External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
116 Commits 45 Branches 66 Tags
sandbox-fix
Commit Graph
64 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sahilb315 b84f33aac3 fix: resolve merge conflicts in seatbelt translator 
- Keep detailed Chrome/Chromium-based system permissions for security
- Preserve move-blocking protection to prevent bypass attacks
- Keep mandatory security denies for credentials and git hooks
- Accept improved network handling with system-socket support
 2026-01-12 22:00:37 +05:30
Sahil BansalandGitHub 11481c3f4c remove windows proxy limitation (#107) 
* remove windows proxy limitation

* move setup cmd details to a single place
 2026-01-11 10:05:19 +05:30
Sahil BansalGitHubAbhisek Datta
 		f851a1ebba remove process control code to pause/resume process (#106) 
Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
 2026-01-10 11:21:24 +00:00
Sahil BansalGitHubCopilot
 		f50d296935 add e2e and alias for npx, pnpx (#105) 
* add e2e and alias for npx, pnpx

* Update .github/workflows/pmg-e2e.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-01-10 16:47:43 +05:30
Sahil BansalandGitHub ca224f523c enable support for proxy mode for npm package managers (#104) 
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2026-01-10 00:24:45 +05:30
Sahil BansalGitHubCopilot
 		31f23fd065 Add support for package executors and support for PTY handling (#100) 
* define contract for package executors

* introduce npx executor

* add npx and pnpx cmd support

* fix typo

* rm PackageExecutor and depend on PackageManager interface

* add support for PTY to handle parent-child process interaction

* refactor PTY handling in proxy flow

* enforce interactiveSession interface check

* close reader explicitly and clean npm version for pkg executors

* rm interaction from interceptors

* add docs and wait for outputRouter before exit

* add support for non interactive TTY for proxy mode

* add support for CI env var check for non interactive tty proxy mode

* update readme to include npx, pnpx support

* Update internal/flows/proxy_flow.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* update ptyx lib

* fix docs typo

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-01-09 22:03:42 +05:30
Sahil BansalandGitHub 6e830c4c3d update node to use v24 (#99) 2026-01-08 06:48:57 +05:30
Sahil BansalandGitHub 028e78aed8 rm npm progress bar flag (#95) 2026-01-07 17:17:00 +05:30
Sahil BansalandGitHub 4fb147b0fb add unit tests for validating config template (#94) 
* add unit tests for validating config template

* add defensive check

* update asserts
 2026-01-07 07:59:32 +00:00
Sahil BansalandGitHub 2bc500f817 replace token based auth with OIDC auth (#80) 2025-12-16 12:58:45 +00:00
Sahil BansalGitHubAbhisek Datta
 		a8723cd680 refactor and introduce tests for npm & pypi (#79) 
* refactor and introduce tests for npm & pypi

* refactor and introduce tests for npm & pypi

* add skip intermediate flags test case

* fix tests

---------

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
 2025-12-08 17:30:29 +00:00
Sahil BansalGitHubCopilot
 		2be1e5f009 Update go version to 1.25 & Add steps for introducing new package manager (#78) 
* upgrade go version to 1.25.1

* introduce doc for steps for creating a new pkg manager

* Update docs/package-manager.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update docs/package-manager.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update docs/package-manager.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-12-08 09:36:32 +05:30
Sahil BansalandGitHub 50d7b55445 Add Pip3 support (#75) 
* add pip3 support

* add pip3 e2e

* chore: rename var
 2025-12-03 20:28:45 +05:30
Sahil BansalandGitHub c47cb30de0 Add pmg E2E Tests (#73) 
* add pmg e2e tests

* pin sha version

* pin python sha version

* add pmg to path

* fix pnpm init

* fix pnpm init

* rm poerty verification

* fix poetry verification

* comment poetry verification

* fix poetry error

* add poetry verification back

* fix poetry error

* add yarn e2e

* fix yarn installation

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2025-12-01 12:13:24 +05:30
Sahil BansalandGitHub 34750d71d3 update report url (#74) 2025-11-11 21:19:53 +05:30
Sahil BansalandGitHub 12aaba8a05 add poetry command (#67) 
* add poetry command

* add poetry.lock extractor & define cmd parser for poetry

* feat: support Poetry caret/tilde version syntax

* add wildcard constraint support & test cases

* readme update

* chore: small fixes
 2025-08-29 00:21:09 +05:30
Sahil BansalandGitHub 78bc6afa67 fix command parsing for unknown flags (#70) 
* fix command parsing for unknown flags

* fix test case

* add dev flag support for npm cmds
 2025-08-28 21:17:59 +05:30
Sahil BansalandGitHub 099dc45958 update docs (#71) 2025-08-28 20:53:24 +05:30
Sahil BansalandGitHub cd306884e3 add trufflehog secret scan CI (#63) 2025-08-13 15:49:12 +05:30
Sahil BansalandGitHub fd7d83704f feat/#28 uv support (#62) 
* follow proper consistent naming in pypi packagemanager

* follow proper consistent naming in pypi packagemanager - 2

* feat: add specialized command parsers to handle pip and uv command formats

* add uv support & modify extractor to be more robust

* add uv alias

* refactor var name & add error handling

* update readme & add support for `uv pip sync` cmd
 2025-08-06 21:10:51 +05:30
Sahil BansalandGitHub 2cbb24b3b1 docs/improve readme and alias text (#60) 
* fix readme TOC links

* add note for removing aliases

* give a clear msg for removing aliases
 2025-07-30 16:42:02 +05:30
Sahil BansalandGitHub 6d39fc0dde fix publish npm test installations (#59) 2025-07-29 21:54:58 +05:30
Sahil BansalandGitHub a1b1c3a0c2 add bun alias in setup cmd (#58) 2025-07-29 18:38:34 +05:30
Sahil BansalandGitHub e184e914a3 fix: improve error wrapping & preserving the error (#57) 2025-07-28 18:03:29 +05:30
Sahil BansalandGitHub c486834c2e feat/#55 bun support (#56) 
* add support for bun package manager

* update readme
 2025-07-28 17:23:32 +05:30
Sahil BansalandGitHub 49b2371cc3 fix: invalid cross-device link (#54) 
* fix: invalid cross-device link

* version flag fix in workflow

* remove version from package.json
 2025-07-04 20:56:31 +05:30
Sahil BansalGitHubCopilotOmkar Phansopkar
 		74248cd74a Publish pmg to npm (#50) 
* feat: pmg publish to npm

* feat: add github action for publishing to npm

* Update publish/npm/install.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update .github/workflows/publish-npm.yml

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* refactor: define constants

* refactor: improve npm package reliability with removing dynamic handlers and better error handling and validation

* fix: publish-npm workflow

* Update publish/npm/test.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* refactor(npm-workflow): use a more portable loop construct

* refactor: remove version field from package.json

* feat: use os.tmpdir() with mkdtempSync for cleaner temp directory handling

* fix: add redirect limit and cleanup to prevent infinite redirects and resource leaks

* remove test.js for npm publisher pack

* chore: test cmd cleanup

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
 2025-07-04 12:42:37 +05:30
Sahil BansalandGitHub ca752edf79 feat: add suppport for bypassing the blocking behavior of malicious packages (#53) 
* feat: add suppport for bypassing the blocking behavior of malicious packages

* feat: add InsecureInstallation config to bypass malware scanning with tests

* ui: introduce ShowWarning interaction method

* guard test fix
 2025-07-02 19:09:27 +05:30
Sahil BansalGitHubCopilot
 		0e17378d3e feat: add posthog analytics support (#52) 
* feat: add posthog analytics events

* Update internal/analytics/analytics.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-06-30 09:47:14 +05:30
Sahil BansalandGitHub 0a62473e9a Docs/add instructions for setup cmds (#45) 
* docs: add instructions for installing & removing aliases

* refactor: fix cmd name

* add diff sections for usage

* add section in index
 2025-06-24 18:17:06 +05:30
Sahil BansalandGitHub d363167981 feat: add setup & remove cmd for better UX (#43) 
* feat: add setup & remove cmd for better UX

* refactor(alias): improve separation of concerns and fix shell sourcing

* chore: remove extra/unused folder

* refactor: introduce separate files for shells

* fix: use temp files for safe shell config modification
 2025-06-24 12:46:21 +05:30
Sahil BansalandGitHub 3f85282935 fix: pip args & manifest files handling (#41) 
* fix: pip args & manifest files handling

* chore: add pflag dependency

* chore: word fixes

* fix: multiple refs for suspicious packages

* refactor: introduce block config

* fix: makefile for windows build

* test: add test cases for manifest based installation

* refactor: Makefile

* refactor: remove .exe for windows build
 2025-06-24 12:44:12 +05:30
Sahil BansalandGitHub b64f158654 fix: resolve dependencies for manifest file scans (#40) 
* fix: resolve dependencies for manifest file scans

* fix: resolve dependencies for manifest file scans

* fix: resolve dependencies for manifest file scans - 2

* revert back to traditional for loop

* fix(manifest-scan): resolve deps only for requirements.txt
 2025-06-16 15:18:45 +05:30
Sahil BansalandGitHub 8f8ca7fd5c docs: update limitation for pypi registry scanning only (#39) 2025-06-12 21:08:41 +05:30
Sahil BansalGitHubCopilot
 		5e9f2af972 Support for scanning manifest files (#36) 
* feat: add extractor logic for manifest files

* feat: add manifest-based package installation detection

* feat: add osv-scanner for extracting lockfiles

* refactor: add comment for cmd parse

* refactor: add Ecosystem() method to PackageManager interface

* refactor: implement package-manager-specific extractors & replace osv-scanner with scalibr

* Update extractor/extractor.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-06-12 18:58:58 +05:30
Sahil BansalandGitHub 302e17fe48 docs: Update supported package managers for pip (#37) 
* docs: update supported package managers for pip

* Update README.md

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2025-06-10 18:46:32 +05:30
Sahil BansalGitHubOmkar Phansopkar
 		53783c6604 feat: Add support for pip Package Manager (#33) 
* feat/init-pip-cmd

* feat: Add PyPi resolver

* test: Add tests for pypi and pypi_resolver

* refactor: unify package dependency resolution and improve PyPI version handling using registry adapter

* chore: remove unused file

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* feat: add Python dependency parsing with extras support

* refactor(deps): Improve PyPI dependency resolution and add custom resolver support

* chore: remove extra file

* fix: improve dependency resolution and package deduplication

* chore: remove extra print statement

* chore: typo fix

* feat: support PyPi package extras

* test: add test for pypi dependency parse function

* fix: remove overwritten of parsedCmd

* chore: remove extra print statement

* chore: typo fix

* feat: support PyPi package extras

* test: add test for pypi dependency parse function

* fix: remove overwritten of parsedCmd

* refactor: enhance code readability & remove extra code

* chore: remove extra code

* Update cmd/npm/npm.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update cmd/npm/pnpm.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update cmd/pypi/pip.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
 2025-06-09 17:37:08 +05:30
Sahil BansalGitHubCopilot
 		8b46964c7a fix(npm): handle multiple packages and flag parsing correctly (#17) 
* fix(npm): handle multiple packages and flag parsing correctly

- Fixes issue where only the first package was scanned; now all packages in install command are parsed and processed.
- Correctly separates flags (e.g., --save-dev) from package names to avoid treating them as packages.
- Applies same fixes to both npm and pnpm flows.
- Updated wrapper to scan all packages before installing, maintaining original CLI behavior.

* refactor: fixed the registry type

* feat: continue installing other packages if one is denied

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* fix(wrapper): exit gracefully for user-rejected packages

* fix: remove env validation

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-05-12 09:23:08 +05:30
Sahil BansalandGitHub f7855e99a2 docs: add CONTRIBUTORS and MAINTAINERS files, update README (#18) 
* docs: README update

* docs: introduce CONTRIBUTING.md

* docs: introduce MAINTAINERS.txt
 2025-05-11 22:42:27 +05:30
Sahil BansalandGitHub 86f8bd42b7 replace AnalysePackage with QueryPackageAnalysis API & use community API (#15) 2025-05-11 22:41:34 +05:30
Sahil BansalGitHubCopilot
 		6a28fb16a1 refactor: improve progress bar logic and update display (#14) 
* fix: Revise progress tracking mechanism

* chore: remove unused getDependencies func

* chore: removed unused property & add fetcher check

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* refactor: make SetProgressTracker common for all fetchers

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-05-06 16:35:59 +05:30
Sahil BansalGitHubCopilot
 		df754ccc82 Add colorful outputs & remove md text (#13) 
* fix: parsePackageInfo to handle pkg names with special character

* Enhance pmg outputs by adding colors and removing markdown notions

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update npm_base.go

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* test: add tests for removeMarkdown

* chore: remove duplicate code

* refactor: convert TerminalColors to global var and split markdown utils

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-05-05 23:32:34 +05:30
Sahil BansalandGitHub 88f39b56ff fix: parsePackageInfo to handle pkg names with special character (#11) 
* fix: parsePackageInfo to handle pkg names with special character

* test: add tests for CleanVersion and ParsePackageInfo util functions
 2025-05-04 18:50:13 +05:30
Sahil BansalandGitHub 5a6b842360 add goreleaser & goreleaser workflow (#8) 2025-05-02 12:37:27 +05:30
Sahil BansalandGitHub 1aa4b06f41 Pnpm suppport (#6) 
* fix: resolves issues #3 and #4

* feat: add pnpm support & introduce pkg manager wrap for npm
 2025-04-30 14:26:38 +05:30
Sahilb315 4f13dfbb40 chore: clean unused deps 2025-04-29 01:52:35 +05:30
Sahilb315 d4a31b14c0 ci: add vet ci 2025-04-29 01:41:50 +05:30
Sahilb315 8b31fd458b feat: add progress bar and add debug & silent flags 2025-04-29 01:33:27 +05:30
Sahil BansalGitHubCopilot
 		5ea85fa1f3 Update pkg/common/utils/utils.go 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2025-04-28 20:48:07 +05:30
Sahilb315 6ae594a896 readme installation update 2025-04-28 20:02:20 +05:30
Sahilb315 1abcc28259 refactor: introduce PackageAnalyser struct and remove unused arborist files 2025-04-28 19:23:36 +05:30
Sahilb315 d60fe87236 Add support for defaulting to latest version and improve code structure 2025-04-25 20:53:07 +05:30
Sahilb315 b8444d244b replaced deps fetching from arborist to custom 2025-04-24 03:46:38 +05:30
Sahilb315 7167db9830 added workers queue 2025-04-23 22:38:39 +05:30
Sahilb315 1085b73c90 readme update 2025-04-23 02:21:44 +05:30
Sahilb315 cdc43d3a14 function name change 2025-04-23 01:12:26 +05:30
Sahilb315 d636a928c4 added Makefile 2025-04-21 21:13:23 +05:30
Sahilb315 2d2f0fdee9 added arborist.js file & support for npm auth token for arborist lib to scan private deps 2025-04-10 01:10:56 +05:30
Sahilb315 ed8f9b6d53 minimal implementation for pmg 2025-04-09 23:27:46 +05:30
Sahilb315 4805f443f5 common functions for grpc 2025-04-09 01:53:05 +05:30
Sahilb315 a190d945ec replaced arborist with arborist bundle & common func for analysis 2025-04-09 00:58:14 +05:30
Sahilb315 e1e57a3ecd embedded arborist.js file & common func for pkg extracting 2025-04-09 00:09:36 +05:30
Sahilb315 b09e34c3eb npm token removal 2025-04-08 02:45:53 +05:30
Sahilb315 3e79d2a53f project initialisation & added npm cmd support 2025-04-08 02:37:15 +05:30