN_BIN = (0, 9, 17)
+EXTRAS: list[dict] = []
 
 
 def preflight() -> dict:
@@ -48,7 +49,7 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     raw = p.read_text("utf-8") if p.exists() else ""
     value = read_key(raw, KEY)
-    return {"path": str(p), "configured": value, "days": _parse_days(value)}
+    return {"path": str(p), "configured": value, "days": _parse_days(value), "extras": []}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:

{pmsec-0.2.2 → pmsec-0.4.0}/src/pmsec/tools/yarn.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import re
 from pathlib import Path
 
+from pmsec.util.extras import apply_extras, read_extras, remove_extras
 from pmsec.util.io import write_atomic
 from pmsec.util.lines import read_key, remove_key, set_key
 from pmsec.util.paths import yarnrc_path
@@ -13,6 +14,9 @@ KEY = "npmMinimalAgeGate"
 DOCS = "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate"
 MIN_BIN = (4, 10, 0)
 SEP = ":"
+EXTRAS = [
+    {"key": "enableHardenedMode", "expected": "true", "line": "enableHardenedMode: true", "sep": SEP},
+]
 
 _DURATION = re.compile(r'^"?\s*(\d+)\s*(d|days?|w|weeks?)\s*"?$', re.IGNORECASE)
 
@@ -48,13 +52,14 @@ def read(env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     raw = p.read_text("utf-8") if p.exists() else ""
     value = read_key(raw, KEY, sep=SEP)
-    return {"path": str(p), "configured": value, "days": _parse_days(value)}
+    return {"path": str(p), "configured": value, "days": _parse_days(value), "extras": read_extras(raw, EXTRAS)}
 
 
 def write(days: int, env: dict[str, str], home: Path, platform: str) -> dict:
     p = path(env, home, platform)
     before = p.read_text("utf-8") if p.exists() else ""
     after = set_key(before, KEY, f'{KEY}: "{days}d"', sep=SEP)
+    after = apply_extras(after, EXTRAS)
     write_atomic(p, after)
     return {"path": str(p), "before": before, "after": after}
 
@@ -64,7 +69,9 @@ def unset(env: dict[str, str], home: Path, platform: str) -> dict:
     if not p.exists():
         return {"path": str(p), "removed": False}
     before = p.read_text("utf-8")
-    after, removed = remove_key(before, KEY, sep=SEP)
+    after, removed_cooldown = remove_key(before, KEY, sep=SEP)
+    after, removed_extras = remove_extras(after, EXTRAS)
+    removed = removed_cooldown or removed_extras
     if removed:
         write_atomic(p, after)
     return {"path": str(p), "removed": removed}

pmsec-0.4.0/src/pmsec/util/extras.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+from pmsec.util.lines import read_key, remove_key, set_key
+
+
+def read_extras(raw: str, extras: list[dict]) -> list[dict]:
+    rows = []
+    for e in extras:
+        cur = read_key(raw, e["key"], sep=e.get("sep", "="), section=e.get("section"))
+        rows.append({
+            "key": e["key"],
+            "configured": cur,
+            "expected": e["expected"],
+            "ok": cur == e["expected"],
+        })
+    return rows
+
+
+def apply_extras(text: str, extras: list[dict]) -> str:
+    out = text
+    for e in extras:
+        out = set_key(out, e["key"], e["line"], sep=e.get("sep", "="), section=e.get("section"))
+    return out
+
+
+def remove_extras(text: str, extras: list[dict]) -> tuple[str, bool]:
+    out = text
+    removed = False
+    for e in extras:
+        out, r = remove_key(out, e["key"], sep=e.get("sep", "="), section=e.get("section"))
+        if r:
+            removed = True
+    return out, removed

{pmsec-0.2.2 → pmsec-0.4.0}/tests/test_cli.py

@@ -35,6 +35,12 @@ def test_set_writes_every_supported_tool_config(tmp_path):
     mise = (tmp_path / ".config" / "mise" / "config.toml").read_text()
     assert "[settings]" in mise
     assert 'minimum_release_age = "7d"' in mise
+    assert "paranoid = true" in mise
+    npmrc = (tmp_path / ".npmrc").read_text()
+    assert "audit-level=high" in npmrc
+    assert "trust-policy=no-downgrade" in npmrc
+    assert "block-exotic-subdeps=true" in npmrc
+    assert "enableHardenedMode: true" in (tmp_path / ".yarnrc.yml").read_text()
 
 
 def test_check_passes_after_set(tmp_path):
@@ -75,7 +81,9 @@ def test_unset_preserves_other_keys(tmp_path):
 def test_set_replaces_existing_value(tmp_path):
     (tmp_path / ".npmrc").write_text("min-release-age=3\nregistry=https://r/\n")
     run(["set", "10", "--tool", "npm"], tmp_path)
-    assert (tmp_path / ".npmrc").read_text() == "min-release-age=10\nregistry=https://r/\n"
+    assert (tmp_path / ".npmrc").read_text() == (
+        "min-release-age=10\nregistry=https://r/\naudit-level=high\n"
+    )
 
 
 def test_tool_filter(tmp_path):
@@ -101,8 +109,9 @@ def test_check_json(tmp_path):
 
 
 def test_set_rejects_zero(tmp_path):
-    with pytest.raises(SystemExit):
-        run(["set", "0"], tmp_path)
+    code, _, err = run(["set", "0"], tmp_path)
+    assert code == 2
+    assert "set requires integer DAYS > 0" in err
 
 
 def test_bun_section_insert(tmp_path):
@@ -120,7 +129,9 @@ def test_bun_creates_section_if_missing(tmp_path):
 
 
 def test_yarn_check_parses_days(tmp_path):
-    (tmp_path / ".yarnrc.yml").write_text('npmMinimalAgeGate: "14d"\n')
+    (tmp_path / ".yarnrc.yml").write_text(
+        'npmMinimalAgeGate: "14d"\nenableHardenedMode: true\n'
+    )
     _, out, _ = run(["check", "--json", "--tool", "yarn", "--min", "7"], tmp_path)
     data = json.loads(out)
     assert data["ok"] is True
@@ -139,3 +150,37 @@ def test_bak_created_once(tmp_path):
     run(["set", "7", "--tool", "npm"], tmp_path)
     run(["set", "10", "--tool", "npm"], tmp_path)
     assert (tmp_path / ".npmrc.bak").read_text() == "registry=https://original/\n"
+
+
+def test_hardening_extras_roundtrip(tmp_path):
+    (tmp_path / ".npmrc").write_text("minimum-release-age=20160\n")
+    code, out, _ = run(["check", "--json", "--tool", "pnpm", "--min", "7"], tmp_path)
+    data = json.loads(out)
+    assert code == 1
+    assert len(data["rows"][0]["extras"]) == 2
+    assert all(not e["ok"] for e in data["rows"][0]["extras"])
+
+    run(["set", "14", "--tool", "pnpm"], tmp_path)
+    npmrc = (tmp_path / ".npmrc").read_text()
+    assert "trust-policy=no-downgrade" in npmrc
+    assert "block-exotic-subdeps=true" in npmrc
+
+    code, out, _ = run(["check", "--json", "--tool", "pnpm", "--min", "7"], tmp_path)
+    assert code == 0
+    assert json.loads(out)["ok"] is True
+
+    run(["unset", "--tool", "pnpm"], tmp_path)
+    after = (tmp_path / ".npmrc").read_text()
+    assert "trust-policy" not in after
+    assert "block-exotic-subdeps" not in after
+    assert "minimum-release-age" not in after
+
+
+@pytest.mark.parametrize("flag", ["--version", "-V"])
+def test_version_flag_prints_package_version(tmp_path, capsys, flag):
+    from pmsec import __version__
+    with pytest.raises(SystemExit) as exc:
+        run([flag], tmp_path)
+    assert exc.value.code == 0
+    captured = capsys.readouterr()
+    assert captured.out.strip() == f"pmsec {__version__}"

{pmsec-0.2.2 → pmsec-0.4.0}/uv.lock

@@ -4,5 +4,5 @@ requires-python = ">=3.10"
 
 [[package]]
 name = "pmsec"
-version = "0.2.2"
+version = "0.4.0"
 source = { editable = "." }

pmsec-0.2.2/src/pmsec/__init__.py

@@ -1 +0,0 @@
-__all__ = ["cli"]