3 Commits

Include renames

Author	SHA1	Message	Date
Sahil BansalandGitHub	94781d6bda	Remove guard mode: proxy interception is now the only flow (#386) ... * refactor: remove guard mode execution paths and guard-only packages Guard (non-proxy) mode is removed; all package-manager commands now always run the proxy flow. Removes the guard engine, the common flow, the extractor package, the npm/pypi dependency resolvers and the PackageResolver plumbing that only guard mode consumed. The guard package retains only PackageManagerGuardInteraction, which the proxy flow and confirmation interceptors reuse for user prompts. Proxy behavior is unchanged. * refactor: remove proxy opt-out surfaces, guard references in config, action and docs Removes Config.ProxyMode, ProxyConfig.Enabled, IsProxyModeEnabled, the proxy_mode legacy fallback, PMG_PROXY_ENABLED handling and the --proxy-mode / --include-dev-dependencies flags. Proxy interception can no longer be disabled. Also removes the proxy-mode input from the GitHub Action, the proxy-mode doctor check and setup info row, updates the E2E workflow to stop passing --proxy-mode=false, and sweeps guard-mode wording from docs and the config template. The legacy proxy_install_only flat key and PMG_PROXY_INSTALL_ONLY env var remain supported. audit.FlowTypeGuard is kept so previously recorded audit events still translate for cloud sync. * feat: fail loudly when a removed proxy opt-out is still configured A leftover proxy.enabled: false / proxy_mode: false config key or PMG_PROXY_ENABLED=false / PMG_PROXY_MODE=false env var previously meant guard mode; silently ignoring it would switch those users to proxy interception without notice. PMG now exits with an actionable error naming the exact source. Precedence mirrors the old resolution order: env (ignored under lockdown) > proxy.enabled > legacy proxy_mode. The pmg config subtree is exempt so the config file can still be fixed with pmg config edit/set. The GitHub Action's proxy-mode input is kept as a tombstone that fails the action when set to false and warns otherwise. * refactor: extract flows.RunProxy and address review findings Collapses the identical parse-then-run body duplicated across the 12 package manager commands into flows.RunProxy. Documents the cache-hit / offline analysis trade-off versus the removed guard manifest path, fixes a stale non-proxy label in the E2E workflow and a stale guard reference in the uvx parser comment. * fix(config): mirror old proxy opt-out precedence exactly PMG_PROXY_MODE only ever took effect through the legacy fallback, which was gated on the presence of a proxy: key in the config file (even a null one). Promoting it to the top env tier caused two inversions: a stale PMG_PROXY_MODE=false hard-failed configs that resolved to proxy mode, and PMG_PROXY_MODE=true silently overrode an explicit proxy.enabled: false file opt-out. The check now resolves in the old order: PMG_PROXY_ENABLED > proxy: section (presence gates the legacy tier) > PMG_PROXY_MODE > flat proxy_mode. parseOptOutBool also accepts numeric values (0 = false) to match viper's WeaklyTypedInput/cast.ToBool coercion, so proxy.enabled: 0 and proxy_mode: 0 are detected as opt-outs. * refactor: move package manager interaction out of guard * refactor: trim package manager interaction * fix(config): normalize config keys viper-style in proxy opt-out check Viper resolved config file keys case-insensitively and expanded dotted keys, so spellings like Proxy:, Enabled:, a literal proxy.enabled key or Proxy_Mode selected guard mode before the removal. The opt-out check now lowercases keys recursively and nests dotted keys before matching, so those existing opt-outs fail loudly instead of being silently ignored. * refactor: remove inert transitive controls, dead parser state and guard audit variant transitive / transitive_depth lost their only consumers with the dependency resolvers; remove the config fields, flags, template and doc entries, and the report/audit plumbing that misreported transitive analysis as enabled. Remove write-only parser state (PackageInstallTarget.Extras, ParsedCommand.ManifestFiles, ShouldExtractFromManifest); IsManifestInstall stays as it feeds sandbox gating via IsInstallationCommand. Remove audit.FlowTypeGuard and its cloud mapping; guard events recorded by pre-removal versions in an unsynced WAL translate to UNSPECIFIED. * fix: address review findings on the opt-out wiring and cleanups Move the removed-opt-out rejection from the CLI PersistentPreRun into proxyFlow.Run: the check now fires exactly for package-manager runs, so non-install commands (pmg setup remove, doctor, config, version) stay usable to fix or remove an opted-out installation, and future commands inherit or avoid the check by construction instead of by exemption list. Also: make the e2e malicious-package assertion actually fail the job when an install is not blocked, route pmg go through flows.RunProxy, and drop the dead extras return from pypiParsePackageInfo (extras are still stripped from package names). * fix(config): make the removed opt-out check faithful to the old resolution The gate that silenced the legacy proxy_mode surfaces matched the raw proxy key case-sensitively in the old code, while values resolved viper-style (case-insensitive, dotted keys); applying each semantic where the old code did fixes both divergences: a case-variant Proxy: section no longer hides a flat proxy_mode: false opt-out, and a dotted proxy.enabled: false overridden by proxy_mode: true no longer errors. Replace the generic key-tree normalization with two targeted lookups (the check only ever resolves proxy.enabled and proxy_mode), which also makes colliding spellings resolve deterministically. Coerce legacy-tier values cast.ToBool-style so PMG_PROXY_MODE=off style opt-outs are detected, log the config read error instead of swallowing it, and shorten the error to a one-line statement with the specific remedy in the help text. Add lockdown coverage (env inert both directions) and a repeated-run determinism test. * fix(config): fall back to defaults for unrecognized proxy opt-out values The old loader swallowed viper errors and ran on defaults, so values like proxy.enabled: yes or PMG_PROXY_ENABLED=banana silently discarded the whole config and defaulted to proxy. Treat them the same way now: unrecognized values mean the default (proxy on) instead of a hard error, and the doc comment no longer claims the old loader failed loudly. Only values that actually meant guard mode fail. Also check the removed opt-out before the CA trust check in pmg go, restoring the old error precedence: a config problem must not steer the user into an unnecessary OS trust store change. * fix(e2e): PMG_PROXY_MODE assertion must match the legacy gate semantics The runner's setup step writes the template config, which has a proxy: section — and with one present the legacy PMG_PROXY_MODE was always inert, so expecting a loud failure there asserts pre-fidelity-fix behavior. Assert both sides instead: inert (command succeeds) with the standard config, loud failure against an empty config dir where the legacy fallback actually applied. * refactor(config): collapse parseOptOutBool to ParseBool over the string form YAML hands us typed values (bool, int), so route them through fmt.Sprintf %v and strconv.ParseBool instead of a per-type switch. Identical behavior for every recognized value; numbers other than 0/1 now read as no opinion instead of cast.ToBool's nonzero-true, which no real config relies on.	2026-07-22 15:19:19 +05:30
3 people	648adcbda4	feat: add uvx (uv tool run) package executor (#357) ... * feat(uvx): add uvx (uv tool run) package executor Adds support for `uvx`, implemented as a PyPI Executor alongside pipx. uvx is an alias for `uv tool run`: it installs a tool into an ephemeral environment and runs it, so it has no install/list subcommand and the first positional argument (or --from) is the package to audit. Parsing highlights: - --from overrides the positional command as the package to audit - --with packages are audited as additional environment dependencies - name@version shorthand (ruff@0.3.0, ruff@latest) is normalized - flag parsing stops at the tool name so the tool's own flags are not misread as uvx options; uvx's value/boolean flags are registered so none greedily consume the package positional - VCS/URL/local-path specs are skipped for registry auditing Wires up command registration, analytics, shell alias/shim, cloud audit mapping, a dedicated `uvx` sandbox profile (UV_*/PIP_* env, uv cache and tool dirs), config policy, docs, unit tests and an E2E workflow step. Closes #326 https://claude.ai/code/session_011hyLxq7oWJX5Dp4tCEfG19 * chore(uvx): align docs and base profile with uvx support Incorporates the low-risk, non-parser improvements from the community PR #345 (author non-responsive) into our implementation: - list uvx (and the previously-missing pipx) as PyPI managers in the pypi-restrictive base profile package_managers and its README, so the base profile applies directly when selected via --sandbox-profile - document uvx in docs/github-action.md and docs/proxy-mode.md - add version / IsExplicitVersion assertions to the uvx parser tests Our pflag-based parser is kept as-is: unlike #345 it audits --with packages and handles all uvx short flags (e.g. -w), both of which the community PR misses. * fix(uvx): skip interpreter requests; use require in tests Addresses review feedback on PR #357: - uvx interpreter requests (`uvx python`, `uvx python@3.12`, `uvx pypy`, ...) launch an isolated interpreter rather than installing a PyPI tool. Treating the positional as a package made the guard flow resolve/analyze pkg:pypi/python (and python==3.12), which could wrongly block or fail a valid invocation. Skip these for the positional; --with packages on the same command are still audited. - Use require.NoError / require.Len for fatal assertions in the uvx tests, matching the repo's testing convention, so a failure stops the subtest before a nil dereference instead of panicking. * docs(uvx): document fail-open and --with-requirements trade-offs Record the two deliberate parsing decisions raised in review as in-code trade-off comments (no behavior change): - unknown flags are tolerated (fail open), consistent with the other executors; the residual gap only affects non-proxy guard mode since the default proxy flow intercepts every registry download. - --with-requirements / --with-editable values are consumed but not expanded into audit targets; expanding them needs manifest-extractor and guard changes, tracked as follow-up. Proxy mode still covers them. * docs(uvx): drop --with-requirements limitation note Per maintainer review: guard mode is being deprecated and auditing the contents of an existing requirements file is a scanner's responsibility, not PMG's. Remove the "known limitation / follow-up" note; the flags stay registered only so their values are not mistaken for the tool positional. --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-07-02 18:49:31 +05:30
3 people	46cc70db53	feat: add GitHub Action for one-step PMG setup in CI (#263) ... * feat: add GitHub Action for one-step PMG setup in CI Composite action at repo root that downloads PMG (with SHA-256 verification against the upstream checksums.txt), runs `pmg setup install`, and wires shims onto $GITHUB_PATH so subsequent `npm install` / `pip install` calls are transparently analyzed. Defaults are conservative: malware blocking + dependency cooldown + proxy mode (matching PMG's own defaults). Sandbox is opt-in because enabling Landlock/Bubblewrap on ubuntu-latest requires relaxing AppArmor user-namespace restrictions. Cloud sync uses the documented SAFEDEP_API_KEY / SAFEDEP_TENANT_ID env-var fallback so we skip the keychain codepath that has no usable backend in headless CI. When cloud is enabled and no endpoint-id is supplied, the action sets PMG_CLOUD_ENDPOINT_ID=github-actions/${GITHUB_REPOSITORY} so events aggregate per repository instead of per ephemeral runner hostname. Closes #248. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * fix(action): drop github.repository template from input description Action manifest validation rejected the action.yml because the endpoint-id input description contained ${{ github.repository }} — template expressions aren't evaluated in input description text and trip the validator with "Unrecognized named-value: 'github'". This caused every job using uses: ./ to fail before any step ran. Also switch the config-file e2e job to verify the staged file directly instead of calling `pmg config get`, which is not in the v0.13.0 release that "latest" resolves to today. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * fix(action): address review comments on PR #263 - Drop opinionated defaults on PMG_* toggle inputs. All defaults are now empty strings, and the action only exports PMG_* env vars when the caller explicitly sets the input. Without this, defaults like PMG_PARANOID=false silently shadowed config-file overrides because env vars beat config.yml in Viper precedence. - Verify cached PMG against upstream checksums.txt on every cache hit. The cached tarball is stored alongside the binary and re-hashed against the freshly-fetched checksums.txt; on drift, the cache entry is evicted and re-downloaded. - Export PMG_* env vars BEFORE running `pmg setup install` so settings like disable-telemetry actually apply during setup, not just to subsequent package-manager calls. - Add `|| true` to the grep that extracts the expected checksum so set -e doesn't kill the script before the friendly error message fires when no checksum entry is found. - Pin third-party actions (actions/checkout, actions/setup-node) to commit SHAs to match the repo's supply-chain hardening convention. - Fix the malicious-package E2E test capturing tee's exit code instead of npm's; redirect to a file and check the actual command exit code. - Add an E2E job that asserts PMG_PARANOID is unset when only config-file is provided — regression guard for the precedence fix. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * ci(action-e2e): scope sandbox tests to action setup, not PMG runtime The landlock job was running `npm install express` with no explicit sandbox profile and the default profile blocks something npm needs (PMG's own e2e uses `--sandbox-profile npm-restrictive` to make this viable). Bubblewrap happened to pass, but verifying the default sandbox profile is permissive enough for arbitrary package installs is PMG's e2e responsibility — this workflow's job is to assert the action wires sandbox config correctly. Switch both drivers to a matrix and verify only what the action owns: PMG_SANDBOX_* env vars propagated, pmg binary runs, bwrap is installed when requested, AppArmor user-ns restriction relaxed. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * ci(action-e2e): bump setup-node to 24 Node 20 reached end-of-life and setup-node now warns on it. Match the version pinned by publish-npm.yml (the repo's newest workflow). Updated the README and docs/github-action.md quick-start examples to match. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-05-18 00:44:06 +05:30