Commit Graph
24 Commits
Author SHA1 Message Date
Abhisek DattaandGitHub 115531f6b3 perf: Use circuit breaker to fail open Malysis query requests (#196)
* perf: Use circuit breaker to fail open Malysis query requests

* fix: Linter fixes

* test: Add test to confirm grpc status error unwrapping
2026-04-03 21:39:00 +05:30
d112ded3da feat: Merge template config into existing user config during setup install (#189)
* docs: Add config merging design spec for #114

Defines the merge-during-setup-install approach for keeping user
configs up to date with new template keys while preserving all
existing values, comments, and formatting.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: Add implementation plan for config merging

TDD-based plan with 6 tasks: dependency setup, failing tests,
core merge implementation, integration test, WriteTemplateConfig
integration, and full verification.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: Merge template config into existing user config during setup install

Instead of skipping when a config file exists, WriteTemplateConfig() now
merges missing keys from the embedded template into the user's config
using YAML AST manipulation. Preserves all user values, comments, and
formatting. Only adds keys present in the template but absent in the
user's config.

Closes #114

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: Graceful error handling for config loading and setup commands

Replace panics in loadViperConfig with error returns so the app falls
back to defaults instead of crashing on malformed config files. Add
SilenceUsage to setup install/remove commands so runtime errors don't
dump the full usage text.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* add test cmd in readme

* update copy text

* refactor: Address review feedback on config merging

- Rename existing/template to dest/source for generic util naming
- Remove unnecessary code comments (Rule N references, obvious comments)
- Add AGENTS.md with dev guide and code style rules, symlink CLAUDE.md
- Add BenchmarkMergeYAML (~46μs/op on M4 Pro)
- Remove stale design spec

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* update `MergeYAML` to use from dry/utils

* update AGENTS.md

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 19:21:01 +05:30
Abhisek DattaandGitHub 19e04b71b4 fix: Enable HTTP/2 for proxy upstream with connection tuning (#183)
* fix: Enable HTTP/2 for proxy upstream with connection tuning

* fix: Handle HTTP/2 upstream translating to HTTP/1.1 downstream

* fix: Remove go tool golangci-lint as per docs

* fix: Code review fixes

* fix: Code review fixes
2026-03-11 14:40:27 +05:30
Sahil BansalandGitHub f1891271c1 Add proxy support for pypi package managers (#150)
* initial pypi registry implementation

* support proxy mode for pypi package managers

* support proxy mode for pypi package managers - 2

* rm default mode as proxy for pip3

* update goproxy version & fix pypi proxy failing on 304

* add PIP_RETRIES=0 env

* update pmg e2e & add proxy mode e2e for pypi

* rm safedep-test-pkg for pypi proxy e2e
2026-02-05 13:30:27 +05:30
Sahil BansalandGitHub cc2dd993ed update module path to safedep/ptyx (#130) 2026-01-19 14:33:37 +05:30
2e1f5b1a36 feat: Add support for policy inheritence (#113)
* feat: Add support for policy inheritence

* fix: Linter fixes

* Update docs/sandbox.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Handle boolean inheritence

* ci: Add linter

* Update sandbox/policy_test.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Linter fixes

* fix: Linter fixes

* fix: Sandbox rule regex format

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-14 10:50:39 +05:30
9693428171 feat: Experimental Sandbox Support (#101)
* feat: Sandbox implementation with seatbelt

* refactor: Remove concept of PM_CACHE

* fix: Misc fixes

* refactor: Sandbox for separation of boundaries

* fix: Apply API

* fix: Add support for sandbox cleanup

* test: Add variable interpolation test

* fix: Misc cleanup fixes

* chore: Cleanup sandbox registry

* chore: Cleanup sandbox policy

* chore: Cleanup sandbox

* fix: Misc cleanup fixes

* fix: Remove violation mode

* fix: Update config template

* chore: Go mod cleanup

* fix: Handle the case when package manager policy is explicitly disabled

* fix: Sandbox executor

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* test: Remove unused var

* test: Add test for seatbelt sandbox driver

* fix: Sandbox profile loader from file should use path for caching

* test: Add policy test

* feat: Add support for config templates

* fix: Seatbelt translator handle glob

* fix: Merge conflicts

* fix: Fix sandbox policy generator for MacOS min permissions

* fix: Sandbox path handling bugs

* fix: Deny read to dangerous directories

* fix: Deny read to dangerous directories

* add sandbox e2e (#112)

* fix: Sandbox E2E test

* fix: Code review fixes

* fix: Code review fixes

* doc: Add sandbox debugging guide

* doc: Update sandbox doc

* docs: Add sandbox usage doc

* fix: Use better error for sandbox without policy

* fix: Add sandbox for npx

* fix: Enable PTY for npm

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
2026-01-13 14:52:02 +05:30
Abhisek DattaandGitHub c0122898ca feat: Add support for setup-info command (#108)
* feat: Add support for setup-info command

* fix: Code review fixes

* fix: Add event log info
2026-01-11 19:25:13 +05:30
31f23fd065 Add support for package executors and support for PTY handling (#100)
* define contract for package executors

* introduce npx executor

* add npx and pnpx cmd support

* fix typo

* rm PackageExecutor and depend on PackageManager interface

* add support for PTY to handle parent-child process interaction

* refactor PTY handling in proxy flow

* enforce interactiveSession interface check

* close reader explicitly and clean npm version for pkg executors

* rm interaction from interceptors

* add docs and wait for outputRouter before exit

* add support for non interactive TTY for proxy mode

* add support for CI env var check for non interactive tty proxy mode

* update readme to include npx, pnpx support

* Update internal/flows/proxy_flow.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* update ptyx lib

* fix docs typo

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-09 22:03:42 +05:30
20c854e473 feat: Config Persistence & API (#83)
* introduce a persistent config

* add tests and refactor config creation

* update config handling and add support for removing config

* add support to skip suspicious pkgs marked as trusted

* add support for config dir Env & unexport functions

* small fixes

* add assert for dir

* fix tests

* fix shell source line & trusted pkgs parsing

* fix flag inconsistency

* update config to read on each invocation and create if does not exist

* fix flags value being overridden

* remove redundant func call

* modify trusted pkg check to be config bound

* modify RemoveConfig to rm files & not dir. add tests for paths.go

* add versions for package for e2e

* modify tests to reset config

* fix: Simplify config persistence

* fix: Misc comments

* fix: Misc fix

* fix: Do not overwrite config file if exists

* fix: Do not overwrite config file if exists

* fix: Config cobra command should override and not replace

* fix: Create dir before writing config template

* fix: Create dir before writing config template

* fix: Misc refactoring

* test: Add test for is trusted package version

* Update cmd/setup/setup.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* Update config/config.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* Apply suggestion from @Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Remove unused constant in config

* fix: Resolve conflict with event logger

* docs: Add doc for eventlogger.Logger interface

* test: Add E2E for config file creation

* fix: Code review fixes

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Sahilb315 <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-01 12:33:52 +05:30
Abhisek DattaandGitHub 21eb05373f feat: Add Support for Proxy with Interceptor (#77) 2025-12-10 08:34:28 +05:30
2be1e5f009 Update go version to 1.25 & Add steps for introducing new package manager (#78)
* upgrade go version to 1.25.1

* introduce doc for steps for creating a new pkg manager

* Update docs/package-manager.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update docs/package-manager.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update docs/package-manager.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-12-08 09:36:32 +05:30
Sahil BansalandGitHub c486834c2e feat/#55 bun support (#56)
* add support for bun package manager

* update readme
2025-07-28 17:23:32 +05:30
0e17378d3e feat: add posthog analytics support (#52)
* feat: add posthog analytics events

* Update internal/analytics/analytics.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-06-30 09:47:14 +05:30
Sahil BansalandGitHub 3f85282935 fix: pip args & manifest files handling (#41)
* fix: pip args & manifest files handling

* chore: add pflag dependency

* chore: word fixes

* fix: multiple refs for suspicious packages

* refactor: introduce block config

* fix: makefile for windows build

* test: add test cases for manifest based installation

* refactor: Makefile

* refactor: remove .exe for windows build
2025-06-24 12:44:12 +05:30
5e9f2af972 Support for scanning manifest files (#36)
* feat: add extractor logic for manifest files

* feat: add manifest-based package installation detection

* feat: add osv-scanner for extracting lockfiles

* refactor: add comment for cmd parse

* refactor: add Ecosystem() method to PackageManager interface

* refactor: implement package-manager-specific extractors & replace osv-scanner with scalibr

* Update extractor/extractor.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-06-12 18:58:58 +05:30
53783c6604 feat: Add support for pip Package Manager (#33)
* feat/init-pip-cmd

* feat: Add PyPi resolver

* test: Add tests for pypi and pypi_resolver

* refactor: unify package dependency resolution and improve PyPI version handling using registry adapter

* chore: remove unused file

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* feat: add Python dependency parsing with extras support

* refactor(deps): Improve PyPI dependency resolution and add custom resolver support

* chore: remove extra file

* fix: improve dependency resolution and package deduplication

* chore: remove extra print statement

* chore: typo fix

* feat: support PyPi package extras

* test: add test for pypi dependency parse function

* fix: remove overwritten of parsedCmd

* chore: remove extra print statement

* chore: typo fix

* feat: support PyPi package extras

* test: add test for pypi dependency parse function

* fix: remove overwritten of parsedCmd

* refactor: enhance code readability & remove extra code

* chore: remove extra code

* Update cmd/npm/npm.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update cmd/npm/pnpm.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update cmd/pypi/pip.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
2025-06-09 17:37:08 +05:30
Abhisek DattaandGitHub e86b6ef056 feat: Refactor PMG to Maintain Separation of Concerns and Clean Architecture (#19)
* feat: Add separate package manager and resolver

* fix: Npm dependency resolver

* feat: Add analyzer for malysis query

* feat: Add package manager guard as the orchestrator

* feat: Add PMG to orchestrate installation

* Add concurrent scan execution

* Introduce package manager interaction abstraction

* feat: Add UI port for guard

* Remove refactored source files

* Update README

* fix: CI script for multi-arch build

* ci: goreleaser CI fix

* fix: npm command parser to extract package names

* feat: Introduce global config primitive

* fix: Close results channel for clean goroutine exit

* ci: Add container image releaser

* test: Improve test for npm resolver

* refactor: Analyzer to generalise

* Improve UI with additional info

* fix: Goreleaser config

* fix: npm resolver bug

* fix: Fail when command exec workflow fails

* fix: Bug with transitive dependency resolution

* fix: Synchronize common data update in dependency resolver

* chore: Improve log handling

* docs: Update README

* fix: UI text wrapping

* fix: UI handling bugs

* feat: Use concurrent dependency resolver
2025-05-15 16:50:59 +05:30
df754ccc82 Add colorful outputs & remove md text (#13)
* fix: parsePackageInfo to handle pkg names with special character

* Enhance pmg outputs by adding colors and removing markdown notions

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update npm_base.go

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* test: add tests for removeMarkdown

* chore: remove duplicate code

* refactor: convert TerminalColors to global var and split markdown utils

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-05-05 23:32:34 +05:30
Sahilb315 4f13dfbb40 chore: clean unused deps 2025-04-29 01:52:35 +05:30
Sahilb315 7167db9830 added workers queue 2025-04-23 22:38:39 +05:30
Sahilb315 ed8f9b6d53 minimal implementation for pmg 2025-04-09 23:27:46 +05:30
Sahilb315 e1e57a3ecd embedded arborist.js file & common func for pkg extracting 2025-04-09 00:09:36 +05:30
Sahilb315 3e79d2a53f project initialisation & added npm cmd support 2025-04-08 02:37:15 +05:30