4 Commits

Include renames

Author	SHA1	Message	Date
Sahil BansalandGitHub	5ac0f275b8	feat(proxy): emit session summary on persistent proxy shutdown (#352) ... * feat(proxy): emit session summary on persistent proxy shutdown The persistent proxy daemon never ran the per-invocation flow that calls LogSessionComplete, so no session summary reached the cloud for server-mode runs. Emit one from the daemon's aggregate stats collector on shutdown, before the final cloud flush, so it is delivered with the run's events and carries the CI/invocation context. Extract the event emission into a shared LogSessionSummary(SessionData); both the per-invocation flow and the daemon now use it. The daemon serves every package manager, so the summary carries no single package manager. * chore(action): shorten default cloud endpoint id prefix to gha/	2026-06-26 14:47:53 +05:30
3 people	c47776db27	feat(proxy): persistent proxy server mode (#351) ... * refactor(flows): extract SetupCACertificate for reuse Move the CA load/generate/merge logic out of proxyFlow into an exported flows.SetupCACertificate so the persistent proxy server can reuse it. * feat(proxy): add persistent proxy server with start/stop/env/status Introduces 'pmg proxy' commands backed by internal/proxyserver: a long-lived MITM proxy that intercepts package managers via env vars (no shims). Supports --daemon (Unix), --state, --port; generic 'env' output that skips cert vars when the CA is OS-trusted; opt-in 'stop --fail-on-violation' (fail-closed on crash) with a synchronous cloud event flush; and the malysis analysis cache. * feat(action): add server-mode for persistent proxy When server-mode=true the action starts the proxy daemon and injects proxy env vars into the job instead of installing shims. * test(proxy): add persistent proxy server E2E workflow * docs(readme): document persistent proxy server mode * fix(proxy): create cache dir before writing state file and daemon log On a fresh CI runner the cache directory does not exist yet; os.OpenFile and os.WriteFile do not create parent dirs, so 'pmg proxy start --daemon' failed with 'no such file or directory'. MkdirAll the parent before writing. * docs: add persistent proxy server architecture doc * refactor proxyserver * fix(proxy): always emit cert env vars instead of skipping on OS-trust status npm/pip/yarn/requests trust the MITM CA inconsistently across tools, versions, and configs; many still use bundled CA stores. Always emitting the cert-path env vars is the conservative choice that works regardless, and is harmless for tools that read the OS store (they ignore the vars). Skipping them when a system CA exists would silently break any tool still on a bundled store. * refactor(proxy): drop redundant audit init in daemon; rely on main.go main.go's PersistentPreRun already initializes the audit pipeline for every command (including the daemon's re-exec'd child) and closes it at process exit. Re-initializing in proxyserver.Run created a second auditor and a second cloud-sync WAL connection, orphaning the first. Removing it makes the daemon consistent with the normal proxy flow, which never self-initializes audit. * fix(proxy): bypass proxy env when flushing events to cloud on stop pmg proxy stop inherits HTTP(S)_PROXY (injected by 'pmg proxy env') pointing at the PMG proxy it just shut down. The cloud sync gRPC client honored those vars and routed api.safedep.io through the dead proxy, failing with 'connection refused' so no events were delivered. Clear the proxy env vars before the sync so PMG's own cloud traffic goes direct. * chore(proxy): address review feedback - configurable bind host via proxy.server.listen_host (default loopback) - proxy commands use ui.ErrorExit instead of returning errors to cobra - rename errcode to ProxyPolicyViolation (covers malware + cooldown) - share cloud sync via audit.DrainToCloud (de-dup with cmd/cloud/sync) - centralize proxy CA bundle path in certmanager - docs: persistent proxy cert trust + bind address * fix(proxy): show real message on fail-on-violation error stopExitError set only WithMsg, but ui.ErrorExit renders HumanError, so the framed error showed 'no human-readable message available'. Set both from one string, and emit the framed error before the stdout summary so the blocked count is stated once. * fix(proxy): flush cloud events from the daemon, not stop The stop process inherits HTTP_PROXY (from 'pmg proxy env'), so its cloud client routed api.safedep.io through the already-stopped proxy and failed with connection refused. Move the flush into the daemon's shutdown, which has no proxy env (it started before env injection) and dials SafeDep directly. - daemon flushes on shutdown via audit.DrainToCloud and records the result in the state file; stop surfaces it (on both success and fail-on-violation paths) since the daemon's own logs aren't visible to stop - coordinate stop's wait with the daemon shutdown budget; on timeout, error out without reading stale state or deleting the file (fail-closed) - persist blocked count before the flush so the gate stays correct if the flush hangs or the daemon is killed mid-flush - remove now-redundant cloud_flush.go * disable auto-sync for proxy cmds * feat(proxy): periodic cloud sync + move proxy env vars to packagemanager - daemon runs a periodic cloud-sync ticker so the shutdown flush stays small; the run total is reported by stop, and shutdown timeouts are coordinated - move EnvVarForProxy from config to packagemanager (it is package-manager knowledge); the shared function now builds the proxy URL and NO_PROXY itself, removing the duplicated construction in the per-command and persistent paths - relocate the #319 yarn and #339 IPv6 regression tests alongside the function - enable cloud sync in the persistent-proxy E2E workflow and fix the stale internal/proxystate path filter * refactor(proxy): rename cloudFlushLockTimeout to cloudFlushLockWait Consistent timeout naming: *LockWait is the lock-acquire bound, *Timeout is the sync-RPC bound. Previously the final-flush pair was cloudFlushLockTimeout vs cloudFlushTimeout — two lookalike names for different operations. * refactor(proxy): extract cloudFlush and trim duplicate shutdown comments The shutdown's final-flush block is now a cloudFlush helper, symmetric with startCloudSyncLoop (one-shot vs loop). Removed the triplicated ticker/lock contention comments, keeping the contract on the function doc and one-line pointers at the call sites. * docs: update persistent proxy cloud sync to daemon-owned model The daemon now owns cloud delivery (periodic sync while serving + final flush on shutdown); stop signals it, waits, and reports the result. Rewrite the Cloud event sync section, fix stop attributions, add the cloud_sync state field, and update the sequence diagram. * docs: move Usage section up below How it works Put the copy-paste recipes near the top so users find them before the internals. * refactor(proxy): address PR review feedback - configurable bind host/port via --host/--port flags + config (listen_host, listen_port), bound directly to config fields per PMG's flag pattern - daemon log path via --log-file and readiness timeout in ProxyDaemonConfig; Daemonize no longer owns path policy (caller validates, fails fast) - gate periodic cloud sync on auto_sync; suppress detached background sync for proxy commands instead of flipping the flag - pmg proxy env --export emits shell-quoted lines for eval (spaces survive) - extract shared flows.BuildCachedMalysisAnalyzer, dropping the analyzer+cache duplication between proxy flow and proxy server - add internal/proxyserver/doc.go documenting the package + boundary vs flows - E2E: assert malicious installs are blocked (drop continue-on-error) - docs: trim Commands/State-file to user contracts; refresh bind address * refactor(proxy): proactive alignment fixes from whole-PR review - gate the shutdown cloud flush on auto_sync too, matching the periodic ticker (auto_sync consistently controls all daemon-driven cloud delivery) - ResolveStatePath takes cacheDir instead of *RuntimeConfig, keeping state.go free of config dependency - drop the empty-host comment in listenAddr; keep the loopback guard so a blank host never silently binds all interfaces * fix: Decouple localdb with malysis analyser construction * fix: Persist global args before proxy server daemon exec * fix: GitHub Action for cloud auto-sync in server mode --------- Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>	2026-06-26 11:19:28 +05:30
Abhisek DattaandGitHub	9b0e12f130	feat: Add Support for Optimistic Cloud Sync (#273) ... * feat: Add support for background sync * refactor: Maintain single source of truth for command defn * fix: Code review fixes * fix: Code review fixes * docs: Add corner case inline doc	2026-05-20 13:56:50 +05:30
3 people	46cc70db53	feat: add GitHub Action for one-step PMG setup in CI (#263) ... * feat: add GitHub Action for one-step PMG setup in CI Composite action at repo root that downloads PMG (with SHA-256 verification against the upstream checksums.txt), runs `pmg setup install`, and wires shims onto $GITHUB_PATH so subsequent `npm install` / `pip install` calls are transparently analyzed. Defaults are conservative: malware blocking + dependency cooldown + proxy mode (matching PMG's own defaults). Sandbox is opt-in because enabling Landlock/Bubblewrap on ubuntu-latest requires relaxing AppArmor user-namespace restrictions. Cloud sync uses the documented SAFEDEP_API_KEY / SAFEDEP_TENANT_ID env-var fallback so we skip the keychain codepath that has no usable backend in headless CI. When cloud is enabled and no endpoint-id is supplied, the action sets PMG_CLOUD_ENDPOINT_ID=github-actions/${GITHUB_REPOSITORY} so events aggregate per repository instead of per ephemeral runner hostname. Closes #248. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * fix(action): drop github.repository template from input description Action manifest validation rejected the action.yml because the endpoint-id input description contained ${{ github.repository }} — template expressions aren't evaluated in input description text and trip the validator with "Unrecognized named-value: 'github'". This caused every job using uses: ./ to fail before any step ran. Also switch the config-file e2e job to verify the staged file directly instead of calling `pmg config get`, which is not in the v0.13.0 release that "latest" resolves to today. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * fix(action): address review comments on PR #263 - Drop opinionated defaults on PMG_* toggle inputs. All defaults are now empty strings, and the action only exports PMG_* env vars when the caller explicitly sets the input. Without this, defaults like PMG_PARANOID=false silently shadowed config-file overrides because env vars beat config.yml in Viper precedence. - Verify cached PMG against upstream checksums.txt on every cache hit. The cached tarball is stored alongside the binary and re-hashed against the freshly-fetched checksums.txt; on drift, the cache entry is evicted and re-downloaded. - Export PMG_* env vars BEFORE running `pmg setup install` so settings like disable-telemetry actually apply during setup, not just to subsequent package-manager calls. - Add `|| true` to the grep that extracts the expected checksum so set -e doesn't kill the script before the friendly error message fires when no checksum entry is found. - Pin third-party actions (actions/checkout, actions/setup-node) to commit SHAs to match the repo's supply-chain hardening convention. - Fix the malicious-package E2E test capturing tee's exit code instead of npm's; redirect to a file and check the actual command exit code. - Add an E2E job that asserts PMG_PARANOID is unset when only config-file is provided — regression guard for the precedence fix. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * ci(action-e2e): scope sandbox tests to action setup, not PMG runtime The landlock job was running `npm install express` with no explicit sandbox profile and the default profile blocks something npm needs (PMG's own e2e uses `--sandbox-profile npm-restrictive` to make this viable). Bubblewrap happened to pass, but verifying the default sandbox profile is permissive enough for arbitrary package installs is PMG's e2e responsibility — this workflow's job is to assert the action wires sandbox config correctly. Switch both drivers to a matrix and verify only what the action owns: PMG_SANDBOX_* env vars propagated, pmg binary runs, bwrap is installed when requested, AppArmor user-ns restriction relaxed. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh * ci(action-e2e): bump setup-node to 24 Node 20 reached end-of-life and setup-node now warns on it. Match the version pinned by publish-npm.yml (the repo's newest workflow). Updated the README and docs/github-action.md quick-start examples to match. https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-05-18 00:44:06 +05:30